@@ -233,7 +233,7 @@ In this example, we'll show how to add the following SQL injection sink using a
233
233
conn.query(q, (err, rows) => {...}); // <-- add 'q' as a SQL injection sink
234
234
});
235
235
236
- We can recognize this using a fuzzy model, as showin in the following extension:
236
+ We can recognize this using a fuzzy model, as shown in the following extension:
237
237
238
238
.. code-block :: yaml
239
239
@@ -244,13 +244,13 @@ We can recognize this using a fuzzy model, as showin in the following extension:
244
244
data :
245
245
- ["mysql", "Fuzzy.Member[query].Argument[0]", "sql-injection"]
246
246
247
- - The first column, **"mysql" **, begins the search at at places where the `mysql ` package is imported.
247
+ - The first column, **"mysql" **, begins the search at places where the `mysql ` package is imported.
248
248
- **Fuzzy ** selects all objects that appear to originate from the `mysql ` package, such as the `pool `, `conn `, `err `, and `rows ` objects.
249
249
- **Member[query] ** selects the **query ** member from any of those objects. In this case, the only such member is `conn.query `.
250
250
In principle, this would also find expressions such as `pool.query ` and `err.query `, but in practice such expressions
251
251
are not likely to occur, because the `pool ` and `err ` objects do not have a member named `query `.
252
252
- **Argument[0] ** selects the first argument of a call to the selected member, that is, the `q ` argument to `conn.query `.
253
- - **sql-injection ** indicates that this is considered a sink for the SQL injection query.
253
+ - **sql-injection ** indicates that this is considered as a sink for the SQL injection query.
254
254
255
255
For reference, a more detailed model might look like this, as described in the preceding examples:
256
256
@@ -485,7 +485,7 @@ The following components are supported:
485
485
- **Awaited ** selects the value of a promise.
486
486
- **Instance ** selects instances of a class.
487
487
- **Fuzzy ** selects all values that are derived from the current value through a combination of the other operations described in this list.
488
- For example, this can be used to find all values the appear to originate from a particular package. This can be useful for finding method calls
488
+ For example, this can be used to find all values that appear to originate from a particular package. This can be useful for finding method calls
489
489
from a known package, but where the receiver type is not known or is difficult to model.
490
490
491
491
The following components are called "call site filters". They select a subset of the previously-selected calls, if the call fits certain criteria:
0 commit comments