Skip to content

Commit af19a03

Browse files
Sim4n6yoff
authored andcommitted
Fix UnicodeDoS vulnerability in CWE-770 code
1 parent 085d803 commit af19a03

File tree

1 file changed

+6
-6
lines changed

1 file changed

+6
-6
lines changed

python/ql/src/experimental/Security/CWE-770/UnicodeDoS.ql

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -61,15 +61,15 @@ predicate underAValue(DataFlow::GuardNode g, ControlFlowNode node, boolean branc
6161
branch = true and
6262
cn.operands(_, op_gt, n.asCfgNode())
6363
or
64-
// not arg <= LIMIT OR not arg < LIMIT
65-
(op_lt = any(LtE lte) or op_lt = any(Lt lt)) and
64+
// not arg >= LIMIT OR not arg > LIMIT
65+
(op_gt = any(GtE gte) or op_gt = any(Gt gt)) and
6666
branch = false and
67-
cn.operands(n.asCfgNode(), op_lt, _)
67+
cn.operands(n.asCfgNode(), op_gt, _)
6868
or
69-
// not LIMIT >= arg OR not LIMIT > arg
70-
(op_gt = any(GtE gte) or op_gt = any(Gt gt)) and
69+
// not LIMIT <= arg OR not LIMIT < arg
70+
(op_lt = any(LtE lte) or op_lt = any(Lt lt)) and
7171
branch = false and
72-
cn.operands(_, op_gt, n.asCfgNode())
72+
cn.operands(_, op_lt, n.asCfgNode())
7373
)
7474
|
7575
lenCall = API::builtin("len").getACall() and

0 commit comments

Comments
 (0)