hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 19:26:02 +02:00
Code Issues Packages Projects Releases Wiki Activity

change RouteSetup to a DataFlow::Node

Browse Source
This commit is contained in:
Erik Krogh Kristensen
2022-03-30 14:17:01 +02:00
committed by erik-krogh
parent d98028be1a
commit 9cb7522bc1
30 changed files with 124 additions and 120 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
javascript/ql/src/Security/CWE-200/PrivateFileExposure.ql
View File

@@ -135,7 +135,7 @@ DataFlow::CallNode servesAPrivateFolder(string description) {
*/
Express::RouteSetup getAnExposingExpressSetup(string path) {
result.isUseCall() and
result.getArgument([0 .. 1]) = servesAPrivateFolder(path).getEnclosingExpr()
result.getArgument([0 .. 1]) = servesAPrivateFolder(path)
}
/**
@@ -149,7 +149,7 @@ DataFlow::CallNode getAnExposingServeSetup(string path) {
from DataFlow::Node node, string path
where
node = getAnExposingExpressSetup(path).flow()
node = getAnExposingExpressSetup(path)
or
node = getAnExposingServeSetup(path)
select node, "Serves " + path + ", which can contain private information."

2
javascript/ql/src/experimental/poi/PoI.qll
View File

@@ -77,7 +77,7 @@ private module StandardPoIs {
UnpromotedRouteSetupPoI() { this = "UnpromotedRouteSetupPoI" }
override predicate is(Node l0) {
l0 instanceof HTTP::RouteSetupCandidate and not l0.asExpr() instanceof HTTP::RouteSetup
l0 instanceof HTTP::RouteSetupCandidate and not l0 instanceof HTTP::RouteSetup
}
}

2
javascript/ql/src/meta/analysis-quality/UnpromotedRouteSetupCandidate.ql
View File

@@ -13,7 +13,7 @@ import CandidateTracking
from HTTP::RouteSetupCandidate setup
where
not setup.asExpr() instanceof HTTP::RouteSetup and
not setup instanceof HTTP::RouteSetup and
exists(HTTP::RouteHandlerCandidate rh |
track(rh, DataFlow::TypeTracker::end()).flowsTo(setup.getARouteHandlerArg())
)