hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-27 09:45:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

Adjust structure to avoid warnings about message

Browse Source
This commit is contained in:
aegilops
2024-05-21 13:51:13 +01:00
parent 8300aeb0a0
commit 83037b1195
1 changed files with 10 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
javascript/ql/src/Security/CWE-693/InsecureHelmet.ql
View File

@@ -14,12 +14,14 @@
import semmle.javascript.frameworks.ExpressModules
class HelmetProperty extends Property {
ExpressLibraries::HelmetRouteHandler helmet;
HelmetProperty() {
exists(ExpressLibraries::HelmetRouteHandler helmet |
helmet.(DataFlow::CallNode).getAnArgument().asExpr().(ObjectExpr).getAProperty() = this
)
helmet.(DataFlow::CallNode).getAnArgument().asExpr().(ObjectExpr).getAProperty() = this
}
ExpressLibraries::HelmetRouteHandler getHelmet() { result = helmet }
predicate isFalse() { this.getInit().(BooleanLiteral).getBoolValue() = false }
predicate isImportantSecuritySetting() {
@@ -29,8 +31,10 @@ class HelmetProperty extends Property {
}
}
from HelmetProperty helmetSetting
from HelmetProperty helmetSetting, ExpressLibraries::HelmetRouteHandler helmet
where
helmetSetting.isFalse() and
helmetSetting.isImportantSecuritySetting()
select helmetSetting, "Helmet route handler, called with $@ set to 'false'", helmetSetting, helmetSetting.getName()
helmetSetting.isImportantSecuritySetting() and
helmetSetting.getHelmet() = helmet
select helmet, "Helmet route handler, called with $@ set to 'false'.", helmetSetting,
helmetSetting.getName()