add context to the rankState predicate in ExponentialBackTracking.qll

2026-02-11 04:31:05 +01:00 · 2022-08-29 13:42:05 +02:00
parent 68bf9f39b9
commit 77949cbeb3
4 changed files with 4 additions and 0 deletions
--- a/python/ql/lib/semmle/python/security/regexp/ExponentialBackTracking.qll
+++ b/python/ql/lib/semmle/python/security/regexp/ExponentialBackTracking.qll
@@ -115,6 +115,7 @@ private newtype TStatePair =
 private int rankState(State state) {
  state =
    rank[result](State s, Location l |
+      stateInsideBacktracking(s) and
      l = s.getRepr().getLocation()
    |
      s order by l.getStartLine(), l.getStartColumn(), s.toString()