hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-01-30 06:42:57 +01:00
Code Issues Packages Projects Releases Wiki Activity

Improve naming.

Browse Source
This commit is contained in:
Slavomir
2021-03-08 15:52:10 +01:00
committed by Chris Smowton
parent 687e556df6
commit 963631dedf
1 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
ql/src/experimental/CWE-79/HTMLTemplateEscapingPassthrough.ql
View File

@@ -91,11 +91,11 @@ class TemplateExecutionFlowConf extends TaintTracking::Configuration {
}
from
TemplateExecutionFlowConf cfg, DataFlow::PathNode source, DataFlow::PathNode sink,
string targetTypeName, DataFlow::PathNode conversionSink
TemplateExecutionFlowConf cfg, DataFlow::PathNode untrustedSource,
DataFlow::PathNode tplExecutionSink, string targetTypeName, DataFlow::PathNode conversionSink
where
cfg.hasFlowPath(source, sink) and
isConvertedToPassthroughType(source.getNode(), targetTypeName, conversionSink)
select sink.getNode(), source, sink,
cfg.hasFlowPath(untrustedSource, tplExecutionSink) and
isConvertedToPassthroughType(untrustedSource.getNode(), targetTypeName, conversionSink)
select tplExecutionSink.getNode(), untrustedSource, tplExecutionSink,
"Data from an $@ will not be auto-escaped because it was $@ to template." + targetTypeName,
source.getNode(), "untrusted source", conversionSink.getNode(), "converted"
untrustedSource.getNode(), "untrusted source", conversionSink.getNode(), "converted"