hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 11:15:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

move LocalUrlSanitizingGuard out of the customizations file

Browse Source
This commit is contained in:
Erik Krogh Kristensen
2022-04-20 10:18:49 +02:00
parent 040dd09c5a
commit 9631b68de9
2 changed files with 14 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
javascript/ql/lib/semmle/javascript/security/dataflow/ServerSideUrlRedirectCustomizations.qll
View File

@@ -47,20 +47,6 @@ module ServerSideUrlRedirect {
}
}
/**
* A call to a function called `isLocalUrl` or similar, which is
* considered to sanitize a variable for purposes of URL redirection.
*/
class LocalUrlSanitizingGuard extends TaintTracking::SanitizerGuardNode, DataFlow::CallNode {
LocalUrlSanitizingGuard() { this.getCalleeName().regexpMatch("(?i)(is_?)?local_?url") }
override predicate sanitizes(boolean outcome, Expr e) {
// `isLocalUrl(e)` sanitizes `e` if it evaluates to `true`
this.getAnArgument().asExpr() = e and
outcome = true
}
}
/**
* A URL attribute for a React Native `WebView`.
*/

14
javascript/ql/lib/semmle/javascript/security/dataflow/ServerSideUrlRedirectQuery.qll
View File

@@ -36,3 +36,17 @@ class Configuration extends TaintTracking::Configuration {
guard instanceof HostnameSanitizerGuard
}
}
/**
* A call to a function called `isLocalUrl` or similar, which is
* considered to sanitize a variable for purposes of URL redirection.
*/
class LocalUrlSanitizingGuard extends TaintTracking::SanitizerGuardNode, DataFlow::CallNode {
LocalUrlSanitizingGuard() { this.getCalleeName().regexpMatch("(?i)(is_?)?local_?url") }
override predicate sanitizes(boolean outcome, Expr e) {
// `isLocalUrl(e)` sanitizes `e` if it evaluates to `true`
this.getAnArgument().asExpr() = e and
outcome = true
}
}