Merge pull request #9825 from erik-krogh/repeatedWord

QL: add ql/repeated-word query
This commit is contained in:
Erik Krogh Kristensen
2022-08-10 07:25:26 +02:00
committed by GitHub
17 changed files with 62 additions and 18 deletions

View File

@@ -348,7 +348,7 @@ module ExprNodes {
/** Gets an argument of this call. */
final ExprCfgNode getAnArgument() { result = this.getArgument(_) }
/** Gets the the keyword argument whose key is `keyword` of this call. */
/** Gets the keyword argument whose key is `keyword` of this call. */
final ExprCfgNode getKeywordArgument(string keyword) {
exists(PairCfgNode n |
e.hasCfgChild(e.getAnArgument(), this, n) and

View File

@@ -79,7 +79,7 @@ class CallNode extends LocalSourceNode, ExprNode {
result.getExprNode() = node.getPositionalArgument(n)
}
/** Gets the name of the the method called by the method call (if any) corresponding to this data-flow node */
/** Gets the name of the method called by the method call (if any) corresponding to this data-flow node */
string getMethodName() { result = node.getExpr().(MethodCall).getMethodName() }
/** Gets the number of arguments of this call. */

View File

@@ -379,7 +379,7 @@ class GraphqlFieldResolutionMethod extends Method, HTTP::Server::RequestHandler:
result.(KeywordParameter).hasName(argDefn.getArgumentName())
or
// TODO this will cause false positives because now *anything* in the **args
// param will be flagged as as RoutedParameter/RemoteFlowSource, but really
// param will be flagged as RoutedParameter/RemoteFlowSource, but really
// only the hash keys corresponding to the defined arguments are user input
// others could be things defined in the `:extras` keyword argument to the `argument`
result instanceof HashSplatParameter // often you see `def field(**args)`