hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-01 11:45:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

JS: use DataFlow::ArrayCreationNode in additional places

Browse Source
This commit is contained in:
Esben Sparre Andreasen
2018-10-08 15:47:11 +02:00
parent 4720c5ab60
commit 70cd03d3bc
7 changed files with 13 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
javascript/ql/src/semmle/javascript/dataflow/Configuration.qll
View File

@@ -336,7 +336,7 @@ private class LibraryPartialCall extends AdditionalPartialInvokeNode {
override predicate isPartialArgument(DataFlow::Node callback, DataFlow::Node argument, int index) {
callback = getArgument(0) and
exists (DataFlow::ArrayLiteralNode array |
exists (DataFlow::ArrayCreationNode array |
array.flowsTo(getArgument(1)) and
argument = array.getElement(index))
}

2
javascript/ql/src/semmle/javascript/frameworks/AngularJS/DependencyInjections.qll
View File

@@ -146,7 +146,7 @@ private DataFlow::PropWrite getAPropertyDependencyInjection(Function function) {
*/
private class FunctionWithInjectProperty extends InjectableFunction {
override Function astNode;
DataFlow::ArrayLiteralNode dependencies;
DataFlow::ArrayCreationNode dependencies;
FunctionWithInjectProperty() {
(

2
javascript/ql/src/semmle/javascript/frameworks/Express.qll
View File

@@ -891,7 +891,7 @@ module Express {
getMethodName() = methodName and
exists (DataFlow::ValueNode arg |
arg = getAnArgument() |
exists (DataFlow::ArrayLiteralNode array |
exists (DataFlow::ArrayCreationNode array |
array.flowsTo(arg) and
routeHandlerArg = array.getAnElement()
) or

10
javascript/ql/src/semmle/javascript/frameworks/ExpressModules.qll
View File

@@ -144,8 +144,8 @@ module ExpressLibraries {
override DataFlow::Node getASecretKey() {
exists (DataFlow::Node secret | secret = getOption("secret") |
if exists(DataFlow::ArrayLiteralNode arr | arr.flowsTo(secret)) then
result = any (DataFlow::ArrayLiteralNode arr | arr.flowsTo(secret)).getAnElement()
if exists(DataFlow::ArrayCreationNode arr | arr.flowsTo(secret)) then
result = any (DataFlow::ArrayCreationNode arr | arr.flowsTo(secret)).getAnElement()
else
result = secret
)
@@ -182,8 +182,8 @@ module ExpressLibraries {
override DataFlow::Node getASecretKey() {
exists (DataFlow::Node arg0 | arg0 = getArgument(0) |
if exists(DataFlow::ArrayLiteralNode arr | arr.flowsTo(arg0)) then
result = any (DataFlow::ArrayLiteralNode arr | arr.flowsTo(arg0)).getAnElement()
if exists(DataFlow::ArrayCreationNode arr | arr.flowsTo(arg0)) then
result = any (DataFlow::ArrayCreationNode arr | arr.flowsTo(arg0)).getAnElement()
else
result = arg0
)
@@ -220,7 +220,7 @@ module ExpressLibraries {
override DataFlow::Node getASecretKey() {
result = getOption("secret") or
exists (DataFlow::ArrayLiteralNode keys |
exists (DataFlow::ArrayCreationNode keys |
keys.flowsTo(getOption("keys")) and
result = keys.getAnElement()
)

4
javascript/ql/src/semmle/javascript/security/dataflow/CommandInjection.qll
View File

@@ -75,7 +75,7 @@ module CommandInjection {
ArgumentListTracking() { this = "ArgumentListTracking" }
override predicate isSource(DataFlow::Node nd) {
nd instanceof DataFlow::ArrayLiteralNode
nd instanceof DataFlow::ArrayCreationNode
or
exists (StringLiteral shell | shellCmd(shell, _) |
nd = DataFlow::valueNode(shell)
@@ -125,7 +125,7 @@ module CommandInjection {
* we want to report the `spawn` call as the sink, so we bind it to `sys`.
*/
private predicate indirectCommandInjection(DataFlow::Node sink, SystemCommandExecution sys) {
exists (ArgumentListTracking cfg, DataFlow::ArrayLiteralNode args,
exists (ArgumentListTracking cfg, DataFlow::ArrayCreationNode args,
StringLiteral shell, string dashC |
shellCmd(shell, dashC) and
cfg.hasFlow(DataFlow::valueNode(shell), sys.getACommandArgument()) and