From 9224a315f10d3468f97c743832d89bf954dd88cc Mon Sep 17 00:00:00 2001 From: edvraa <80588099+edvraa@users.noreply.github.com> Date: Wed, 12 May 2021 23:24:50 +0300 Subject: [PATCH] inline isGinContextCookieFlow --- ql/src/experimental/CWE-1004/CookieWithoutHttpOnly.ql | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/ql/src/experimental/CWE-1004/CookieWithoutHttpOnly.ql b/ql/src/experimental/CWE-1004/CookieWithoutHttpOnly.ql index c97bf1a18c7..261ddad911e 100644 --- a/ql/src/experimental/CWE-1004/CookieWithoutHttpOnly.ql +++ b/ql/src/experimental/CWE-1004/CookieWithoutHttpOnly.ql @@ -34,11 +34,6 @@ predicate isNetHttpCookieFlow(DataFlow::PathNode source, DataFlow::PathNode sink ) } -/** Holds if `HttpOnly` of `gin-gonic/gin.Context.SetCookie` is set to `false` or not set (default value is used). */ -predicate isGinContextCookieFlow(DataFlow::PathNode source, DataFlow::PathNode sink) { - any(BoolToGinSetCookieTrackingConfiguration cfg).hasFlowPath(source, sink) -} - /** * Holds if there is gorilla cookie store creation to `Save` path and * `HttpOnly` is set to `false` or not set (default value is used). @@ -84,6 +79,6 @@ predicate isGorillaSessionsCookieFlow(DataFlow::PathNode source, DataFlow::PathN from DataFlow::PathNode source, DataFlow::PathNode sink where isNetHttpCookieFlow(source, sink) or - isGinContextCookieFlow(source, sink) or + any(BoolToGinSetCookieTrackingConfiguration cfg).hasFlowPath(source, sink) or isGorillaSessionsCookieFlow(source, sink) select sink.getNode(), source, sink, "Cookie attribute 'HttpOnly' is not set to true."