Module SecondOrderCommandInjection
Classes and predicates for reasoning about second order command injection.
Import path
import semmle.javascript.security.dataflow.SecondOrderCommandInjectionCustomizationsClasses
| ArgSink | An argument to an invocation of |
| ArgsArraySink | An arguments array given to an invocation of |
| DoubleDashSanitizer | A sanitizer that blocks flow when a string does not start with “–” |
| ExternalInputSource | A parameter of an exported function, seen as a source for second order command injection. |
| PathRelativeSanitizer | A call to path.relative which sanitizes the taint. |
| PrefixStringSanitizer | A sanitizer that blocks flow when a string is tested to start with a certain prefix. |
| RemoteFlowAsSource | A source of remote flow, seen as a source for second order command injection. |
| Sanitizer | A sanitizer for second order command injection. |
| Sink | A sink for second order command injection. |
| Source | A source for second order command injection. |
| VulnerableCommandSink | A sink that invokes a command described by the |