hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-29 18:55:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

JS: Do not require flow from key -> rhs

Browse Source
This commit is contained in:
Asger F
2019-11-15 10:08:33 +00:00
committed by Asger Feldthaus
parent 96bf9db200
commit ac2f0a8e11
1 changed files with 3 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
javascript/ql/src/Security/CWE-400/PrototypePollutionUtility.ql
View File

@@ -161,12 +161,12 @@ class UnsafePropLabel extends FlowLabel {
* }
* ```
*
* This configuration is used to find four separate data flow paths originating
* This configuration is used to find three separate data flow paths originating
* from a property enumeration, all leading to the same dynamic property write.
*
* In particular, the base, property name, and rhs of the property write should all
* In particular, the base and property name of the property write should all
* depend on the enumerated property name (`key`) and the right-hand side should
* additionally depend on the source object (`src`), while allowing steps of form
* depend on the source property (`src[key]`), while allowing steps of form
* `x -> x[p]` and `p -> x[p]`.
*
* Note that in the above example, the flow from `key` to the base of the write (`dst`)
@@ -384,7 +384,6 @@ predicate isPrototypePollutingAssignment(Node base, Node prop, Node rhs, Enumera
exists(PropNameTracking cfg |
cfg.hasFlow(enum, base) and
cfg.hasFlow(enum, prop) and
cfg.hasFlow(enum, rhs) and
cfg.hasFlow(enum.getASourceProp(), rhs)
)
}