hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-02-26 03:43:41 +01:00
Code Issues Packages Projects Releases Wiki Activity

Java: fix test case for version 1.4

Browse Source 
Need the existence of an ApplicationProperties File, not an ApplicationProperties ConfigPair
This commit is contained in:
Jami Cogswell
2025-07-15 19:50:04 -04:00
parent 3823186dc6
commit 2bfc4b4ee2
3 changed files with 39 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
java/ql/src/Security/CWE/CWE-200/InsecureSpringActuatorConfig/InsecureSpringActuatorConfig.ql
View File

@@ -15,9 +15,9 @@ import java
import semmle.code.xml.MavenPom
import semmle.code.java.security.SpringBootActuatorsConfigQuery
from SpringBootPom pom, ApplicationProperties ap, Dependency d
from SpringBootPom pom, Dependency d
where
hasConfidentialEndPointExposed(pom, ap) and
hasConfidentialEndPointExposed(pom) and
d = pom.getADependency() and
d.getArtifact().getValue() = "spring-boot-starter-actuator"
select d, "Insecure configuration of Spring Boot Actuator exposes sensitive endpoints."