Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit d998d06

Browse files
erik-krogherik-krogh
committed
add link to source in alert-message for js/shell-command-constructed-from-input
1 parent 1d9f8c2 commit d998d06

1 file changed

Lines changed: 3 additions & 3 deletions

File tree

‎javascript/ql/src/Security/CWE-078/UnsafeShellCommandConstruction.ql‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,6 @@ import DataFlow::PathGraph
1818

1919
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink, Sink sinkNode
2020
where cfg.hasFlowPath(source, sink) and sinkNode = sink.getNode()
21-
select sinkNode.getAlertLocation(), source, sink, "$@ based on library input is later used in $@.",
22-
sinkNode.getAlertLocation(), sinkNode.getSinkType(), sinkNode.getCommandExecution(),
23-
"shell command"
21+
select sinkNode.getAlertLocation(), source, sink, "$@ based on $@ is later used in $@.",
22+
sinkNode.getAlertLocation(), sinkNode.getSinkType(), source.getNode(), "library input",
23+
sinkNode.getCommandExecution(), "shell command"

0 commit comments

Comments
 (0)