hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-29 10:45:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

print the endpointExample in the alert-messsage, and only report one working example

Browse Source
This commit is contained in:
erik-krogh
2022-08-24 13:09:48 +02:00
parent 5e3cb08ed2
commit f1799ae3d2
2 changed files with 17 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
javascript/ql/src/Security/CWE-178/CaseSensitiveMiddlewarePath.ql
View File

@@ -116,7 +116,11 @@ predicate isMatchingCandidate(
exists(getCaseSensitiveBypassExample(getARoot(regexp))) and
ignorePrefix = true and
testWithGroups = false and
str = [getCaseSensitiveBypassExample(getARoot(regexp)), getAnEndpointExample(endPoint)]
str =
[
getCaseSensitiveBypassExample(getARoot(regexp)), getAnEndpointExample(endPoint),
toOtherCase(getAnEndpointExample(endPoint))
]
)
}
@@ -124,14 +128,17 @@ import RegexpMatching::RegexpMatching<isMatchingCandidate/4> as Matcher
from
DataFlow::RegExpCreationNode regexp, Routing::RouteSetup middleware, Routing::RouteSetup endpoint,
DataFlow::Node arg, string byPassExample, string endpointExample
DataFlow::Node arg, string byPassExample, string endpointExample, string byPassEndPoint
where
isCaseSensitiveMiddleware(middleware, regexp, arg) and
byPassExample = getCaseSensitiveBypassExample(getARoot(regexp)) and
isGuardedCaseInsensitiveEndpoint(endpoint, middleware) and
endpointExample = getAnEndpointExample(endpoint) and
Matcher::matches(regexp.getRoot(), endpointExample) and
not Matcher::matches(regexp.getRoot(), byPassExample)
// only report one example.
endpointExample =
min(string ex | ex = getAnEndpointExample(endpoint) and Matcher::matches(regexp.getRoot(), ex)) and
not Matcher::matches(regexp.getRoot(), byPassExample) and
byPassEndPoint = toOtherCase(endpointExample) and
not Matcher::matches(regexp.getRoot(), byPassEndPoint)
select arg,
"This route uses a case-sensitive path $@, but is guarding a case-insensitive path $@. A path such as '"
+ byPassExample + "' will bypass the middleware.", regexp, "pattern", endpoint, "here"
+ byPassEndPoint + "' will bypass the middleware.", regexp, "pattern", endpoint, "here"