hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-01-29 22:32:58 +01:00
Code Issues Packages Projects Releases Wiki Activity

Apply suggestions from code review

Browse Source 
Co-authored-by: Chris Smowton <smowton@github.com>
This commit is contained in:
Slavomir
2021-04-01 15:50:25 +03:00
committed by Chris Smowton
parent 1a9b09e8bd
commit dc95902e56
2 changed files with 4 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
ql/src/experimental/CWE-79/HTMLTemplateEscapingPassthrough.qhelp
View File

@@ -8,7 +8,7 @@
that allow values to be rendered as-is in the template, avoiding the escaping that all the other strings go
through.
</p>
<p>Using them on user-provided values will result in an XSS.</p>
<p>Using them on user-provided values will result in an opportunity for XSS.</p>
</overview>
<recommendation>
<p>

8
ql/src/experimental/CWE-79/HTMLTemplateEscapingPassthrough.ql
View File

@@ -42,10 +42,9 @@ class PassthroughTypeName extends string {
* output of the templates.
*/
class FlowConfFromUntrustedToPassthroughTypeConversion extends TaintTracking::Configuration {
string dstTypeName;
PassthroughTypeName dstTypeName;
FlowConfFromUntrustedToPassthroughTypeConversion() {
dstTypeName instanceof PassthroughTypeName and
this = "UntrustedToConversion" + dstTypeName
}
@@ -105,11 +104,10 @@ class FlowConfPassthroughTypeConversionToTemplateExecutionCall extends TaintTrac
isSourceConversionToPassthroughType(source, _)
}
private predicate isSourceConversionToPassthroughType(DataFlow::TypeCastNode source, string name) {
private predicate isSourceConversionToPassthroughType(DataFlow::TypeCastNode source, PassthroughTypeName name) {
exists(Type typ |
typ = source.getResultType() and
typ.getUnderlyingType*().hasQualifiedName("html/template", name) and
name instanceof PassthroughTypeName
typ.getUnderlyingType*().hasQualifiedName("html/template", name)
)
}