JS: UrlSearchParamsTaintStep

asgerf · asgerf · commit 8f750d4ad33c · 2021-03-23T14:53:12.000Z
diff --git a/javascript/ql/src/semmle/javascript/dataflow/TaintTracking.qll b/javascript/ql/src/semmle/javascript/dataflow/TaintTracking.qll
@@ -828,13 +828,13 @@ module TaintTracking {
   /**
    * A taint propagating data flow edge arising from URL parameter parsing.
    */
-  private class UrlSearchParamsTaintStep extends DataFlow::AdditionalFlowStep, DataFlow::ValueNode {
+  private class UrlSearchParamsTaintStep extends DataFlow::SharedFlowStep {
     /**
      * Holds if `succ` is a `URLSearchParams` providing access to the
      * parameters encoded in `pred`.
      */
     override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
-      isUrlSearchParams(succ, pred) and succ = this
+      isUrlSearchParams(succ, pred)
     }
 
     /**
@@ -847,17 +847,14 @@ module TaintTracking {
      *    which can be accessed using a `get` or `getAll` call. (See getableUrlPseudoProperty())
      */
     override predicate storeStep(DataFlow::Node pred, DataFlow::SourceNode succ, string prop) {
-      succ = this and
-      (
-        prop = ["searchParams", "hash", "search", hiddenUrlPseudoProperty()] and
-        exists(DataFlow::NewNode newUrl | succ = newUrl |
-          newUrl = DataFlow::globalVarRef("URL").getAnInstantiation() and
-          pred = newUrl.getArgument(0)
-        )
-        or
-        prop = getableUrlPseudoProperty() and
-        isUrlSearchParams(succ, pred)
+      prop = ["searchParams", "hash", "search", hiddenUrlPseudoProperty()] and
+      exists(DataFlow::NewNode newUrl | succ = newUrl |
+        newUrl = DataFlow::globalVarRef("URL").getAnInstantiation() and
+        pred = newUrl.getArgument(0)
       )
+      or
+      prop = getableUrlPseudoProperty() and
+      isUrlSearchParams(succ, pred)
     }
 
     /**
@@ -869,7 +866,6 @@ module TaintTracking {
     override predicate loadStoreStep(
       DataFlow::Node pred, DataFlow::Node succ, string loadProp, string storeProp
     ) {
-      succ = this and
       loadProp = hiddenUrlPseudoProperty() and
       storeProp = getableUrlPseudoProperty() and
       exists(DataFlow::PropRead read | read = succ |
@@ -884,7 +880,6 @@ module TaintTracking {
      * This step is used to load the value stored in the pseudo-property `getableUrlPseudoProperty()`.
      */
     override predicate loadStep(DataFlow::Node pred, DataFlow::Node succ, string prop) {
-      succ = this and
       prop = getableUrlPseudoProperty() and
       // this is a call to `get` or `getAll` on a `URLSearchParams` object
       exists(string m, DataFlow::MethodCallNode call | call = succ |
