JS: generalize js/incomplete-sanitization to handle ConstantString

2026-03-23 07:56:54 +01:00 · 2018-12-10 22:52:18 +01:00
parent a4b3b1e8c8
commit a1d92bfa50
3 changed files with 36 additions and 1 deletions
--- a/javascript/ql/src/Security/CWE-116/IncompleteSanitization.ql
+++ b/javascript/ql/src/Security/CWE-116/IncompleteSanitization.ql
@@ -25,7 +25,7 @@ string metachar() {
 string getAMatchedString(Expr e) {
  result = getAMatchedConstant(e.(RegExpLiteral).getRoot()).getValue()
  or
-  result = e.(StringLiteral).getValue()
+  result = e.getStringValue()
 }

 /** Gets a constant matched by `t`. */