mirror of
https://github.com/github/codeql.git
synced 2025-12-17 17:23:36 +01:00
Remove @Input() decorated members as remote sources, in favour of a later Threat Model
This commit is contained in:
@@ -184,39 +184,3 @@ private class ExternalRemoteFlowSource extends RemoteFlowSource {
|
||||
|
||||
override string getSourceType() { result = ap.getSourceType() }
|
||||
}
|
||||
|
||||
/**
|
||||
* An Angular @Input() decorator on a member declaration.
|
||||
*/
|
||||
class InputMember extends MemberDeclaration {
|
||||
InputMember() {
|
||||
exists(Decorator decorator, Expr expr |
|
||||
decorator.getElement() = this and
|
||||
decorator.getExpression() = expr and
|
||||
expr.(CallExpr).getCallee().(VarRef).getName() = "Input"
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A use of an Angular @Input() member, modeled as `InputMember`.
|
||||
*/
|
||||
class InputMemberUse extends DataFlow::Node {
|
||||
InputMemberUse() {
|
||||
exists(InputMember member, string memberName, ThisExpr ta, FieldAccess fa |
|
||||
memberName = member.getName() and
|
||||
fa.getBase() = ta and
|
||||
fa.getPropertyName() = memberName and
|
||||
this.asExpr() = fa
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A remote flow source that is a member of an Angular component class.
|
||||
*/
|
||||
private class AngularInputUse extends RemoteFlowSource, InputMemberUse {
|
||||
AngularInputUse() { this = this }
|
||||
|
||||
override string getSourceType() { result = "Angular @Input()" }
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user