hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 03:05:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

case insensitive authorization header

Browse Source
This commit is contained in:
Erik Krogh Kristensen
2020-06-03 15:23:51 +02:00
parent b508ad41c8
commit 7c26efbc12
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
javascript/ql/src/semmle/javascript/frameworks/ClientRequests.qll
View File

@@ -263,13 +263,13 @@ module ClientRequest {
/** An expression that is used as a credential in a request. */
private class AuthorizationHeader extends CredentialsExpr {
AuthorizationHeader() {
exists(DataFlow::PropWrite write | write.getPropertyName() = "Authorization" |
exists(DataFlow::PropWrite write | write.getPropertyName().regexpMatch("(?i)authorization") |
this = write.getRhs().asExpr()
)
or
exists(DataFlow::MethodCallNode call | call.getMethodName() = ["append", "set"] |
call.getNumArgument() = 2 and
call.getArgument(0).mayHaveStringValue("Authorization") and
call.getArgument(0).getStringValue().regexpMatch("(?i)authorization") and
this = call.getArgument(1).asExpr()
)
}