Skip to content

Commit e06ed50

Browse files
author
Max Schaefer
committed
JavaScript: Make flow summaries work for non-taint configurations.
With flow labels it often makes more sense to use a `DataFlow::Configuration` rather than a `TaintTracking::Configuration`, so flow summaries should support both.
1 parent d83faaf commit e06ed50

File tree

4 files changed

+4
-6
lines changed

4 files changed

+4
-6
lines changed

javascript/ql/src/Security/Summaries/ExtractSinkSummaries.ql

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ import Configurations
1111
import PortalExitSource
1212
import SinkFromAnnotation
1313

14-
from TaintTracking::Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink, Portal p
14+
from DataFlow::Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink, Portal p
1515
where
1616
cfg.hasFlowPath(source, sink) and
1717
p = source.getNode().(PortalExitSource).getPortal() and

javascript/ql/src/Security/Summaries/ExtractSourceSummaries.ql

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ import Configurations
1111
import PortalEntrySink
1212
import SourceFromAnnotation
1313

14-
from TaintTracking::Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink, Portal p
14+
from DataFlow::Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink, Portal p
1515
where
1616
cfg.hasFlowPath(source, sink) and
1717
p = sink.getNode().(PortalEntrySink).getPortal() and

javascript/ql/src/Security/Summaries/PortalEntrySink.qll

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,7 @@ class PortalEntrySink extends DataFlow::AdditionalSink {
1111
PortalEntrySink() { this = p.getAnEntryNode(true) }
1212

1313
override predicate isSinkFor(DataFlow::Configuration cfg, DataFlow::FlowLabel lbl) {
14-
cfg instanceof TaintTracking::Configuration and
15-
lbl = any(DataFlow::FlowLabel l)
14+
any()
1615
}
1716

1817
/** Gets the portal of which this is an entry node. */

javascript/ql/src/Security/Summaries/PortalExitSource.qll

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,7 @@ class PortalExitSource extends DataFlow::AdditionalSource {
1111
PortalExitSource() { this = p.getAnExitNode(true) }
1212

1313
override predicate isSourceFor(DataFlow::Configuration cfg, DataFlow::FlowLabel lbl) {
14-
cfg instanceof TaintTracking::Configuration and
15-
lbl = any(DataFlow::FlowLabel l)
14+
any()
1615
}
1716

1817
/** Gets the portal of which this is an exit node. */

0 commit comments

Comments
 (0)