Modify Sanitizer

haby0 · haby0 · commit a17b0d4e5c84 · 2021-10-05T17:12:04.000+08:00
diff --git a/python/ql/src/experimental/Security/CWE-348/ClientSuppliedIpUsedInSecurityCheck.ql b/python/ql/src/experimental/Security/CWE-348/ClientSuppliedIpUsedInSecurityCheck.ql
@@ -39,10 +39,9 @@ class ClientSuppliedIpUsedInSecurityCheckConfig extends TaintTracking::Configura
 
   override predicate isSanitizer(DataFlow::Node node) {
     exists(Subscript ss |
-      not ss.getIndex().(IntegerLiteral).getText() = "0" and
       ss.getObject().(Call).getFunc().(Attribute).getName() = "split" and
-      ss.getObject().(Call).getArg(0).(StrConst).getText() = "," and
-      ss.getObject().(Call).getFunc().(Attribute).getObject() = node.asExpr()
+      ss.getObject().(Call).getAnArg().(StrConst).getText() = "," and
+      ss = node.asExpr()
     )
   }
 }

Original file line number	Diff line number	Diff line change
`@@ -39,10 +39,9 @@ class ClientSuppliedIpUsedInSecurityCheckConfig extends TaintTracking::Configura`
`39`	`39`
`40`	`40`	`override predicate isSanitizer(DataFlow::Node node) {`
`41`	`41`	`exists(Subscript ss \|`
`42`		`- not ss.getIndex().(IntegerLiteral).getText() = "0" and`
`43`	`42`	`ss.getObject().(Call).getFunc().(Attribute).getName() = "split" and`
`44`		`- ss.getObject().(Call).getArg(0).(StrConst).getText() = "," and`
`45`		`- ss.getObject().(Call).getFunc().(Attribute).getObject() = node.asExpr()`
	`43`	`+ ss.getObject().(Call).getAnArg().(StrConst).getText() = "," and`
	`44`	`+ ss = node.asExpr()`
`46`	`45`	`)`
`47`	`46`	`}`
`48`	`47`	`}`