Update javascript/ql/src/Security/CWE-352/MissingCsrfMiddleware.ql

asgerf · erik-krogh · web-flow · commit 310dd0518562 · 2020-01-28T12:46:34.000Z
Co-Authored-By: Erik Krogh Kristensen &lt;erik-krogh@github.com&gt;
diff --git a/javascript/ql/src/Security/CWE-352/MissingCsrfMiddleware.ql b/javascript/ql/src/Security/CWE-352/MissingCsrfMiddleware.ql
@@ -17,7 +17,7 @@ string cookieProperty() {
   result = "session" or result = "cookies" or result = "user"
 }
 
-/** Gets a data flow node that flows to the base of an access to `cookies` or `session`. */
+/** Gets a data flow node that flows to the base of an access to `cookies`, `session`, or `user`. */
 private DataFlow::SourceNode nodeLeadingToCookieAccess(DataFlow::TypeBackTracker t) {
   t.start() and
   exists(DataFlow::PropRead value |

Original file line number	Diff line number	Diff line change
`@@ -17,7 +17,7 @@ string cookieProperty() {`
`17`	`17`	`result = "session" or result = "cookies" or result = "user"`
`18`	`18`	`}`
`19`	`19`
`20`		-/** Gets a data flow node that flows to the base of an access to `cookies` or `session`. */
	`20`	+/** Gets a data flow node that flows to the base of an access to `cookies`, `session`, or `user`. */
`21`	`21`	`private DataFlow::SourceNode nodeLeadingToCookieAccess(DataFlow::TypeBackTracker t) {`
`22`	`22`	`t.start() and`
`23`	`23`	`exists(DataFlow::PropRead value \|`