Add additional Filter Methods

This commit is contained in:
Maiky
2023-07-27 23:04:55 +02:00
parent 3f36d3244b
commit f5e17d7d39
2 changed files with 17 additions and 2 deletions

View File

@@ -34,7 +34,16 @@ module NetLdap {
/** A call that constructs a LDAP query */
private class NetLdapFilter extends LdapConstruction::Range, DataFlow::CallNode {
NetLdapFilter() { this = any(ldap().getMember("Filter").getAMethodCall("eq")) }
NetLdapFilter() {
this =
any(ldap()
.getMember("Filter")
.getAMethodCall([
"begins", "bineq", "contains", "ends", "eq", "equals", "ex", "ge", "le", "ne",
"present"
])
)
}
override DataFlow::Node getQuery() { result = this.getArgument([0, 1]) }
}

View File

@@ -34,7 +34,13 @@ module LdapInjection {
exists(DataFlow::CallNode filterCall |
(
filterCall =
API::getTopLevelMember("Net").getMember("LDAP").getMember("Filter").getAMethodCall("eq") or
API::getTopLevelMember("Net")
.getMember("LDAP")
.getMember("Filter")
.getAMethodCall([
"begins", "bineq", "contains", "ends", "eq", "equals", "ex", "ge", "le", "ne",
"present"
]) or
filterCall.getMethodName() = "[]"
) and
n1 = filterCall.getArgument([0, 1]) and