hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-27 17:55:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1214 from asger-semmle/taint-addexpr-phi

Browse Source 
Approved by esben-semmle, xiemaisi
This commit is contained in:
semmle-qlci
2019-04-08 11:55:06 +01:00
committed by GitHub
parent 6e7ae8a0a9 e55330b820
commit f54366bf95
7 changed files with 55 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
javascript/ql/src/semmle/javascript/StringConcatenation.qll
View File

@@ -10,7 +10,7 @@ module StringConcatenation {
result = expr.flow()
or
exists(SsaExplicitDefinition def | def.getDef() = expr |
result = DataFlow::valueNode(def.getVariable().getAUse())
result = DataFlow::ssaDefinitionNode(def)
)
}

4
javascript/ql/src/semmle/javascript/dataflow/TaintTracking.qll
View File

@@ -366,7 +366,9 @@ module TaintTracking {
* Note that since we cannot easily distinguish string append from addition,
* we consider any `+` operation to propagate taint.
*/
class StringConcatenationTaintStep extends AdditionalTaintStep, DataFlow::ValueNode {
class StringConcatenationTaintStep extends AdditionalTaintStep {
StringConcatenationTaintStep() { StringConcatenation::taintStep(_, this) }
override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
succ = this and
StringConcatenation::taintStep(pred, succ)