hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-22 07:15:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

JS: Move AngularJSTemplateUrlSink to ClientSideUrlRedirection query

Browse Source 
This is not perfect but at least we can be consistent about keeping URLs-that-lead-to-xss in the same query
This commit is contained in:
Asger F
2024-08-16 14:36:44 +02:00
parent 699d3a0a0a
commit 9ee7599aeb
7 changed files with 52 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
javascript/ql/lib/semmle/javascript/security/dataflow/ClientSideUrlRedirectCustomizations.qll
View File

@@ -237,6 +237,15 @@ module ClientSideUrlRedirect {
override predicate isXssSink() { any() }
}
/**
* A `templateUrl` member of an AngularJS directive.
*/
private class AngularJSTemplateUrlSink extends Sink {
AngularJSTemplateUrlSink() { this = any(AngularJS::CustomDirective d).getMember("templateUrl") }
override predicate isXssSink() { any() }
}
private class SinkFromModel extends Sink {
SinkFromModel() { this = ModelOutput::getASinkNode("url-redirection").asSink() }
}

7
javascript/ql/lib/semmle/javascript/security/dataflow/TaintedPathCustomizations.qll
View File

@@ -653,10 +653,11 @@ module TaintedPath {
}
/**
* A `templateUrl` member of an AngularJS directive.
* DEPRECATED. This is no longer seen as a path-injection sink. It is tentatively handled
* by the client-side URL redirection query for now.
*/
class AngularJSTemplateUrlSink extends Sink, DataFlow::ValueNode {
AngularJSTemplateUrlSink() { this = any(AngularJS::CustomDirective d).getMember("templateUrl") }
deprecated class AngularJSTemplateUrlSink extends DataFlow::ValueNode instanceof Sink {
AngularJSTemplateUrlSink() { none() }
}
/**