add express.csrf as an CSRF protecting middleware

2026-04-28 18:25:24 +02:00 · 2020-10-19 15:39:02 +02:00
parent 27a2cd310d
commit ce95676130
2 changed files with 19 additions and 0 deletions
--- a/javascript/ql/src/Security/CWE-352/MissingCsrfMiddleware.ql
+++ b/javascript/ql/src/Security/CWE-352/MissingCsrfMiddleware.ql
@@ -94,6 +94,8 @@ DataFlow::CallNode csrfMiddlewareCreation() {
    exists(result.getOptionArgument(0, "csrf"))
    or
    callee = DataFlow::moduleMember("lusca", "csrf")
+    or
+    callee = DataFlow::moduleMember("express", "csrf")
  )
 }