hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-24 04:36:35 +01:00
Code Issues Packages Projects Releases Wiki Activity

make a few more queries consistent with the other languages

Browse Source
This commit is contained in:
erik-krogh
2022-10-02 22:38:25 +02:00
parent 2f673efc67
commit 39ffa558f1
4 changed files with 8 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
java/ql/src/Security/CWE/CWE-117/LogInjection.ql
View File

@@ -17,5 +17,5 @@ import DataFlow::PathGraph
from LogInjectionConfiguration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
where cfg.hasFlowPath(source, sink)
select sink.getNode(), source, sink, "Log entry depends on a $@.", source.getNode(),
select sink.getNode(), source, sink, "This log entry depends on a $@.", source.getNode(),
"user-provided value"

2
java/ql/src/Security/CWE/CWE-190/ArithmeticUncontrolled.ql
View File

@@ -55,5 +55,5 @@ where
underflowSink(exp, sink.getNode().asExpr()) and
effect = "underflow"
select exp, source, sink,
"This arithmetic expression depends on a $@, potentially causing an " + effect + ".",
"This arithmetic expression depends on an $@, potentially causing an " + effect + ".",
source.getNode(), "uncontrolled value"

4
java/ql/src/Security/CWE/CWE-918/RequestForgery.ql
View File

@@ -17,5 +17,5 @@ import DataFlow::PathGraph
from DataFlow::PathNode source, DataFlow::PathNode sink, RequestForgeryConfiguration conf
where conf.hasFlowPath(source, sink)
select sink.getNode(), source, sink, "Potential server-side request forgery due to $@.",
source.getNode(), "a user-provided value"
select sink.getNode(), source, sink, "Potential server-side request forgery due to a $@.",
source.getNode(), "user-provided value"

8
java/ql/test/query-tests/security/CWE-190/semmle/tests/ArithmeticUncontrolled.expected
View File

@@ -12,7 +12,7 @@ nodes
| Test.java:280:37:280:41 | data2 | semmle.label | data2 |
subpaths
#select
| Test.java:210:17:210:24 | ... + ... | Test.java:206:14:206:57 | nextInt(...) : Number | Test.java:210:17:210:20 | data | This arithmetic expression depends on a $@, potentially causing an overflow. | Test.java:206:14:206:57 | nextInt(...) | uncontrolled value |
| Test.java:241:37:241:46 | ... + ... | Test.java:206:14:206:57 | nextInt(...) : Number | Test.java:241:37:241:40 | data | This arithmetic expression depends on a $@, potentially causing an overflow. | Test.java:206:14:206:57 | nextInt(...) | uncontrolled value |
| Test.java:249:17:249:25 | ... + ... | Test.java:245:15:245:35 | nextInt(...) : Number | Test.java:249:17:249:21 | data2 | This arithmetic expression depends on a $@, potentially causing an overflow. | Test.java:245:15:245:35 | nextInt(...) | uncontrolled value |
| Test.java:280:37:280:47 | ... + ... | Test.java:245:15:245:35 | nextInt(...) : Number | Test.java:280:37:280:41 | data2 | This arithmetic expression depends on a $@, potentially causing an overflow. | Test.java:245:15:245:35 | nextInt(...) | uncontrolled value |
| Test.java:210:17:210:24 | ... + ... | Test.java:206:14:206:57 | nextInt(...) : Number | Test.java:210:17:210:20 | data | This arithmetic expression depends on an $@, potentially causing an overflow. | Test.java:206:14:206:57 | nextInt(...) | uncontrolled value |
| Test.java:241:37:241:46 | ... + ... | Test.java:206:14:206:57 | nextInt(...) : Number | Test.java:241:37:241:40 | data | This arithmetic expression depends on an $@, potentially causing an overflow. | Test.java:206:14:206:57 | nextInt(...) | uncontrolled value |
| Test.java:249:17:249:25 | ... + ... | Test.java:245:15:245:35 | nextInt(...) : Number | Test.java:249:17:249:21 | data2 | This arithmetic expression depends on an $@, potentially causing an overflow. | Test.java:245:15:245:35 | nextInt(...) | uncontrolled value |
| Test.java:280:37:280:47 | ... + ... | Test.java:245:15:245:35 | nextInt(...) : Number | Test.java:280:37:280:41 | data2 | This arithmetic expression depends on an $@, potentially causing an overflow. | Test.java:245:15:245:35 | nextInt(...) | uncontrolled value |