mirror of
https://github.com/github/codeql.git
synced 2026-04-30 11:15:13 +02:00
JS: Rename variables to match new class name
This commit is contained in:
@@ -535,13 +535,13 @@ module Vue {
|
||||
*/
|
||||
class VHtmlSourceWrite extends TaintTracking::SharedTaintStep {
|
||||
override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
|
||||
exists(Vue::Component instance, string expr, VHtmlAttribute attr |
|
||||
exists(Vue::Component component, string expr, VHtmlAttribute attr |
|
||||
attr.getAttr().getRoot() =
|
||||
instance.getTemplateElement().(Vue::Template::HtmlElement).getElement() and
|
||||
component.getTemplateElement().(Vue::Template::HtmlElement).getElement() and
|
||||
expr = attr.getAttr().getValue() and
|
||||
// only support for simple identifier expressions
|
||||
expr.regexpMatch("(?i)[a-z0-9_]+") and
|
||||
pred = instance.getAPropertyValue(expr) and
|
||||
pred = component.getAPropertyValue(expr) and
|
||||
succ = attr
|
||||
)
|
||||
}
|
||||
@@ -642,15 +642,15 @@ module Vue {
|
||||
or
|
||||
result = routeConfig().getMember("beforeEnter").getParameter([0, 1]).getAnImmediateUse()
|
||||
or
|
||||
exists(Component i |
|
||||
result = i.getABoundFunction().getAFunctionValue().getReceiver().getAPropertyRead("$route")
|
||||
exists(Component c |
|
||||
result = c.getABoundFunction().getAFunctionValue().getReceiver().getAPropertyRead("$route")
|
||||
or
|
||||
result =
|
||||
i.getALifecycleHook(["beforeRouteEnter", "beforeRouteUpdate", "beforeRouteLeave"])
|
||||
c.getALifecycleHook(["beforeRouteEnter", "beforeRouteUpdate", "beforeRouteLeave"])
|
||||
.getAFunctionValue()
|
||||
.getParameter([0, 1])
|
||||
or
|
||||
result = i.getWatchHandler("$route").getParameter([0, 1])
|
||||
result = c.getWatchHandler("$route").getParameter([0, 1])
|
||||
)
|
||||
)
|
||||
or
|
||||
@@ -668,7 +668,7 @@ module Vue {
|
||||
this = routeObject().getAPropertyRead(name)
|
||||
or
|
||||
exists(string prop |
|
||||
this = any(Component i).getWatchHandler(prop).getParameter([0, 1]) and
|
||||
this = any(Component c).getWatchHandler(prop).getParameter([0, 1]) and
|
||||
name = prop.regexpCapture("\\$route\\.(params|query|hash|path|fullPath)\\b.*", 1)
|
||||
)
|
||||
|
|
||||
|
||||
@@ -26,7 +26,7 @@ private module VueAPI {
|
||||
* or equivalent.
|
||||
*/
|
||||
class VueConfigObject extends API::Node {
|
||||
VueConfigObject() { this.getARhs() = any(Vue::Component i).getOwnOptionsObject() }
|
||||
VueConfigObject() { this.getARhs() = any(Vue::Component c).getOwnOptionsObject() }
|
||||
|
||||
/** Gets an API node representing `this` in the Vue component. */
|
||||
API::Node getAnInstanceRef() {
|
||||
|
||||
@@ -347,7 +347,7 @@ module DomBasedXss {
|
||||
class VueTemplateSink extends DomBasedXss::Sink {
|
||||
VueTemplateSink() {
|
||||
// Note: don't use Vue::Instance#getTemplate as it includes an unwanted getALocalSource() step
|
||||
this = any(Vue::Component i).getOption("template")
|
||||
this = any(Vue::Component c).getOption("template")
|
||||
}
|
||||
}
|
||||
|
||||
@@ -357,8 +357,8 @@ module DomBasedXss {
|
||||
*/
|
||||
class VueCreateElementSink extends DomBasedXss::Sink {
|
||||
VueCreateElementSink() {
|
||||
exists(Vue::Component i, DataFlow::FunctionNode f |
|
||||
f.flowsTo(i.getRender()) and
|
||||
exists(Vue::Component c, DataFlow::FunctionNode f |
|
||||
f.flowsTo(c.getRender()) and
|
||||
this = f.getParameter(0).getACall().getArgument(0)
|
||||
)
|
||||
}
|
||||
|
||||
@@ -1,15 +1,15 @@
|
||||
import javascript
|
||||
import semmle.javascript.security.dataflow.Xss
|
||||
|
||||
query predicate instance_getAPropertyValue(Vue::Component i, string name, DataFlow::Node prop) {
|
||||
i.getAPropertyValue(name) = prop
|
||||
query predicate instance_getAPropertyValue(Vue::Component c, string name, DataFlow::Node prop) {
|
||||
c.getAPropertyValue(name) = prop
|
||||
}
|
||||
|
||||
query predicate instance_getOption(Vue::Component i, string name, DataFlow::Node prop) {
|
||||
i.getOption(name) = prop
|
||||
query predicate instance_getOption(Vue::Component c, string name, DataFlow::Node prop) {
|
||||
c.getOption(name) = prop
|
||||
}
|
||||
|
||||
query predicate instance(Vue::Component i) { any() }
|
||||
query predicate instance(Vue::Component c) { any() }
|
||||
|
||||
query predicate instance_heapStep(
|
||||
Vue::InstanceHeapStep step, DataFlow::Node pred, DataFlow::Node succ
|
||||
|
||||
Reference in New Issue
Block a user