From d998d06b942911cae3cdae9d5a21e65abe33dbf6 Mon Sep 17 00:00:00 2001 From: Erik Krogh Kristensen Date: Thu, 18 Mar 2021 13:37:18 +0100 Subject: [PATCH] add link to source in alert-message for js/shell-command-constructed-from-input --- .../src/Security/CWE-078/UnsafeShellCommandConstruction.ql | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/javascript/ql/src/Security/CWE-078/UnsafeShellCommandConstruction.ql b/javascript/ql/src/Security/CWE-078/UnsafeShellCommandConstruction.ql index f5d5113634d..1b4d5523ba4 100644 --- a/javascript/ql/src/Security/CWE-078/UnsafeShellCommandConstruction.ql +++ b/javascript/ql/src/Security/CWE-078/UnsafeShellCommandConstruction.ql @@ -18,6 +18,6 @@ import DataFlow::PathGraph from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink, Sink sinkNode where cfg.hasFlowPath(source, sink) and sinkNode = sink.getNode() -select sinkNode.getAlertLocation(), source, sink, "$@ based on library input is later used in $@.", - sinkNode.getAlertLocation(), sinkNode.getSinkType(), sinkNode.getCommandExecution(), - "shell command" +select sinkNode.getAlertLocation(), source, sink, "$@ based on $@ is later used in $@.", + sinkNode.getAlertLocation(), sinkNode.getSinkType(), source.getNode(), "library input", + sinkNode.getCommandExecution(), "shell command"