hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-21 03:06:31 +01:00
Code Issues Packages Projects Releases Wiki Activity

autoformat

Browse Source
This commit is contained in:
Erik Krogh Kristensen
2020-03-26 19:55:31 +01:00
parent baf50c832c
commit be11418c77
2 changed files with 9 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
javascript/ql/src/semmle/javascript/Arrays.qll
View File

@@ -8,7 +8,8 @@ module ArrayTaintTracking {
/** /**
* A taint propagating data flow edge caused by the builtin array functions. * A taint propagating data flow edge caused by the builtin array functions.
*/ */
private class ArrayFunctionTaintStep extends TaintTracking::AdditionalTaintStep, DataFlow::CallNode { private class ArrayFunctionTaintStep extends TaintTracking::AdditionalTaintStep,
DataFlow::CallNode {
ArrayFunctionTaintStep() { arrayFunctionTaintStep(_, _, this) } ArrayFunctionTaintStep() { arrayFunctionTaintStep(_, _, this) }
override predicate step(DataFlow::Node pred, DataFlow::Node succ) { override predicate step(DataFlow::Node pred, DataFlow::Node succ) {

16
javascript/ql/src/semmle/javascript/dataflow/TaintTracking.qll
View File

@@ -229,18 +229,16 @@ module TaintTracking {
* promises. * promises.
*/ */
private class HeapTaintStep extends AdditionalTaintStep { private class HeapTaintStep extends AdditionalTaintStep {
HeapTaintStep() { HeapTaintStep() { heapStep(_, this) }
heapStep(_, this)
}
override predicate step(DataFlow::Node pred, DataFlow::Node succ) { override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
heapStep(pred, succ) and succ = this heapStep(pred, succ) and succ = this
} }
} }
/** /**
* Holds if there is taint propagation through the heap from `pred` to `succ`. * Holds if there is taint propagation through the heap from `pred` to `succ`.
*/ */
private predicate heapStep(DataFlow::Node pred, DataFlow::Node succ) { private predicate heapStep(DataFlow::Node pred, DataFlow::Node succ) {
exists(Expr e, Expr f | e = succ.asExpr() and f = pred.asExpr() | exists(Expr e, Expr f | e = succ.asExpr() and f = pred.asExpr() |
// arrays with tainted elements and objects with tainted property names are tainted // arrays with tainted elements and objects with tainted property names are tainted
@@ -398,9 +396,9 @@ module TaintTracking {
} }
} }
/** /**
* Holds if taint can propagate from `pred` to `succ` with a step related to string manipulation. * Holds if taint can propagate from `pred` to `succ` with a step related to string manipulation.
*/ */
private predicate stringManipulationStep(DataFlow::Node pred, DataFlow::ValueNode succ) { private predicate stringManipulationStep(DataFlow::Node pred, DataFlow::ValueNode succ) {
// string operations that propagate taint // string operations that propagate taint
exists(string name | name = succ.getAstNode().(MethodCallExpr).getMethodName() | exists(string name | name = succ.getAstNode().(MethodCallExpr).getMethodName() |