Update javascript/ql/src/experimental/Security/CWE-340/TokenBuiltFromUUID.ql

bananabr · erik-krogh · web-flow · commit f7ace6f801a1 · 2022-10-25T14:27:03.000-05:00
Co-authored-by: Erik Krogh Kristensen &lt;erik-krogh@github.com&gt;
diff --git a/javascript/ql/src/experimental/Security/CWE-340/TokenBuiltFromUUID.ql b/javascript/ql/src/experimental/Security/CWE-340/TokenBuiltFromUUID.ql
@@ -19,7 +19,7 @@ class PredictableResultSource extends DataFlow::Node {
   PredictableResultSource() {
     exists(API::Node uuidCallRet |
       uuidCallRet =
-        API::moduleImport("uuid").getMember(["v1", "v2", "v3", "v5"]).getACall().getReturn()
+        API::moduleImport("uuid").getMember(["v1", "v3", "v5"]).getACall().getReturn()
     |
       this = uuidCallRet.asSource()
     )

Original file line number	Diff line number	Diff line change
`@@ -19,7 +19,7 @@ class PredictableResultSource extends DataFlow::Node {`
`19`	`19`	`PredictableResultSource() {`
`20`	`20`	`exists(API::Node uuidCallRet \|`
`21`	`21`	`uuidCallRet =`
`22`		`- API::moduleImport("uuid").getMember(["v1", "v2", "v3", "v5"]).getACall().getReturn()`
	`22`	`+ API::moduleImport("uuid").getMember(["v1", "v3", "v5"]).getACall().getReturn()`
`23`	`23`	`\|`
`24`	`24`	`this = uuidCallRet.asSource()`
`25`	`25`	`)`