hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-29 02:35:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

Java: convert XXE test to .qlref

Browse Source
This commit is contained in:
Nora Dimitrijević
2025-06-23 17:59:18 +02:00
parent 7f33f57c9b
commit 162b1c51a9
20 changed files with 560 additions and 132 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
java/ql/test/query-tests/security/CWE-611/XMLReaderTests.java
View File

@@ -13,7 +13,7 @@ public class XMLReaderTests {
public void unconfiguredReader(Socket sock) throws Exception {
XMLReader reader = XMLReaderFactory.createXMLReader();
reader.parse(new InputSource(sock.getInputStream())); // $ hasTaintFlow
reader.parse(new InputSource(sock.getInputStream())); // $ Alert
}
public void safeReaderFromConfig1(Socket sock) throws Exception {
@@ -53,21 +53,21 @@ public class XMLReaderTests {
XMLReader reader = XMLReaderFactory.createXMLReader();
reader.setFeature("http://xml.org/sax/features/external-general-entities", false);
reader.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
reader.parse(new InputSource(sock.getInputStream())); // $ hasTaintFlow
reader.parse(new InputSource(sock.getInputStream())); // $ Alert
}
public void partialConfiguredXMLReader2(Socket sock) throws Exception {
XMLReader reader = XMLReaderFactory.createXMLReader();
reader.setFeature("http://xml.org/sax/features/external-general-entities", false);
reader.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
reader.parse(new InputSource(sock.getInputStream())); // $ hasTaintFlow
reader.parse(new InputSource(sock.getInputStream())); // $ Alert
}
public void partilaConfiguredXMLReader3(Socket sock) throws Exception {
XMLReader reader = XMLReaderFactory.createXMLReader();
reader.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
reader.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
reader.parse(new InputSource(sock.getInputStream())); // $ hasTaintFlow
reader.parse(new InputSource(sock.getInputStream())); // $ Alert
}
public void misConfiguredXMLReader1(Socket sock) throws Exception {
@@ -75,7 +75,7 @@ public class XMLReaderTests {
reader.setFeature("http://xml.org/sax/features/external-general-entities", true);
reader.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
reader.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
reader.parse(new InputSource(sock.getInputStream())); // $ hasTaintFlow
reader.parse(new InputSource(sock.getInputStream())); // $ Alert
}
public void misConfiguredXMLReader2(Socket sock) throws Exception {
@@ -83,7 +83,7 @@ public class XMLReaderTests {
reader.setFeature("http://xml.org/sax/features/external-general-entities", false);
reader.setFeature("http://xml.org/sax/features/external-parameter-entities", true);
reader.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
reader.parse(new InputSource(sock.getInputStream())); // $ hasTaintFlow
reader.parse(new InputSource(sock.getInputStream())); // $ Alert
}
public void misConfiguredXMLReader3(Socket sock) throws Exception {
@@ -91,12 +91,12 @@ public class XMLReaderTests {
reader.setFeature("http://xml.org/sax/features/external-general-entities", false);
reader.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
reader.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", true);
reader.parse(new InputSource(sock.getInputStream())); // $ hasTaintFlow
reader.parse(new InputSource(sock.getInputStream())); // $ Alert
}
public void misConfiguredXMLReader4(Socket sock) throws Exception {
XMLReader reader = XMLReaderFactory.createXMLReader();
reader.setFeature("http://apache.org/xml/features/disallow-doctype-decl", false);
reader.parse(new InputSource(sock.getInputStream())); // $ hasTaintFlow
reader.parse(new InputSource(sock.getInputStream())); // $ Alert
}
}