hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-26 17:25:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

small changes based on review feedback

Browse Source
This commit is contained in:
Erik Krogh Kristensen
2019-11-26 15:57:31 +01:00
parent 0f948339af
commit b5a57986c6
3 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
javascript/ql/src/Security/CWE-079/ExceptionXss.ql
View File

@@ -1,5 +1,5 @@
/**
* @name Client-side cross-site scripting through exception
* @name Cross-site scripting through exception
* @description User input being part of an exception allows for
* cross-site scripting if that exception is written
* to the DOM.

6
javascript/ql/src/semmle/javascript/security/dataflow/ExceptionXss.qll
View File

@@ -12,9 +12,9 @@ module ExceptionXss {
import Xss as Xss
/**
* Holds if `node` cannot cause an exception containing sensitive information to be thrown.
* Holds if `node` is unlikely to cause an exception containing sensitive information to be thrown.
*/
predicate canDefinitelyNotThrowSensitiveInformation(DataFlow::Node node) {
private predicate isUnlikelyToThrowSensitiveInformation(DataFlow::Node node) {
node = any(DataFlow::CallNode call | call.getCalleeName() = "getElementById").getAnArgument()
or
node = any(DataFlow::CallNode call | call.getCalleeName() = "indexOf").getAnArgument()
@@ -28,7 +28,7 @@ module ExceptionXss {
* Holds if `node` can possibly cause an exception containing sensitive information to be thrown.
*/
predicate canThrowSensitiveInformation(DataFlow::Node node) {
not canDefinitelyNotThrowSensitiveInformation(node) and
not isUnlikelyToThrowSensitiveInformation(node) and
(
// in the case of reflective calls the below ensures that both InvokeNodes have no known callee.
forex(DataFlow::InvokeNode call | node = call.getAnArgument() | not exists(call.getACallee()))