Skip to content

Commit aae3e2d

Browse files
erik-krogherik-krogh
committed
other changes based on Esbens review
1 parent ff25451 commit aae3e2d

File tree

4 files changed

+36
-32
lines changed

4 files changed

+36
-32
lines changed

‎java/ql/lib/semmle/code/java/security/OverlyLargeRangeQuery.qll

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -75,13 +75,13 @@ predicate overlapsWithCharEscape(RegExpCharacterRange range, RegExpCharacterClas
7575
range.isRange(low, high)
7676
|
7777
escape.getValue() = "w" and
78-
inRange(low, high).regexpMatch("\\w")
78+
getInRange(low, high).regexpMatch("\\w")
7979
or
8080
escape.getValue() = "d" and
81-
inRange(low, high).regexpMatch("\\d")
81+
getInRange(low, high).regexpMatch("\\d")
8282
or
8383
escape.getValue() = "s" and
84-
inRange(low, high).regexpMatch("\\s")
84+
getInRange(low, high).regexpMatch("\\s")
8585
)
8686
}
8787

@@ -109,7 +109,7 @@ class OverlyWideRange extends RegExpCharacterRange {
109109
// any non-alpha numeric as part of the range
110110
not isAlphanumeric([low, high].toUnicode())
111111
) and
112-
// some cases I want to exclude from being flagged
112+
// allowlist for known ranges
113113
not this = allowedWideRanges()
114114
}
115115

@@ -125,16 +125,16 @@ RegExpCharacterRange allowedWideRanges() {
125125
// the same with " " and "!". " " is the first printable character, and "!" is the first non-white-space printable character.
126126
result.isRange([" ", "!"], _)
127127
or
128-
// I've seen this often enough, looks OK.
128+
// the `[@-_]` range is intentional
129129
result.isRange("@", "_")
130130
or
131131
// starting from the zero byte is a good indication that it's purposely matching a large range.
132132
result.isRange(0.toUnicode(), _)
133133
}
134134

135-
/** Gets all chars between (and including) `low` and `high`. */
135+
/** Gets a char between (and including) `low` and `high`. */
136136
bindingset[low, high]
137-
private string inRange(string low, string high) {
137+
private string getInRange(string low, string high) {
138138
result = [toCodePoint(low) .. toCodePoint(high)].toUnicode()
139139
}
140140

@@ -239,7 +239,8 @@ module RangePrinter {
239239
isAlphanumeric(high)
240240
then result = low + "-" + high
241241
else
242-
result = strictconcat(string char | char = inRange(low, high) | escape(char) order by char)
242+
result =
243+
strictconcat(string char | char = getInRange(low, high) | escape(char) order by char)
243244
)
244245
}
245246

‎javascript/ql/lib/semmle/javascript/security/OverlyLargeRangeQuery.qll

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -75,13 +75,13 @@ predicate overlapsWithCharEscape(RegExpCharacterRange range, RegExpCharacterClas
7575
range.isRange(low, high)
7676
|
7777
escape.getValue() = "w" and
78-
inRange(low, high).regexpMatch("\\w")
78+
getInRange(low, high).regexpMatch("\\w")
7979
or
8080
escape.getValue() = "d" and
81-
inRange(low, high).regexpMatch("\\d")
81+
getInRange(low, high).regexpMatch("\\d")
8282
or
8383
escape.getValue() = "s" and
84-
inRange(low, high).regexpMatch("\\s")
84+
getInRange(low, high).regexpMatch("\\s")
8585
)
8686
}
8787

@@ -109,7 +109,7 @@ class OverlyWideRange extends RegExpCharacterRange {
109109
// any non-alpha numeric as part of the range
110110
not isAlphanumeric([low, high].toUnicode())
111111
) and
112-
// some cases I want to exclude from being flagged
112+
// allowlist for known ranges
113113
not this = allowedWideRanges()
114114
}
115115

@@ -125,16 +125,16 @@ RegExpCharacterRange allowedWideRanges() {
125125
// the same with " " and "!". " " is the first printable character, and "!" is the first non-white-space printable character.
126126
result.isRange([" ", "!"], _)
127127
or
128-
// I've seen this often enough, looks OK.
128+
// the `[@-_]` range is intentional
129129
result.isRange("@", "_")
130130
or
131131
// starting from the zero byte is a good indication that it's purposely matching a large range.
132132
result.isRange(0.toUnicode(), _)
133133
}
134134

135-
/** Gets all chars between (and including) `low` and `high`. */
135+
/** Gets a char between (and including) `low` and `high`. */
136136
bindingset[low, high]
137-
private string inRange(string low, string high) {
137+
private string getInRange(string low, string high) {
138138
result = [toCodePoint(low) .. toCodePoint(high)].toUnicode()
139139
}
140140

@@ -239,7 +239,8 @@ module RangePrinter {
239239
isAlphanumeric(high)
240240
then result = low + "-" + high
241241
else
242-
result = strictconcat(string char | char = inRange(low, high) | escape(char) order by char)
242+
result =
243+
strictconcat(string char | char = getInRange(low, high) | escape(char) order by char)
243244
)
244245
}
245246

‎python/ql/lib/semmle/python/security/OverlyLargeRangeQuery.qll

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -75,13 +75,13 @@ predicate overlapsWithCharEscape(RegExpCharacterRange range, RegExpCharacterClas
7575
range.isRange(low, high)
7676
|
7777
escape.getValue() = "w" and
78-
inRange(low, high).regexpMatch("\\w")
78+
getInRange(low, high).regexpMatch("\\w")
7979
or
8080
escape.getValue() = "d" and
81-
inRange(low, high).regexpMatch("\\d")
81+
getInRange(low, high).regexpMatch("\\d")
8282
or
8383
escape.getValue() = "s" and
84-
inRange(low, high).regexpMatch("\\s")
84+
getInRange(low, high).regexpMatch("\\s")
8585
)
8686
}
8787

@@ -109,7 +109,7 @@ class OverlyWideRange extends RegExpCharacterRange {
109109
// any non-alpha numeric as part of the range
110110
not isAlphanumeric([low, high].toUnicode())
111111
) and
112-
// some cases I want to exclude from being flagged
112+
// allowlist for known ranges
113113
not this = allowedWideRanges()
114114
}
115115

@@ -125,16 +125,16 @@ RegExpCharacterRange allowedWideRanges() {
125125
// the same with " " and "!". " " is the first printable character, and "!" is the first non-white-space printable character.
126126
result.isRange([" ", "!"], _)
127127
or
128-
// I've seen this often enough, looks OK.
128+
// the `[@-_]` range is intentional
129129
result.isRange("@", "_")
130130
or
131131
// starting from the zero byte is a good indication that it's purposely matching a large range.
132132
result.isRange(0.toUnicode(), _)
133133
}
134134

135-
/** Gets all chars between (and including) `low` and `high`. */
135+
/** Gets a char between (and including) `low` and `high`. */
136136
bindingset[low, high]
137-
private string inRange(string low, string high) {
137+
private string getInRange(string low, string high) {
138138
result = [toCodePoint(low) .. toCodePoint(high)].toUnicode()
139139
}
140140

@@ -239,7 +239,8 @@ module RangePrinter {
239239
isAlphanumeric(high)
240240
then result = low + "-" + high
241241
else
242-
result = strictconcat(string char | char = inRange(low, high) | escape(char) order by char)
242+
result =
243+
strictconcat(string char | char = getInRange(low, high) | escape(char) order by char)
243244
)
244245
}
245246

‎ruby/ql/lib/codeql/ruby/security/OverlyLargeRangeQuery.qll

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -75,13 +75,13 @@ predicate overlapsWithCharEscape(RegExpCharacterRange range, RegExpCharacterClas
7575
range.isRange(low, high)
7676
|
7777
escape.getValue() = "w" and
78-
inRange(low, high).regexpMatch("\\w")
78+
getInRange(low, high).regexpMatch("\\w")
7979
or
8080
escape.getValue() = "d" and
81-
inRange(low, high).regexpMatch("\\d")
81+
getInRange(low, high).regexpMatch("\\d")
8282
or
8383
escape.getValue() = "s" and
84-
inRange(low, high).regexpMatch("\\s")
84+
getInRange(low, high).regexpMatch("\\s")
8585
)
8686
}
8787

@@ -109,7 +109,7 @@ class OverlyWideRange extends RegExpCharacterRange {
109109
// any non-alpha numeric as part of the range
110110
not isAlphanumeric([low, high].toUnicode())
111111
) and
112-
// some cases I want to exclude from being flagged
112+
// allowlist for known ranges
113113
not this = allowedWideRanges()
114114
}
115115

@@ -125,16 +125,16 @@ RegExpCharacterRange allowedWideRanges() {
125125
// the same with " " and "!". " " is the first printable character, and "!" is the first non-white-space printable character.
126126
result.isRange([" ", "!"], _)
127127
or
128-
// I've seen this often enough, looks OK.
128+
// the `[@-_]` range is intentional
129129
result.isRange("@", "_")
130130
or
131131
// starting from the zero byte is a good indication that it's purposely matching a large range.
132132
result.isRange(0.toUnicode(), _)
133133
}
134134

135-
/** Gets all chars between (and including) `low` and `high`. */
135+
/** Gets a char between (and including) `low` and `high`. */
136136
bindingset[low, high]
137-
private string inRange(string low, string high) {
137+
private string getInRange(string low, string high) {
138138
result = [toCodePoint(low) .. toCodePoint(high)].toUnicode()
139139
}
140140

@@ -239,7 +239,8 @@ module RangePrinter {
239239
isAlphanumeric(high)
240240
then result = low + "-" + high
241241
else
242-
result = strictconcat(string char | char = inRange(low, high) | escape(char) order by char)
242+
result =
243+
strictconcat(string char | char = getInRange(low, high) | escape(char) order by char)
243244
)
244245
}
245246

0 commit comments

Comments
 (0)