hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-01 03:35:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix test

Browse Source
This commit is contained in:
Grzegorz Golawski
2020-08-30 22:55:17 +02:00
parent 5e462a897d
commit 0f555d42ed
2 changed files with 77 additions and 75 deletions
Download Patch File Download Diff File Expand all files Collapse all files

150
java/ql/test/experimental/query-tests/security/CWE-074/XsltInjection.expected
View File

@@ -1,52 +1,50 @@
edges
| XsltInjection.java:28:44:28:66 | getInputStream(...) : InputStream | XsltInjection.java:29:5:29:59 | newTransformer(...) |
| XsltInjection.java:33:66:33:88 | getInputStream(...) : InputStream | XsltInjection.java:34:5:34:74 | newTransformer(...) |
| XsltInjection.java:38:45:38:70 | param : String | XsltInjection.java:41:5:41:59 | newTransformer(...) |
| XsltInjection.java:45:54:45:76 | getInputStream(...) : InputStream | XsltInjection.java:46:5:46:74 | newTransformer(...) |
| XsltInjection.java:50:82:50:104 | getInputStream(...) : InputStream | XsltInjection.java:51:5:51:59 | newTransformer(...) |
| XsltInjection.java:55:91:55:113 | getInputStream(...) : InputStream | XsltInjection.java:56:5:56:59 | newTransformer(...) |
| XsltInjection.java:60:120:60:142 | getInputStream(...) : InputStream | XsltInjection.java:61:5:61:74 | newTransformer(...) |
| XsltInjection.java:65:102:65:124 | getInputStream(...) : InputStream | XsltInjection.java:66:5:66:59 | newTransformer(...) |
| XsltInjection.java:70:44:70:66 | getInputStream(...) : InputStream | XsltInjection.java:74:5:74:34 | newTransformer(...) |
| XsltInjection.java:78:44:78:66 | getInputStream(...) : InputStream | XsltInjection.java:81:5:81:34 | newTransformer(...) |
| XsltInjection.java:85:44:85:66 | getInputStream(...) : InputStream | XsltInjection.java:88:5:88:35 | load(...) |
| XsltInjection.java:85:44:85:66 | getInputStream(...) : InputStream | XsltInjection.java:89:5:89:37 | load30(...) |
| XsltInjection.java:85:44:85:66 | getInputStream(...) : InputStream | XsltInjection.java:90:5:90:37 | load30(...) |
| XsltInjection.java:85:44:85:66 | getInputStream(...) : InputStream | XsltInjection.java:91:5:91:37 | load30(...) |
| XsltInjection.java:85:44:85:66 | getInputStream(...) : InputStream | XsltInjection.java:92:5:92:37 | load30(...) |
| XsltInjection.java:85:44:85:66 | getInputStream(...) : InputStream | XsltInjection.java:93:5:93:37 | load30(...) |
| XsltInjection.java:85:44:85:66 | getInputStream(...) : InputStream | XsltInjection.java:94:5:94:37 | load30(...) |
| XsltInjection.java:85:44:85:66 | getInputStream(...) : InputStream | XsltInjection.java:95:5:95:37 | load30(...) |
| XsltInjection.java:85:44:85:66 | getInputStream(...) : InputStream | XsltInjection.java:96:5:96:37 | load30(...) |
| XsltInjection.java:85:44:85:66 | getInputStream(...) : InputStream | XsltInjection.java:97:5:97:37 | load30(...) |
| XsltInjection.java:101:36:101:61 | param : String | XsltInjection.java:106:5:106:46 | load(...) |
| XsltInjection.java:101:36:101:61 | param : String | XsltInjection.java:108:5:108:50 | load(...) |
| XsltInjection.java:103:44:103:66 | getInputStream(...) : InputStream | XsltInjection.java:107:5:107:49 | load(...) |
| XsltInjection.java:30:44:30:66 | getInputStream(...) : InputStream | XsltInjection.java:31:5:31:59 | newTransformer(...) |
| XsltInjection.java:35:66:35:88 | getInputStream(...) : InputStream | XsltInjection.java:36:5:36:74 | newTransformer(...) |
| XsltInjection.java:40:45:40:70 | param : String | XsltInjection.java:43:5:43:59 | newTransformer(...) |
| XsltInjection.java:47:54:47:76 | getInputStream(...) : InputStream | XsltInjection.java:48:5:48:74 | newTransformer(...) |
| XsltInjection.java:52:82:52:104 | getInputStream(...) : InputStream | XsltInjection.java:53:5:53:59 | newTransformer(...) |
| XsltInjection.java:57:91:57:113 | getInputStream(...) : InputStream | XsltInjection.java:58:5:58:59 | newTransformer(...) |
| XsltInjection.java:62:120:62:142 | getInputStream(...) : InputStream | XsltInjection.java:63:5:63:74 | newTransformer(...) |
| XsltInjection.java:67:102:67:124 | getInputStream(...) : InputStream | XsltInjection.java:68:5:68:59 | newTransformer(...) |
| XsltInjection.java:72:44:72:66 | getInputStream(...) : InputStream | XsltInjection.java:76:5:76:34 | newTransformer(...) |
| XsltInjection.java:80:44:80:66 | getInputStream(...) : InputStream | XsltInjection.java:83:5:83:34 | newTransformer(...) |
| XsltInjection.java:87:44:87:66 | getInputStream(...) : InputStream | XsltInjection.java:90:5:90:35 | load(...) |
| XsltInjection.java:87:44:87:66 | getInputStream(...) : InputStream | XsltInjection.java:91:5:91:37 | load30(...) |
| XsltInjection.java:87:44:87:66 | getInputStream(...) : InputStream | XsltInjection.java:92:5:92:37 | load30(...) |
| XsltInjection.java:87:44:87:66 | getInputStream(...) : InputStream | XsltInjection.java:93:5:93:37 | load30(...) |
| XsltInjection.java:87:44:87:66 | getInputStream(...) : InputStream | XsltInjection.java:94:5:94:37 | load30(...) |
| XsltInjection.java:87:44:87:66 | getInputStream(...) : InputStream | XsltInjection.java:95:5:95:37 | load30(...) |
| XsltInjection.java:87:44:87:66 | getInputStream(...) : InputStream | XsltInjection.java:96:5:96:37 | load30(...) |
| XsltInjection.java:87:44:87:66 | getInputStream(...) : InputStream | XsltInjection.java:97:5:97:37 | load30(...) |
| XsltInjection.java:87:44:87:66 | getInputStream(...) : InputStream | XsltInjection.java:98:5:98:37 | load30(...) |
| XsltInjection.java:87:44:87:66 | getInputStream(...) : InputStream | XsltInjection.java:99:5:99:37 | load30(...) |
| XsltInjection.java:103:36:103:61 | param : String | XsltInjection.java:108:5:108:46 | load(...) |
| XsltInjection.java:103:36:103:61 | param : String | XsltInjection.java:110:5:110:50 | load(...) |
| XsltInjection.java:105:44:105:66 | getInputStream(...) : InputStream | XsltInjection.java:109:5:109:49 | load(...) |
nodes
| XsltInjection.java:28:44:28:66 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
| XsltInjection.java:29:5:29:59 | newTransformer(...) | semmle.label | newTransformer(...) |
| XsltInjection.java:33:66:33:88 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
| XsltInjection.java:34:5:34:74 | newTransformer(...) | semmle.label | newTransformer(...) |
| XsltInjection.java:38:45:38:70 | param : String | semmle.label | param : String |
| XsltInjection.java:41:5:41:59 | newTransformer(...) | semmle.label | newTransformer(...) |
| XsltInjection.java:45:54:45:76 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
| XsltInjection.java:46:5:46:74 | newTransformer(...) | semmle.label | newTransformer(...) |
| XsltInjection.java:50:82:50:104 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
| XsltInjection.java:51:5:51:59 | newTransformer(...) | semmle.label | newTransformer(...) |
| XsltInjection.java:55:91:55:113 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
| XsltInjection.java:56:5:56:59 | newTransformer(...) | semmle.label | newTransformer(...) |
| XsltInjection.java:60:120:60:142 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
| XsltInjection.java:61:5:61:74 | newTransformer(...) | semmle.label | newTransformer(...) |
| XsltInjection.java:65:102:65:124 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
| XsltInjection.java:66:5:66:59 | newTransformer(...) | semmle.label | newTransformer(...) |
| XsltInjection.java:70:44:70:66 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
| XsltInjection.java:74:5:74:34 | newTransformer(...) | semmle.label | newTransformer(...) |
| XsltInjection.java:78:44:78:66 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
| XsltInjection.java:81:5:81:34 | newTransformer(...) | semmle.label | newTransformer(...) |
| XsltInjection.java:85:44:85:66 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
| XsltInjection.java:88:5:88:35 | load(...) | semmle.label | load(...) |
| XsltInjection.java:89:5:89:37 | load30(...) | semmle.label | load30(...) |
| XsltInjection.java:90:5:90:37 | load30(...) | semmle.label | load30(...) |
| XsltInjection.java:30:44:30:66 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
| XsltInjection.java:31:5:31:59 | newTransformer(...) | semmle.label | newTransformer(...) |
| XsltInjection.java:35:66:35:88 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
| XsltInjection.java:36:5:36:74 | newTransformer(...) | semmle.label | newTransformer(...) |
| XsltInjection.java:40:45:40:70 | param : String | semmle.label | param : String |
| XsltInjection.java:43:5:43:59 | newTransformer(...) | semmle.label | newTransformer(...) |
| XsltInjection.java:47:54:47:76 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
| XsltInjection.java:48:5:48:74 | newTransformer(...) | semmle.label | newTransformer(...) |
| XsltInjection.java:52:82:52:104 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
| XsltInjection.java:53:5:53:59 | newTransformer(...) | semmle.label | newTransformer(...) |
| XsltInjection.java:57:91:57:113 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
| XsltInjection.java:58:5:58:59 | newTransformer(...) | semmle.label | newTransformer(...) |
| XsltInjection.java:62:120:62:142 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
| XsltInjection.java:63:5:63:74 | newTransformer(...) | semmle.label | newTransformer(...) |
| XsltInjection.java:67:102:67:124 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
| XsltInjection.java:68:5:68:59 | newTransformer(...) | semmle.label | newTransformer(...) |
| XsltInjection.java:72:44:72:66 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
| XsltInjection.java:76:5:76:34 | newTransformer(...) | semmle.label | newTransformer(...) |
| XsltInjection.java:80:44:80:66 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
| XsltInjection.java:83:5:83:34 | newTransformer(...) | semmle.label | newTransformer(...) |
| XsltInjection.java:87:44:87:66 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
| XsltInjection.java:90:5:90:35 | load(...) | semmle.label | load(...) |
| XsltInjection.java:91:5:91:37 | load30(...) | semmle.label | load30(...) |
| XsltInjection.java:92:5:92:37 | load30(...) | semmle.label | load30(...) |
| XsltInjection.java:93:5:93:37 | load30(...) | semmle.label | load30(...) |
@@ -54,32 +52,34 @@ nodes
| XsltInjection.java:95:5:95:37 | load30(...) | semmle.label | load30(...) |
| XsltInjection.java:96:5:96:37 | load30(...) | semmle.label | load30(...) |
| XsltInjection.java:97:5:97:37 | load30(...) | semmle.label | load30(...) |
| XsltInjection.java:101:36:101:61 | param : String | semmle.label | param : String |
| XsltInjection.java:103:44:103:66 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
| XsltInjection.java:106:5:106:46 | load(...) | semmle.label | load(...) |
| XsltInjection.java:107:5:107:49 | load(...) | semmle.label | load(...) |
| XsltInjection.java:108:5:108:50 | load(...) | semmle.label | load(...) |
| XsltInjection.java:98:5:98:37 | load30(...) | semmle.label | load30(...) |
| XsltInjection.java:99:5:99:37 | load30(...) | semmle.label | load30(...) |
| XsltInjection.java:103:36:103:61 | param : String | semmle.label | param : String |
| XsltInjection.java:105:44:105:66 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
| XsltInjection.java:108:5:108:46 | load(...) | semmle.label | load(...) |
| XsltInjection.java:109:5:109:49 | load(...) | semmle.label | load(...) |
| XsltInjection.java:110:5:110:50 | load(...) | semmle.label | load(...) |
#select
| XsltInjection.java:29:5:29:59 | newTransformer(...) | XsltInjection.java:28:44:28:66 | getInputStream(...) : InputStream | XsltInjection.java:29:5:29:59 | newTransformer(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:28:44:28:66 | getInputStream(...) | this user input |
| XsltInjection.java:34:5:34:74 | newTransformer(...) | XsltInjection.java:33:66:33:88 | getInputStream(...) : InputStream | XsltInjection.java:34:5:34:74 | newTransformer(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:33:66:33:88 | getInputStream(...) | this user input |
| XsltInjection.java:41:5:41:59 | newTransformer(...) | XsltInjection.java:38:45:38:70 | param : String | XsltInjection.java:41:5:41:59 | newTransformer(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:38:45:38:70 | param | this user input |
| XsltInjection.java:46:5:46:74 | newTransformer(...) | XsltInjection.java:45:54:45:76 | getInputStream(...) : InputStream | XsltInjection.java:46:5:46:74 | newTransformer(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:45:54:45:76 | getInputStream(...) | this user input |
| XsltInjection.java:51:5:51:59 | newTransformer(...) | XsltInjection.java:50:82:50:104 | getInputStream(...) : InputStream | XsltInjection.java:51:5:51:59 | newTransformer(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:50:82:50:104 | getInputStream(...) | this user input |
| XsltInjection.java:56:5:56:59 | newTransformer(...) | XsltInjection.java:55:91:55:113 | getInputStream(...) : InputStream | XsltInjection.java:56:5:56:59 | newTransformer(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:55:91:55:113 | getInputStream(...) | this user input |
| XsltInjection.java:61:5:61:74 | newTransformer(...) | XsltInjection.java:60:120:60:142 | getInputStream(...) : InputStream | XsltInjection.java:61:5:61:74 | newTransformer(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:60:120:60:142 | getInputStream(...) | this user input |
| XsltInjection.java:66:5:66:59 | newTransformer(...) | XsltInjection.java:65:102:65:124 | getInputStream(...) : InputStream | XsltInjection.java:66:5:66:59 | newTransformer(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:65:102:65:124 | getInputStream(...) | this user input |
| XsltInjection.java:74:5:74:34 | newTransformer(...) | XsltInjection.java:70:44:70:66 | getInputStream(...) : InputStream | XsltInjection.java:74:5:74:34 | newTransformer(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:70:44:70:66 | getInputStream(...) | this user input |
| XsltInjection.java:81:5:81:34 | newTransformer(...) | XsltInjection.java:78:44:78:66 | getInputStream(...) : InputStream | XsltInjection.java:81:5:81:34 | newTransformer(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:78:44:78:66 | getInputStream(...) | this user input |
| XsltInjection.java:88:5:88:35 | load(...) | XsltInjection.java:85:44:85:66 | getInputStream(...) : InputStream | XsltInjection.java:88:5:88:35 | load(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:85:44:85:66 | getInputStream(...) | this user input |
| XsltInjection.java:89:5:89:37 | load30(...) | XsltInjection.java:85:44:85:66 | getInputStream(...) : InputStream | XsltInjection.java:89:5:89:37 | load30(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:85:44:85:66 | getInputStream(...) | this user input |
| XsltInjection.java:90:5:90:37 | load30(...) | XsltInjection.java:85:44:85:66 | getInputStream(...) : InputStream | XsltInjection.java:90:5:90:37 | load30(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:85:44:85:66 | getInputStream(...) | this user input |
| XsltInjection.java:91:5:91:37 | load30(...) | XsltInjection.java:85:44:85:66 | getInputStream(...) : InputStream | XsltInjection.java:91:5:91:37 | load30(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:85:44:85:66 | getInputStream(...) | this user input |
| XsltInjection.java:92:5:92:37 | load30(...) | XsltInjection.java:85:44:85:66 | getInputStream(...) : InputStream | XsltInjection.java:92:5:92:37 | load30(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:85:44:85:66 | getInputStream(...) | this user input |
| XsltInjection.java:93:5:93:37 | load30(...) | XsltInjection.java:85:44:85:66 | getInputStream(...) : InputStream | XsltInjection.java:93:5:93:37 | load30(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:85:44:85:66 | getInputStream(...) | this user input |
| XsltInjection.java:94:5:94:37 | load30(...) | XsltInjection.java:85:44:85:66 | getInputStream(...) : InputStream | XsltInjection.java:94:5:94:37 | load30(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:85:44:85:66 | getInputStream(...) | this user input |
| XsltInjection.java:95:5:95:37 | load30(...) | XsltInjection.java:85:44:85:66 | getInputStream(...) : InputStream | XsltInjection.java:95:5:95:37 | load30(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:85:44:85:66 | getInputStream(...) | this user input |
| XsltInjection.java:96:5:96:37 | load30(...) | XsltInjection.java:85:44:85:66 | getInputStream(...) : InputStream | XsltInjection.java:96:5:96:37 | load30(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:85:44:85:66 | getInputStream(...) | this user input |
| XsltInjection.java:97:5:97:37 | load30(...) | XsltInjection.java:85:44:85:66 | getInputStream(...) : InputStream | XsltInjection.java:97:5:97:37 | load30(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:85:44:85:66 | getInputStream(...) | this user input |
| XsltInjection.java:106:5:106:46 | load(...) | XsltInjection.java:101:36:101:61 | param : String | XsltInjection.java:106:5:106:46 | load(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:101:36:101:61 | param | this user input |
| XsltInjection.java:107:5:107:49 | load(...) | XsltInjection.java:103:44:103:66 | getInputStream(...) : InputStream | XsltInjection.java:107:5:107:49 | load(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:103:44:103:66 | getInputStream(...) | this user input |
| XsltInjection.java:108:5:108:50 | load(...) | XsltInjection.java:101:36:101:61 | param : String | XsltInjection.java:108:5:108:50 | load(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:101:36:101:61 | param | this user input |
| XsltInjection.java:31:5:31:59 | newTransformer(...) | XsltInjection.java:30:44:30:66 | getInputStream(...) : InputStream | XsltInjection.java:31:5:31:59 | newTransformer(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:30:44:30:66 | getInputStream(...) | this user input |
| XsltInjection.java:36:5:36:74 | newTransformer(...) | XsltInjection.java:35:66:35:88 | getInputStream(...) : InputStream | XsltInjection.java:36:5:36:74 | newTransformer(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:35:66:35:88 | getInputStream(...) | this user input |
| XsltInjection.java:43:5:43:59 | newTransformer(...) | XsltInjection.java:40:45:40:70 | param : String | XsltInjection.java:43:5:43:59 | newTransformer(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:40:45:40:70 | param | this user input |
| XsltInjection.java:48:5:48:74 | newTransformer(...) | XsltInjection.java:47:54:47:76 | getInputStream(...) : InputStream | XsltInjection.java:48:5:48:74 | newTransformer(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:47:54:47:76 | getInputStream(...) | this user input |
| XsltInjection.java:53:5:53:59 | newTransformer(...) | XsltInjection.java:52:82:52:104 | getInputStream(...) : InputStream | XsltInjection.java:53:5:53:59 | newTransformer(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:52:82:52:104 | getInputStream(...) | this user input |
| XsltInjection.java:58:5:58:59 | newTransformer(...) | XsltInjection.java:57:91:57:113 | getInputStream(...) : InputStream | XsltInjection.java:58:5:58:59 | newTransformer(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:57:91:57:113 | getInputStream(...) | this user input |
| XsltInjection.java:63:5:63:74 | newTransformer(...) | XsltInjection.java:62:120:62:142 | getInputStream(...) : InputStream | XsltInjection.java:63:5:63:74 | newTransformer(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:62:120:62:142 | getInputStream(...) | this user input |
| XsltInjection.java:68:5:68:59 | newTransformer(...) | XsltInjection.java:67:102:67:124 | getInputStream(...) : InputStream | XsltInjection.java:68:5:68:59 | newTransformer(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:67:102:67:124 | getInputStream(...) | this user input |
| XsltInjection.java:76:5:76:34 | newTransformer(...) | XsltInjection.java:72:44:72:66 | getInputStream(...) : InputStream | XsltInjection.java:76:5:76:34 | newTransformer(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:72:44:72:66 | getInputStream(...) | this user input |
| XsltInjection.java:83:5:83:34 | newTransformer(...) | XsltInjection.java:80:44:80:66 | getInputStream(...) : InputStream | XsltInjection.java:83:5:83:34 | newTransformer(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:80:44:80:66 | getInputStream(...) | this user input |
| XsltInjection.java:90:5:90:35 | load(...) | XsltInjection.java:87:44:87:66 | getInputStream(...) : InputStream | XsltInjection.java:90:5:90:35 | load(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:87:44:87:66 | getInputStream(...) | this user input |
| XsltInjection.java:91:5:91:37 | load30(...) | XsltInjection.java:87:44:87:66 | getInputStream(...) : InputStream | XsltInjection.java:91:5:91:37 | load30(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:87:44:87:66 | getInputStream(...) | this user input |
| XsltInjection.java:92:5:92:37 | load30(...) | XsltInjection.java:87:44:87:66 | getInputStream(...) : InputStream | XsltInjection.java:92:5:92:37 | load30(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:87:44:87:66 | getInputStream(...) | this user input |
| XsltInjection.java:93:5:93:37 | load30(...) | XsltInjection.java:87:44:87:66 | getInputStream(...) : InputStream | XsltInjection.java:93:5:93:37 | load30(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:87:44:87:66 | getInputStream(...) | this user input |
| XsltInjection.java:94:5:94:37 | load30(...) | XsltInjection.java:87:44:87:66 | getInputStream(...) : InputStream | XsltInjection.java:94:5:94:37 | load30(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:87:44:87:66 | getInputStream(...) | this user input |
| XsltInjection.java:95:5:95:37 | load30(...) | XsltInjection.java:87:44:87:66 | getInputStream(...) : InputStream | XsltInjection.java:95:5:95:37 | load30(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:87:44:87:66 | getInputStream(...) | this user input |
| XsltInjection.java:96:5:96:37 | load30(...) | XsltInjection.java:87:44:87:66 | getInputStream(...) : InputStream | XsltInjection.java:96:5:96:37 | load30(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:87:44:87:66 | getInputStream(...) | this user input |
| XsltInjection.java:97:5:97:37 | load30(...) | XsltInjection.java:87:44:87:66 | getInputStream(...) : InputStream | XsltInjection.java:97:5:97:37 | load30(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:87:44:87:66 | getInputStream(...) | this user input |
| XsltInjection.java:98:5:98:37 | load30(...) | XsltInjection.java:87:44:87:66 | getInputStream(...) : InputStream | XsltInjection.java:98:5:98:37 | load30(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:87:44:87:66 | getInputStream(...) | this user input |
| XsltInjection.java:99:5:99:37 | load30(...) | XsltInjection.java:87:44:87:66 | getInputStream(...) : InputStream | XsltInjection.java:99:5:99:37 | load30(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:87:44:87:66 | getInputStream(...) | this user input |
| XsltInjection.java:108:5:108:46 | load(...) | XsltInjection.java:103:36:103:61 | param : String | XsltInjection.java:108:5:108:46 | load(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:103:36:103:61 | param | this user input |
| XsltInjection.java:109:5:109:49 | load(...) | XsltInjection.java:105:44:105:66 | getInputStream(...) : InputStream | XsltInjection.java:109:5:109:49 | load(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:105:44:105:66 | getInputStream(...) | this user input |
| XsltInjection.java:110:5:110:50 | load(...) | XsltInjection.java:103:36:103:61 | param : String | XsltInjection.java:110:5:110:50 | load(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:103:36:103:61 | param | this user input |

2
java/ql/test/experimental/query-tests/security/CWE-074/XsltInjection.java
View File

@@ -15,6 +15,7 @@ import javax.xml.transform.stax.StAXSource;
import javax.xml.transform.stream.StreamResult;
import javax.xml.transform.stream.StreamSource;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestParam;
import org.xml.sax.InputSource;
@@ -23,6 +24,7 @@ import net.sf.saxon.s9api.Processor;
import net.sf.saxon.s9api.XdmValue;
import net.sf.saxon.s9api.XsltCompiler;
@Controller
public class XsltInjection {
public void testStreamSourceInputStream(Socket socket) throws Exception {
StreamSource source = new StreamSource(socket.getInputStream());