зеркало из https://github.com/github/codeql.git
Update javascript/ql/src/experimental/Security/CWE-94/ServerSideTemplateInjection.ql
Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com>
This commit is contained in:
Родитель
8310c96b97
Коммит
3a4ea82ae2
|
@ -25,11 +25,11 @@ abstract class ServerSideTemplateInjectionSink extends DataFlow::Node { }
|
|||
|
||||
class SSTIPugSink extends ServerSideTemplateInjectionSink {
|
||||
SSTIPugSink() {
|
||||
exists(CallNode compile, ModuleImportNode renderImport, Node sink |
|
||||
exists(CallNode compile, ModuleImportNode renderImport |
|
||||
renderImport = moduleImport(["pug", "jade"]) and
|
||||
(
|
||||
compile = renderImport.getAMemberCall("compile") and
|
||||
sink.getStartLine() != sink.getASuccessor().getStartLine()
|
||||
exists(compile.getACall())
|
||||
or
|
||||
compile = renderImport.getAMemberCall("render")
|
||||
) and
|
||||
|
|
Загрузка…
Ссылка в новой задаче