hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-13 18:59:27 +02:00
Code Issues Packages Projects Releases Wiki Activity

JS: Fix flow through +=

Browse Source
This commit is contained in:
Asger F
2019-04-05 13:55:48 +01:00
parent 15fa4f8b7a
commit e55330b820
7 changed files with 55 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
javascript/ql/src/semmle/javascript/StringConcatenation.qll
View File

@@ -10,7 +10,7 @@ module StringConcatenation {
result = expr.flow()
or
exists(SsaExplicitDefinition def | def.getDef() = expr |
result = DataFlow::valueNode(def.getVariable().getAUse())
result = DataFlow::ssaDefinitionNode(def)
)
}

4
javascript/ql/src/semmle/javascript/dataflow/TaintTracking.qll
View File

@@ -366,7 +366,9 @@ module TaintTracking {
* Note that since we cannot easily distinguish string append from addition,
* we consider any `+` operation to propagate taint.
*/
class StringConcatenationTaintStep extends AdditionalTaintStep, DataFlow::ValueNode {
class StringConcatenationTaintStep extends AdditionalTaintStep {
StringConcatenationTaintStep() { StringConcatenation::taintStep(_, this) }
override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
succ = this and
StringConcatenation::taintStep(pred, succ)