hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-06-03 04:40:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

change ATM to Atm for StoredXss and XssThroughDom configs

Browse Source
This commit is contained in:
tombolton
2022-04-26 16:22:17 +01:00
parent 0f00bb6e39
commit fc71c6142f
4 changed files with 12 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
javascript/ql/experimental/adaptivethreatmodeling/lib/experimental/adaptivethreatmodeling/StoredXssATM.qll
View File

@@ -25,8 +25,8 @@ module SinkEndpointFilter {
}
}
class StoredXssATMConfig extends ATMConfig {
StoredXssATMConfig() { this = "StoredXssATMConfig" }
class StoredXssAtmConfig extends ATMConfig {
StoredXssAtmConfig() { this = "StoredXssAtmConfig" }
override predicate isKnownSource(DataFlow::Node source) { source instanceof Source }
@@ -43,12 +43,12 @@ class StoredXssATMConfig extends ATMConfig {
* A taint-tracking configuration for reasoning about XSS.
*/
class Configuration extends TaintTracking::Configuration {
Configuration() { this = "StoredXssATMConfig" }
Configuration() { this = "StoredXssAtmConfig" }
override predicate isSource(DataFlow::Node source) { source instanceof Source }
override predicate isSink(DataFlow::Node sink) {
(sink instanceof Sink or any(StoredXssATMConfig cfg).isEffectiveSink(sink))
(sink instanceof Sink or any(StoredXssAtmConfig cfg).isEffectiveSink(sink))
}
override predicate isSanitizer(DataFlow::Node node) {

8
javascript/ql/experimental/adaptivethreatmodeling/lib/experimental/adaptivethreatmodeling/XssThroughDomATM.qll
View File

@@ -29,8 +29,8 @@ module SinkEndpointFilter {
}
}
class XssThroughDOMATMConfig extends ATMConfig {
XssThroughDOMATMConfig() { this = "XssThroughDOMATMConfig" }
class XssThroughDomAtmConfig extends ATMConfig {
XssThroughDomAtmConfig() { this = "XssThroughDomAtmConfig" }
override predicate isKnownSource(DataFlow::Node source) { source instanceof Source }
@@ -47,12 +47,12 @@ class XssThroughDOMATMConfig extends ATMConfig {
* A taint-tracking configuration for reasoning about XSS through the DOM.
*/
class Configuration extends TaintTracking::Configuration {
Configuration() { this = "XssThroughDOMATMConfig" }
Configuration() { this = "XssThroughDomAtmConfig" }
override predicate isSource(DataFlow::Node source) { source instanceof Source }
override predicate isSink(DataFlow::Node sink) {
(sink instanceof DomBasedXss::Sink or any(XssThroughDOMATMConfig cfg).isEffectiveSink(sink))
(sink instanceof DomBasedXss::Sink or any(XssThroughDomAtmConfig cfg).isEffectiveSink(sink))
}
override predicate isSanitizer(DataFlow::Node node) {

4
javascript/ql/experimental/adaptivethreatmodeling/modelbuilding/extraction/ExtractEndpointData.qll
View File

@@ -31,13 +31,13 @@ AtmConfig getAtmCfg(Query query) {
or
query instanceof SqlInjectionQuery and result instanceof SqlInjectionATM::SqlInjectionAtmConfig
or
query instanceof StoredXssQuery and result instanceof StoredXssATM::StoredXssATMConfig
query instanceof StoredXssQuery and result instanceof StoredXssATM::StoredXssAtmConfig
or
query instanceof TaintedPathQuery and result instanceof TaintedPathATM::TaintedPathATMConfig
or
query instanceof XssQuery and result instanceof XssATM::DomBasedXssATMConfig
or
query instanceof XssThroughDomQuery and result instanceof XssThroughDomATM::XssThroughDOMATMConfig
query instanceof XssThroughDomQuery and result instanceof XssThroughDomATM::XssThroughDomAtmConfig
}
/** DEPRECATED: Alias for getAtmCfg */

4
javascript/ql/experimental/adaptivethreatmodeling/modelbuilding/extraction/ExtractEndpointMapping.ql
View File

@@ -22,7 +22,7 @@ where
c instanceof SqlInjectionAtm::SqlInjectionAtmConfig
or
queryName = "StoredXssATM.ql" and
c instanceof StoredXssAtm::StoredXssATMConfig
c instanceof StoredXssAtm::StoredXssAtmConfig
or
queryName = "TaintedPathInjectionATM.ql" and
c instanceof TaintedPathAtm::TaintedPathAtmConfig
@@ -30,7 +30,7 @@ where
queryName = "XssATM.ql" and c instanceof XssAtm::DomBasedXssAtmConfig
or
queryName = "XssThroughDomATM.ql" and
c instanceof XssThroughDomAtm::XssThroughDOMATMConfig
c instanceof XssThroughDomAtm::XssThroughDomAtmConfig
) and
e = c.getASinkEndpointType()
select queryName, e.getEncoding() as endpointTypeEncoded