hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-27 09:45:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

JS: Improve lodash model

Browse Source
This commit is contained in:
Asger Feldthaus
2020-10-27 15:30:13 +00:00
parent 9fc5c0bdb8
commit a9adb2912a
2 changed files with 12 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
javascript/ql/src/experimental/Security/CWE-94/ServerSideTemplateInjection.ql
View File

@@ -57,6 +57,12 @@ class SSTINunjucksSink extends ServerSideTemplateInjectionSink {
}
}
class LodashTemplateSink extends ServerSideTemplateInjectionSink {
LodashTemplateSink() {
this = LodashUnderscore::member("template").getACall().getArgument(0)
}
}
from DataFlow::PathNode source, DataFlow::PathNode sink, ServerSideTemplateInjectionConfiguration c
where c.hasFlowPath(source, sink)
select sink.getNode(), source, sink,

7
javascript/ql/src/semmle/javascript/frameworks/LodashUnderscore.qll
View File

@@ -407,7 +407,12 @@ module LodashUnderscore {
"shuffle", "sample", "toArray", "partition", "compact", "first", "initial", "last",
"rest", "flatten", "without", "difference", "uniq", "unique", "unzip", "transpose",
"object", "chunk", "values", "mapObject", "pick", "omit", "defaults", "clone", "tap",
"identity"] and
"identity",
// String category
"camelCase", "capitalize", "deburr", "kebabCase", "lowerCase", "lowerFirst", "pad",
"padEnd", "padStart", "repeat", "replace", "snakeCase", "split", "startCase", "toLower",
"toUpper", "trim", "trimEnd", "trimStart", "truncate", "unescape", "upperCase",
"upperFirst", "words"] and
pred = call.getArgument(0) and
succ = call
or