hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 19:26:02 +02:00
Code Issues Packages Projects Releases Wiki Activity

JavaScript: Include 'unzipper' library in ZipSlip.

Browse Source
This commit is contained in:
Jason Reed
2019-03-15 09:26:08 -04:00
parent 8124980f58
commit aa9ba9557c
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
javascript/ql/src/semmle/javascript/security/dataflow/ZipSlip.qll
View File

@@ -45,6 +45,8 @@ module ZipSlip {
* Gets a node that can be a parsed archive.
*/
private DataFlow::SourceNode parsedArchive() {
result = DataFlow::moduleImport("unzipper").getAMemberCall("Parse")
or
result = DataFlow::moduleImport("unzip").getAMemberCall("Parse")
or
result = DataFlow::moduleImport("tar-stream").getAMemberCall("extract")