Add property params to RequestInputAccess

2025-12-20 10:46:30 +01:00 · 2022-11-10 12:24:39 +01:00
parent 8e546e8496
commit ee02265ac2
1 changed files with 1 additions and 1 deletions
--- a/javascript/ql/lib/semmle/javascript/frameworks/Hapi.qll
+++ b/javascript/ql/lib/semmle/javascript/frameworks/Hapi.qll
@@ -134,7 +134,7 @@ module Hapi {
        kind = "parameter" and
        exists(DataFlow::PropRead query |
          // `request.query.name`
-          query.accesses(request, "query") and
+          query.accesses(request, ["query", "params"]) and
          this.(DataFlow::PropRead).accesses(query, _)
        )
        or