@@ -87,7 +87,7 @@ class HttpStringLiteral extends StringLiteral {
8787 HttpStringLiteral ( ) {
8888 // Match URLs with the HTTP protocol and without private IP addresses to reduce false positives.
8989 exists ( string s | this .getRepresentedString ( ) = s |
90- s .regexpMatch ( "(?i)http://[\\[: a-zA-Z0-9].*" ) and
90+ s .regexpMatch ( "(?i)http://[\\[a-zA-Z0-9].*" ) and
9191 not s .substring ( 7 , s .length ( ) ) .regexpMatch ( getPrivateHostRegex ( ) )
9292 )
9393 }
@@ -106,37 +106,33 @@ predicate concatHttpString(Expr protocol, Expr host) {
106106 .( CompileTimeConstantExpr )
107107 .getStringValue ( )
108108 .regexpMatch ( "(?i)http(://)?" )
109- ) and // Not empty host string
110- (
111- host .( CompileTimeConstantExpr ) .getStringValue ( ) .length ( ) > 0 or
112- host
113- .( VarAccess )
114- .getVariable ( )
115- .getAnAssignedValue ( )
116- .( CompileTimeConstantExpr )
117- .getStringValue ( )
118- .length ( ) > 0
119109 ) and
120- not (
121- host .( CompileTimeConstantExpr ) .getStringValue ( ) .regexpMatch ( getPrivateHostRegex ( ) ) or
122- host
123- .( VarAccess )
124- .getVariable ( )
125- .getAnAssignedValue ( )
126- .( CompileTimeConstantExpr )
127- .getStringValue ( )
128- .regexpMatch ( getPrivateHostRegex ( ) )
110+ not exists ( string hostString |
111+ hostString = host .( CompileTimeConstantExpr ) .getStringValue ( ) or
112+ hostString =
113+ host .( VarAccess ) .getVariable ( ) .getAnAssignedValue ( ) .( CompileTimeConstantExpr ) .getStringValue ( )
114+ |
115+ hostString .length ( ) = 0 or // Empty host is loopback address
116+ hostString .regexpMatch ( getPrivateHostRegex ( ) )
129117 )
130118}
131119
120+ /** Gets the leftmost operand in a concatenated string */
121+ Expr getLeftmostConcatOperand ( Expr expr ) {
122+ if expr instanceof AddExpr
123+ then result = getLeftmostConcatOperand ( expr .( AddExpr ) .getLeftOperand ( ) )
124+ else result = expr
125+ }
126+
132127/**
133128 * String concatenated with `HttpStringLiteral`.
134129 */
135130class HttpString extends Expr {
136131 HttpString ( ) {
137132 this instanceof HttpStringLiteral
138133 or
139- concatHttpString ( this .( AddExpr ) .getLeftOperand ( ) , this .( AddExpr ) .getRightOperand ( ) )
134+ concatHttpString ( this .( AddExpr ) .getLeftOperand ( ) ,
135+ getLeftmostConcatOperand ( this .( AddExpr ) .getRightOperand ( ) ) )
140136 }
141137}
142138
0 commit comments