Skip to content

Commit 23b18ae

Browse files
NapalysNapalys
committed
JS: Now unknown flags are not flagged in taint paths
1 parent eca7a88 commit 23b18ae

File tree

3 files changed

+1
-84
lines changed

3 files changed

+1
-84
lines changed

‎javascript/ql/lib/semmle/javascript/security/dataflow/TaintedPathCustomizations.qll

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -223,7 +223,7 @@ module TaintedPath {
223223
output = this and
224224
not exists(DataFlow::RegExpCreationNode regexp, RegExpTerm term |
225225
this.(StringReplaceCall).getRegExp() = regexp and
226-
this.(StringReplaceCall).isGlobal() and
226+
this.(StringReplaceCall).maybeGlobal() and
227227
regexp.getRoot() = term
228228
|
229229
term.getAMatchedString() = "/" or

‎javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/Consistency.expected

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +0,0 @@
1-
| TaintedPath.js:207 | did not expect an alert, but found an alert for TaintedPath | OK -- Might be okay depending on what unknownFlags evaluates to. | |

‎javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/TaintedPath.expected

Lines changed: 0 additions & 82 deletions
Original file line numberDiff line numberDiff line change
@@ -1619,39 +1619,6 @@ nodes
16191619
| TaintedPath.js:206:29:206:85 | path.re ... '), '') |
16201620
| TaintedPath.js:206:29:206:85 | path.re ... '), '') |
16211621
| TaintedPath.js:206:29:206:85 | path.re ... '), '') |
1622-
| TaintedPath.js:207:29:207:32 | path |
1623-
| TaintedPath.js:207:29:207:32 | path |
1624-
| TaintedPath.js:207:29:207:32 | path |
1625-
| TaintedPath.js:207:29:207:32 | path |
1626-
| TaintedPath.js:207:29:207:32 | path |
1627-
| TaintedPath.js:207:29:207:32 | path |
1628-
| TaintedPath.js:207:29:207:32 | path |
1629-
| TaintedPath.js:207:29:207:32 | path |
1630-
| TaintedPath.js:207:29:207:32 | path |
1631-
| TaintedPath.js:207:29:207:32 | path |
1632-
| TaintedPath.js:207:29:207:32 | path |
1633-
| TaintedPath.js:207:29:207:32 | path |
1634-
| TaintedPath.js:207:29:207:32 | path |
1635-
| TaintedPath.js:207:29:207:32 | path |
1636-
| TaintedPath.js:207:29:207:32 | path |
1637-
| TaintedPath.js:207:29:207:32 | path |
1638-
| TaintedPath.js:207:29:207:97 | path.re ... )), '') |
1639-
| TaintedPath.js:207:29:207:97 | path.re ... )), '') |
1640-
| TaintedPath.js:207:29:207:97 | path.re ... )), '') |
1641-
| TaintedPath.js:207:29:207:97 | path.re ... )), '') |
1642-
| TaintedPath.js:207:29:207:97 | path.re ... )), '') |
1643-
| TaintedPath.js:207:29:207:97 | path.re ... )), '') |
1644-
| TaintedPath.js:207:29:207:97 | path.re ... )), '') |
1645-
| TaintedPath.js:207:29:207:97 | path.re ... )), '') |
1646-
| TaintedPath.js:207:29:207:97 | path.re ... )), '') |
1647-
| TaintedPath.js:207:29:207:97 | path.re ... )), '') |
1648-
| TaintedPath.js:207:29:207:97 | path.re ... )), '') |
1649-
| TaintedPath.js:207:29:207:97 | path.re ... )), '') |
1650-
| TaintedPath.js:207:29:207:97 | path.re ... )), '') |
1651-
| TaintedPath.js:207:29:207:97 | path.re ... )), '') |
1652-
| TaintedPath.js:207:29:207:97 | path.re ... )), '') |
1653-
| TaintedPath.js:207:29:207:97 | path.re ... )), '') |
1654-
| TaintedPath.js:207:29:207:97 | path.re ... )), '') |
16551622
| examples/TaintedPath.js:8:7:8:52 | filePath |
16561623
| examples/TaintedPath.js:8:7:8:52 | filePath |
16571624
| examples/TaintedPath.js:8:7:8:52 | filePath |
@@ -6831,22 +6798,6 @@ edges
68316798
| TaintedPath.js:202:7:202:48 | path | TaintedPath.js:206:29:206:32 | path |
68326799
| TaintedPath.js:202:7:202:48 | path | TaintedPath.js:206:29:206:32 | path |
68336800
| TaintedPath.js:202:7:202:48 | path | TaintedPath.js:206:29:206:32 | path |
6834-
| TaintedPath.js:202:7:202:48 | path | TaintedPath.js:207:29:207:32 | path |
6835-
| TaintedPath.js:202:7:202:48 | path | TaintedPath.js:207:29:207:32 | path |
6836-
| TaintedPath.js:202:7:202:48 | path | TaintedPath.js:207:29:207:32 | path |
6837-
| TaintedPath.js:202:7:202:48 | path | TaintedPath.js:207:29:207:32 | path |
6838-
| TaintedPath.js:202:7:202:48 | path | TaintedPath.js:207:29:207:32 | path |
6839-
| TaintedPath.js:202:7:202:48 | path | TaintedPath.js:207:29:207:32 | path |
6840-
| TaintedPath.js:202:7:202:48 | path | TaintedPath.js:207:29:207:32 | path |
6841-
| TaintedPath.js:202:7:202:48 | path | TaintedPath.js:207:29:207:32 | path |
6842-
| TaintedPath.js:202:7:202:48 | path | TaintedPath.js:207:29:207:32 | path |
6843-
| TaintedPath.js:202:7:202:48 | path | TaintedPath.js:207:29:207:32 | path |
6844-
| TaintedPath.js:202:7:202:48 | path | TaintedPath.js:207:29:207:32 | path |
6845-
| TaintedPath.js:202:7:202:48 | path | TaintedPath.js:207:29:207:32 | path |
6846-
| TaintedPath.js:202:7:202:48 | path | TaintedPath.js:207:29:207:32 | path |
6847-
| TaintedPath.js:202:7:202:48 | path | TaintedPath.js:207:29:207:32 | path |
6848-
| TaintedPath.js:202:7:202:48 | path | TaintedPath.js:207:29:207:32 | path |
6849-
| TaintedPath.js:202:7:202:48 | path | TaintedPath.js:207:29:207:32 | path |
68506801
| TaintedPath.js:202:14:202:37 | url.par ... , true) | TaintedPath.js:202:14:202:43 | url.par ... ).query |
68516802
| TaintedPath.js:202:14:202:37 | url.par ... , true) | TaintedPath.js:202:14:202:43 | url.par ... ).query |
68526803
| TaintedPath.js:202:14:202:37 | url.par ... , true) | TaintedPath.js:202:14:202:43 | url.par ... ).query |
@@ -6959,38 +6910,6 @@ edges
69596910
| TaintedPath.js:206:29:206:32 | path | TaintedPath.js:206:29:206:85 | path.re ... '), '') |
69606911
| TaintedPath.js:206:29:206:32 | path | TaintedPath.js:206:29:206:85 | path.re ... '), '') |
69616912
| TaintedPath.js:206:29:206:32 | path | TaintedPath.js:206:29:206:85 | path.re ... '), '') |
6962-
| TaintedPath.js:207:29:207:32 | path | TaintedPath.js:207:29:207:97 | path.re ... )), '') |
6963-
| TaintedPath.js:207:29:207:32 | path | TaintedPath.js:207:29:207:97 | path.re ... )), '') |
6964-
| TaintedPath.js:207:29:207:32 | path | TaintedPath.js:207:29:207:97 | path.re ... )), '') |
6965-
| TaintedPath.js:207:29:207:32 | path | TaintedPath.js:207:29:207:97 | path.re ... )), '') |
6966-
| TaintedPath.js:207:29:207:32 | path | TaintedPath.js:207:29:207:97 | path.re ... )), '') |
6967-
| TaintedPath.js:207:29:207:32 | path | TaintedPath.js:207:29:207:97 | path.re ... )), '') |
6968-
| TaintedPath.js:207:29:207:32 | path | TaintedPath.js:207:29:207:97 | path.re ... )), '') |
6969-
| TaintedPath.js:207:29:207:32 | path | TaintedPath.js:207:29:207:97 | path.re ... )), '') |
6970-
| TaintedPath.js:207:29:207:32 | path | TaintedPath.js:207:29:207:97 | path.re ... )), '') |
6971-
| TaintedPath.js:207:29:207:32 | path | TaintedPath.js:207:29:207:97 | path.re ... )), '') |
6972-
| TaintedPath.js:207:29:207:32 | path | TaintedPath.js:207:29:207:97 | path.re ... )), '') |
6973-
| TaintedPath.js:207:29:207:32 | path | TaintedPath.js:207:29:207:97 | path.re ... )), '') |
6974-
| TaintedPath.js:207:29:207:32 | path | TaintedPath.js:207:29:207:97 | path.re ... )), '') |
6975-
| TaintedPath.js:207:29:207:32 | path | TaintedPath.js:207:29:207:97 | path.re ... )), '') |
6976-
| TaintedPath.js:207:29:207:32 | path | TaintedPath.js:207:29:207:97 | path.re ... )), '') |
6977-
| TaintedPath.js:207:29:207:32 | path | TaintedPath.js:207:29:207:97 | path.re ... )), '') |
6978-
| TaintedPath.js:207:29:207:32 | path | TaintedPath.js:207:29:207:97 | path.re ... )), '') |
6979-
| TaintedPath.js:207:29:207:32 | path | TaintedPath.js:207:29:207:97 | path.re ... )), '') |
6980-
| TaintedPath.js:207:29:207:32 | path | TaintedPath.js:207:29:207:97 | path.re ... )), '') |
6981-
| TaintedPath.js:207:29:207:32 | path | TaintedPath.js:207:29:207:97 | path.re ... )), '') |
6982-
| TaintedPath.js:207:29:207:32 | path | TaintedPath.js:207:29:207:97 | path.re ... )), '') |
6983-
| TaintedPath.js:207:29:207:32 | path | TaintedPath.js:207:29:207:97 | path.re ... )), '') |
6984-
| TaintedPath.js:207:29:207:32 | path | TaintedPath.js:207:29:207:97 | path.re ... )), '') |
6985-
| TaintedPath.js:207:29:207:32 | path | TaintedPath.js:207:29:207:97 | path.re ... )), '') |
6986-
| TaintedPath.js:207:29:207:32 | path | TaintedPath.js:207:29:207:97 | path.re ... )), '') |
6987-
| TaintedPath.js:207:29:207:32 | path | TaintedPath.js:207:29:207:97 | path.re ... )), '') |
6988-
| TaintedPath.js:207:29:207:32 | path | TaintedPath.js:207:29:207:97 | path.re ... )), '') |
6989-
| TaintedPath.js:207:29:207:32 | path | TaintedPath.js:207:29:207:97 | path.re ... )), '') |
6990-
| TaintedPath.js:207:29:207:32 | path | TaintedPath.js:207:29:207:97 | path.re ... )), '') |
6991-
| TaintedPath.js:207:29:207:32 | path | TaintedPath.js:207:29:207:97 | path.re ... )), '') |
6992-
| TaintedPath.js:207:29:207:32 | path | TaintedPath.js:207:29:207:97 | path.re ... )), '') |
6993-
| TaintedPath.js:207:29:207:32 | path | TaintedPath.js:207:29:207:97 | path.re ... )), '') |
69946913
| examples/TaintedPath.js:8:7:8:52 | filePath | examples/TaintedPath.js:11:36:11:43 | filePath |
69956914
| examples/TaintedPath.js:8:7:8:52 | filePath | examples/TaintedPath.js:11:36:11:43 | filePath |
69966915
| examples/TaintedPath.js:8:7:8:52 | filePath | examples/TaintedPath.js:11:36:11:43 | filePath |
@@ -10811,7 +10730,6 @@ edges
1081110730
| TaintedPath.js:197:45:197:48 | path | TaintedPath.js:195:24:195:30 | req.url | TaintedPath.js:197:45:197:48 | path | This path depends on a $@. | TaintedPath.js:195:24:195:30 | req.url | user-provided value |
1081210731
| TaintedPath.js:198:35:198:38 | path | TaintedPath.js:195:24:195:30 | req.url | TaintedPath.js:198:35:198:38 | path | This path depends on a $@. | TaintedPath.js:195:24:195:30 | req.url | user-provided value |
1081310732
| TaintedPath.js:206:29:206:85 | path.re ... '), '') | TaintedPath.js:202:24:202:30 | req.url | TaintedPath.js:206:29:206:85 | path.re ... '), '') | This path depends on a $@. | TaintedPath.js:202:24:202:30 | req.url | user-provided value |
10814-
| TaintedPath.js:207:29:207:97 | path.re ... )), '') | TaintedPath.js:202:24:202:30 | req.url | TaintedPath.js:207:29:207:97 | path.re ... )), '') | This path depends on a $@. | TaintedPath.js:202:24:202:30 | req.url | user-provided value |
1081510733
| examples/TaintedPath.js:11:29:11:43 | ROOT + filePath | examples/TaintedPath.js:8:28:8:34 | req.url | examples/TaintedPath.js:11:29:11:43 | ROOT + filePath | This path depends on a $@. | examples/TaintedPath.js:8:28:8:34 | req.url | user-provided value |
1081610734
| express.js:8:20:8:32 | req.query.bar | express.js:8:20:8:32 | req.query.bar | express.js:8:20:8:32 | req.query.bar | This path depends on a $@. | express.js:8:20:8:32 | req.query.bar | user-provided value |
1081710735
| handlebars.js:11:32:11:39 | filePath | handlebars.js:29:46:29:60 | req.params.path | handlebars.js:11:32:11:39 | filePath | This path depends on a $@. | handlebars.js:29:46:29:60 | req.params.path | user-provided value |

0 commit comments

Comments
 (0)