File tree Expand file tree Collapse file tree 1 file changed +3
-2
lines changed
ruby/ql/src/experimental/decompression-api Expand file tree Collapse file tree 1 file changed +3
-2
lines changed Original file line number Diff line number Diff line change @@ -19,7 +19,7 @@ import DataFlow::PathGraph
19
19
class DecompressionApiUse extends DataFlow:: Node {
20
20
private DataFlow:: CallNode call ;
21
21
22
- // this should find the first argument of Zlib::Inflate.inflate
22
+ // this should find the first argument in calls to Zlib::Inflate.inflate or Zip::File.open_buffer
23
23
DecompressionApiUse ( ) {
24
24
this = call .getArgument ( 0 ) and
25
25
(
@@ -28,6 +28,7 @@ class DecompressionApiUse extends DataFlow::Node {
28
28
)
29
29
}
30
30
31
+ // returns calls to Zlib::Inflate.inflate or Zip::File.open_buffer
31
32
DataFlow:: CallNode getCall ( ) { result = call }
32
33
}
33
34
@@ -37,7 +38,7 @@ class Configuration extends TaintTracking::Configuration {
37
38
// this predicate will be used to constrain our query to find instances where only remote user-controlled data flows to the sink
38
39
override predicate isSource ( DataFlow:: Node source ) { source instanceof RemoteFlowSource }
39
40
40
- // our Decompression APIs defined above will the the sinks we use for this query
41
+ // our Decompression APIs defined above will be the sinks we use for this query
41
42
override predicate isSink ( DataFlow:: Node sink ) {
42
43
sink instanceof DecompressionApiUse
43
44
}
You can’t perform that action at this time.
0 commit comments