hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-23 04:06:37 +01:00
Code Issues Packages Projects Releases Wiki Activity

Python: Rename sink definitions for XXE/XML bomb

Browse Source
This commit is contained in:
Rasmus Wriedt Larsen
2022-04-07 15:34:56 +02:00
parent 7728b6cf1b
commit 405480c410
2 changed files with 6 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
python/ql/src/experimental/semmle/python/security/dataflow/XmlBombCustomizations.qll
View File

@@ -35,11 +35,10 @@ module XmlBomb {
} }
/** /**
* A call to an XML parser that performs internal entity expansion, viewed * A call to an XML parser that is vulnerable to XML bombs.
* as a data flow sink for XML-bomb vulnerabilities.
*/ */
class XmlParsingWithEntityResolution extends Sink { class XmlParsingVulnerableToXmlBomb extends Sink {
XmlParsingWithEntityResolution() { XmlParsingVulnerableToXmlBomb() {
exists(XML::XmlParsing parsing, XML::XmlParsingVulnerabilityKind kind | exists(XML::XmlParsing parsing, XML::XmlParsingVulnerabilityKind kind |
kind.isXmlBomb() and kind.isXmlBomb() and
parsing.vulnerableTo(kind) and parsing.vulnerableTo(kind) and

7
python/ql/src/experimental/semmle/python/security/dataflow/XxeCustomizations.qll
View File

@@ -35,11 +35,10 @@ module Xxe {
} }
/** /**
* A call to an XML parser that performs external entity expansion, viewed * A call to an XML parser that is vulnerable to XXE.
* as a data flow sink for XXE vulnerabilities.
*/ */
class XmlParsingWithExternalEntityResolution extends Sink { class XmlParsingVulnerableToXxe extends Sink {
XmlParsingWithExternalEntityResolution() { XmlParsingVulnerableToXxe() {
exists(XML::XmlParsing parsing, XML::XmlParsingVulnerabilityKind kind | exists(XML::XmlParsing parsing, XML::XmlParsingVulnerabilityKind kind |
kind.isXxe() and kind.isXxe() and
parsing.vulnerableTo(kind) and parsing.vulnerableTo(kind) and