Skip to content

Commit 10498c3

Browse files
committed
treat jQuery as fully modelled
1 parent a1ee900 commit 10498c3

File tree

2 files changed

+11
-1
lines changed

2 files changed

+11
-1
lines changed

javascript/ql/experimental/adaptivethreatmodeling/lib/experimental/adaptivethreatmodeling/CoreKnowledge.qll

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -157,6 +157,9 @@ predicate isOtherModeledArgument(DataFlow::Node n, FilteringReason reason) {
157157
any(LodashUnderscore::Member m).getACall().getAnArgument() = n and
158158
reason instanceof LodashUnderscoreArgumentReason
159159
or
160+
any(JQuery::MethodCall m).getAnArgument() = n and
161+
reason instanceof JQueryArgumentReason
162+
or
160163
exists(ClientRequest r |
161164
r.getAnArgument() = n or n = r.getUrl() or n = r.getHost() or n = r.getADataNode()
162165
) and

javascript/ql/experimental/adaptivethreatmodeling/lib/experimental/adaptivethreatmodeling/FilteringReasons.qll

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,8 @@ newtype TFilteringReason =
3030
TArgumentToBuiltinGlobalVarRefReason() or
3131
TConstantReceiverReason() or
3232
TBuiltinCallNameReason() or
33-
TBase64ManipulationReason()
33+
TBase64ManipulationReason() or
34+
TJQueryArgumentReason()
3435

3536
/** A reason why a particular endpoint was filtered out by the endpoint filters. */
3637
abstract class FilteringReason extends TFilteringReason {
@@ -201,3 +202,9 @@ class Base64ManipulationReason extends NotASinkReason, TBase64ManipulationReason
201202

202203
override int getEncoding() { result = 28 }
203204
}
205+
206+
class JQueryArgumentReason extends NotASinkReason, TJQueryArgumentReason {
207+
override string getDescription() { result = "JQueryArgument" }
208+
209+
override int getEncoding() { result = 29 }
210+
}

0 commit comments

Comments
 (0)