@@ -159,8 +159,8 @@ deprecated class BoolToGinSetCookieTrackingConfiguration extends DataFlow::Confi
159159 exists ( DataFlow:: MethodCallNode mcn |
160160 mcn .getTarget ( ) instanceof GinContextSetCookieMethod and
161161 mcn .getArgument ( 6 ) = sink and
162- exists ( DataFlow:: Node nameArg |
163- NameToGinSetCookieTrackingFlow :: flowTo ( nameArg ) and
162+ exists ( NameToGinSetCookieTrackingConfiguration cfg , DataFlow:: Node nameArg |
163+ cfg . hasFlowTo ( nameArg ) and
164164 mcn .getArgument ( 0 ) = nameArg
165165 )
166166 )
@@ -184,6 +184,25 @@ private module BoolToGinSetCookieTrackingConfig implements DataFlow::ConfigSig {
184184
185185module BoolToGinSetCookieTrackingFlow = DataFlow:: Global< BoolToGinSetCookieTrackingConfig > ;
186186
187+ /**
188+ * DEPRECATED: Use `NameToGinSetCookieTrackingConfig` instead.
189+ *
190+ * A taint-tracking configuration for tracking flow from sensitive names to
191+ * `gin-gonic/gin.Context.SetCookie`.
192+ */
193+ deprecated private class NameToGinSetCookieTrackingConfiguration extends DataFlow2:: Configuration {
194+ NameToGinSetCookieTrackingConfiguration ( ) { this = "NameToGinSetCookieTrackingConfiguration" }
195+
196+ override predicate isSource ( DataFlow:: Node source ) { isAuthVariable ( source .asExpr ( ) ) }
197+
198+ override predicate isSink ( DataFlow:: Node sink ) {
199+ exists ( DataFlow:: MethodCallNode mcn |
200+ mcn .getTarget ( ) instanceof GinContextSetCookieMethod and
201+ mcn .getArgument ( 0 ) = sink
202+ )
203+ }
204+ }
205+
187206/**
188207 * A taint-tracking configuration for tracking flow from sensitive names to
189208 * `gin-gonic/gin.Context.SetCookie`.
0 commit comments