hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-03 12:45:27 +02:00
Code Issues Packages Projects Releases Wiki Activity

move hasPathWithoutUnmatchedReturn to Configuration.qll

Browse Source
This commit is contained in:
Erik Krogh Kristensen
2021-05-10 10:55:09 +02:00
parent b4e35f54d9
commit d913668943
4 changed files with 13 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
javascript/ql/src/semmle/javascript/dataflow/Configuration.qll
View File

@@ -2068,3 +2068,14 @@ class VarAccessBarrier extends DataFlow::Node {
)
}
}
/**
* Holds if there is a path without unmatched return steps from `source` to `sink`.
*/
predicate hasPathWithoutUnmatchedReturn(SourcePathNode source, SinkPathNode sink) {
exists(MidPathNode mid |
source.getASuccessor*() = mid and
sink = mid.getASuccessor() and
mid.getPathSummary().hasReturn() = false
)
}

2
javascript/ql/src/semmle/javascript/security/dataflow/UnsafeHtmlConstruction.qll
View File

@@ -38,7 +38,7 @@ module UnsafeHtmlConstruction {
// override to require that there is a path without unmatched return steps
override predicate hasFlowPath(DataFlow::SourcePathNode source, DataFlow::SinkPathNode sink) {
super.hasFlowPath(source, sink) and
hasPathWithoutUnmatchedReturn(source, sink)
DataFlow::hasPathWithoutUnmatchedReturn(source, sink)
}
override predicate isAdditionalTaintStep(DataFlow::Node pred, DataFlow::Node succ) {

13
javascript/ql/src/semmle/javascript/security/dataflow/UnsafeHtmlConstructionCustomizations.qll
View File

@@ -174,17 +174,4 @@ module UnsafeHtmlConstruction {
override string describe() { result = "Markdown rendering" }
}
/**
* Holds if there is a path without unmatched return steps from `source` to `sink`.
*/
predicate hasPathWithoutUnmatchedReturn(
DataFlow::SourcePathNode source, DataFlow::SinkPathNode sink
) {
exists(DataFlow::MidPathNode mid |
source.getASuccessor*() = mid and
sink = mid.getASuccessor() and
mid.getPathSummary().hasReturn() = false
)
}
}

3
javascript/ql/src/semmle/javascript/security/dataflow/UnsafeShellCommandConstruction.qll
View File

@@ -14,7 +14,6 @@ import javascript
*/
module UnsafeShellCommandConstruction {
import UnsafeShellCommandConstructionCustomizations::UnsafeShellCommandConstruction
import UnsafeHtmlConstructionCustomizations
/**
* A taint-tracking configuration for reasoning about shell command constructed from library input vulnerabilities.
@@ -36,7 +35,7 @@ module UnsafeShellCommandConstruction {
// override to require that there is a path without unmatched return steps
override predicate hasFlowPath(DataFlow::SourcePathNode source, DataFlow::SinkPathNode sink) {
super.hasFlowPath(source, sink) and
UnsafeHtmlConstruction::requireMatchedReturn(source, sink)
DataFlow::hasPathWithoutUnmatchedReturn(source, sink)
}
override predicate isAdditionalTaintStep(DataFlow::Node pred, DataFlow::Node succ) {