Merge pull request #2479 from max-schaefer/localTaintStep

semmle-qlci · web-flow · commit ceb9fff70cf0 · 2019-12-02T11:35:43.000Z
Approved by asgerf
diff --git a/javascript/ql/src/semmle/javascript/dataflow/DataFlow.qll b/javascript/ql/src/semmle/javascript/dataflow/DataFlow.qll
@@ -1575,4 +1575,6 @@ module DataFlow {
   import Configuration
   import TrackedNodes
   import TypeTracking
+
+  predicate localTaintStep = TaintTracking::localTaintStep/2;
 }
diff --git a/javascript/ql/src/semmle/javascript/dataflow/TaintTracking.qll b/javascript/ql/src/semmle/javascript/dataflow/TaintTracking.qll
@@ -902,4 +902,12 @@ module TaintTracking {
 
     override predicate appliesTo(Configuration cfg) { any() }
   }
+
+  /**
+   * Holds if taint propagates from `pred` to `succ` in one local (intra-procedural) step.
+   */
+  predicate localTaintStep(DataFlow::Node pred, DataFlow::Node succ) {
+    DataFlow::localFlowStep(pred, succ) or
+    any(AdditionalTaintStep s).step(pred, succ)
+  }
 }

Original file line number	Diff line number	Diff line change
`@@ -1575,4 +1575,6 @@ module DataFlow {`
`1575`	`1575`	`import Configuration`
`1576`	`1576`	`import TrackedNodes`
`1577`	`1577`	`import TypeTracking`
	`1578`	`+`
	`1579`	`+ predicate localTaintStep = TaintTracking::localTaintStep/2;`
`1578`	`1580`	`}`
Original file line number	Diff line number	Diff line change
`@@ -902,4 +902,12 @@ module TaintTracking {`
`902`	`902`
`903`	`903`	`override predicate appliesTo(Configuration cfg) { any() }`
`904`	`904`	`}`
	`905`	`+`
	`906`	`+ /**`
	`907`	+ * Holds if taint propagates from `pred` to `succ` in one local (intra-procedural) step.
	`908`	`+ */`
	`909`	`+ predicate localTaintStep(DataFlow::Node pred, DataFlow::Node succ) {`
	`910`	`+ DataFlow::localFlowStep(pred, succ) or`
	`911`	`+ any(AdditionalTaintStep s).step(pred, succ)`
	`912`	`+ }`
`905`	`913`	`}`