add "valid" to the AdHocWhitelistCheckSanitizer

2025-12-20 10:46:30 +01:00 · 2020-05-11 16:44:24 +02:00
parent 8d41ce1630
commit bb8905b46e
1 changed files with 2 additions and 1 deletions
--- a/javascript/ql/src/semmle/javascript/dataflow/TaintTracking.qll
+++ b/javascript/ql/src/semmle/javascript/dataflow/TaintTracking.qll
@@ -778,7 +778,8 @@ module TaintTracking {
   */
  class AdHocWhitelistCheckSanitizer extends SanitizerGuardNode, DataFlow::CallNode {
    AdHocWhitelistCheckSanitizer() {
-      getCalleeName().regexpMatch("(?i).*((?<!un)safe|whitelist|allow|(?<!un)auth(?!or\\b)).*") and
+      getCalleeName()
+          .regexpMatch("(?i).*((?<!un)safe|whitelist|valid|allow|(?<!un)auth(?!or\\b)).*") and
      getNumArgument() = 1
    }