Add property params to RequestInputAccess

mbaluda · web-flow · commit ee02265ac2fd · 2022-11-10T12:24:39.000+01:00
diff --git a/javascript/ql/lib/semmle/javascript/frameworks/Hapi.qll b/javascript/ql/lib/semmle/javascript/frameworks/Hapi.qll
@@ -134,7 +134,7 @@ module Hapi {
         kind = "parameter" and
         exists(DataFlow::PropRead query |
           // `request.query.name`
-          query.accesses(request, "query") and
+          query.accesses(request, ["query", "params"]) and
           this.(DataFlow::PropRead).accesses(query, _)
         )
         or

Original file line number	Diff line number	Diff line change
`@@ -134,7 +134,7 @@ module Hapi {`
`134`	`134`	`kind = "parameter" and`
`135`	`135`	`exists(DataFlow::PropRead query \|`
`136`	`136`	// `request.query.name`
`137`		`- query.accesses(request, "query") and`
	`137`	`+ query.accesses(request, ["query", "params"]) and`
`138`	`138`	`this.(DataFlow::PropRead).accesses(query, _)`
`139`	`139`	`)`
`140`	`140`	`or`