55
66import javascript
77
8- module InsecureCookie {
8+ module Cookie {
99 /**
1010 * `secure` property of the cookie options.
1111 */
@@ -14,7 +14,7 @@ module InsecureCookie {
1414 /**
1515 * Abstract class to represent different cases of insecure cookie settings.
1616 */
17- abstract class InsecureCookies extends DataFlow:: Node {
17+ abstract class Cookie extends DataFlow:: Node {
1818 /**
1919 * Gets the name of the middleware/library used to set the cookie.
2020 */
@@ -34,8 +34,7 @@ module InsecureCookie {
3434 /**
3535 * A cookie set using the `express` module `cookie-session` (https://github.com/expressjs/cookie-session).
3636 */
37- class InsecureCookieSession extends ExpressLibraries:: CookieSession:: MiddlewareInstance ,
38- InsecureCookies {
37+ class InsecureCookieSession extends ExpressLibraries:: CookieSession:: MiddlewareInstance , Cookie {
3938 override string getKind ( ) { result = "cookie-session" }
4039
4140 override DataFlow:: SourceNode getCookieOptionsArgument ( ) { result = this .getOption ( "cookie" ) }
@@ -54,7 +53,7 @@ module InsecureCookie {
5453 * A cookie set using the `express` module `express-session` (https://github.com/expressjs/session).
5554 */
5655 class InsecureExpressSessionCookie extends ExpressLibraries:: ExpressSession:: MiddlewareInstance ,
57- InsecureCookies {
56+ Cookie {
5857 override string getKind ( ) { result = "express-session" }
5958
6059 override DataFlow:: SourceNode getCookieOptionsArgument ( ) { result = this .getOption ( "cookie" ) }
@@ -73,7 +72,7 @@ module InsecureCookie {
7372 /**
7473 * A cookie set using `response.cookie` from `express` module (https://expressjs.com/en/api.html#res.cookie).
7574 */
76- class InsecureExpressCookieResponse extends InsecureCookies {
75+ class InsecureExpressCookieResponse extends Cookie {
7776 InsecureExpressCookieResponse ( ) {
7877 this = any ( Express:: ResponseExpr response ) .flow ( ) .getALocalSource ( ) .getAMethodCall ( "cookie" )
7978 }
@@ -97,7 +96,7 @@ module InsecureCookie {
9796 /**
9897 * A cookie set using `Set-Cookie` header of an `HTTP` response (https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie).
9998 */
100- class InsecureSetCookieHeader extends InsecureCookies {
99+ class InsecureSetCookieHeader extends Cookie {
101100 InsecureSetCookieHeader ( ) {
102101 this .asExpr ( ) = any ( HTTP:: SetCookieHeader setCookie ) .getHeaderArgument ( )
103102 }
@@ -120,7 +119,7 @@ module InsecureCookie {
120119 /**
121120 * A cookie set using `js-cookie` library (https://github.com/js-cookie/js-cookie).
122121 */
123- class InsecureJsCookie extends InsecureCookies {
122+ class InsecureJsCookie extends Cookie {
124123 InsecureJsCookie ( ) {
125124 this = DataFlow:: globalVarRef ( "Cookie" ) .getAMemberCall ( "set" ) or
126125 this = DataFlow:: globalVarRef ( "Cookie" ) .getAMemberCall ( "noConflict" ) .getAMemberCall ( "set" ) or
0 commit comments