hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-01-30 06:42:57 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fixes from code review

Browse Source
This commit is contained in:
Slavomir
2021-03-05 01:01:30 +01:00
committed by Chris Smowton
parent ad91e4abcb
commit 687e556df6
1 changed files with 8 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
ql/src/experimental/CWE-79/HTMLTemplateEscapingPassthrough.ql
View File

@@ -14,6 +14,8 @@ import DataFlow::PathGraph
/**
* Holds if the provided src node flows into a conversion to a PassthroughType.
* The `targetType` parameter gets populated with the name of the PassthroughType,
* and `conversionSink` with the node where the conversion happens.
*/
predicate isConvertedToPassthroughType(
DataFlow::Node src, string targetType, DataFlow::PathNode conversionSink
@@ -26,11 +28,11 @@ predicate isConvertedToPassthroughType(
}
/**
* Gets the names of the types that will not be escaped when passed to
* Provides the names of the types that will not be escaped when passed to
* a `html/template` template.
*/
string getAPassthroughTypeName() {
result = ["HTML", "HTMLAttr", "JS", "JSStr", "CSS", "Srcset", "URL"]
class PassthroughTypeName extends string {
PassthroughTypeName() { this = ["HTML", "HTMLAttr", "JS", "JSStr", "CSS", "Srcset", "URL"] }
}
/**
@@ -43,7 +45,7 @@ class ConversionFlowToPassthroughTypeConf extends TaintTracking::Configuration {
string dstTypeName;
ConversionFlowToPassthroughTypeConf() {
dstTypeName = getAPassthroughTypeName() and
dstTypeName instanceof PassthroughTypeName and
this = "UnsafeConversion" + dstTypeName
}
@@ -55,7 +57,7 @@ class ConversionFlowToPassthroughTypeConf extends TaintTracking::Configuration {
exists(Type typ |
typ = sink.getResultType() and
typ.getUnderlyingType*().hasQualifiedName("html/template", name) and
name = getAPassthroughTypeName()
name instanceof PassthroughTypeName
)
}
@@ -63,7 +65,7 @@ class ConversionFlowToPassthroughTypeConf extends TaintTracking::Configuration {
}
/**
* Holds if the the sink is a data value argument of a template execution call.
* Holds if the sink is a data value argument of a template execution call.
*/
predicate isSinkToTemplateExec(DataFlow::Node sink, DataFlow::CallNode call) {
exists(Method fn, string methodName |