Add req.url.origin to RequestInputAccess

mbaluda · web-flow · commit 8e546e84968b · 2022-11-08T16:14:10.000+01:00
diff --git a/javascript/ql/lib/semmle/javascript/frameworks/Hapi.qll b/javascript/ql/lib/semmle/javascript/frameworks/Hapi.qll
@@ -142,7 +142,7 @@ module Hapi {
           // `request.url.path`
           kind = "url" and
           url.accesses(request, "url") and
-          this.(DataFlow::PropRead).accesses(url, "path")
+          this.(DataFlow::PropRead).accesses(url, ["path", "origin"])
         )
         or
         exists(DataFlow::PropRead state |

Original file line number	Diff line number	Diff line change
`@@ -142,7 +142,7 @@ module Hapi {`
`142`	`142`	// `request.url.path`
`143`	`143`	`kind = "url" and`
`144`	`144`	`url.accesses(request, "url") and`
`145`		`- this.(DataFlow::PropRead).accesses(url, "path")`
	`145`	`+ this.(DataFlow::PropRead).accesses(url, ["path", "origin"])`
`146`	`146`	`)`
`147`	`147`	`or`
`148`	`148`	`exists(DataFlow::PropRead state \|`