@@ -115,22 +115,23 @@ predicate definesRhinoClass(MethodAccess ma, Expr sink) {
115
115
116
116
/** A script injection sink. */
117
117
class ScriptInjectionSink extends DataFlow:: ExprNode {
118
+ MethodAccess methodAccess ;
119
+
118
120
ScriptInjectionSink ( ) {
119
- isScriptArgument ( _ , this .getExpr ( ) ) or
120
- evaluatesRhinoExpression ( _ , this .getExpr ( ) ) or
121
- compilesScript ( _ , this .getExpr ( ) ) or
122
- definesRhinoClass ( _ , this .getExpr ( ) )
121
+ isScriptArgument ( methodAccess , this .getExpr ( ) ) or
122
+ evaluatesRhinoExpression ( methodAccess , this .getExpr ( ) ) or
123
+ compilesScript ( methodAccess , this .getExpr ( ) ) or
124
+ definesRhinoClass ( methodAccess , this .getExpr ( ) )
123
125
}
124
126
125
127
/** An access to the method associated with this sink. */
126
- MethodAccess getMethodAccess ( ) {
127
- isScriptArgument ( result , this .getExpr ( ) ) or
128
- evaluatesRhinoExpression ( result , this .getExpr ( ) ) or
129
- compilesScript ( result , this .getExpr ( ) ) or
130
- definesRhinoClass ( result , this .getExpr ( ) )
131
- }
128
+ MethodAccess getMethodAccess ( ) { result = methodAccess }
132
129
}
133
130
131
+ /**
132
+ * A taint tracking configuration that tracks flow from `RemoteFlowSource` to an argument
133
+ * of a method call that executes injected script.
134
+ */
134
135
class ScriptInjectionConfiguration extends TaintTracking:: Configuration {
135
136
ScriptInjectionConfiguration ( ) { this = "ScriptInjectionConfiguration" }
136
137
0 commit comments