Skip to content

Commit e5afdc5

Browse files
committed
use HtmlSanitizerCall to recognize sanitizers
1 parent 3e3372b commit e5afdc5

File tree

1 file changed

+2
-4
lines changed
  • javascript/ql/src/semmle/javascript/security/dataflow

1 file changed

+2
-4
lines changed

javascript/ql/src/semmle/javascript/security/dataflow/Xss.qll

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -304,12 +304,10 @@ module DomBasedXss {
304304
private class UriEncodingSanitizer extends Sanitizer, Shared::UriEncodingSanitizer { }
305305

306306
/**
307-
* Holds if there exists two dataflow edges to `succ`, where one edges is sanitized, and the other edge starts with `pred`.
307+
* Holds if there exists two dataflow edges to `succ`, where one edges is sanitized, and the other edge starts with `pred`.
308308
*/
309309
predicate isOptionallySanitizedEdge(DataFlow::Node pred, DataFlow::Node succ) {
310-
exists(DataFlow::CallNode sanitizer |
311-
sanitizer.getCalleeName().regexpMatch("(?i).*sanitize.*")
312-
|
310+
exists(HtmlSanitizerCall sanitizer |
313311
// sanitized = sanitize ? sanitizer(source) : source;
314312
exists(ConditionalExpr branch, Variable var, VarAccess access |
315313
branch = succ.asExpr() and access = var.getAnAccess()

0 commit comments

Comments
 (0)