mirror of
https://github.com/github/codeql.git
synced 2026-04-18 13:34:02 +02:00
Restrict logic for checking for id parameters on index expressions for performance
This commit is contained in:
@@ -2,7 +2,6 @@
|
||||
|
||||
import csharp
|
||||
import semmle.code.csharp.dataflow.flowsources.Remote
|
||||
import DataFlow as DF
|
||||
import TaintTracking as TT
|
||||
import ActionMethods
|
||||
|
||||
@@ -26,7 +25,7 @@ private predicate hasIdParameter(ActionMethod m) {
|
||||
exists(StringLiteral idStr, IndexerCall idx |
|
||||
idStr.getValue().toLowerCase().matches(["%id", "%idx"]) and
|
||||
TT::localTaint(src, DataFlow::exprNode(idx.getQualifier())) and
|
||||
DF::localExprFlow(idStr, idx.getArgument(0))
|
||||
idStr = idx.getArgument(0)
|
||||
)
|
||||
)
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user