Update cpp/ql/src/Security/CWE/CWE-290/AuthenticationBypass.ql

geoffw0 · MathiasVP · web-flow · commit d628cc5ab815 · 2023-01-17T14:37:19.000Z
Co-authored-by: Mathias Vorreiter Pedersen &lt;mathiasvp@github.com&gt;
diff --git a/cpp/ql/src/Security/CWE/CWE-290/AuthenticationBypass.ql b/cpp/ql/src/Security/CWE/CWE-290/AuthenticationBypass.ql
@@ -32,7 +32,7 @@ predicate hardCodedAddressOrIP(StringLiteral txt) {
     s.regexpMatch("\"[0-9]+[.][0-9]+[.][0-9]+[.][0-9]+\"") or
     // Hard-coded addresses such as www.mycompany.com
     s.regexpMatch("\"(www\\.|http:|https:).*\"") or
-    s.regexpMatch("\".*\\.(" + concat(getATopLevelDomain(), "|") + ")\"")
+    s.regexpMatch("\".*\\.(" + strictconcat(getATopLevelDomain(), "|") + ")\"")
   )
 }
 

Original file line number	Diff line number	Diff line change
`@@ -32,7 +32,7 @@ predicate hardCodedAddressOrIP(StringLiteral txt) {`
`32`	`32`	`s.regexpMatch("\"[0-9]+[.][0-9]+[.][0-9]+[.][0-9]+\"") or`
`33`	`33`	`// Hard-coded addresses such as www.mycompany.com`
`34`	`34`	`s.regexpMatch("\"(www\\.\|http:\|https:).*\"") or`
`35`		`- s.regexpMatch("\".*\\.(" + concat(getATopLevelDomain(), "\|") + ")\"")`
	`35`	`+ s.regexpMatch("\".*\\.(" + strictconcat(getATopLevelDomain(), "\|") + ")\"")`
`36`	`36`	`)`
`37`	`37`	`}`
`38`	`38`