hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 11:15:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

JS: Fix TaintedPath

Browse Source
This commit is contained in:
Asger Feldthaus
2020-03-28 10:04:06 +00:00
parent ec19bed1fa
commit 9ee81cb115
2 changed files with 15 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
javascript/ql/src/semmle/javascript/dataflow/TaintTracking.qll
View File

@@ -333,17 +333,26 @@ module TaintTracking {
}
/**
* DEPRECATED. Use the predicate `TaintTracking::persistentStorageStep` instead.
*
* A taint propagating data flow edge through persistent storage.
*/
class PersistentStorageTaintStep extends SharedTaintStep {
deprecated class PersistentStorageTaintStep extends SharedTaintStep {
override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
exists(PersistentReadAccess read |
pred = read.getAWrite().getValue() and
succ = read
)
persistentStorageStep(pred, succ)
}
}
/**
* Holds if `pred -> succ` is a taint propagating data flow edge through persistent storage.
*/
predicate persistentStorageStep(DataFlow::Node pred, DataFlow::Node succ) {
exists(PersistentReadAccess read |
pred = read.getAWrite().getValue() and
succ = read
)
}
predicate arrayFunctionTaintStep = ArrayTaintTracking::arrayFunctionTaintStep/3;
/**

2
javascript/ql/src/semmle/javascript/security/dataflow/TaintedPathCustomizations.qll
View File

@@ -661,7 +661,7 @@ module TaintedPath {
or
promiseTaintStep(src, dst) and srclabel = dstlabel
or
any(TaintTracking::PersistentStorageTaintStep st).step(src, dst) and srclabel = dstlabel
TaintTracking::persistentStorageStep(src, dst) and srclabel = dstlabel
or
exists(DataFlow::PropRead read | read = dst |
src = read.getBase() and