hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 19:26:02 +02:00
Code Issues Packages Projects Releases Wiki Activity

recognize more modelled database accesses

Browse Source
This commit is contained in:
Esben Sparre Andreasen
2021-12-10 14:54:59 +01:00
parent b0f6cf1491
commit cfd2dcffa0
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
javascript/ql/experimental/adaptivethreatmodeling/lib/experimental/adaptivethreatmodeling/CoreKnowledge.qll
View File

@@ -200,8 +200,9 @@ predicate isOtherModeledArgument(DataFlow::Node n, FilteringReason reason) {
or
call instanceof FileSystemAccess and reason instanceof FileSystemAccessReason
or
// TODO database accesses are less well defined than database query sinks, so this may cover unmodeled sinks
call instanceof DatabaseAccess and reason instanceof DatabaseAccessReason
// TODO database accesses are less well defined than database query sinks, so this may cover unmodeled sinks on existing database models
[call, call.getAMethodCall() /* command pattern where the query is built, and then exec'ed later */] instanceof DatabaseAccess and
reason instanceof DatabaseAccessReason
or
call = DOM::domValueRef() and reason instanceof DOMReason
or