Skip to content

Commit 1189414

Browse files
committed
remove regular expression that did nothing
1 parent 79e161e commit 1189414

File tree

1 file changed

+1
-3
lines changed

1 file changed

+1
-3
lines changed

javascript/ql/lib/semmle/javascript/security/dataflow/UnsafeShellCommandConstructionCustomizations.qll

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -92,9 +92,7 @@ module UnsafeShellCommandConstruction {
9292
StringConcatEndingInCommandExecutionSink() {
9393
this = root.getALeaf() and
9494
root = isExecutedAsShellCommand(DataFlow::TypeBackTracker::end(), sys) and
95-
exists(string prev | prev = this.getPreviousLeaf().getStringValue() |
96-
prev.regexpMatch(".*\\s*('|\")?[0-9a-zA-Z/:_-]*")
97-
)
95+
exists(this.getPreviousLeaf().getStringValue()) // looks like a shell command construction that could be done safer, it has a known prefix
9896
}
9997

10098
override string getSinkType() { result = "string concatenation" }

0 commit comments

Comments
 (0)