Skip to content

Commit b09ed4b

Browse files
committed
JS: Update UnsafeJQueryPlugin
1 parent a1d8a05 commit b09ed4b

File tree

1 file changed

+3
-6
lines changed

1 file changed

+3
-6
lines changed

javascript/ql/lib/semmle/javascript/security/dataflow/UnsafeJQueryPluginQuery.qll

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -31,16 +31,13 @@ class Configuration extends TaintTracking::Configuration {
3131
aliasPropertyPresenceStep(src, sink)
3232
}
3333

34-
override predicate isSanitizerEdge(DataFlow::Node pred, DataFlow::Node succ) {
34+
override predicate isSanitizerOut(DataFlow::Node node) {
3535
// prefixing prevents forced html/css confusion:
3636
// prefixing through concatenation:
37-
StringConcatenation::taintStep(pred, succ, _, any(int i | i >= 1))
37+
StringConcatenation::taintStep(node, _, _, any(int i | i >= 1))
3838
or
3939
// prefixing through a poor-mans templating system:
40-
exists(StringReplaceCall replace |
41-
replace = succ and
42-
pred = replace.getRawReplacement()
43-
)
40+
node = any(StringReplaceCall call).getRawReplacement()
4441
}
4542

4643
override predicate isSanitizerGuard(TaintTracking::SanitizerGuardNode node) {

0 commit comments

Comments
 (0)