File tree Expand file tree Collapse file tree
javascript/ql/src/semmle/javascript Expand file tree Collapse file tree Original file line number Diff line number Diff line change @@ -8,7 +8,8 @@ module ArrayTaintTracking {
88 /**
99 * A taint propagating data flow edge caused by the builtin array functions.
1010 */
11- private class ArrayFunctionTaintStep extends TaintTracking:: AdditionalTaintStep , DataFlow:: CallNode {
11+ private class ArrayFunctionTaintStep extends TaintTracking:: AdditionalTaintStep ,
12+ DataFlow:: CallNode {
1213 ArrayFunctionTaintStep ( ) { arrayFunctionTaintStep ( _, _, this ) }
1314
1415 override predicate step ( DataFlow:: Node pred , DataFlow:: Node succ ) {
Original file line number Diff line number Diff line change @@ -229,18 +229,16 @@ module TaintTracking {
229229 * promises.
230230 */
231231 private class HeapTaintStep extends AdditionalTaintStep {
232- HeapTaintStep ( ) {
233- heapStep ( _, this )
234- }
232+ HeapTaintStep ( ) { heapStep ( _, this ) }
235233
236234 override predicate step ( DataFlow:: Node pred , DataFlow:: Node succ ) {
237235 heapStep ( pred , succ ) and succ = this
238236 }
239237 }
240238
241- /**
242- * Holds if there is taint propagation through the heap from `pred` to `succ`.
243- */
239+ /**
240+ * Holds if there is taint propagation through the heap from `pred` to `succ`.
241+ */
244242 private predicate heapStep ( DataFlow:: Node pred , DataFlow:: Node succ ) {
245243 exists ( Expr e , Expr f | e = succ .asExpr ( ) and f = pred .asExpr ( ) |
246244 // arrays with tainted elements and objects with tainted property names are tainted
@@ -398,9 +396,9 @@ module TaintTracking {
398396 }
399397 }
400398
401- /**
402- * Holds if taint can propagate from `pred` to `succ` with a step related to string manipulation.
403- */
399+ /**
400+ * Holds if taint can propagate from `pred` to `succ` with a step related to string manipulation.
401+ */
404402 private predicate stringManipulationStep ( DataFlow:: Node pred , DataFlow:: ValueNode succ ) {
405403 // string operations that propagate taint
406404 exists ( string name | name = succ .getAstNode ( ) .( MethodCallExpr ) .getMethodName ( ) |
You can’t perform that action at this time.
0 commit comments