Skip to content

Commit 8c08f3d

Browse files
committed
Convert more to using better predicate calls
1 parent 70cc904 commit 8c08f3d

File tree

1 file changed

+9
-15
lines changed

1 file changed

+9
-15
lines changed

javascript/frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/RemoteFlowSources.qll

Lines changed: 9 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -133,21 +133,17 @@ private class RouteParameterAccess extends RemoteFlowSource instanceof PropRead
133133
override string getSourceType() { result = "RouteParameterAccess" }
134134

135135
RouteParameterAccess() {
136-
exists(
137-
ControllerHandler handler, RouteManifest routeManifest, ParameterNode handlerParameter,
138-
MethodCallNode getParameterCall
139-
|
136+
exists(ControllerHandler handler, RouteManifest routeManifest, MethodCallNode getParameterCall |
140137
handler.isAttachedToRoute(routeManifest.getName()) and
141138
this.asExpr().getEnclosingFunction() = handler.getFunction() and
142-
handlerParameter = handler.getParameter(0) and
143-
getParameterCall.getMethodName() = "getParameter" and
144-
getParameterCall.getReceiver().getALocalSource() = handlerParameter and
139+
getParameterCall = handler.getParameter(0).getAMemberCall("getParameter") and
145140
(
146-
routeManifest.matchesPathString(this.getPropertyName()) and
147-
this.getBase().getALocalSource() = getParameterCall
141+
exists(string path |
142+
this = getParameterCall.getAPropertyRead(path) and
143+
routeManifest.matchesPathString(path)
144+
)
148145
or
149-
/* TODO: Why does `routeManifest.matchesPathString` not work for propertyName?? */
150-
this.getBase().(PropRead).getBase().getALocalSource() = getParameterCall
146+
this = getParameterCall.getAPropertyRead().getAPropertyRead()
151147
)
152148
)
153149
}
@@ -157,10 +153,8 @@ private class DisplayEventHandlerParameterAccess extends RemoteFlowSource instan
157153
override string getSourceType() { result = "DisplayEventHandlerParameterAccess" }
158154

159155
DisplayEventHandlerParameterAccess() {
160-
exists(DisplayEventHandler handler, MethodCallNode getParameterCall |
161-
getParameterCall.getMethodName() = "getParameter" and
162-
this.getBase().getALocalSource() = getParameterCall and
163-
handler.getParameter(0) = getParameterCall.getReceiver().getALocalSource()
156+
exists(DisplayEventHandler handler |
157+
this = handler.getParameter(0).getAMemberCall("getParameter").getAPropertyRead()
164158
)
165159
}
166160
}

0 commit comments

Comments
 (0)