hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-01 11:45:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Ruby: Minor changes to InsecureDownload

Browse Source
This commit is contained in:
Harry Maclean
2022-04-27 18:04:21 +12:00
parent f35379bf8c
commit 992cc517a8
2 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
ruby/ql/lib/codeql/ruby/security/InsecureDownloadCustomizations.qll
View File

@@ -71,7 +71,7 @@ module InsecureDownload {
}
/**
* A HTTP or FTP url.
* A HTTP or FTP URL.
*/
class InsecureUrl extends DataFlow::Node {
string str;
@@ -99,8 +99,8 @@ module InsecureDownload {
* A string containing a sensitive file extension,
* seen as a source for downloads of sensitive files through an insecure connection.
*/
class SensitiveFileUrl extends Source {
SensitiveFileUrl() { hasUnsafeExtension(this.asExpr().getConstantValue().getString()) }
class SensitiveFileName extends Source {
SensitiveFileName() { hasUnsafeExtension(this.asExpr().getConstantValue().getString()) }
override DataFlow::FlowState getALabel() { result instanceof Label::Sensitive }
}

2
ruby/ql/lib/codeql/ruby/security/InsecureDownloadQuery.qll
View File

@@ -1,5 +1,5 @@
/**
* Provides a taint tracking configuration for reasoning about download of sensitive file through insecure connection.
* Provides a dataflow configuration for reasoning about the download of sensitive file through insecure connection.
*
* Note, for performance reasons: only import this file if
* `InsecureDownload::Configuration` is needed, otherwise