Skip to content

Commit 3b073eb

Browse files
committed
Remove related logic that detects query parameters
Even for INSERT, UPSERT, or CREATE calls, keep the tracking granularity low to prevent the CQL injection query making an alert on those cases with calls to `entries`.
1 parent 3ae7055 commit 3b073eb

File tree

1 file changed

+3
-6
lines changed
  • javascript/frameworks/cap/lib/advanced_security/javascript/frameworks/cap

1 file changed

+3
-6
lines changed

javascript/frameworks/cap/lib/advanced_security/javascript/frameworks/cap/CDS.qll

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -929,8 +929,7 @@ class CqlCreateMethodCall extends CqlShortcutMethodCall {
929929
exists(DataFlow::CallNode chainedMethodCall |
930930
chainedMethodCall = this.getAChainedMethodCall(_)
931931
|
932-
result = chainedMethodCall.getAnArgument() or
933-
result = chainedMethodCall.getAnArgument().(SourceNode).getAPropertyWrite().getRhs()
932+
result = chainedMethodCall.getAnArgument()
934933
)
935934
}
936935
}
@@ -958,8 +957,7 @@ class CqlInsertMethodCall extends CqlShortcutMethodCall {
958957
exists(DataFlow::CallNode chainedMethodCall |
959958
chainedMethodCall = this.getAChainedMethodCall(_)
960959
|
961-
result = chainedMethodCall.getAnArgument() or
962-
result = chainedMethodCall.getAnArgument().(SourceNode).getAPropertyWrite().getRhs()
960+
result = chainedMethodCall.getAnArgument()
963961
)
964962
}
965963
}
@@ -971,8 +969,7 @@ class CqlUpsertMethodCall extends CqlShortcutMethodCall {
971969
exists(DataFlow::CallNode chainedMethodCall |
972970
chainedMethodCall = this.getAChainedMethodCall(_)
973971
|
974-
result = chainedMethodCall.getAnArgument() or
975-
result = chainedMethodCall.getAnArgument().(SourceNode).getAPropertyWrite().getRhs()
972+
result = chainedMethodCall.getAnArgument()
976973
)
977974
}
978975
}

0 commit comments

Comments
 (0)