Skip to content

Commit f1b0f1a

Browse files
Use shared filepath normalization libary
1 parent 7194113 commit f1b0f1a

File tree

1 file changed

+1
-42
lines changed

1 file changed

+1
-42
lines changed

csharp/ql/lib/semmle/code/csharp/security/dataflow/XSSFlowSteps.qll

Lines changed: 1 addition & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22

33
import csharp
44
private import codeql.util.Unit
5+
private import codeql.util.FilePath
56
private import semmle.code.csharp.frameworks.microsoft.AspNetCore
67

78
/**
@@ -179,45 +180,3 @@ private class RelativeViewCallFilepath extends NormalizableFilepath {
179180
/** Holds if this string is the `idx`th path that will be searched for the `vc` call. */
180181
predicate hasViewCallWithIndex(ViewCall vc, int idx) { vc = vc_ and idx = idx_ }
181182
}
182-
183-
// TODO: this could be a shared library
184-
/**
185-
* A filepath that should be normalized.
186-
* Extend to provide additional strings that should be normalized as filepaths.
187-
*/
188-
abstract private class NormalizableFilepath extends string {
189-
bindingset[this]
190-
NormalizableFilepath() { any() }
191-
192-
/** Gets the normalized filepath for this string; traversing `/../` paths. */
193-
string getNormalizedPath() {
194-
exists(string norm |
195-
norm = this.getNormalizedUpTo(0).regexpReplaceAll("/+$", "") and
196-
(if this.matches("/%") then result = "/" + norm else result = norm)
197-
)
198-
}
199-
200-
private string getComponent(int i) { result = this.splitAt("/", i) }
201-
202-
private int getNumComponents() { result = strictcount(int i | exists(this.getComponent(i))) }
203-
204-
private string getNormalizedUpTo(int i) {
205-
i in [0 .. this.getNumComponents()] and
206-
(
207-
i = this.getNumComponents() and
208-
result = ""
209-
or
210-
i < this.getNumComponents() and
211-
exists(string comp, string sofar |
212-
comp = this.getComponent(i) and sofar = this.getNormalizedUpTo(i + 1)
213-
|
214-
if comp = [".", ""]
215-
then result = sofar
216-
else
217-
if comp = ".." or not sofar.matches("../%")
218-
then result = comp + "/" + sofar
219-
else exists(string base | sofar = "../" + base | result = base)
220-
)
221-
)
222-
}
223-
}

0 commit comments

Comments
 (0)