hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-24 04:36:35 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #9816 from erik-krogh/msgConsis

Browse Source 
Make alert messages consistent across languages
This commit is contained in:
Erik Krogh Kristensen
2022-08-25 15:20:01 +02:00
committed by GitHub
parent 2e2621adad c7aa58252a
commit 06afe9c0f4
106 changed files with 764 additions and 729 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
java/ql/src/Security/CWE/CWE-089/SqlTainted.ql
View File

@@ -19,4 +19,5 @@ import DataFlow::PathGraph
from QueryInjectionSink query, DataFlow::PathNode source, DataFlow::PathNode sink
where queryTaintedBy(query, source, sink)
select query, source, sink, "Query might include code from $@.", source.getNode(), "this user input"
select query, source, sink, "This SQL query depends on $@.", source.getNode(),
"a user-provided value"

5
java/ql/src/Security/CWE/CWE-611/XXE.ql
View File

@@ -51,5 +51,6 @@ class XxeConfig extends TaintTracking::Configuration {
from DataFlow::PathNode source, DataFlow::PathNode sink, XxeConfig conf
where conf.hasFlowPath(source, sink)
select sink.getNode(), source, sink, "Unsafe parsing of XML file from $@.", source.getNode(),
"user input"
select sink.getNode(), source, sink,
"A $@ is parsed as XML without guarding against external entity expansion.", source.getNode(),
"user-provided value"