Update java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll

haby0 · smowton · web-flow · commit a5ebe8c60055 · 2021-04-10T09:26:08.000+08:00
Co-authored-by: Chris Smowton &lt;smowton@github.com&gt;
diff --git a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
@@ -12,7 +12,7 @@ class VerificationMethodToIfFlowConfig extends DataFlow3::Configuration {
   VerificationMethodToIfFlowConfig() { this = "VerificationMethodToIfFlowConfig" }
 
   override predicate isSource(DataFlow::Node src) {
-    exists(MethodAccess ma, BarrierGuard bg | ma = bg |
+    exists(MethodAccess ma | ma instanceof BarrierGuard |
       (
         ma.getMethod().getAParameter().getName().regexpMatch("(?i).*(token|auth|referer|origin).*")
         or

Original file line number	Diff line number	Diff line change
`@@ -12,7 +12,7 @@ class VerificationMethodToIfFlowConfig extends DataFlow3::Configuration {`
`12`	`12`	`VerificationMethodToIfFlowConfig() { this = "VerificationMethodToIfFlowConfig" }`
`13`	`13`
`14`	`14`	`override predicate isSource(DataFlow::Node src) {`
`15`		`- exists(MethodAccess ma, BarrierGuard bg \| ma = bg \|`
	`15`	`+ exists(MethodAccess ma \| ma instanceof BarrierGuard \|`
`16`	`16`	`(`
`17`	`17`	`ma.getMethod().getAParameter().getName().regexpMatch("(?i).(token\|auth\|referer\|origin).")`
`18`	`18`	`or`