hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 19:26:02 +02:00
Code Issues Packages Projects Releases Wiki Activity

Update InsecureDependencyResolution with code review comments

Browse Source
This commit is contained in:
Jonathan Leitschuh
2019-12-09 20:37:53 -05:00
parent f341234edb
commit 229622459c
4 changed files with 111 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
java/ql/test/query-tests/security/CWE-829/semmle/tests/InsecureDependencyResolution.qlref Normal file
View File

@@ -0,0 +1 @@
Security/CWE/CWE-829/InsecureDependencyResolution.ql

48
java/ql/test/query-tests/security/CWE-829/semmle/tests/insecure-pom.xml Normal file
View File

@@ -0,0 +1,48 @@
<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
<!-- Duplicated in java/ql/src/Security/CWE/CWE-829/insecure-pom.xml -->
<modelVersion>4.0.0</modelVersion>
<groupId>com.semmle</groupId>
<artifactId>parent</artifactId>
<version>1.0</version>
<packaging>pom</packaging>
<name>Security Testing</name>
<description>An example of insecure download and upload of dependencies</description>
<distributionManagement>
<repository>
<id>insecure-releases</id>
<name>Insecure Repository Releases</name>
<!-- BAD! Use HTTPS -->
<url>http://insecure-repository.example</url>
</repository>
<snapshotRepository>
<id>insecure-snapshots</id>
<name>Insecure Repository Snapshots</name>
<!-- BAD! Use HTTPS -->
<url>http://insecure-repository.example</url>
</snapshotRepository>
</distributionManagement>
<repositories>
<repository>
<id>insecure</id>
<name>Insecure Repository</name>
<!-- BAD! Use HTTPS -->
<url>http://insecure-repository.example</url>
</repository>
</repositories>
<pluginRepositories>
<pluginRepository>
<id>insecure-plugins</id>
<name>Insecure Repository Releases</name>
<!-- BAD! Use HTTPS -->
<url>http://insecure-repository.example</url>
</pluginRepository>
</pluginRepositories>
</project>

48
java/ql/test/query-tests/security/CWE-829/semmle/tests/secure-pom.xml Normal file
View File

@@ -0,0 +1,48 @@
<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
<!-- Duplicated in java/ql/src/Security/CWE/CWE-829/secure-pom.xml -->
<modelVersion>4.0.0</modelVersion>
<groupId>com.semmle</groupId>
<artifactId>parent</artifactId>
<version>1.0</version>
<packaging>pom</packaging>
<name>Security Testing</name>
<description>An example of secure download and upload of dependencies</description>
<distributionManagement>
<repository>
<id>insecure-releases</id>
<name>Secure Repository Releases</name>
<!-- GOOD! Use HTTPS -->
<url>https://insecure-repository.example</url>
</repository>
<snapshotRepository>
<id>insecure-snapshots</id>
<name>Secure Repository Snapshots</name>
<!-- GOOD! Use HTTPS -->
<url>https://insecure-repository.example</url>
</snapshotRepository>
</distributionManagement>
<repositories>
<repository>
<id>insecure</id>
<name>Secure Repository</name>
<!-- GOOD! Use HTTPS -->
<url>https://insecure-repository.example</url>
</repository>
</repositories>
<pluginRepositories>
<pluginRepository>
<id>insecure-plugins</id>
<name>Secure Repository Releases</name>
<!-- GOOD! Use HTTPS -->
<url>https://insecure-repository.example</url>
</pluginRepository>
</pluginRepositories>
</project>