Skip to content

Commit 179ea04

Browse files
committed
Rust: Merge query implementation into one file
1 parent 494f914 commit 179ea04

File tree

2 files changed

+26
-32
lines changed

2 files changed

+26
-32
lines changed

rust/ql/lib/codeql/rust/security/regex/RegexInjectionQuery.qll

Lines changed: 0 additions & 31 deletions
This file was deleted.

rust/ql/src/queries/security/CWE-730/RegexInjection.ql

Lines changed: 26 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,32 @@
1111
* external/cwe/cwe-400
1212
*/
1313

14-
private import codeql.rust.security.regex.RegexInjectionQuery
14+
private import rust
15+
private import codeql.rust.dataflow.DataFlow
16+
private import codeql.rust.dataflow.TaintTracking
17+
private import codeql.rust.Concepts
18+
private import codeql.rust.security.regex.RegexInjectionExtensions
19+
20+
/**
21+
* A taint configuration for detecting regular expression injection vulnerabilities.
22+
*/
23+
module RegexInjectionConfig implements DataFlow::ConfigSig {
24+
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelSource }
25+
26+
predicate isSink(DataFlow::Node sink) { sink instanceof RegexInjectionSink }
27+
28+
predicate isBarrier(DataFlow::Node barrier) { barrier instanceof RegexInjectionBarrier }
29+
30+
predicate isAdditionalFlowStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
31+
any(RegexInjectionAdditionalFlowStep s).step(nodeFrom, nodeTo)
32+
}
33+
}
34+
35+
/**
36+
* Detect taint flow of tainted data that reaches a regular expression sink.
37+
*/
38+
module RegexInjectionFlow = TaintTracking::Global<RegexInjectionConfig>;
39+
1540
private import RegexInjectionFlow::PathGraph
1641

1742
from RegexInjectionFlow::PathNode sourceNode, RegexInjectionFlow::PathNode sinkNode

0 commit comments

Comments
 (0)