File tree Expand file tree Collapse file tree
javascript/ql/src/semmle/javascript/security/dataflow Expand file tree Collapse file tree Original file line number Diff line number Diff line change @@ -40,45 +40,11 @@ module LogInjection {
4040 RemoteSource ( ) { this instanceof RemoteFlowSource }
4141 }
4242
43- /**
44- * An source node representing a logging mechanism.
45- */
46- class ConsoleSource extends DataFlow:: SourceNode {
47- ConsoleSource ( ) {
48- exists ( DataFlow:: SourceNode node |
49- node = this and this = DataFlow:: moduleImport ( "console" )
50- or
51- this = DataFlow:: globalVarRef ( "console" )
52- )
53- }
54- }
55-
56- /**
57- * A call to a logging mechanism. For example, the call could be in the following forms:
58- * `console.log('hello')` or
59- *
60- * `let logger = console.log;`
61- * `logger('hello')` or
62- *
63- * `let logger = {info: console.log};`
64- * `logger.info('hello')`
65- */
66- class LoggingCall extends DataFlow:: CallNode {
67- LoggingCall ( ) {
68- exists ( DataFlow:: SourceNode node , string propName |
69- any ( ConsoleSource console ) .getAPropertyRead ( ) = node .getAPropertySource ( propName ) and
70- this = node .getAPropertyRead ( propName ) .getACall ( )
71- )
72- or
73- this = any ( LoggerCall call )
74- }
75- }
76-
7743 /**
7844 * An argument to a logging mechanism.
7945 */
8046 class LoggingSink extends Sink {
81- LoggingSink ( ) { this = any ( LoggingCall console ) .getAnArgument ( ) }
47+ LoggingSink ( ) { this = any ( LoggerCall console ) .getAMessageComponent ( ) }
8248 }
8349
8450 /**
You can’t perform that action at this time.
0 commit comments