mirror of
https://github.com/github/codeql.git
synced 2026-02-14 14:11:20 +01:00
5727b2a5f4
When constructing a path through a property write/read pair, we want to make sure that we only use value-preserving steps to track the base object. However, the value flowing in from the right-hand side of the assignment may have a different flow label (such as `taint()`), so we cannot use the normal `append` predicate to construct the composite path.
37 lines
1.0 KiB
Plaintext
37 lines
1.0 KiB
Plaintext
import javascript
|
|
|
|
class TestTaintTrackingConfiguration extends TaintTracking::Configuration {
|
|
TestTaintTrackingConfiguration() {
|
|
this = "TestTaintTrackingConfiguration"
|
|
}
|
|
|
|
override predicate isSource(DataFlow::Node src) {
|
|
exists (VariableDeclarator vd |
|
|
vd.getBindingPattern().(VarDecl).getName().matches("%source%") and
|
|
src.asExpr() = vd.getInit()
|
|
)
|
|
}
|
|
|
|
override predicate isSink(DataFlow::Node snk) {
|
|
exists (VariableDeclarator vd |
|
|
vd.getBindingPattern().(VarDecl).getName().matches("%sink%") and
|
|
snk.asExpr() = vd.getInit()
|
|
)
|
|
}
|
|
|
|
override predicate isSanitizer(DataFlow::Node src, DataFlow::Node snk) {
|
|
src = src and
|
|
snk.asExpr().(PropAccess).getPropertyName() = "notTracked"
|
|
or
|
|
exists (Function f |
|
|
f.getName().matches("%noReturnTracking%") and
|
|
src = f.getAReturnedExpr().flow() and
|
|
snk.(DataFlow::InvokeNode).getACallee() = f
|
|
)
|
|
}
|
|
}
|
|
|
|
from TestTaintTrackingConfiguration tttc, DataFlow::Node src, DataFlow::Node snk
|
|
where tttc.hasFlow(src, snk)
|
|
select src, snk
|