Skip to content

Commit 13b2b76

Browse files
authored
Go: note that numeric-typed nodes can't cause path traversal
1 parent 34de400 commit 13b2b76

File tree

1 file changed

+9
-0
lines changed

1 file changed

+9
-0
lines changed

go/ql/lib/semmle/go/security/TaintedPathCustomizations.qll

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,15 @@ module TaintedPath {
7070
PathAsSink() { this = any(FileSystemAccess fsa).getAPathArgument() }
7171
}
7272

73+
/**
74+
* A numeric-typed node, considered a sanitizer for path traversal.
75+
*/
76+
class NumericSanitizer extends Sanitizer {
77+
NumericSanitizer() {
78+
this.getType() instanceof NumericType or this.getType() instanceof BoolType
79+
}
80+
}
81+
7382
/**
7483
* A call to `filepath.Rel`, considered as a sanitizer for path traversal.
7584
*/

0 commit comments

Comments
 (0)