hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-29 02:35:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add support for Saxon

Browse Source
This commit is contained in:
Grzegorz Golawski
2020-05-15 00:12:08 +02:00
parent d590f3fba8
commit 14ce049fc6
20 changed files with 328 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files

122
java/ql/test/experimental/query-tests/security/CWE-074/XsltInjection.expected
View File

@@ -1,43 +1,85 @@
edges
| XsltInjection.java:21:44:21:66 | getInputStream(...) : InputStream | XsltInjection.java:22:5:22:59 | newTransformer(...) |
| XsltInjection.java:26:66:26:88 | getInputStream(...) : InputStream | XsltInjection.java:27:5:27:74 | newTransformer(...) |
| XsltInjection.java:30:45:30:70 | param : String | XsltInjection.java:33:5:33:59 | newTransformer(...) |
| XsltInjection.java:37:54:37:76 | getInputStream(...) : InputStream | XsltInjection.java:38:5:38:74 | newTransformer(...) |
| XsltInjection.java:42:82:42:104 | getInputStream(...) : InputStream | XsltInjection.java:43:5:43:59 | newTransformer(...) |
| XsltInjection.java:47:91:47:113 | getInputStream(...) : InputStream | XsltInjection.java:48:5:48:59 | newTransformer(...) |
| XsltInjection.java:52:120:52:142 | getInputStream(...) : InputStream | XsltInjection.java:53:5:53:74 | newTransformer(...) |
| XsltInjection.java:57:102:57:124 | getInputStream(...) : InputStream | XsltInjection.java:58:5:58:59 | newTransformer(...) |
| XsltInjection.java:62:44:62:66 | getInputStream(...) : InputStream | XsltInjection.java:66:5:66:34 | newTransformer(...) |
| XsltInjection.java:70:44:70:66 | getInputStream(...) : InputStream | XsltInjection.java:73:5:73:34 | newTransformer(...) |
| XsltInjection.java:27:44:27:66 | getInputStream(...) : InputStream | XsltInjection.java:28:5:28:59 | newTransformer(...) |
| XsltInjection.java:32:66:32:88 | getInputStream(...) : InputStream | XsltInjection.java:33:5:33:74 | newTransformer(...) |
| XsltInjection.java:36:45:36:70 | param : String | XsltInjection.java:39:5:39:59 | newTransformer(...) |
| XsltInjection.java:43:54:43:76 | getInputStream(...) : InputStream | XsltInjection.java:44:5:44:74 | newTransformer(...) |
| XsltInjection.java:48:82:48:104 | getInputStream(...) : InputStream | XsltInjection.java:49:5:49:59 | newTransformer(...) |
| XsltInjection.java:53:91:53:113 | getInputStream(...) : InputStream | XsltInjection.java:54:5:54:59 | newTransformer(...) |
| XsltInjection.java:58:120:58:142 | getInputStream(...) : InputStream | XsltInjection.java:59:5:59:74 | newTransformer(...) |
| XsltInjection.java:63:102:63:124 | getInputStream(...) : InputStream | XsltInjection.java:64:5:64:59 | newTransformer(...) |
| XsltInjection.java:68:44:68:66 | getInputStream(...) : InputStream | XsltInjection.java:72:5:72:34 | newTransformer(...) |
| XsltInjection.java:76:44:76:66 | getInputStream(...) : InputStream | XsltInjection.java:79:5:79:34 | newTransformer(...) |
| XsltInjection.java:83:44:83:66 | getInputStream(...) : InputStream | XsltInjection.java:86:5:86:35 | load(...) |
| XsltInjection.java:83:44:83:66 | getInputStream(...) : InputStream | XsltInjection.java:87:5:87:37 | load30(...) |
| XsltInjection.java:83:44:83:66 | getInputStream(...) : InputStream | XsltInjection.java:88:5:88:37 | load30(...) |
| XsltInjection.java:83:44:83:66 | getInputStream(...) : InputStream | XsltInjection.java:89:5:89:37 | load30(...) |
| XsltInjection.java:83:44:83:66 | getInputStream(...) : InputStream | XsltInjection.java:90:5:90:37 | load30(...) |
| XsltInjection.java:83:44:83:66 | getInputStream(...) : InputStream | XsltInjection.java:91:5:91:37 | load30(...) |
| XsltInjection.java:83:44:83:66 | getInputStream(...) : InputStream | XsltInjection.java:92:5:92:37 | load30(...) |
| XsltInjection.java:83:44:83:66 | getInputStream(...) : InputStream | XsltInjection.java:93:5:93:37 | load30(...) |
| XsltInjection.java:83:44:83:66 | getInputStream(...) : InputStream | XsltInjection.java:94:5:94:37 | load30(...) |
| XsltInjection.java:83:44:83:66 | getInputStream(...) : InputStream | XsltInjection.java:95:5:95:37 | load30(...) |
| XsltInjection.java:98:36:98:61 | param : String | XsltInjection.java:103:5:103:46 | load(...) |
| XsltInjection.java:98:36:98:61 | param : String | XsltInjection.java:105:5:105:50 | load(...) |
| XsltInjection.java:100:44:100:66 | getInputStream(...) : InputStream | XsltInjection.java:104:5:104:49 | load(...) |
nodes
| XsltInjection.java:21:44:21:66 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
| XsltInjection.java:22:5:22:59 | newTransformer(...) | semmle.label | newTransformer(...) |
| XsltInjection.java:26:66:26:88 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
| XsltInjection.java:27:5:27:74 | newTransformer(...) | semmle.label | newTransformer(...) |
| XsltInjection.java:30:45:30:70 | param : String | semmle.label | param : String |
| XsltInjection.java:33:5:33:59 | newTransformer(...) | semmle.label | newTransformer(...) |
| XsltInjection.java:37:54:37:76 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
| XsltInjection.java:38:5:38:74 | newTransformer(...) | semmle.label | newTransformer(...) |
| XsltInjection.java:42:82:42:104 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
| XsltInjection.java:43:5:43:59 | newTransformer(...) | semmle.label | newTransformer(...) |
| XsltInjection.java:47:91:47:113 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
| XsltInjection.java:48:5:48:59 | newTransformer(...) | semmle.label | newTransformer(...) |
| XsltInjection.java:52:120:52:142 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
| XsltInjection.java:53:5:53:74 | newTransformer(...) | semmle.label | newTransformer(...) |
| XsltInjection.java:57:102:57:124 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
| XsltInjection.java:58:5:58:59 | newTransformer(...) | semmle.label | newTransformer(...) |
| XsltInjection.java:62:44:62:66 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
| XsltInjection.java:66:5:66:34 | newTransformer(...) | semmle.label | newTransformer(...) |
| XsltInjection.java:70:44:70:66 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
| XsltInjection.java:73:5:73:34 | newTransformer(...) | semmle.label | newTransformer(...) |
| XsltInjection.java:27:44:27:66 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
| XsltInjection.java:28:5:28:59 | newTransformer(...) | semmle.label | newTransformer(...) |
| XsltInjection.java:32:66:32:88 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
| XsltInjection.java:33:5:33:74 | newTransformer(...) | semmle.label | newTransformer(...) |
| XsltInjection.java:36:45:36:70 | param : String | semmle.label | param : String |
| XsltInjection.java:39:5:39:59 | newTransformer(...) | semmle.label | newTransformer(...) |
| XsltInjection.java:43:54:43:76 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
| XsltInjection.java:44:5:44:74 | newTransformer(...) | semmle.label | newTransformer(...) |
| XsltInjection.java:48:82:48:104 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
| XsltInjection.java:49:5:49:59 | newTransformer(...) | semmle.label | newTransformer(...) |
| XsltInjection.java:53:91:53:113 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
| XsltInjection.java:54:5:54:59 | newTransformer(...) | semmle.label | newTransformer(...) |
| XsltInjection.java:58:120:58:142 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
| XsltInjection.java:59:5:59:74 | newTransformer(...) | semmle.label | newTransformer(...) |
| XsltInjection.java:63:102:63:124 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
| XsltInjection.java:64:5:64:59 | newTransformer(...) | semmle.label | newTransformer(...) |
| XsltInjection.java:68:44:68:66 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
| XsltInjection.java:72:5:72:34 | newTransformer(...) | semmle.label | newTransformer(...) |
| XsltInjection.java:76:44:76:66 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
| XsltInjection.java:79:5:79:34 | newTransformer(...) | semmle.label | newTransformer(...) |
| XsltInjection.java:83:44:83:66 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
| XsltInjection.java:86:5:86:35 | load(...) | semmle.label | load(...) |
| XsltInjection.java:87:5:87:37 | load30(...) | semmle.label | load30(...) |
| XsltInjection.java:88:5:88:37 | load30(...) | semmle.label | load30(...) |
| XsltInjection.java:89:5:89:37 | load30(...) | semmle.label | load30(...) |
| XsltInjection.java:90:5:90:37 | load30(...) | semmle.label | load30(...) |
| XsltInjection.java:91:5:91:37 | load30(...) | semmle.label | load30(...) |
| XsltInjection.java:92:5:92:37 | load30(...) | semmle.label | load30(...) |
| XsltInjection.java:93:5:93:37 | load30(...) | semmle.label | load30(...) |
| XsltInjection.java:94:5:94:37 | load30(...) | semmle.label | load30(...) |
| XsltInjection.java:95:5:95:37 | load30(...) | semmle.label | load30(...) |
| XsltInjection.java:98:36:98:61 | param : String | semmle.label | param : String |
| XsltInjection.java:100:44:100:66 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
| XsltInjection.java:103:5:103:46 | load(...) | semmle.label | load(...) |
| XsltInjection.java:104:5:104:49 | load(...) | semmle.label | load(...) |
| XsltInjection.java:105:5:105:50 | load(...) | semmle.label | load(...) |
#select
| XsltInjection.java:22:5:22:59 | newTransformer(...) | XsltInjection.java:21:44:21:66 | getInputStream(...) : InputStream | XsltInjection.java:22:5:22:59 | newTransformer(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:21:44:21:66 | getInputStream(...) | this user input |
| XsltInjection.java:27:5:27:74 | newTransformer(...) | XsltInjection.java:26:66:26:88 | getInputStream(...) : InputStream | XsltInjection.java:27:5:27:74 | newTransformer(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:26:66:26:88 | getInputStream(...) | this user input |
| XsltInjection.java:33:5:33:59 | newTransformer(...) | XsltInjection.java:30:45:30:70 | param : String | XsltInjection.java:33:5:33:59 | newTransformer(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:30:45:30:70 | param | this user input |
| XsltInjection.java:38:5:38:74 | newTransformer(...) | XsltInjection.java:37:54:37:76 | getInputStream(...) : InputStream | XsltInjection.java:38:5:38:74 | newTransformer(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:37:54:37:76 | getInputStream(...) | this user input |
| XsltInjection.java:43:5:43:59 | newTransformer(...) | XsltInjection.java:42:82:42:104 | getInputStream(...) : InputStream | XsltInjection.java:43:5:43:59 | newTransformer(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:42:82:42:104 | getInputStream(...) | this user input |
| XsltInjection.java:48:5:48:59 | newTransformer(...) | XsltInjection.java:47:91:47:113 | getInputStream(...) : InputStream | XsltInjection.java:48:5:48:59 | newTransformer(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:47:91:47:113 | getInputStream(...) | this user input |
| XsltInjection.java:53:5:53:74 | newTransformer(...) | XsltInjection.java:52:120:52:142 | getInputStream(...) : InputStream | XsltInjection.java:53:5:53:74 | newTransformer(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:52:120:52:142 | getInputStream(...) | this user input |
| XsltInjection.java:58:5:58:59 | newTransformer(...) | XsltInjection.java:57:102:57:124 | getInputStream(...) : InputStream | XsltInjection.java:58:5:58:59 | newTransformer(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:57:102:57:124 | getInputStream(...) | this user input |
| XsltInjection.java:66:5:66:34 | newTransformer(...) | XsltInjection.java:62:44:62:66 | getInputStream(...) : InputStream | XsltInjection.java:66:5:66:34 | newTransformer(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:62:44:62:66 | getInputStream(...) | this user input |
| XsltInjection.java:73:5:73:34 | newTransformer(...) | XsltInjection.java:70:44:70:66 | getInputStream(...) : InputStream | XsltInjection.java:73:5:73:34 | newTransformer(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:70:44:70:66 | getInputStream(...) | this user input |
| XsltInjection.java:28:5:28:59 | newTransformer(...) | XsltInjection.java:27:44:27:66 | getInputStream(...) : InputStream | XsltInjection.java:28:5:28:59 | newTransformer(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:27:44:27:66 | getInputStream(...) | this user input |
| XsltInjection.java:33:5:33:74 | newTransformer(...) | XsltInjection.java:32:66:32:88 | getInputStream(...) : InputStream | XsltInjection.java:33:5:33:74 | newTransformer(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:32:66:32:88 | getInputStream(...) | this user input |
| XsltInjection.java:39:5:39:59 | newTransformer(...) | XsltInjection.java:36:45:36:70 | param : String | XsltInjection.java:39:5:39:59 | newTransformer(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:36:45:36:70 | param | this user input |
| XsltInjection.java:44:5:44:74 | newTransformer(...) | XsltInjection.java:43:54:43:76 | getInputStream(...) : InputStream | XsltInjection.java:44:5:44:74 | newTransformer(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:43:54:43:76 | getInputStream(...) | this user input |
| XsltInjection.java:49:5:49:59 | newTransformer(...) | XsltInjection.java:48:82:48:104 | getInputStream(...) : InputStream | XsltInjection.java:49:5:49:59 | newTransformer(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:48:82:48:104 | getInputStream(...) | this user input |
| XsltInjection.java:54:5:54:59 | newTransformer(...) | XsltInjection.java:53:91:53:113 | getInputStream(...) : InputStream | XsltInjection.java:54:5:54:59 | newTransformer(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:53:91:53:113 | getInputStream(...) | this user input |
| XsltInjection.java:59:5:59:74 | newTransformer(...) | XsltInjection.java:58:120:58:142 | getInputStream(...) : InputStream | XsltInjection.java:59:5:59:74 | newTransformer(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:58:120:58:142 | getInputStream(...) | this user input |
| XsltInjection.java:64:5:64:59 | newTransformer(...) | XsltInjection.java:63:102:63:124 | getInputStream(...) : InputStream | XsltInjection.java:64:5:64:59 | newTransformer(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:63:102:63:124 | getInputStream(...) | this user input |
| XsltInjection.java:72:5:72:34 | newTransformer(...) | XsltInjection.java:68:44:68:66 | getInputStream(...) : InputStream | XsltInjection.java:72:5:72:34 | newTransformer(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:68:44:68:66 | getInputStream(...) | this user input |
| XsltInjection.java:79:5:79:34 | newTransformer(...) | XsltInjection.java:76:44:76:66 | getInputStream(...) : InputStream | XsltInjection.java:79:5:79:34 | newTransformer(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:76:44:76:66 | getInputStream(...) | this user input |
| XsltInjection.java:86:5:86:35 | load(...) | XsltInjection.java:83:44:83:66 | getInputStream(...) : InputStream | XsltInjection.java:86:5:86:35 | load(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:83:44:83:66 | getInputStream(...) | this user input |
| XsltInjection.java:87:5:87:37 | load30(...) | XsltInjection.java:83:44:83:66 | getInputStream(...) : InputStream | XsltInjection.java:87:5:87:37 | load30(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:83:44:83:66 | getInputStream(...) | this user input |
| XsltInjection.java:88:5:88:37 | load30(...) | XsltInjection.java:83:44:83:66 | getInputStream(...) : InputStream | XsltInjection.java:88:5:88:37 | load30(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:83:44:83:66 | getInputStream(...) | this user input |
| XsltInjection.java:89:5:89:37 | load30(...) | XsltInjection.java:83:44:83:66 | getInputStream(...) : InputStream | XsltInjection.java:89:5:89:37 | load30(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:83:44:83:66 | getInputStream(...) | this user input |
| XsltInjection.java:90:5:90:37 | load30(...) | XsltInjection.java:83:44:83:66 | getInputStream(...) : InputStream | XsltInjection.java:90:5:90:37 | load30(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:83:44:83:66 | getInputStream(...) | this user input |
| XsltInjection.java:91:5:91:37 | load30(...) | XsltInjection.java:83:44:83:66 | getInputStream(...) : InputStream | XsltInjection.java:91:5:91:37 | load30(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:83:44:83:66 | getInputStream(...) | this user input |
| XsltInjection.java:92:5:92:37 | load30(...) | XsltInjection.java:83:44:83:66 | getInputStream(...) : InputStream | XsltInjection.java:92:5:92:37 | load30(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:83:44:83:66 | getInputStream(...) | this user input |
| XsltInjection.java:93:5:93:37 | load30(...) | XsltInjection.java:83:44:83:66 | getInputStream(...) : InputStream | XsltInjection.java:93:5:93:37 | load30(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:83:44:83:66 | getInputStream(...) | this user input |
| XsltInjection.java:94:5:94:37 | load30(...) | XsltInjection.java:83:44:83:66 | getInputStream(...) : InputStream | XsltInjection.java:94:5:94:37 | load30(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:83:44:83:66 | getInputStream(...) | this user input |
| XsltInjection.java:95:5:95:37 | load30(...) | XsltInjection.java:83:44:83:66 | getInputStream(...) : InputStream | XsltInjection.java:95:5:95:37 | load30(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:83:44:83:66 | getInputStream(...) | this user input |
| XsltInjection.java:103:5:103:46 | load(...) | XsltInjection.java:98:36:98:61 | param : String | XsltInjection.java:103:5:103:46 | load(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:98:36:98:61 | param | this user input |
| XsltInjection.java:104:5:104:49 | load(...) | XsltInjection.java:100:44:100:66 | getInputStream(...) : InputStream | XsltInjection.java:104:5:104:49 | load(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:100:44:100:66 | getInputStream(...) | this user input |
| XsltInjection.java:105:5:105:50 | load(...) | XsltInjection.java:98:36:98:61 | param : String | XsltInjection.java:105:5:105:50 | load(...) | XSLT transformation might include stylesheet from $@. | XsltInjection.java:98:36:98:61 | param | this user input |

40
java/ql/test/experimental/query-tests/security/CWE-074/XsltInjection.java
View File

@@ -2,10 +2,12 @@ import java.io.InputStreamReader;
import java.io.StringReader;
import java.io.StringWriter;
import java.net.Socket;
import java.net.URI;
import javax.xml.XMLConstants;
import javax.xml.parsers.DocumentBuilderFactory;
import javax.xml.stream.XMLInputFactory;
import javax.xml.transform.Source;
import javax.xml.transform.TransformerFactory;
import javax.xml.transform.dom.DOMSource;
import javax.xml.transform.sax.SAXSource;
@@ -16,6 +18,10 @@ import javax.xml.transform.stream.StreamSource;
import org.springframework.web.bind.annotation.RequestParam;
import org.xml.sax.InputSource;
import net.sf.saxon.s9api.Processor;
import net.sf.saxon.s9api.XdmValue;
import net.sf.saxon.s9api.XsltCompiler;
public class XsltInjection {
public void testStreamSourceInputStream(Socket socket) throws Exception {
StreamSource source = new StreamSource(socket.getInputStream());
@@ -73,10 +79,44 @@ public class XsltInjection {
factory.newTransformer(source).transform(null, null);
}
public void testSaxon(Socket socket) throws Exception {
StreamSource source = new StreamSource(socket.getInputStream());
XsltCompiler compiler = new Processor(true).newXsltCompiler();
compiler.compile(source).load().transform();
compiler.compile(source).load30().transform(null, null);
compiler.compile(source).load30().applyTemplates((Source) null);
compiler.compile(source).load30().applyTemplates((Source) null, null);
compiler.compile(source).load30().applyTemplates((XdmValue) null);
compiler.compile(source).load30().applyTemplates((XdmValue) null, null);
compiler.compile(source).load30().callFunction(null, null);
compiler.compile(source).load30().callFunction(null, null, null);
compiler.compile(source).load30().callTemplate(null);
compiler.compile(source).load30().callTemplate(null, null);
}
public void testSaxonXsltPackage(@RequestParam String param, Socket socket) throws Exception {
URI uri = new URI(param);
StreamSource source = new StreamSource(socket.getInputStream());
XsltCompiler compiler = new Processor(true).newXsltCompiler();
compiler.loadExecutablePackage(uri).load().transform();
compiler.compilePackage(source).link().load().transform();
compiler.loadLibraryPackage(uri).link().load().transform();
}
public void testOkFeatureSecureProcessing(Socket socket) throws Exception {
StreamSource source = new StreamSource(socket.getInputStream());
TransformerFactory factory = TransformerFactory.newInstance();
factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
factory.newTransformer(source).transform(null, null);
}
public void testOkSaxon(Socket socket) throws Exception {
StreamSource source = new StreamSource(socket.getInputStream());
XsltCompiler compiler = new Processor(true).newXsltCompiler();
compiler.compile(source).load().close();
compiler.compile((Source) new Object()).load().transform();
}
}

2
java/ql/test/experimental/query-tests/security/CWE-074/options
View File

@@ -1 +1 @@
//semmle-extractor-options: --javac-args -cp ${testdir}/../../../stubs/springframework-5.2.3
//semmle-extractor-options: --javac-args -cp ${testdir}/../../../stubs/springframework-5.2.3:${testdir}/../../../stubs/Saxon-HE-9.9.1-7