hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-06-18 19:31:11 +02:00
Code Issues Packages Projects Releases Wiki Activity

lift XssSink check to InformationLeakSink

Browse Source
This commit is contained in:
Alvaro Muñoz
2021-06-01 17:16:41 +02:00
parent 970b4e7d6a
commit 9aba92397d
2 changed files with 7 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
java/ql/src/Security/CWE/CWE-209/StackTraceExposure.ql
View File

@@ -15,7 +15,6 @@
import java
import semmle.code.java.dataflow.DataFlow
import semmle.code.java.dataflow.TaintTracking
import semmle.code.java.security.XSS
import semmle.code.java.security.InformationLeak
/**
@@ -91,10 +90,7 @@ class StackTraceStringToHTTPResponseSinkFlowConfig extends TaintTracking::Config
override predicate isSource(DataFlow::Node src) { stackTraceExpr(_, src.asExpr()) }
override predicate isSink(DataFlow::Node sink) {
sink instanceof XssSink or
sink instanceof InformationLeakSink
}
override predicate isSink(DataFlow::Node sink) { sink instanceof InformationLeakSink }
}
/**
@@ -134,10 +130,7 @@ class GetMessageFlowSourceToHTTPResponseSinkFlowConfig extends TaintTracking::Co
override predicate isSource(DataFlow::Node src) { src.asExpr() instanceof GetMessageFlowSource }
override predicate isSink(DataFlow::Node sink) {
sink instanceof XssSink or
sink instanceof InformationLeakSink
}
override predicate isSink(DataFlow::Node sink) { sink instanceof InformationLeakSink }
}
/**