hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-03-01 13:23:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

Revamp the query to be more selective

Browse Source
This commit is contained in:
luchua-bc
2021-01-05 00:04:08 +00:00
parent 496db4b42f
commit 195755d687
5 changed files with 93 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
java/ql/src/semmle/code/java/frameworks/Servlets.qll
View File

@@ -323,11 +323,20 @@ class ServletWebXMLListenerType extends RefType {
}
}
/** Holds if `c` is a call to some override of methods of `HttpServlet`, for example `doGet` or `doPost`. */
predicate isServletMethod(Callable c, string methodName) {
c.getDeclaringType() instanceof ServletClass and
c.getNumberOfParameters() = 2 and
c.getParameter(0).getType() instanceof ServletRequest and
c.getParameter(1).getType() instanceof ServletResponse and
c.getName() = methodName
/** Holds if `ma` is a method access to some override of methods of `HttpServlet`, for example `doGet` or `doPost`. */
predicate isServletMethod(MethodAccess ma, string methodName) {
exists(Method m |
m = ma.getEnclosingCallable() and
m.getDeclaringType() instanceof ServletClass and
m.getNumberOfParameters() = 2 and
m.getParameter(0).getType() instanceof ServletRequest and
m.getParameter(1).getType() instanceof ServletResponse and
m.getName() = methodName and
ma.getQualifier() = m.getParameter(0).getAnAccess() and
(
ma.getMethod() instanceof ServletRequestGetParameterMethod or
ma.getMethod() instanceof ServletRequestGetParameterMapMethod or
ma.getMethod() instanceof HttpServletRequestGetQueryStringMethod
)
)
}