Restrict logic for checking for id parameters on index expressions for performance

This commit is contained in:
Joe Farebrother
2023-09-15 16:35:29 +01:00
parent 6d704be7d2
commit 68ad5b7c00

View File

@@ -2,7 +2,6 @@
import csharp
import semmle.code.csharp.dataflow.flowsources.Remote
import DataFlow as DF
import TaintTracking as TT
import ActionMethods
@@ -26,7 +25,7 @@ private predicate hasIdParameter(ActionMethod m) {
exists(StringLiteral idStr, IndexerCall idx |
idStr.getValue().toLowerCase().matches(["%id", "%idx"]) and
TT::localTaint(src, DataFlow::exprNode(idx.getQualifier())) and
DF::localExprFlow(idStr, idx.getArgument(0))
idStr = idx.getArgument(0)
)
)
}