mirror of
https://github.com/github/codeql.git
synced 2026-04-24 16:25:15 +02:00
Java: rename 'UnsafeUrlForward' to 'UrlForward'
This commit is contained in:
@@ -7,7 +7,7 @@ import org.springframework.web.bind.annotation.GetMapping;
|
||||
import org.springframework.web.servlet.ModelAndView;
|
||||
|
||||
@Controller
|
||||
public class UnsafeUrlForward {
|
||||
public class UrlForward {
|
||||
|
||||
@GetMapping("/bad1")
|
||||
public ModelAndView bad1(String url) {
|
||||
@@ -27,7 +27,7 @@ without validating the input, which may cause file leakage. In the <code>good1</
|
||||
ordinary forwarding requests are shown, which will not cause file leakage.
|
||||
</p>
|
||||
|
||||
<sample src="UnsafeUrlForward.java" />
|
||||
<sample src="UrlForward.java" />
|
||||
|
||||
<p>The following examples show an HTTP request parameter or request path being used directly in a
|
||||
request dispatcher of Java EE without validating the input, which allows sensitive file exposure
|
||||
@@ -14,10 +14,10 @@
|
||||
*/
|
||||
|
||||
import java
|
||||
import semmle.code.java.security.UnsafeUrlForwardQuery
|
||||
import UnsafeUrlForwardFlow::PathGraph
|
||||
import semmle.code.java.security.UrlForwardQuery
|
||||
import UrlForwardFlow::PathGraph
|
||||
|
||||
from UnsafeUrlForwardFlow::PathNode source, UnsafeUrlForwardFlow::PathNode sink
|
||||
where UnsafeUrlForwardFlow::flowPath(source, sink)
|
||||
from UrlForwardFlow::PathNode source, UrlForwardFlow::PathNode sink
|
||||
where UrlForwardFlow::flowPath(source, sink)
|
||||
select sink.getNode(), source, sink, "Untrusted URL forward depends on a $@.", source.getNode(),
|
||||
"user-provided value"
|
||||
Reference in New Issue
Block a user