hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-02 20:25:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

add domNode.innerHTML += sink as a DOM sink

Browse Source
This commit is contained in:
Erik Krogh Kristensen
2022-04-05 14:23:10 +02:00
committed by erik-krogh
parent 74a79f8622
commit e387ebaedd
4 changed files with 26 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
javascript/ql/lib/semmle/javascript/security/dataflow/DOM.qll
View File

@@ -208,7 +208,11 @@ class DomPropertyWrite extends DataFlow::Node instanceof DataFlow::PropWrite {
/**
* Gets the data flow node corresponding to the value being written.
*/
DataFlow::Node getRhs() { result = super.getRhs() }
DataFlow::Node getRhs() {
result = super.getRhs()
or
result = super.getWriteNode().(AssignAddExpr).getRhs().flow()
}
}
/**