hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 03:05:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

JS: address review comments about duplicated logic

Browse Source
This commit is contained in:
Esben Sparre Andreasen
2020-02-04 10:49:23 +01:00
parent bbd60f52ba
commit 8a2c81b41c
1 changed files with 12 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
javascript/ql/src/semmle/javascript/security/dataflow/TaintedPath.qll
View File

@@ -69,17 +69,19 @@ module TaintedPath {
)
or
// string method calls of interest
exists(DataFlow::MethodCallNode mcn | srclabel = dstlabel |
exists(DataFlow::MethodCallNode mcn, string name |
srclabel = dstlabel and dst = mcn and mcn.calls(src, name)
|
exists(string substringMethodName |
substringMethodName = "substr" or
substringMethodName = "substring" or
substringMethodName = "slice"
|
mcn.calls(src, substringMethodName) and
name = substringMethodName and
// to avoid very dynamic transformations, require at least one fixed index
exists(mcn.getAnArgument().asExpr().getIntValue()) and
dst = mcn
) or
exists(mcn.getAnArgument().asExpr().getIntValue())
)
or
exists(string argumentlessMethodName |
argumentlessMethodName = "toLocaleLowerCase" or
argumentlessMethodName = "toLocaleUpperCase" or
@@ -89,16 +91,14 @@ module TaintedPath {
argumentlessMethodName = "trimLeft" or
argumentlessMethodName = "trimRight"
|
mcn.calls(src, argumentlessMethodName) and
dst = mcn
name = argumentlessMethodName
)
or
mcn.calls(src, "split") and
dst = mcn and
not exists (DataFlow::Node splitBy |
splitBy = mcn.getArgument(0)|
name = "split" and
not exists(DataFlow::Node splitBy | splitBy = mcn.getArgument(0) |
splitBy.mayHaveStringValue("/") or
any(DataFlow::RegExpLiteralNode reg | reg.getRoot().getAMatchedString() = "/").flowsTo(splitBy)
any(DataFlow::RegExpLiteralNode reg | reg.getRoot().getAMatchedString() = "/")
.flowsTo(splitBy)
)
)
}