@@ -85,7 +85,7 @@ predicate isScriptArgument(MethodAccess ma, Expr sink) {
85
85
/**
86
86
* Holds if a Rhino expression evaluation method is vulnerable to code injection.
87
87
*/
88
- predicate evaluateRhinoExpression ( MethodAccess ma , Expr sink ) {
88
+ predicate evaluatesRhinoExpression ( MethodAccess ma , Expr sink ) {
89
89
exists ( RhinoEvaluateExpressionMethod m | m = ma .getMethod ( ) |
90
90
(
91
91
if ma .getMethod ( ) .getName ( ) = "compileReader"
@@ -102,32 +102,32 @@ predicate evaluateRhinoExpression(MethodAccess ma, Expr sink) {
102
102
/**
103
103
* Holds if a Rhino expression compilation method is vulnerable to code injection.
104
104
*/
105
- predicate compileScript ( MethodAccess ma , Expr sink ) {
105
+ predicate compilesScript ( MethodAccess ma , Expr sink ) {
106
106
exists ( RhinoCompileClassMethod m | m = ma .getMethod ( ) | sink = ma .getArgument ( 0 ) )
107
107
}
108
108
109
109
/**
110
110
* Holds if a Rhino class loading method is vulnerable to code injection.
111
111
*/
112
- predicate defineClass ( MethodAccess ma , Expr sink ) {
112
+ predicate definesRhinoClass ( MethodAccess ma , Expr sink ) {
113
113
exists ( RhinoDefineClassMethod m | m = ma .getMethod ( ) | sink = ma .getArgument ( 1 ) )
114
114
}
115
115
116
116
/** A script injection sink. */
117
117
class ScriptInjectionSink extends DataFlow:: ExprNode {
118
118
ScriptInjectionSink ( ) {
119
119
isScriptArgument ( _, this .getExpr ( ) ) or
120
- evaluateRhinoExpression ( _, this .getExpr ( ) ) or
121
- compileScript ( _, this .getExpr ( ) ) or
122
- defineClass ( _, this .getExpr ( ) )
120
+ evaluatesRhinoExpression ( _, this .getExpr ( ) ) or
121
+ compilesScript ( _, this .getExpr ( ) ) or
122
+ definesRhinoClass ( _, this .getExpr ( ) )
123
123
}
124
124
125
125
/** An access to the method associated with this sink. */
126
126
MethodAccess getMethodAccess ( ) {
127
127
isScriptArgument ( result , this .getExpr ( ) ) or
128
- evaluateRhinoExpression ( result , this .getExpr ( ) ) or
129
- compileScript ( result , this .getExpr ( ) ) or
130
- defineClass ( result , this .getExpr ( ) )
128
+ evaluatesRhinoExpression ( result , this .getExpr ( ) ) or
129
+ compilesScript ( result , this .getExpr ( ) ) or
130
+ definesRhinoClass ( result , this .getExpr ( ) )
131
131
}
132
132
}
133
133
0 commit comments