hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-01 11:45:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

JS: fixup visibility of DataFlow::HtmlAttributeNode

Browse Source
This commit is contained in:
Esben Sparre Andreasen
2019-02-15 09:03:40 +01:00
parent 4ce7ec1661
commit 80a716f3b3
2 changed files with 5 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
javascript/ql/src/semmle/javascript/dataflow/DataFlow.qll
View File

@@ -742,22 +742,21 @@ module DataFlow {
/**
* A data flow node representing an HTML attribute.
*/
private class HtmlAttributeNode extends DataFlow::Node, THtmlAttributeNode {
class HtmlAttributeNode extends DataFlow::Node, THtmlAttributeNode {
HTML::Attribute attr;
HtmlAttributeNode() { this = THtmlAttributeNode(attr) }
override string toString() { result = attr.toString() }
override ASTNode getAstNode() { none() }
override BasicBlock getBasicBlock() { none() }
override predicate hasLocationInfo(
string filepath, int startline, int startcolumn, int endline, int endcolumn
) {
attr.getLocation().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
}
/** Gets the attribute corresponding to this data flow node. */
HTML::Attribute getAttribute() { result = attr }
}
/**

2
javascript/ql/src/semmle/javascript/security/dataflow/Xss.qll
View File

@@ -203,7 +203,7 @@ module DomBasedXss {
*/
class VHtmlSink extends DomBasedXss::Sink {
HTML::Attribute attr;
VHtmlSink() { this = DataFlow::THtmlAttributeNode(attr) and attr.getName() = "v-html" }
VHtmlSink() { this.(DataFlow::HtmlAttributeNode).getAttribute() = attr and attr.getName() = "v-html" }
HTML::Attribute getAttr() {
result = attr
}