improve readability

erik-krogh · asgerf · web-flow · commit eb00da5b31de · 2020-06-09T20:02:46.000+02:00
Co-authored-by: Asger F &lt;asgerf@github.com&gt;
diff --git a/javascript/ql/src/Security/CWE-312/BuildArtifactLeak.ql b/javascript/ql/src/Security/CWE-312/BuildArtifactLeak.ql
@@ -19,5 +19,5 @@ import DataFlow::PathGraph
 from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
 where cfg.hasFlowPath(source, sink)
 select sink.getNode(), source, sink,
-  "Sensitive data returned by $@ is stored in build artifact here.", source.getNode(),
+  "Sensitive data returned by $@ is stored in a build artifact here.", source.getNode(),
   source.getNode().(CleartextLogging::Source).describe()
diff --git a/javascript/ql/src/semmle/javascript/Arrays.qll b/javascript/ql/src/semmle/javascript/Arrays.qll
@@ -40,7 +40,7 @@ module ArrayTaintTracking {
       succ = call
     )
     or
-    // `arary.reduce` with tainted value in callback
+    // `array.reduce` with tainted value in callback
     call.(DataFlow::MethodCallNode).getMethodName() = "reduce" and
     pred = call.getArgument(0).(DataFlow::FunctionNode).getAReturn() and // Require the argument to be a closure to avoid spurious call/return flow
     succ = call
diff --git a/javascript/ql/src/semmle/javascript/security/dataflow/CleartextLoggingCustomizations.qll b/javascript/ql/src/semmle/javascript/security/dataflow/CleartextLoggingCustomizations.qll
@@ -197,6 +197,8 @@ module CleartextLogging {
     )
     or
     // A property-copy step,
+    // dst[x] = src[x]
+    // dst[x] = JSON.stringify(src[x])
     exists(DataFlow::PropWrite write, DataFlow::PropRead read |
       read = write.getRhs()
       or

Original file line number	Diff line number	Diff line change
`@@ -40,7 +40,7 @@ module ArrayTaintTracking {`
`40`	`40`	`succ = call`
`41`	`41`	`)`
`42`	`42`	`or`
`43`		- // `arary.reduce` with tainted value in callback
	`43`	+ // `array.reduce` with tainted value in callback
`44`	`44`	`call.(DataFlow::MethodCallNode).getMethodName() = "reduce" and`
`45`	`45`	`pred = call.getArgument(0).(DataFlow::FunctionNode).getAReturn() and // Require the argument to be a closure to avoid spurious call/return flow`
`46`	`46`	`succ = call`
Original file line number	Diff line number	Diff line change
`@@ -197,6 +197,8 @@ module CleartextLogging {`
`197`	`197`	`)`
`198`	`198`	`or`
`199`	`199`	`// A property-copy step,`
	`200`	`+ // dst[x] = src[x]`
	`201`	`+ // dst[x] = JSON.stringify(src[x])`
`200`	`202`	`exists(DataFlow::PropWrite write, DataFlow::PropRead read \|`
`201`	`203`	`read = write.getRhs()`
`202`	`204`	`or`