Skip to content

Commit 97c27ac

Browse files
committed
revert SqlInjection.ql changes
1 parent 58f4cd7 commit 97c27ac

File tree

2 files changed

+3
-4
lines changed

2 files changed

+3
-4
lines changed

javascript/ql/lib/semmle/javascript/security/dataflow/SqlInjectionQuery.qll

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,6 @@
99

1010
import javascript
1111
import SqlInjectionCustomizations::SqlInjection
12-
import semmle.javascript.frameworks.TypeORM
1312

1413
/**
1514
* A taint-tracking configuration for reasoning about string based query injection vulnerabilities.
@@ -19,7 +18,7 @@ class Configuration extends TaintTracking::Configuration {
1918

2019
override predicate isSource(DataFlow::Node source) { source instanceof Source }
2120

22-
override predicate isSink(DataFlow::Node sink) { sink instanceof TypeOrm::QueryString }
21+
override predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
2322

2423
override predicate isSanitizer(DataFlow::Node node) {
2524
super.isSanitizer(node) or

javascript/ql/src/Security/CWE-089/SqlInjection.ql

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,8 +22,8 @@ from DataFlow::Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode
2222
where
2323
(
2424
cfg instanceof SqlInjection::Configuration and type = "string"
25-
// or
26-
// cfg instanceof NosqlInjection::Configuration and type = "object"
25+
or
26+
cfg instanceof NosqlInjection::Configuration and type = "object"
2727
) and
2828
cfg.hasFlowPath(source, sink)
2929
select sink.getNode(), source, sink, "This query " + type + " depends on a $@.", source.getNode(),

0 commit comments

Comments
 (0)