JS: Fixed path query not flagging new RegExp with DotRemovingReplaceCall

This commit is contained in:
Napalys
2024-11-27 08:55:21 +01:00
parent aa557cf950
commit 875478c1c6
4 changed files with 114 additions and 5 deletions

View File

@@ -305,9 +305,9 @@ module TaintedPath {
input = this.getReceiver() and
output = this and
this.isGlobal() and
exists(RegExpLiteral literal, RegExpTerm term |
this.getRegExp().asExpr() = literal and
literal.getRoot() = term and
exists(DataFlow::RegExpCreationNode regexp, RegExpTerm term |
this.getRegExp() = regexp and
regexp.getRoot() = term and
not term.getAMatchedString() = "/"
|
term.getAMatchedString() = "." or