Skip to content

Commit 02aa9c6

Browse files
committed
Optimize the sink and update qldoc
1 parent d4323a4 commit 02aa9c6

File tree

1 file changed

+11
-10
lines changed

1 file changed

+11
-10
lines changed

java/ql/src/experimental/Security/CWE/CWE-094/ScriptInjection.ql

Lines changed: 11 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -115,22 +115,23 @@ predicate definesRhinoClass(MethodAccess ma, Expr sink) {
115115

116116
/** A script injection sink. */
117117
class ScriptInjectionSink extends DataFlow::ExprNode {
118+
MethodAccess methodAccess;
119+
118120
ScriptInjectionSink() {
119-
isScriptArgument(_, this.getExpr()) or
120-
evaluatesRhinoExpression(_, this.getExpr()) or
121-
compilesScript(_, this.getExpr()) or
122-
definesRhinoClass(_, this.getExpr())
121+
isScriptArgument(methodAccess, this.getExpr()) or
122+
evaluatesRhinoExpression(methodAccess, this.getExpr()) or
123+
compilesScript(methodAccess, this.getExpr()) or
124+
definesRhinoClass(methodAccess, this.getExpr())
123125
}
124126

125127
/** An access to the method associated with this sink. */
126-
MethodAccess getMethodAccess() {
127-
isScriptArgument(result, this.getExpr()) or
128-
evaluatesRhinoExpression(result, this.getExpr()) or
129-
compilesScript(result, this.getExpr()) or
130-
definesRhinoClass(result, this.getExpr())
131-
}
128+
MethodAccess getMethodAccess() { result = methodAccess }
132129
}
133130

131+
/**
132+
* A taint tracking configuration that tracks flow from `RemoteFlowSource` to an argument
133+
* of a method call that executes injected script.
134+
*/
134135
class ScriptInjectionConfiguration extends TaintTracking::Configuration {
135136
ScriptInjectionConfiguration() { this = "ScriptInjectionConfiguration" }
136137

0 commit comments

Comments
 (0)