hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-20 10:46:30 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #9002 from atorralba/atorralba/https-urls-improvs

Browse Source 
Java: Add OkHttp and Retrofit models
This commit is contained in:
Tony Torralba
2022-05-11 10:48:08 +02:00
committed by GitHub
parent 506e09ef32 2d3b15f936
commit 43b425d0e4
117 changed files with 6173 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
java/ql/src/Security/CWE/CWE-319/HttpsUrls.ql
View File

@@ -14,10 +14,7 @@ import java
import semmle.code.java.security.HttpsUrlsQuery
import DataFlow::PathGraph
from DataFlow::PathNode source, DataFlow::PathNode sink, MethodAccess m, HttpStringLiteral s
where
source.getNode().asExpr() = s and
sink.getNode().asExpr() = m.getQualifier() and
any(HttpStringToUrlOpenMethodFlowConfig c).hasFlowPath(source, sink)
select m, source, sink, "URL may have been constructed with HTTP protocol, using $@.", s,
"this source"
from DataFlow::PathNode source, DataFlow::PathNode sink
where any(HttpStringToUrlOpenMethodFlowConfig c).hasFlowPath(source, sink)
select sink.getNode(), source, sink, "URL may have been constructed with HTTP protocol, using $@.",
source.getNode(), "this source"

5
java/ql/src/change-notes/2022-05-02-non-https-urls-simplified.md Normal file
View File

@@ -0,0 +1,5 @@
---
category: minorAnalysis
---
* The query `java/non-https-urls` has been simplified
and no longer requires its sinks to be `MethodAccess`es.