Skip to content

Commit 503b339

Browse files
committed
remove hbs specific checks
1 parent d016ba2 commit 503b339

File tree

1 file changed

+1
-6
lines changed

1 file changed

+1
-6
lines changed

javascript/ql/src/experimental/Security/CWE-073/TemplateObjectInjection.ql

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -14,10 +14,6 @@ import javascript
1414
import DataFlow::PathGraph
1515
import semmle.javascript.security.TaintedObject
1616

17-
predicate isUsingHbsEngine() {
18-
Express::appCreation().getAMethodCall("set").getArgument(1).mayHaveStringValue("hbs")
19-
}
20-
2117
class TemplateObjInjectionConfig extends TaintTracking::Configuration {
2218
TemplateObjInjectionConfig() { this = "TemplateObjInjectionConfig" }
2319

@@ -32,8 +28,7 @@ class TemplateObjInjectionConfig extends TaintTracking::Configuration {
3228
exists(MethodCallExpr mc |
3329
Express::isResponse(mc.getReceiver()) and
3430
mc.getMethodName() = "render" and
35-
sink.asExpr() = mc.getArgument(1) and
36-
isUsingHbsEngine()
31+
sink.asExpr() = mc.getArgument(1)
3732
)
3833
}
3934

0 commit comments

Comments
 (0)