JS: Restrict AP length in ExceptionXss

2026-04-25 08:45:14 +02:00 · 2025-01-06 14:28:58 +01:00
parent 23d7420cec
commit 7ccb476b1b
1 changed files with 2 additions and 0 deletions
--- a/javascript/ql/lib/semmle/javascript/security/dataflow/ExceptionXssQuery.qll
+++ b/javascript/ql/lib/semmle/javascript/security/dataflow/ExceptionXssQuery.qll
@@ -153,6 +153,8 @@ module ExceptionXssConfig implements DataFlow::StateConfigSig {
    canThrowSensitiveInformation(node1) and
    node2 = getExceptionTarget(node1)
  }
+
+  int accessPathLimit() { result = 1 }
 }

 /**