hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 11:15:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

Use inline implementation for ScriptEngineFactory

Browse Source
This commit is contained in:
luchua-bc
2021-05-14 20:05:56 +00:00
parent 0ac8453398
commit 2c1374bdcf
1 changed files with 4 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
java/ql/src/experimental/Security/CWE/CWE-094/ScriptInjection.ql
View File

@@ -26,17 +26,6 @@ class ScriptEngineMethod extends Method {
this.getDeclaringType().getASupertype*().hasQualifiedName("javax.script", "ScriptEngineFactory") and
this.hasName(["getProgram", "getMethodCallSyntax"])
}
/** Holds if the index is for an injectable parameter. */
bindingset[index]
predicate isInjectableArgIndex(int index) {
if
this.getDeclaringType()
.getASupertype*()
.hasQualifiedName("javax.script", "ScriptEngineFactory")
then any()
else index = 0
}
}
/** The context class `org.mozilla.javascript.Context` of Rhino Java Script Engine. */
@@ -82,10 +71,11 @@ class RhinoDefineClassMethod extends Method {
/** Holds if `ma` is a method access of `ScriptEngineMethod`. */
predicate scriptEngine(MethodAccess ma, Expr sink) {
exists(ScriptEngineMethod m, int index |
exists(ScriptEngineMethod m |
m = ma.getMethod() and
m.isInjectableArgIndex(index) and
sink = ma.getArgument(index)
if m.getDeclaringType().getASupertype*().hasQualifiedName("javax.script", "ScriptEngineFactory")
then sink = ma.getArgument(_) // all arguments allow script injection
else sink = ma.getArgument(0)
)
}