hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-16 16:53:25 +01:00
Code Issues Packages Projects Releases Wiki Activity

JS: Simplify config in PrototypePollutingFunction.ql.

Browse Source
This commit is contained in:
Anders Schack-Mulligen
2025-01-31 14:59:39 +01:00
parent e55130ebce
commit db1ed67e52
1 changed files with 13 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
javascript/ql/src/Security/CWE-915/PrototypePollutingFunction.ql
View File

@@ -251,25 +251,19 @@ module PropNameTrackingConfig implements DataFlow::StateConfigSig {
node = DataFlow::MakeStateBarrierGuard<FlowState, BarrierGuard>::getABarrierNode(state)
}
predicate isAdditionalFlowStep(
DataFlow::Node node1, FlowState state1, DataFlow::Node node2, FlowState state2
) {
exists(state1) and
state2 = state1 and
(
// Step through `p -> x[p]`
exists(DataFlow::PropRead read |
node1 = read.getPropertyNameExpr().flow() and
not read.(DynamicPropRead).hasDominatingAssignment() and
node2 = read
)
or
// Step through `x -> x[p]`
exists(DynamicPropRead read |
not read.hasDominatingAssignment() and
node1 = read.getBase() and
node2 = read
)
predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
// Step through `p -> x[p]`
exists(DataFlow::PropRead read |
node1 = read.getPropertyNameExpr().flow() and
not read.(DynamicPropRead).hasDominatingAssignment() and
node2 = read
)
or
// Step through `x -> x[p]`
exists(DynamicPropRead read |
not read.hasDominatingAssignment() and
node1 = read.getBase() and
node2 = read
)
}