hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 11:15:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

*)update XQueryInjection.ql

Browse Source
This commit is contained in:
haby0
2021-01-23 18:26:58 +08:00
committed by GitHub
parent ec4c155043
commit 44d99f8cd4
1 changed files with 22 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
java/ql/src/Security/CWE/CWE-652/XQueryInjection.ql
View File

@@ -15,6 +15,28 @@ import semmle.code.java.dataflow.FlowSources
import XQueryInjectionLib
import DataFlow::PathGraph
class XQueryInjectionConfig extends DataFlow::Configuration {
XQueryInjectionConfig() { this = "XQueryInjectionConfig" }
override predicate isSource(DataFlow::Node source) { source instanceof XQueryInjectionSource }
override predicate isSink(DataFlow::Node sink) { sink instanceof XQueryInjectionSink }
override predicate isBarrier(DataFlow::Node node) {
exists(MethodAccess ma, Method m, BindParameterRemoteFlowConf conf, DataFlow::Node node1 |
m = ma.getMethod()
|
node.asExpr() = ma and
m.hasName("bindString") and
m.getDeclaringType()
.getASourceSupertype*()
.hasQualifiedName("javax.xml.xquery", "XQDynamicContext") and
ma.getArgument(1) = node1.asExpr() and
conf.hasFlowTo(node1)
)
}
}
from DataFlow::PathNode source, DataFlow::PathNode sink, XQueryInjectionConfig conf
where conf.hasFlowPath(source, sink)
select sink.getNode(), source, sink, "XQuery query might include code from $@.", source.getNode(),