hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-03 04:39:29 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1854 from asger-semmle/prototype-pollution-precision

Browse Source 
Approved by esben-semmle, xiemaisi
This commit is contained in:
semmle-qlci
2019-09-03 10:50:24 +01:00
committed by GitHub
parent e4d59c361a c71a66a045
commit 6778f28424
2 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
change-notes/1.23/analysis-javascript.md
View File

@@ -18,6 +18,7 @@
| **Query** | **Expected impact** | **Change** |
|--------------------------------|------------------------------|---------------------------------------------------------------------------|
| Client-side cross-site scripting (`js/xss`) | More results | More potential vulnerabilities involving functions that manipulate DOM attributes are now recognized. |
| Prototype pollution (`js/prototype-pollution`) | Same results | The results are now shown on LGTM by default. |
## Changes to QL libraries

4
javascript/ql/src/Security/CWE-400/PrototypePollution.ql
View File

@@ -3,8 +3,8 @@
* @description Recursively merging a user-controlled object into another object
* can allow an attacker to modify the built-in Object prototype.
* @kind path-problem
* @problem.severity warning
* @precision medium
* @problem.severity error
* @precision high
* @id js/prototype-pollution
* @tags security
* external/cwe/cwe-250