mirror of
https://github.com/github/codeql.git
synced 2026-03-23 16:06:47 +01:00
28 lines
725 B
Plaintext
28 lines
725 B
Plaintext
//
|
|
// Modern version of ReflectedXssWithCustomSanitizer_old.ql
|
|
//
|
|
|
|
import javascript
|
|
import semmle.javascript.security.dataflow.ReflectedXss::ReflectedXss
|
|
|
|
class IsVarNameSanitizer extends TaintTracking::AdditionalSanitizerGuardNode, DataFlow::CallNode {
|
|
IsVarNameSanitizer() {
|
|
getCalleeName() = "isVarName"
|
|
}
|
|
|
|
override predicate sanitizes(boolean outcome, Expr e) {
|
|
outcome = true and
|
|
e = getArgument(0).asExpr()
|
|
}
|
|
|
|
override predicate appliesTo(TaintTracking::Configuration cfg) {
|
|
cfg instanceof Configuration
|
|
}
|
|
|
|
}
|
|
|
|
from Configuration xss, Source source, Sink sink
|
|
where xss.hasFlow(source, sink)
|
|
select sink, "Cross-site scripting vulnerability due to $@.",
|
|
source, "user-provided value"
|