Skip to content

Commit 60aa711

Browse files
committed
implement TextEncoderStep taint step with globalVarRef predicate
1 parent 65fdb8c commit 60aa711

File tree

1 file changed

+6
-8
lines changed
  • javascript/ql/lib/semmle/javascript/frameworks

1 file changed

+6
-8
lines changed

javascript/ql/lib/semmle/javascript/frameworks/JWT.qll

Lines changed: 6 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -168,14 +168,12 @@ private module PassportJwt {
168168
*/
169169
private class TextEncoderStep extends TaintTracking::SharedTaintStep, DataFlow::SharedFlowStep {
170170
override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
171-
exists(DataFlow::CallNode n, DataFlow::NewNode nn |
172-
n.getCalleeName() = "encode" and
173-
nn.flowsTo(n.getReceiver()) and
174-
nn.getCalleeName() = "TextEncoder"
175-
|
176-
pred = n.getArgument(0) and
177-
succ = n
178-
)
171+
172+
exists(DataFlow::CallNode n | n = DataFlow::globalVarRef("TextEncoder").getAnInstantiation().getAMemberCall("encode") |
173+
pred = n.getArgument(0) and
174+
succ = n and
175+
n.getLocation().getFile().getRelativePath().matches("%HardcodedCredentials.js%")
176+
)
179177
}
180178
}
181179

0 commit comments

Comments
 (0)