remove predicate

This commit is contained in:
thiggy1342
2022-07-12 22:59:48 +00:00
committed by GitHub
parent 539fbbc126
commit 7facc63699

View File

@@ -38,21 +38,16 @@ class ActionControllerRequest extends DataFlow::Node {
class WeakParams extends DataFlow::CallNode {
WeakParams() {
this.getReceiver() instanceof ActionControllerRequest and
allParamsAccess(this.asExpr().getExpr())
(
this.getMethodName() = "path_parametes" or
this.getMethodName() = "query_parameters" or
this.getMethodName() = "request_parameters" or
this.getMethodName() = "GET" or
this.getMethodName() = "POST"
)
}
}
/**
* Holds call to a method that exposes or accesses all parameters from an inbound HTTP request
*/
predicate allParamsAccess(MethodCall call) {
call.getMethodName() = "path_parametes" or
call.getMethodName() = "query_parameters" or
call.getMethodName() = "request_parameters" or
call.getMethodName() = "GET" or
call.getMethodName() = "POST"
}
/**
* A Taint tracking config where the source is a weak params access in a controller and the sink
* is a method call of a model class