Update java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll

haby0 · smowton · web-flow · commit c77c7b0a982b · 2021-04-10T04:27:16.000+08:00
Co-authored-by: Chris Smowton &lt;smowton@github.com&gt;
diff --git a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
@@ -27,7 +27,12 @@ class VerificationMethodToIfFlowConfig extends DataFlow3::Configuration {
   }
 }
 
-/** Taint-tracking configuration tracing flow from untrusted inputs to verification of remote user input. */
+/** Taint-tracking configuration tracing flow from untrusted inputs to an argument of a function whose result is used as an if-statement condition.
+* 
+* For example, in the context `String userControlled = request.getHeader("xyz"); boolean isGood = checkToken(userControlled); if(isGood) { ...`,
+* the flow from `checkToken`'s result to the condition of `if(isGood)` matches the configuration `VerificationMethodToIfFlowConfig` above,
+* and so the flow from `getHeader(...)` to the argument to `checkToken` matches this configuration.
+ */
 class VerificationMethodFlowConfig extends TaintTracking2::Configuration {
   VerificationMethodFlowConfig() { this = "VerificationMethodFlowConfig" }
 

Original file line number	Diff line number	Diff line change
`@@ -27,7 +27,12 @@ class VerificationMethodToIfFlowConfig extends DataFlow3::Configuration {`
`27`	`27`	`}`
`28`	`28`	`}`
`29`	`29`
`30`		`-/** Taint-tracking configuration tracing flow from untrusted inputs to verification of remote user input. */`
	`30`	`+/** Taint-tracking configuration tracing flow from untrusted inputs to an argument of a function whose result is used as an if-statement condition.`
	`31`	`+*`
	`32`	+* For example, in the context `String userControlled = request.getHeader("xyz"); boolean isGood = checkToken(userControlled); if(isGood) { ...`,
	`33`	+* the flow from `checkToken`'s result to the condition of `if(isGood)` matches the configuration `VerificationMethodToIfFlowConfig` above,
	`34`	+* and so the flow from `getHeader(...)` to the argument to `checkToken` matches this configuration.
	`35`	`+ */`
`31`	`36`	`class VerificationMethodFlowConfig extends TaintTracking2::Configuration {`
`32`	`37`	`VerificationMethodFlowConfig() { this = "VerificationMethodFlowConfig" }`
`33`	`38`