hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-01-29 22:32:58 +01:00
Code Issues Packages Projects Releases Wiki Activity

Use getAPredecessor

Browse Source
This commit is contained in:
edvraa
2021-04-29 14:44:50 +03:00
committed by Owen Mansel-Chan
parent ff06815db1
commit 9c0b83fd34
1 changed files with 5 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
ql/src/experimental/CWE-1004/CookieWithoutHttpOnly.ql
View File

@@ -30,15 +30,13 @@ predicate isGinContextCookieFlow(Expr expr) {
exists(CallExpr c |
c.getTarget().getQualifiedName() = "github.com/gin-gonic/gin.Context.SetCookie" and
c.getArgument(6) = expr and
exists(DataFlow::Node valSrc, DataFlow::Node httpOnlyArg |
DataFlow::localFlow(valSrc, httpOnlyArg) and
exists(DataFlow::Node httpOnlyArg |
httpOnlyArg.asExpr() = c.getArgument(6) and
valSrc.asExpr().getBoolValue() = false
httpOnlyArg.getAPredecessor*().asExpr().getBoolValue() = false
) and
exists(DataFlow::Node nameSrc, DataFlow::Node nameArg |
DataFlow::localFlow(nameSrc, nameArg) and
exists(DataFlow::Node nameArg |
nameArg.asExpr() = c.getArgument(0) and
isAuthVariable(nameSrc.asExpr())
isAuthVariable(nameArg.getAPredecessor*().asExpr())
)
)
}
@@ -57,10 +55,7 @@ predicate isGorillaSessionsCookieFlow(Expr expr) {
or
exists(DataFlow::Node rhs |
rhs = getValueForFieldWrite(options.asExpr(), "HttpOnly") and
exists(DataFlow::Node valSrc |
DataFlow::localFlow(valSrc, rhs) and
valSrc.asExpr().getBoolValue() = false
)
rhs.getAPredecessor*().asExpr().getBoolValue() = false
)
)
)