From 076e4a49d54e302be7da9916197a07485e4e0067 Mon Sep 17 00:00:00 2001 From: Asger F Date: Tue, 27 May 2025 09:47:43 +0200 Subject: [PATCH] JS: Mark AngularJS $location as client-side remote flow source --- .../javascript/frameworks/AngularJS/AngularJSCore.qll | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/javascript/ql/lib/semmle/javascript/frameworks/AngularJS/AngularJSCore.qll b/javascript/ql/lib/semmle/javascript/frameworks/AngularJS/AngularJSCore.qll index a85a0a7813ce..248a88e3d1cc 100644 --- a/javascript/ql/lib/semmle/javascript/frameworks/AngularJS/AngularJSCore.qll +++ b/javascript/ql/lib/semmle/javascript/frameworks/AngularJS/AngularJSCore.qll @@ -550,20 +550,25 @@ class DirectiveTargetName extends string { * * See https://docs.angularjs.org/api/ng/service/$location for details. */ -private class LocationFlowSource extends RemoteFlowSource instanceof DataFlow::MethodCallNode { +private class LocationFlowSource extends ClientSideRemoteFlowSource instanceof DataFlow::MethodCallNode +{ + private ClientSideRemoteFlowKind kind; + LocationFlowSource() { exists(ServiceReference service, string m, int n | service.getName() = "$location" and this = service.getAMethodCall(m) and n = super.getNumArgument() | - m = "search" and n < 2 + m = "search" and n < 2 and kind.isQuery() or - m = "hash" and n = 0 + m = "hash" and n = 0 and kind.isFragment() ) } override string getSourceType() { result = "$location" } + + override ClientSideRemoteFlowKind getKind() { result = kind } } /**