JS: StringFormattingStep

2026-04-28 02:05:14 +02:00 · 2020-03-27 15:23:25 +00:00
parent a00fdc9b25
commit 9f15b14df9
1 changed files with 5 additions and 10 deletions
--- a/javascript/ql/src/semmle/javascript/dataflow/TaintTracking.qll
+++ b/javascript/ql/src/semmle/javascript/dataflow/TaintTracking.qll
@@ -520,17 +520,12 @@ module TaintTracking {
  /**
   * A taint propagating data flow edge arising from string formatting.
   */
-  private class StringFormattingTaintStep extends AdditionalTaintStep {
-    PrintfStyleCall call;
-
-    StringFormattingTaintStep() {
-      this = call and
-      call.returnsFormatted()
-    }
-
+  private class StringFormattingTaintStep extends SharedTaintStep {
    override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
-      succ = this and
-      (
+      exists(PrintfStyleCall call |
+        call.returnsFormatted() and
+        succ = call
+      |
        pred = call.getFormatString()
        or
        pred = call.getFormatArgument(_)