JS: Use sanitizerIn in ExtenralAPIUsedWithUntrustedData

This commit is contained in:
Asger F
2023-07-11 14:50:29 +02:00
parent 094302a27b
commit e863e2376d

View File

@@ -46,15 +46,11 @@ class Configuration extends TaintTracking::Configuration {
)
}
override predicate isSanitizerEdge(DataFlow::Node pred, DataFlow::Node succ) {
override predicate isSanitizerIn(DataFlow::Node node) {
// Block flow from the location to its properties, as the relevant properties (hash and search) are taint sources of their own.
// The location source is only used for propagating through API calls like `new URL(location)` and into external APIs where
// the whole location object escapes.
exists(DataFlow::PropRead read |
read = DOM::locationRef().getAPropertyRead() and
pred = read.getBase() and
succ = read
)
node = DOM::locationRef().getAPropertyRead()
}
}