Skip to content

Commit fb52bfe

Browse files
committed
Refactor fix logger step
previously lost some intentional sharing
1 parent 768e57f commit fb52bfe

File tree

2 files changed

+19
-7
lines changed

2 files changed

+19
-7
lines changed

javascript/frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/UI5LogsToHttpQuery.qll

Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -29,13 +29,7 @@ module UI5LogEntryToHttp implements DataFlow::StateConfigSig {
2929
UI5LogInjection::isAdditionalFlowStep(start, end) and
3030
preState = postState
3131
or
32-
inSameWebApp(start.getFile(), end.getFile()) and
33-
start =
34-
ModelOutput::getATypeNode("SapLogger")
35-
.getMember(["debug", "error", "fatal", "info", "trace", "warning"])
36-
.getACall()
37-
.getAnArgument() and
38-
end = ModelOutput::getATypeNode("SapLogEntries").asSource() and
32+
stepLogger(start, end) and
3933
preState = "not-logged-not-accessed" and
4034
postState = "logged-and-accessed"
4135
}

javascript/frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/dataflow/FlowSteps.qll

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -342,3 +342,21 @@ class ResourceBundleGetTextCallArgToReturnValueStep extends DataFlow::SharedFlow
342342
)
343343
}
344344
}
345+
346+
/**
347+
* A step from any argument of a SAP logging function to the `onLogEntry`
348+
* method of a custom log listener in the same application.
349+
*/
350+
predicate stepLogger(DataFlow::Node start, DataFlow::Node end) {
351+
inSameWebApp(start.getFile(), end.getFile()) and
352+
start =
353+
ModelOutput::getATypeNode("SapLogger")
354+
.getMember(["debug", "error", "fatal", "info", "trace", "warning"])
355+
.getACall()
356+
.getAnArgument() and
357+
end = ModelOutput::getATypeNode("SapLogEntries").asSource()
358+
}
359+
360+
class LogArgumentToListener extends DataFlow::SharedFlowStep {
361+
override predicate step(DataFlow::Node start, DataFlow::Node end) { stepLogger(start, end) }
362+
}

0 commit comments

Comments
 (0)