hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-01 03:35:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

JS: better matching of String.prototype.search in js/regex-injection

Browse Source
This commit is contained in:
Esben Sparre Andreasen
2018-09-05 08:35:00 +02:00
parent 6e9cc46e80
commit b9d825b379
4 changed files with 31 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
javascript/ql/src/semmle/javascript/security/dataflow/RegExpInjection.qll
View File

@@ -69,7 +69,13 @@ module RegExpInjection {
mce.getReceiver().analyze().getAType() = TTString() and
mce.getMethodName() = methodName |
(methodName = "match" and this.asExpr() = mce.getArgument(0) and mce.getNumArgument() = 1) or
(methodName = "search" and this.asExpr() = mce.getArgument(0) and mce.getNumArgument() = 1)
(
methodName = "search" and
this.asExpr() = mce.getArgument(0) and
mce.getNumArgument() = 1 and
// `String.prototype.search` returns a number, so exclude chained accesses
not exists(PropAccess p | p.getBase() = mce)
)
)
}