JS: Disable diff-informedness for full SSRF

Partial SSRF uses its result in a way that prevents diff-informedness
This commit is contained in:
Asger F
2025-02-06 11:30:18 +01:00
parent d3ee658399
commit 7d6abb4e0a

View File

@@ -30,12 +30,10 @@ private module FullServerSideRequestForgeryConfig implements DataFlow::ConfigSig
node instanceof FullUrlControlSanitizer
}
predicate observeDiffInformedIncrementalMode() { any() }
Location getASelectedSinkLocation(DataFlow::Node sink) {
result = sink.(Sink).getLocation()
or
result = sink.(Sink).getRequest().getLocation()
predicate observeDiffInformedIncrementalMode() {
// The partial request forgery query depends on `fullyControlledRequest` to reject alerts about
// such full-controlled requests, regardless of the associated source.
none()
}
}