mirror of
https://github.com/github/codeql.git
synced 2026-04-29 18:55:14 +02:00
change naming of StringSplitCall methods
This commit is contained in:
@@ -28,9 +28,9 @@ class DangerousScheme extends string {
|
||||
DataFlow::SourceNode schemeOf(DataFlow::Node url) {
|
||||
// url.split(":")[0]
|
||||
exists(StringSplitCall split |
|
||||
split.getSplitAt() = ":" and
|
||||
split.getSeparator() = ":" and
|
||||
result = split.getAnElementRead(0) and
|
||||
url = split.getUnsplit()
|
||||
url = split.getBaseString()
|
||||
)
|
||||
or
|
||||
// url.getScheme(), url.getProtocol(), getScheme(url), getProtocol(url)
|
||||
|
||||
@@ -23,8 +23,8 @@ import semmle.javascript.DynamicPropertyAccess
|
||||
*/
|
||||
class SplitCall extends StringSplitCall {
|
||||
SplitCall() {
|
||||
getSplitAt() = "." and
|
||||
getUnsplit() instanceof ParameterNode
|
||||
getSeparator() = "." and
|
||||
getBaseString() instanceof ParameterNode
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -170,9 +170,9 @@ class StringSplitCall extends DataFlow::MethodCallNode {
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets a the SourceNode for the string before it is split.
|
||||
* Gets the DataFlow::Node for the base string that is split.
|
||||
*/
|
||||
DataFlow::SourceNode getUnsplit() { result = getReceiver().getALocalSource() }
|
||||
DataFlow::Node getBaseString() { result = getReceiver() }
|
||||
|
||||
/**
|
||||
* Gets a read of the `i`th element from the split string.
|
||||
|
||||
@@ -98,8 +98,8 @@ module TaintedPath {
|
||||
)
|
||||
or
|
||||
// A `str.split()` call can either split into path elements (`str.split("/")`) or split by some other string.
|
||||
exists(StringSplitCall mcn | dst = mcn and mcn.getUnsplit() = src |
|
||||
if mcn.getSplitAt() = "/"
|
||||
exists(StringSplitCall mcn | dst = mcn and mcn.getBaseString() = src |
|
||||
if mcn.getSeparator() = "/"
|
||||
then
|
||||
srclabel.(Label::PosixPath).canContainDotDotSlash() and
|
||||
dstlabel instanceof Label::SplitPath
|
||||
|
||||
@@ -286,8 +286,8 @@ module DomBasedXss {
|
||||
|
||||
QueryPrefixSanitizer() {
|
||||
this = splitCall.getAnElementRead(0) and
|
||||
splitCall.getSplitAt() = "?" and
|
||||
splitCall.getUnsplit() = [DOM::locationRef(), DOM::locationRef().getAPropertyRead("href")]
|
||||
splitCall.getSeparator() = "?" and
|
||||
splitCall.getBaseString().getALocalSource() = [DOM::locationRef(), DOM::locationRef().getAPropertyRead("href")]
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user