From c756bdbc30548ffae4158d26f3d88fa05ef440c1 Mon Sep 17 00:00:00 2001 From: Ed Minnix Date: Wed, 12 Apr 2023 20:39:18 -0400 Subject: [PATCH] Fix naming in SensitiveCookieNotHttpOnly --- .../Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql b/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql index 358450c6ea6..6a49279d3dc 100644 --- a/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql +++ b/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql @@ -126,7 +126,7 @@ predicate isTestMethod(MethodAccess ma) { * A taint configuration tracking flow of a method that sets the `HttpOnly` flag, * or one that removes a cookie, to a `ServletResponse.addCookie` call. */ -module SetHttpOnlyOrRemovesCookieConfiguration implements DataFlow::ConfigSig { +module SetHttpOnlyOrRemovesCookieConfig implements DataFlow::ConfigSig { predicate isSource(DataFlow::Node source) { source.asExpr() = any(MethodAccess ma | setsCookieHttpOnly(ma) or removesCookie(ma)).getQualifier() @@ -138,8 +138,7 @@ module SetHttpOnlyOrRemovesCookieConfiguration implements DataFlow::ConfigSig { } } -module SetHttpOnlyOrRemovesCookieFlow = - TaintTracking::Global; +module SetHttpOnlyOrRemovesCookieFlow = TaintTracking::Global; /** * A cookie that is added to an HTTP response and which doesn't have `httpOnly` set, used as a sink