File tree Expand file tree Collapse file tree 1 file changed +10
-6
lines changed
csharp/ql/lib/semmle/code/csharp/security/dataflow Expand file tree Collapse file tree 1 file changed +10
-6
lines changed Original file line number Diff line number Diff line change @@ -115,17 +115,21 @@ class HttpServerTransferSink extends Sink {
115
115
}
116
116
}
117
117
118
- private predicate isLocalUrlSanitizer ( Guard g , Expr e , AbstractValue v ) {
119
- (
120
- g . ( MethodCall ) . getTarget ( ) .hasName ( "IsLocalUrl" ) and
121
- e = g . ( MethodCall ) .getArgument ( 0 )
118
+ private predicate isLocalUrlSanitizerMethodCall ( MethodCall guard , Expr e , AbstractValue v ) {
119
+ exists ( Method m | m = guard . getTarget ( ) |
120
+ m .hasName ( "IsLocalUrl" ) and
121
+ e = guard .getArgument ( 0 )
122
122
or
123
- g . ( MethodCall ) . getTarget ( ) .hasName ( "IsUrlLocalToHost" ) and
124
- e = g . ( MethodCall ) .getArgument ( 1 )
123
+ m .hasName ( "IsUrlLocalToHost" ) and
124
+ e = guard .getArgument ( 1 )
125
125
) and
126
126
v .( AbstractValues:: BooleanValue ) .getValue ( ) = true
127
127
}
128
128
129
+ private predicate isLocalUrlSanitizer ( Guard g , Expr e , AbstractValue v ) {
130
+ isLocalUrlSanitizerMethodCall ( g , e , v )
131
+ }
132
+
129
133
/**
130
134
* A URL argument to a call to `UrlHelper.IsLocalUrl()` or `HttpRequestBase.IsUrlLocalToHost()` that
131
135
* is a sanitizer for URL redirects.
You can’t perform that action at this time.
0 commit comments