hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-29 02:35:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

Java: add websocket reads as remote flow source.

Browse Source 
Currently, JAX-WS reads are considered as untrusted. However, `java.net.http.WebSocket` reads are not marked as such.

This PR adds support for the same.
This commit is contained in:
Porcupiney Hairs
2020-05-12 22:45:48 +05:30
parent 768e5190a1
commit 3f6eef8437
3 changed files with 57 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
java/ql/test/query-tests/security/CWE-079/semmle/tests/WebsocketXss.java Normal file
View File

@@ -0,0 +1,27 @@
// package test.cwe079.cwe.examples;
// import java.net.http.HttpClient;
// import java.net.http.WebSocket;
// import java.net.URI;
// import java.util.*;
// import java.util.concurrent.*;
// public class WebsocketXss {
// public static void main(String[] args) throws Exception {
// WebSocket.Listener listener = new WebSocket.Listener() {
// public CompletionStage<?> onText(WebSocket webSocket, CharSequence message, boolean last) {
// try {
// HttpClient client = HttpClient.newBuilder().build();
// CompletableFuture<WebSocket> ws = client.newWebSocketBuilder()
// .buildAsync(URI.create("ws://websocket.example.com"), null);
// ws.get().sendText​(message, false);
// } catch (Exception e) {
// // TODO: handle exception
// }
// return null;
// };
// };
// }
// }