Skip to content

Commit a763874

Browse files
committed
Remove propagation steps for INSERT and UPSERT
This is also related to the controversial `entries` call.
1 parent 9101ff3 commit a763874

File tree

1 file changed

+0
-20
lines changed

1 file changed

+0
-20
lines changed

javascript/frameworks/cap/lib/advanced_security/javascript/frameworks/cap/CAPCqlInjectionQuery.qll

Lines changed: 0 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -212,25 +212,5 @@ class CqlInjectionConfiguration extends TaintTracking::Configuration {
212212
start = cqlClause.getArgument().flow().getAPredecessor*().(StringOps::Concatenation) and
213213
end = cqlClause.flow()
214214
)
215-
or
216-
/*
217-
* 3. In case of INSERT and UPSERT, jump from an object write to a query parameter to the argument itself.
218-
* e.g. Given below code:
219-
*
220-
* ``` javascript
221-
* await INSERT.into(Service1Entity).entries({ id: "" + id });
222-
* ```
223-
*
224-
* This step jumps from `id` in the property value expression to the enclosing object `{ id: "" + id }`.
225-
* This in conjunction with the above step 2 will make the taint tracker jump from `id` to the entire
226-
* INSERT clause.
227-
*/
228-
229-
exists(CqlClause cqlClause, PropWrite propWrite |
230-
(cqlClause instanceof CqlInsertClause or cqlClause instanceof CqlUpsertClause) and
231-
cqlClause.getArgument().flow() = propWrite.getBase() and
232-
start = propWrite.getRhs().getAPredecessor*().(StringOps::Concatenation) and
233-
end = cqlClause.flow()
234-
)
235215
}
236216
}

0 commit comments

Comments
 (0)