hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-21 15:05:56 +02:00
Code Issues Packages Projects Releases Wiki Activity

JS: Fix the spurious flow

Browse Source
This commit is contained in:
Asger F
2025-02-12 11:53:34 +01:00
parent c051b4c98d
commit cf33db78cc
2 changed files with 5 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
javascript/ql/lib/semmle/javascript/frameworks/SQL.qll
View File

@@ -221,7 +221,10 @@ private module Postgres {
/** Gets a value that is plugged into a raw placeholder variable, making it a sink for SQL injection. */
private DataFlow::Node getARawValue() {
result = this.getValues() and this.getARawParameterName() = "1" // Special case: if the argument is not an array or object, it's just plugged into $1
result = this.getValues() and
this.getARawParameterName() = "1" and // Special case: if the argument is not an array or object, it's just plugged into $1
not result instanceof DataFlow::ArrayCreationNode and
not result instanceof DataFlow::ObjectLiteralNode
or
exists(DataFlow::SourceNode values | values = this.getValues().getALocalSource() |
result = values.getAPropertyWrite(this.getARawParameterName()).getRhs()

2
javascript/ql/test/query-tests/Security/CWE-089/untyped/pg-promise.js
View File

@@ -39,7 +39,7 @@ require('express')().get('/foo', (req, res) => {
req.params.id, // $ Alert
req.params.name, // $ Alert
req.params.foo, // OK - not using raw interpolation
] // $ SPURIOUS: Alert - implicit reads causes flow here in addition to the individual array elements
]
});
db.one({
text: 'SELECT * FROM news where id = ${id}:raw AND name = ${name}',