hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-11 01:39:28 +02:00
Code Issues Packages Projects Releases Wiki Activity

support credentials in a Buffer

Browse Source
This commit is contained in:
Erik Krogh Kristensen
2020-06-03 12:02:00 +02:00
parent ba44ebe8a8
commit a1940979ba
3 changed files with 40 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
javascript/ql/src/semmle/javascript/security/dataflow/HardcodedCredentials.qll
View File

@@ -21,11 +21,17 @@ module HardcodedCredentials {
override predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
override predicate isAdditionalFlowStep(DataFlow::Node src, DataFlow::Node trg) {
override predicate isAdditionalFlowStep(DataFlow::Node src, DataFlow::Node trg) {
exists(Base64::Encode encode | src = encode.getInput() and trg = encode.getOutput())
or
trg.(StringOps::ConcatenationRoot).getALeaf() = src and
not exists(src.(StringOps::ConcatenationLeaf).getStringValue()) // to avoid e.g. the ":" in `user + ":" + pass` being flagged as a constant credential.
or
exists(DataFlow::MethodCallNode bufferFrom |
bufferFrom = DataFlow::globalVarRef("Buffer").getAMethodCall("from") and
trg = bufferFrom and
src = bufferFrom.getArgument(0)
)
}
}
}