Skip to content

Commit e75912c

Browse files
committed
Cleanup UI5 & RemoteFlowSources qll
1 parent bb9452e commit e75912c

2 files changed

Lines changed: 0 additions & 20 deletions

File tree

javascript/frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/RemoteFlowSources.qll

Lines changed: 0 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -173,22 +173,3 @@ private class UI5ExtRemoteSource extends RemoteFlowSource {
173173
result = "Remote flow" // Don't discriminate between UI5-specific remote flows and vanilla ones
174174
}
175175
}
176-
177-
/**
178-
* URLSearchParams.get() and getAll() return URL query parameter values which are user-controlled.
179-
* e.g., `new URLSearchParams(window.location.search).get("param")`
180-
*/
181-
private class UrlSearchParamsSource extends RemoteFlowSource {
182-
UrlSearchParamsSource() {
183-
exists(DataFlow::NewNode newCall, DataFlow::MethodCallNode getCall |
184-
// Match: new URLSearchParams(...)
185-
newCall.getCalleeName() = "URLSearchParams" and
186-
// Match: .get() or .getAll() on the URLSearchParams instance
187-
getCall.getMethodName() = ["get", "getAll"] and
188-
newCall.flowsTo(getCall.getReceiver()) and
189-
this = getCall
190-
)
191-
}
192-
193-
override string getSourceType() { result = "URL query parameter" }
194-
}

javascript/frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/UI5.qll

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -358,7 +358,6 @@ class ControlReference extends Reference {
358358
// Fragment.byId(viewId, controlId) - static method with 2 arguments
359359
this.getNumArgument() = 2 and
360360
this.getArgument(1).getALocalSource().getStringValue() = controlId and
361-
this.getMethodName() = "byId" and
362361
exists(FragmentModule fragment | this = fragment.getAMemberCall("byId"))
363362
}
364363

0 commit comments

Comments
 (0)