File tree Expand file tree Collapse file tree 1 file changed +10
-6
lines changed
csharp/ql/lib/semmle/code/csharp/security/dataflow Expand file tree Collapse file tree 1 file changed +10
-6
lines changed Original file line number Diff line number Diff line change @@ -115,17 +115,21 @@ class HttpServerTransferSink extends Sink {
115115 }
116116}
117117
118- private predicate isLocalUrlSanitizer ( Guard g , Expr e , AbstractValue v ) {
119- (
120- g . ( MethodCall ) . getTarget ( ) .hasName ( "IsLocalUrl" ) and
121- e = g . ( MethodCall ) .getArgument ( 0 )
118+ private predicate isLocalUrlSanitizerMethodCall ( MethodCall guard , Expr e , AbstractValue v ) {
119+ exists ( Method m | m = guard . getTarget ( ) |
120+ m .hasName ( "IsLocalUrl" ) and
121+ e = guard .getArgument ( 0 )
122122 or
123- g . ( MethodCall ) . getTarget ( ) .hasName ( "IsUrlLocalToHost" ) and
124- e = g . ( MethodCall ) .getArgument ( 1 )
123+ m .hasName ( "IsUrlLocalToHost" ) and
124+ e = guard .getArgument ( 1 )
125125 ) and
126126 v .( AbstractValues:: BooleanValue ) .getValue ( ) = true
127127}
128128
129+ private predicate isLocalUrlSanitizer ( Guard g , Expr e , AbstractValue v ) {
130+ isLocalUrlSanitizerMethodCall ( g , e , v )
131+ }
132+
129133/**
130134 * A URL argument to a call to `UrlHelper.IsLocalUrl()` or `HttpRequestBase.IsUrlLocalToHost()` that
131135 * is a sanitizer for URL redirects.
You can’t perform that action at this time.
0 commit comments