hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-29 02:35:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #20 from esben-semmle/js/more-auth-calls-and-rate-limiters

Browse Source 
Approved by xiemaisi
This commit is contained in:
semmle-qlci
2018-08-07 09:42:07 +01:00
committed by GitHub
parent c06edd3745 fa90c53b43
commit 6533ddfeaf
5 changed files with 7 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
javascript/ql/src/semmle/javascript/security/SensitiveActions.qll
View File

@@ -143,7 +143,7 @@ class AuthorizationCall extends SensitiveAction, DataFlow::CallNode {
exists(string s | s = getCalleeName() |
// name contains `login` or `auth`, but not as part of `loginfo` or `unauth`;
// also exclude `author`
s.regexpMatch("(?i).*(login(?!fo)|(?<!un)auth(?!or\\b)).*") and
s.regexpMatch("(?i).*(login(?!fo)|(?<!un)auth(?!or\\b)|verify).*") and
// but it does not start with `get` or `set`
not s.regexpMatch("(?i)(get|set).*")
)

2
javascript/ql/src/semmle/javascript/security/dataflow/MissingRateLimiting.qll
View File

@@ -131,7 +131,7 @@ abstract class RateLimiter extends Express::RouteHandlerExpr {
*/
class ExpressRateLimit extends RateLimiter {
ExpressRateLimit() {
DataFlow::moduleImport("express-rate-limit").getAnInstantiation().flowsToExpr(this)
DataFlow::moduleImport("express-rate-limit").getAnInvocation().flowsToExpr(this)
}
}