File tree Expand file tree Collapse file tree 2 files changed +9
-10
lines changed
javascript/ql/src/semmle/javascript Expand file tree Collapse file tree 2 files changed +9
-10
lines changed Original file line number Diff line number Diff line change @@ -8,7 +8,8 @@ module ArrayTaintTracking {
8
8
/**
9
9
* A taint propagating data flow edge caused by the builtin array functions.
10
10
*/
11
- private class ArrayFunctionTaintStep extends TaintTracking:: AdditionalTaintStep , DataFlow:: CallNode {
11
+ private class ArrayFunctionTaintStep extends TaintTracking:: AdditionalTaintStep ,
12
+ DataFlow:: CallNode {
12
13
ArrayFunctionTaintStep ( ) { arrayFunctionTaintStep ( _, _, this ) }
13
14
14
15
override predicate step ( DataFlow:: Node pred , DataFlow:: Node succ ) {
Original file line number Diff line number Diff line change @@ -229,18 +229,16 @@ module TaintTracking {
229
229
* promises.
230
230
*/
231
231
private class HeapTaintStep extends AdditionalTaintStep {
232
- HeapTaintStep ( ) {
233
- heapStep ( _, this )
234
- }
232
+ HeapTaintStep ( ) { heapStep ( _, this ) }
235
233
236
234
override predicate step ( DataFlow:: Node pred , DataFlow:: Node succ ) {
237
235
heapStep ( pred , succ ) and succ = this
238
236
}
239
237
}
240
238
241
- /**
242
- * Holds if there is taint propagation through the heap from `pred` to `succ`.
243
- */
239
+ /**
240
+ * Holds if there is taint propagation through the heap from `pred` to `succ`.
241
+ */
244
242
private predicate heapStep ( DataFlow:: Node pred , DataFlow:: Node succ ) {
245
243
exists ( Expr e , Expr f | e = succ .asExpr ( ) and f = pred .asExpr ( ) |
246
244
// arrays with tainted elements and objects with tainted property names are tainted
@@ -398,9 +396,9 @@ module TaintTracking {
398
396
}
399
397
}
400
398
401
- /**
402
- * Holds if taint can propagate from `pred` to `succ` with a step related to string manipulation.
403
- */
399
+ /**
400
+ * Holds if taint can propagate from `pred` to `succ` with a step related to string manipulation.
401
+ */
404
402
private predicate stringManipulationStep ( DataFlow:: Node pred , DataFlow:: ValueNode succ ) {
405
403
// string operations that propagate taint
406
404
exists ( string name | name = succ .getAstNode ( ) .( MethodCallExpr ) .getMethodName ( ) |
You can’t perform that action at this time.
0 commit comments