hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 11:15:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

JS: Port HostHeaderPoisoningInEmailGeneration

Browse Source
This commit is contained in:
Asger F
2023-10-05 09:19:32 +02:00
parent bc88f50a5f
commit 8715c1b324
3 changed files with 30 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
javascript/ql/lib/semmle/javascript/security/dataflow/HostHeaderPoisoningInEmailGenerationQuery.qll
View File

@@ -6,9 +6,28 @@
import javascript
/**
* A taint tracking configuration for host header poisoning in email generation.
* A taint tracking configuration for host header poisoning.
*/
class Configuration extends TaintTracking::Configuration {
module HostHeaderPoisoningConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node node) {
exists(Http::RequestHeaderAccess input | node = input |
input.getKind() = "header" and
input.getAHeaderName() = "host"
)
}
predicate isSink(DataFlow::Node node) { exists(EmailSender email | node = email.getABody()) }
}
/**
* Taint tracking configuration host header poisoning.
*/
module HostHeaderPoisoningFlow = TaintTracking::Global<HostHeaderPoisoningConfig>;
/**
* DEPRECATED. Use the `HostHeaderPoisoningFlow` module instead.
*/
deprecated class Configuration extends TaintTracking::Configuration {
Configuration() { this = "TaintedHostHeader" }
override predicate isSource(DataFlow::Node node) {