@@ -159,8 +159,8 @@ deprecated class BoolToGinSetCookieTrackingConfiguration extends DataFlow::Confi
159
159
exists ( DataFlow:: MethodCallNode mcn |
160
160
mcn .getTarget ( ) instanceof GinContextSetCookieMethod and
161
161
mcn .getArgument ( 6 ) = sink and
162
- exists ( DataFlow:: Node nameArg |
163
- NameToGinSetCookieTrackingFlow :: flowTo ( nameArg ) and
162
+ exists ( NameToGinSetCookieTrackingConfiguration cfg , DataFlow:: Node nameArg |
163
+ cfg . hasFlowTo ( nameArg ) and
164
164
mcn .getArgument ( 0 ) = nameArg
165
165
)
166
166
)
@@ -184,6 +184,25 @@ private module BoolToGinSetCookieTrackingConfig implements DataFlow::ConfigSig {
184
184
185
185
module BoolToGinSetCookieTrackingFlow = DataFlow:: Global< BoolToGinSetCookieTrackingConfig > ;
186
186
187
+ /**
188
+ * DEPRECATED: Use `NameToGinSetCookieTrackingConfig` instead.
189
+ *
190
+ * A taint-tracking configuration for tracking flow from sensitive names to
191
+ * `gin-gonic/gin.Context.SetCookie`.
192
+ */
193
+ deprecated private class NameToGinSetCookieTrackingConfiguration extends DataFlow2:: Configuration {
194
+ NameToGinSetCookieTrackingConfiguration ( ) { this = "NameToGinSetCookieTrackingConfiguration" }
195
+
196
+ override predicate isSource ( DataFlow:: Node source ) { isAuthVariable ( source .asExpr ( ) ) }
197
+
198
+ override predicate isSink ( DataFlow:: Node sink ) {
199
+ exists ( DataFlow:: MethodCallNode mcn |
200
+ mcn .getTarget ( ) instanceof GinContextSetCookieMethod and
201
+ mcn .getArgument ( 0 ) = sink
202
+ )
203
+ }
204
+ }
205
+
187
206
/**
188
207
* A taint-tracking configuration for tracking flow from sensitive names to
189
208
* `gin-gonic/gin.Context.SetCookie`.
0 commit comments