mirror of
https://github.com/github/codeql.git
synced 2025-12-17 17:23:36 +01:00
2ba98da107
Angular template expressions cannot refer to global variables, any unqualified identifier is a reference to a property provided by the component. We extract them as implicitly declared local variables which the QL model can then connect with data flow steps.
23 lines
545 B
TypeScript
23 lines
545 B
TypeScript
import { Component } from "@angular/core";
|
|
import { DomSanitizer } from '@angular/platform-browser';
|
|
|
|
@Component({
|
|
selector: "source-component",
|
|
templateUrl: "./source.component.html"
|
|
})
|
|
export class Source {
|
|
taint: string;
|
|
taintedArray: string[];
|
|
safeArray: string[];
|
|
|
|
constructor(private sanitizer: DomSanitizer) {
|
|
this.taint = source();
|
|
this.taintedArray = [...source()];
|
|
this.safeArray = ['a', 'b'];
|
|
}
|
|
|
|
methodOnComponent(x) {
|
|
this.sanitizer.bypassSecurityTrustHtml(x);
|
|
}
|
|
}
|