hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-21 11:16:30 +01:00
Code Issues Packages Projects Releases Wiki Activity

change name to suggestion from previous code review

Browse Source
This commit is contained in:
Erik Krogh Kristensen
2020-02-28 09:55:15 +01:00
parent 922779e049
commit d8a96dd771
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
javascript/ql/src/semmle/javascript/security/UselessUseOfCat.qll
View File

@@ -105,7 +105,7 @@ class UselessCat extends CommandCall {
getArgument(0).mayHaveStringValue(getACatExecuteable()) getArgument(0).mayHaveStringValue(getACatExecuteable())
) and ) and
// wildcards, pipes, redirections, other bash features, and multiple files (spaces) are OK. // wildcards, pipes, redirections, other bash features, and multiple files (spaces) are OK.
not containsNonTrivialBashChar(getNonCommandConstantString()) and not containsNonTrivialShellChar(getNonCommandConstantString()) and
// Only acceptable option is "encoding", everything else is non-trivial to emulate with fs.readFile. // Only acceptable option is "encoding", everything else is non-trivial to emulate with fs.readFile.
( (
not exists(getOptionsArg()) not exists(getOptionsArg())
@@ -174,7 +174,7 @@ module PrettyPrintCatCall {
) and ) and
fileArg = createFileArgument(cat).trim() and fileArg = createFileArgument(cat).trim() and
// sanity check in case of surprising `toString` results, other uses of `containsNonTrivialBashChar` should ensure that this conjunct will hold most of the time // sanity check in case of surprising `toString` results, other uses of `containsNonTrivialBashChar` should ensure that this conjunct will hold most of the time
not(containsNonTrivialBashChar(fileArg.regexpReplaceAll("\\$|\\`| ", ""))) // string concat might contain " ", template strings might contain "$" or `, and that is OK. not(containsNonTrivialShellChar(fileArg.regexpReplaceAll("\\$|\\`| ", ""))) // string concat might contain " ", template strings might contain "$" or `, and that is OK.
| |
result = result =
"fs.readFile" + sync + "(" + fileArg + extraArg + callback + ")" "fs.readFile" + sync + "(" + fileArg + extraArg + callback + ")"