Update javascript/ql/src/Security/CWE-730/ServerCrash.ql

esbena · erik-krogh · web-flow · commit 12b985be8748 · 2021-01-13T14:49:29.000+01:00
Co-authored-by: Erik Krogh Kristensen &lt;erik-krogh@github.com&gt;
diff --git a/javascript/ql/src/Security/CWE-730/ServerCrash.ql b/javascript/ql/src/Security/CWE-730/ServerCrash.ql
@@ -40,6 +40,7 @@ Function invokedByRouteHandler(HTTP::RouteHandler rh) {
   // follow the immediate call graph
   exists(DataFlow::InvokeNode invk |
     result = invk.getACallee() and
+    // purposely not checking for `getEnclosingTryCatchStmt`. An async callback called from inside a try-catch can still crash the server.
     invk.getEnclosingFunction() = invokedByRouteHandler(rh)
   )
   // if new edges are added here, the `edges` predicate should be updated accordingly

Original file line number	Diff line number	Diff line change
`@@ -40,6 +40,7 @@ Function invokedByRouteHandler(HTTP::RouteHandler rh) {`
`40`	`40`	`// follow the immediate call graph`
`41`	`41`	`exists(DataFlow::InvokeNode invk \|`
`42`	`42`	`result = invk.getACallee() and`
	`43`	+ // purposely not checking for `getEnclosingTryCatchStmt`. An async callback called from inside a try-catch can still crash the server.
`43`	`44`	`invk.getEnclosingFunction() = invokedByRouteHandler(rh)`
`44`	`45`	`)`
`45`	`46`	// if new edges are added here, the `edges` predicate should be updated accordingly