Skip to content

Commit b86b9ba

Browse files
Update javascript/ql/src/experimental/Security/CWE-090/LdapInjectionCustomizations.qll
Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com>
1 parent 2872991 commit b86b9ba

File tree

1 file changed

+3
-13
lines changed

1 file changed

+3
-13
lines changed

javascript/ql/src/experimental/Security/CWE-090/LdapInjectionCustomizations.qll

Lines changed: 3 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -39,26 +39,16 @@ module LdapInjection {
3939
* An LDAP filter for an API call that executes an operation against the LDAP server.
4040
*/
4141
class LdapjsSearchFilterAsSink extends Sink, LdapjsSearchFilter {
42-
override DataFlow::Node getQueryCall() {
43-
exists(LdapjsClientAPICall call | result = call.getCalleeNode() |
44-
this =
45-
call
46-
.getArgument(1)
47-
.getALocalSource()
48-
.(DataFlow::SourceNode)
49-
.getAPropertyWrite("filter")
50-
.getRhs()
51-
)
42+
override DataFlow::InvokeNode getQueryCall() {
43+
result = this.(LdapjsSearchFilter).getQueryCall()
5244
}
5345
}
5446

5547
/**
5648
* An LDAP DN argument for an API call that executes an operation against the LDAP server.
5749
*/
5850
class LdapjsDNArgumentAsSink extends Sink, LdapjsDNArgument {
59-
override DataFlow::Node getQueryCall() {
60-
exists(LdapjsClientAPICall call | result = call.getCalleeNode() | this = call.getArgument(0))
61-
}
51+
override DataFlow::InvokeNode getQueryCall() { result = this.(LdapjsDNArgument).getQueryCall() }
6252
}
6353

6454
/**

0 commit comments

Comments
 (0)