hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-24 12:46:34 +01:00
Code Issues Packages Projects Releases Wiki Activity

add String type startsWith

Browse Source
This commit is contained in:
haby0
2021-04-22 19:20:54 +08:00
parent 1712d01b74
commit 407dcea751
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
java/ql/src/experimental/Security/CWE/CWE-348/UseOfLessTrustedSourceLib.qll
View File

@@ -52,11 +52,13 @@ private class CompareSink extends UseOfLessTrustedSink {
)
or
exists(MethodAccess ma |
ma.getMethod().hasName("contains") and
ma.getMethod().getName() in ["contains", "startsWith"] and
ma.getMethod().getDeclaringType() instanceof TypeString and
ma.getMethod().getNumberOfParameters() = 1 and
ma.getQualifier() = this.asExpr() and
not ma.getArgument(0).(CompileTimeConstantExpr).getStringValue().toLowerCase() in ["", "unknown"]
not ma.getArgument(0).(CompileTimeConstantExpr).getStringValue().toLowerCase() in [
"", "unknown"
]
)
or
exists(MethodAccess ma |