Skip to content

Commit 768e57f

Browse files
committed
Fix shared flow step LogArgumentToListener
over sharing of flow steps was occuring unintentionally
1 parent dcfc88b commit 768e57f

File tree

2 files changed

+9
-21
lines changed

2 files changed

+9
-21
lines changed

javascript/frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/UI5LogsToHttpQuery.qll

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -29,11 +29,15 @@ module UI5LogEntryToHttp implements DataFlow::StateConfigSig {
2929
UI5LogInjection::isAdditionalFlowStep(start, end) and
3030
preState = postState
3131
or
32-
exists(LogArgumentToListener logArgumentToListener |
33-
logArgumentToListener.step(start, end) and
34-
preState = "not-logged-not-accessed" and
35-
postState = "logged-and-accessed"
36-
)
32+
inSameWebApp(start.getFile(), end.getFile()) and
33+
start =
34+
ModelOutput::getATypeNode("SapLogger")
35+
.getMember(["debug", "error", "fatal", "info", "trace", "warning"])
36+
.getACall()
37+
.getAnArgument() and
38+
end = ModelOutput::getATypeNode("SapLogEntries").asSource() and
39+
preState = "not-logged-not-accessed" and
40+
postState = "logged-and-accessed"
3741
}
3842

3943
predicate isSink(DataFlow::Node node, FlowState state) {

javascript/frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/dataflow/FlowSteps.qll

Lines changed: 0 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -342,19 +342,3 @@ class ResourceBundleGetTextCallArgToReturnValueStep extends DataFlow::SharedFlow
342342
)
343343
}
344344
}
345-
346-
/**
347-
* A step from any argument of a SAP logging function to the `onLogEntry`
348-
* method of a custom log listener in the same application.
349-
*/
350-
class LogArgumentToListener extends DataFlow::SharedFlowStep {
351-
override predicate step(DataFlow::Node start, DataFlow::Node end) {
352-
inSameWebApp(start.getFile(), end.getFile()) and
353-
start =
354-
ModelOutput::getATypeNode("SapLogger")
355-
.getMember(["debug", "error", "fatal", "info", "trace", "warning"])
356-
.getACall()
357-
.getAnArgument() and
358-
end = ModelOutput::getATypeNode("SapLogEntries").asSource()
359-
}
360-
}

0 commit comments

Comments
 (0)