|
1 | 1 | import javascript
|
2 | 2 |
|
3 |
| -class CheckPathSanitizerGuard extends TaintTracking::SanitizerGuardNode, DataFlow::CallNode { |
| 3 | +class CheckPathSanitizerGuard extends DataFlow::CallNode { |
4 | 4 | CheckPathSanitizerGuard() { this.getCalleeName() = "checkPath" }
|
5 | 5 |
|
6 |
| - override predicate sanitizes(boolean outcome, Expr e) { |
| 6 | + predicate blocksExpr(boolean outcome, Expr e) { |
7 | 7 | outcome = true and
|
8 | 8 | e = this.getArgument(0).asExpr()
|
9 | 9 | }
|
10 | 10 | }
|
11 | 11 |
|
12 |
| -class CommandLineFileNameConfiguration extends TaintTracking::Configuration { |
13 |
| - CommandLineFileNameConfiguration() { this = "CommandLineFileNameConfiguration" } |
14 |
| - |
15 |
| - override predicate isSource(DataFlow::Node source) { |
| 12 | +module CommandLineFileNameConfig implements DataFlow::ConfigSig { |
| 13 | + predicate isSource(DataFlow::Node source) { |
16 | 14 | DataFlow::globalVarRef("process").getAPropertyRead("argv").getAPropertyRead() = source
|
17 | 15 | }
|
18 | 16 |
|
19 |
| - override predicate isSink(DataFlow::Node sink) { |
| 17 | + predicate isSink(DataFlow::Node sink) { |
20 | 18 | DataFlow::moduleMember("fs", "readFile").getACall().getArgument(0) = sink
|
21 | 19 | }
|
22 | 20 |
|
23 |
| - override predicate isSanitizerGuard(TaintTracking::SanitizerGuardNode nd) { |
24 |
| - nd instanceof CheckPathSanitizerGuard |
| 21 | + predicate isBarrier(DataFlow::Node node) { |
| 22 | + node = DataFlow::MakeBarrierGuard<CheckPathSanitizerGuard>::getABarrierNode() |
25 | 23 | }
|
26 | 24 | }
|
27 | 25 |
|
28 |
| -from CommandLineFileNameConfiguration cfg, DataFlow::Node source, DataFlow::Node sink |
29 |
| -where cfg.hasFlow(source, sink) |
| 26 | +module CommandLineFileNameFlow = TaintTracking::Global<CommandLineFileNameConfig>; |
| 27 | + |
| 28 | +from DataFlow::Node source, DataFlow::Node sink |
| 29 | +where CommandLineFileNameFlow::flow(source, sink) |
30 | 30 | select source, sink
|
0 commit comments