mirror of
https://github.com/github/codeql.git
synced 2026-02-11 20:51:06 +01:00
Convert barrier guard to MaD
I checked that without the model a test fails.
This commit is contained in:
@@ -11,6 +11,11 @@ extensions:
|
||||
- ["System", "Environment", False, "get_CommandLine", "()", "", "ReturnValue", "commandargs", "manual"]
|
||||
- ["System", "Environment", False, "GetEnvironmentVariable", "", "", "ReturnValue", "environment", "manual"]
|
||||
- ["System", "Environment", False, "GetEnvironmentVariables", "", "", "ReturnValue", "environment", "manual"]
|
||||
- addsTo:
|
||||
pack: codeql/csharp-all
|
||||
extensible: barrierGuardModel
|
||||
data:
|
||||
- ["System", "Uri", False, "get_IsAbsoluteUri", "()", "", "Argument[this]", "false", "url-redirection", "manual"]
|
||||
- addsTo:
|
||||
pack: codeql/csharp-all
|
||||
extensible: summaryModel
|
||||
|
||||
@@ -165,27 +165,6 @@ class ContainsUrlSanitizer extends Sanitizer {
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A check that the URL is relative, and therefore safe for URL redirects.
|
||||
*/
|
||||
private predicate isRelativeUrlSanitizer(Guard guard, Expr e, GuardValue v) {
|
||||
guard =
|
||||
any(PropertyAccess access |
|
||||
access.getProperty().hasFullyQualifiedName("System", "Uri", "IsAbsoluteUri") and
|
||||
e = access.getQualifier() and
|
||||
v.asBooleanValue() = false
|
||||
)
|
||||
}
|
||||
|
||||
/**
|
||||
* A check that the URL is relative, and therefore safe for URL redirects.
|
||||
*/
|
||||
class RelativeUrlSanitizer extends Sanitizer {
|
||||
RelativeUrlSanitizer() {
|
||||
this = DataFlow::BarrierGuard<isRelativeUrlSanitizer/3>::getABarrierNode()
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A comparison on the `Host` property of a url, that is a sanitizer for URL redirects.
|
||||
* E.g. `url.Host == "example.org"`
|
||||
|
||||
Reference in New Issue
Block a user