hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-26 01:05:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

JS: Handle default 'content-type' header in Response() objects

Browse Source
This commit is contained in:
Asger F
2025-11-26 13:29:43 +01:00
parent 0414555e43
commit cc7bf4e880
4 changed files with 20 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
javascript/ql/lib/semmle/javascript/frameworks/WebResponse.qll
View File

@@ -45,6 +45,10 @@ private class ResponseArgumentHeaders extends Http::HeaderDefinition {
ResponseArgumentHeaders() {
headerNode = response.getParameter(1).getMember("headers") and
this = headerNode.asSink()
or
not exists(response.getParameter(1).getMember("headers")) and
headerNode = API::root() and // just bind 'headerNode' to something
this = response
}
ResponseCall getResponse() { result = response }
@@ -80,9 +84,14 @@ private class ResponseArgumentHeaders extends Http::HeaderDefinition {
override predicate defines(string headerName, string headerValue) {
this.getHeaderNode(headerName).getAValueReachingSink().getStringValue() = headerValue
or
// If no 'content-type' header is defined, a default one is sent in the HTTP response.
not exists(this.getHeaderNode("content-type")) and
headerName = "content-type" and
headerValue = "text/plain;charset=utf-8"
}
override string getAHeaderName() { exists(this.getHeaderNode(result)) }
override string getAHeaderName() { exists(this.getHeaderNode(result)) or result = "content-type" }
override Http::RouteHandler getRouteHandler() { none() }
}