Add req.url.origin to RequestInputAccess

2026-05-04 21:25:44 +02:00 · 2022-11-08 16:14:10 +01:00
parent 8b33e6d175
commit 8e546e8496
1 changed files with 1 additions and 1 deletions
--- a/javascript/ql/lib/semmle/javascript/frameworks/Hapi.qll
+++ b/javascript/ql/lib/semmle/javascript/frameworks/Hapi.qll
@@ -142,7 +142,7 @@ module Hapi {
          // `request.url.path`
          kind = "url" and
          url.accesses(request, "url") and
-          this.(DataFlow::PropRead).accesses(url, "path")
+          this.(DataFlow::PropRead).accesses(url, ["path", "origin"])
        )
        or
        exists(DataFlow::PropRead state |