hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-21 23:14:03 +02:00
Code Issues Packages Projects Releases Wiki Activity

JS: Support Reflect.ownKeys

Browse Source
This commit is contained in:
Asger F
2019-11-21 12:03:22 +00:00
committed by Asger Feldthaus
parent 8af233307a
commit f7543aec95
3 changed files with 115 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
javascript/ql/src/Security/CWE-400/PrototypePollutionUtility.ql
View File

@@ -71,7 +71,7 @@ abstract class EnumeratedPropName extends DataFlow::Node {
}
/**
* Property enumeration through `for-in` for `Object.keys` or `Object.getOwnPropertyName`.
* Property enumeration through `for-in` for `Object.keys` or similar.
*/
class ForInEnumeratedPropName extends EnumeratedPropName {
DataFlow::Node object;
@@ -82,9 +82,13 @@ class ForInEnumeratedPropName extends EnumeratedPropName {
object = stmt.getIterationDomain().flow()
)
or
exists(CallNode call, string name |
call = globalVarRef("Object").getAMemberCall(name) and
(name = "keys" or name = "getOwnPropertyNames") and
exists(CallNode call |
call = globalVarRef("Object").getAMemberCall("keys")
or
call = globalVarRef("Object").getAMemberCall("getOwnPropertyNames")
or
call = globalVarRef("Reflect").getAMemberCall("ownKeys")
|
object = call.getArgument(0) and
this = getAnEnumeratedArrayElement(call)
)