Skip to content

Commit d31b59e

Browse files
asgerfasgerf
committed
JS: Call super in isBarrier() override
1 parent e3c84ee commit d31b59e

File tree

2 files changed

+5
-31
lines changed

2 files changed

+5
-31
lines changed

‎javascript/ql/lib/semmle/javascript/security/dataflow/TypeConfusionThroughParameterTamperingQuery.qll

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,11 @@ class Configuration extends DataFlow::Configuration {
2626
sink.analyze().getAType() = TTObject()
2727
}
2828

29-
override predicate isBarrier(DataFlow::Node node) { node instanceof Barrier }
29+
override predicate isBarrier(DataFlow::Node node) {
30+
super.isBarrier(node)
31+
or
32+
node instanceof Barrier
33+
}
3034

3135
override predicate isBarrierGuard(DataFlow::BarrierGuardNode guard) {
3236
guard instanceof TypeOfTestBarrier or

‎javascript/ql/test/query-tests/Security/CWE-843/TypeConfusionThroughParameterTampering.expected

Lines changed: 0 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -16,10 +16,6 @@ nodes
1616
| tst.js:27:5:27:7 | foo |
1717
| tst.js:28:5:28:7 | foo |
1818
| tst.js:28:5:28:7 | foo |
19-
| tst.js:36:9:36:11 | foo |
20-
| tst.js:36:9:36:11 | foo |
21-
| tst.js:41:5:41:7 | foo |
22-
| tst.js:41:5:41:7 | foo |
2319
| tst.js:45:9:45:35 | foo |
2420
| tst.js:45:15:45:35 | ctx.req ... ery.foo |
2521
| tst.js:45:15:45:35 | ctx.req ... ery.foo |
@@ -38,19 +34,9 @@ nodes
3834
| tst.js:92:9:92:16 | data.foo |
3935
| tst.js:92:9:92:16 | data.foo |
4036
| tst.js:92:9:92:16 | data.foo |
41-
| tst.js:95:9:95:16 | data.foo |
42-
| tst.js:95:9:95:16 | data.foo |
43-
| tst.js:95:9:95:16 | data.foo |
4437
| tst.js:98:9:98:16 | data.foo |
4538
| tst.js:98:9:98:16 | data.foo |
4639
| tst.js:98:9:98:16 | data.foo |
47-
| tst.js:103:9:103:29 | data |
48-
| tst.js:103:16:103:29 | req.query.data |
49-
| tst.js:103:16:103:29 | req.query.data |
50-
| tst.js:105:9:105:12 | data |
51-
| tst.js:105:9:105:12 | data |
52-
| tst.js:107:9:107:12 | data |
53-
| tst.js:107:9:107:12 | data |
5440
edges
5541
| tst.js:5:9:5:27 | foo | tst.js:6:5:6:7 | foo |
5642
| tst.js:5:9:5:27 | foo | tst.js:6:5:6:7 | foo |
@@ -63,10 +49,6 @@ edges
6349
| tst.js:5:9:5:27 | foo | tst.js:27:5:27:7 | foo |
6450
| tst.js:5:9:5:27 | foo | tst.js:28:5:28:7 | foo |
6551
| tst.js:5:9:5:27 | foo | tst.js:28:5:28:7 | foo |
66-
| tst.js:5:9:5:27 | foo | tst.js:36:9:36:11 | foo |
67-
| tst.js:5:9:5:27 | foo | tst.js:36:9:36:11 | foo |
68-
| tst.js:5:9:5:27 | foo | tst.js:41:5:41:7 | foo |
69-
| tst.js:5:9:5:27 | foo | tst.js:41:5:41:7 | foo |
7052
| tst.js:5:15:5:27 | req.query.foo | tst.js:5:9:5:27 | foo |
7153
| tst.js:5:15:5:27 | req.query.foo | tst.js:5:9:5:27 | foo |
7254
| tst.js:14:16:14:18 | bar | tst.js:15:9:15:11 | bar |
@@ -84,29 +66,17 @@ edges
8466
| tst.js:80:23:80:23 | p | tst.js:82:9:82:9 | p |
8567
| tst.js:90:5:90:12 | data.foo | tst.js:90:5:90:12 | data.foo |
8668
| tst.js:92:9:92:16 | data.foo | tst.js:92:9:92:16 | data.foo |
87-
| tst.js:95:9:95:16 | data.foo | tst.js:95:9:95:16 | data.foo |
8869
| tst.js:98:9:98:16 | data.foo | tst.js:98:9:98:16 | data.foo |
89-
| tst.js:103:9:103:29 | data | tst.js:105:9:105:12 | data |
90-
| tst.js:103:9:103:29 | data | tst.js:105:9:105:12 | data |
91-
| tst.js:103:9:103:29 | data | tst.js:107:9:107:12 | data |
92-
| tst.js:103:9:103:29 | data | tst.js:107:9:107:12 | data |
93-
| tst.js:103:16:103:29 | req.query.data | tst.js:103:9:103:29 | data |
94-
| tst.js:103:16:103:29 | req.query.data | tst.js:103:9:103:29 | data |
9570
#select
9671
| tst.js:6:5:6:7 | foo | tst.js:5:15:5:27 | req.query.foo | tst.js:6:5:6:7 | foo | Potential type confusion as $@ may be either an array or a string. | tst.js:5:15:5:27 | req.query.foo | this HTTP request parameter |
9772
| tst.js:8:5:8:7 | foo | tst.js:5:15:5:27 | req.query.foo | tst.js:8:5:8:7 | foo | Potential type confusion as $@ may be either an array or a string. | tst.js:5:15:5:27 | req.query.foo | this HTTP request parameter |
9873
| tst.js:11:9:11:11 | foo | tst.js:5:15:5:27 | req.query.foo | tst.js:11:9:11:11 | foo | Potential type confusion as $@ may be either an array or a string. | tst.js:5:15:5:27 | req.query.foo | this HTTP request parameter |
9974
| tst.js:15:9:15:11 | bar | tst.js:5:15:5:27 | req.query.foo | tst.js:15:9:15:11 | bar | Potential type confusion as $@ may be either an array or a string. | tst.js:5:15:5:27 | req.query.foo | this HTTP request parameter |
10075
| tst.js:27:5:27:7 | foo | tst.js:5:15:5:27 | req.query.foo | tst.js:27:5:27:7 | foo | Potential type confusion as $@ may be either an array or a string. | tst.js:5:15:5:27 | req.query.foo | this HTTP request parameter |
10176
| tst.js:28:5:28:7 | foo | tst.js:5:15:5:27 | req.query.foo | tst.js:28:5:28:7 | foo | Potential type confusion as $@ may be either an array or a string. | tst.js:5:15:5:27 | req.query.foo | this HTTP request parameter |
102-
| tst.js:36:9:36:11 | foo | tst.js:5:15:5:27 | req.query.foo | tst.js:36:9:36:11 | foo | Potential type confusion as $@ may be either an array or a string. | tst.js:5:15:5:27 | req.query.foo | this HTTP request parameter |
103-
| tst.js:41:5:41:7 | foo | tst.js:5:15:5:27 | req.query.foo | tst.js:41:5:41:7 | foo | Potential type confusion as $@ may be either an array or a string. | tst.js:5:15:5:27 | req.query.foo | this HTTP request parameter |
10477
| tst.js:46:5:46:7 | foo | tst.js:45:15:45:35 | ctx.req ... ery.foo | tst.js:46:5:46:7 | foo | Potential type confusion as $@ may be either an array or a string. | tst.js:45:15:45:35 | ctx.req ... ery.foo | this HTTP request parameter |
10578
| tst.js:81:9:81:9 | p | tst.js:77:25:77:38 | req.query.path | tst.js:81:9:81:9 | p | Potential type confusion as $@ may be either an array or a string. | tst.js:77:25:77:38 | req.query.path | this HTTP request parameter |
10679
| tst.js:82:9:82:9 | p | tst.js:77:25:77:38 | req.query.path | tst.js:82:9:82:9 | p | Potential type confusion as $@ may be either an array or a string. | tst.js:77:25:77:38 | req.query.path | this HTTP request parameter |
10780
| tst.js:90:5:90:12 | data.foo | tst.js:90:5:90:12 | data.foo | tst.js:90:5:90:12 | data.foo | Potential type confusion as $@ may be either an array or a string. | tst.js:90:5:90:12 | data.foo | this HTTP request parameter |
10881
| tst.js:92:9:92:16 | data.foo | tst.js:92:9:92:16 | data.foo | tst.js:92:9:92:16 | data.foo | Potential type confusion as $@ may be either an array or a string. | tst.js:92:9:92:16 | data.foo | this HTTP request parameter |
109-
| tst.js:95:9:95:16 | data.foo | tst.js:95:9:95:16 | data.foo | tst.js:95:9:95:16 | data.foo | Potential type confusion as $@ may be either an array or a string. | tst.js:95:9:95:16 | data.foo | this HTTP request parameter |
11082
| tst.js:98:9:98:16 | data.foo | tst.js:98:9:98:16 | data.foo | tst.js:98:9:98:16 | data.foo | Potential type confusion as $@ may be either an array or a string. | tst.js:98:9:98:16 | data.foo | this HTTP request parameter |
111-
| tst.js:105:9:105:12 | data | tst.js:103:16:103:29 | req.query.data | tst.js:105:9:105:12 | data | Potential type confusion as $@ may be either an array or a string. | tst.js:103:16:103:29 | req.query.data | this HTTP request parameter |
112-
| tst.js:107:9:107:12 | data | tst.js:103:16:103:29 | req.query.data | tst.js:107:9:107:12 | data | Potential type confusion as $@ may be either an array or a string. | tst.js:103:16:103:29 | req.query.data | this HTTP request parameter |

0 commit comments

Comments
 (0)