|
1 | 1 | import javascript |
2 | 2 |
|
3 | | -class CheckPathSanitizerGuard extends TaintTracking::SanitizerGuardNode, DataFlow::CallNode { |
| 3 | +class CheckPathSanitizerGuard extends DataFlow::CallNode { |
4 | 4 | CheckPathSanitizerGuard() { this.getCalleeName() = "checkPath" } |
5 | 5 |
|
6 | | - override predicate sanitizes(boolean outcome, Expr e) { |
| 6 | + predicate blocksExpr(boolean outcome, Expr e) { |
7 | 7 | outcome = true and |
8 | 8 | e = this.getArgument(0).asExpr() |
9 | 9 | } |
10 | 10 | } |
11 | 11 |
|
12 | | -class CommandLineFileNameConfiguration extends TaintTracking::Configuration { |
13 | | - CommandLineFileNameConfiguration() { this = "CommandLineFileNameConfiguration" } |
14 | | - |
15 | | - override predicate isSource(DataFlow::Node source) { |
| 12 | +module CommandLineFileNameConfig implements DataFlow::ConfigSig { |
| 13 | + predicate isSource(DataFlow::Node source) { |
16 | 14 | DataFlow::globalVarRef("process").getAPropertyRead("argv").getAPropertyRead() = source |
17 | 15 | } |
18 | 16 |
|
19 | | - override predicate isSink(DataFlow::Node sink) { |
| 17 | + predicate isSink(DataFlow::Node sink) { |
20 | 18 | DataFlow::moduleMember("fs", "readFile").getACall().getArgument(0) = sink |
21 | 19 | } |
22 | 20 |
|
23 | | - override predicate isSanitizerGuard(TaintTracking::SanitizerGuardNode nd) { |
24 | | - nd instanceof CheckPathSanitizerGuard |
| 21 | + predicate isBarrier(DataFlow::Node node) { |
| 22 | + node = DataFlow::MakeBarrierGuard<CheckPathSanitizerGuard>::getABarrierNode() |
25 | 23 | } |
26 | 24 | } |
27 | 25 |
|
28 | | -from CommandLineFileNameConfiguration cfg, DataFlow::Node source, DataFlow::Node sink |
29 | | -where cfg.hasFlow(source, sink) |
| 26 | +module CommandLineFileNameFlow = TaintTracking::Global<CommandLineFileNameConfig>; |
| 27 | + |
| 28 | +from DataFlow::Node source, DataFlow::Node sink |
| 29 | +where CommandLineFileNameFlow::flow(source, sink) |
30 | 30 | select source, sink |
0 commit comments