Python: require dict sinks be dangerous.

This commit is contained in:
Rasmus Lerchedahl Petersen
2023-09-29 13:45:23 +02:00
parent f3a01612e8
commit 97696680e6

View File

@@ -77,7 +77,11 @@ module NoSqlInjection {
/** A NoSQL query that is vulnerable to user controlled dictionaries. */
class NoSqlExecutionAsDictSink extends DictSink {
NoSqlExecutionAsDictSink() { this = any(NoSqlExecution noSqlExecution).getQuery() }
NoSqlExecutionAsDictSink() {
exists(NoSqlExecution noSqlExecution | this = noSqlExecution.getQuery() |
noSqlExecution.interpretsDict()
)
}
}
/** A JSON decoding converts a string to a dictionary. */