mirror of
https://github.com/github/codeql.git
synced 2026-04-19 14:04:09 +02:00
20 lines
655 B
Plaintext
20 lines
655 B
Plaintext
//
|
|
// Modern version of ReflectedXssWithCustomSanitizer_old.ql
|
|
//
|
|
import javascript
|
|
import semmle.javascript.security.dataflow.ReflectedXssQuery
|
|
private import semmle.javascript.security.dataflow.Xss::Shared as SharedXss
|
|
|
|
class IsVarNameSanitizer extends SharedXss::BarrierGuard, DataFlow::CallNode {
|
|
IsVarNameSanitizer() { this.getCalleeName() = "isVarName" }
|
|
|
|
override predicate blocksExpr(boolean outcome, Expr e) {
|
|
outcome = true and
|
|
e = this.getArgument(0).asExpr()
|
|
}
|
|
}
|
|
|
|
from Source source, Sink sink
|
|
where ReflectedXssFlow::flow(source, sink)
|
|
select sink, "Cross-site scripting vulnerability due to $@.", source, "user-provided value"
|