hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-01 11:45:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add sample

Browse Source
This commit is contained in:
SpaceWhite
2020-02-15 16:49:33 +09:00
parent 1ad7bd9684
commit 0be6f84387
2 changed files with 2 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
java/ql/src/Security/CWE/CWE-094/ScriptEngine.java
View File

@@ -1,4 +1,4 @@
// Bad: arbitrary code execution
// Bad: ScriptEngine allows arbitrary code injection
ScriptEngineManager scriptEngineManager = new ScriptEngineManager();
ScriptEngine scriptEngine = scriptEngineManager.getEngineByExtension("js");
Object result = scriptEngine.eval(code);

4
java/ql/src/Security/CWE/CWE-094/ScriptEngine.qhelp
View File

@@ -14,9 +14,7 @@ Use "Cloudbees Rhino Sandbox" or sandboxing with SecurityManager or use <a href=
<example>
The following code could executes random JavaScript code
ScriptEngineManager scriptEngineManager = new ScriptEngineManager();
ScriptEngine scriptEngine = scriptEngineManager.getEngineByExtension("js");
Object result = scriptEngine.eval(code);
<sample src="ScriptEngine.java" />
</example>
<references>