hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-01 03:35:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

Replace class and module name

Browse Source
This commit is contained in:
ubuntu
2020-08-16 14:53:31 +02:00
parent d4b231b867
commit 91d44854c0
2 changed files with 9 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
javascript/ql/src/experimental/Security/CWE-614/InsecureCookie.ql
View File

@@ -11,9 +11,9 @@
*/
import javascript
import InsecureCookie::InsecureCookie
import InsecureCookie::Cookie
from InsecureCookies insecureCookies
from Cookie insecureCookies
where insecureCookies.isInsecure()
select "Cookie is added to response without the 'secure' flag being set to true (using " +
insecureCookies.getKind() + ").", insecureCookies

15
javascript/ql/src/experimental/Security/CWE-614/InsecureCookie.qll
View File

@@ -5,7 +5,7 @@
import javascript
module InsecureCookie {
module Cookie {
/**
* `secure` property of the cookie options.
*/
@@ -14,7 +14,7 @@ module InsecureCookie {
/**
* Abstract class to represent different cases of insecure cookie settings.
*/
abstract class InsecureCookies extends DataFlow::Node {
abstract class Cookie extends DataFlow::Node {
/**
* Gets the name of the middleware/library used to set the cookie.
*/
@@ -34,8 +34,7 @@ module InsecureCookie {
/**
* A cookie set using the `express` module `cookie-session` (https://github.com/expressjs/cookie-session).
*/
class InsecureCookieSession extends ExpressLibraries::CookieSession::MiddlewareInstance,
InsecureCookies {
class InsecureCookieSession extends ExpressLibraries::CookieSession::MiddlewareInstance, Cookie {
override string getKind() { result = "cookie-session" }
override DataFlow::SourceNode getCookieOptionsArgument() { result = this.getOption("cookie") }
@@ -54,7 +53,7 @@ module InsecureCookie {
* A cookie set using the `express` module `express-session` (https://github.com/expressjs/session).
*/
class InsecureExpressSessionCookie extends ExpressLibraries::ExpressSession::MiddlewareInstance,
InsecureCookies {
Cookie {
override string getKind() { result = "express-session" }
override DataFlow::SourceNode getCookieOptionsArgument() { result = this.getOption("cookie") }
@@ -73,7 +72,7 @@ module InsecureCookie {
/**
* A cookie set using `response.cookie` from `express` module (https://expressjs.com/en/api.html#res.cookie).
*/
class InsecureExpressCookieResponse extends InsecureCookies {
class InsecureExpressCookieResponse extends Cookie {
InsecureExpressCookieResponse() {
this = any(Express::ResponseExpr response).flow().getALocalSource().getAMethodCall("cookie")
}
@@ -97,7 +96,7 @@ module InsecureCookie {
/**
* A cookie set using `Set-Cookie` header of an `HTTP` response (https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie).
*/
class InsecureSetCookieHeader extends InsecureCookies {
class InsecureSetCookieHeader extends Cookie {
InsecureSetCookieHeader() {
this.asExpr() = any(HTTP::SetCookieHeader setCookie).getHeaderArgument()
}
@@ -120,7 +119,7 @@ module InsecureCookie {
/**
* A cookie set using `js-cookie` library (https://github.com/js-cookie/js-cookie).
*/
class InsecureJsCookie extends InsecureCookies {
class InsecureJsCookie extends Cookie {
InsecureJsCookie() {
this = DataFlow::globalVarRef("Cookie").getAMemberCall("set") or
this = DataFlow::globalVarRef("Cookie").getAMemberCall("noConflict").getAMemberCall("set") or