hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-24 04:36:35 +01:00
Code Issues Packages Projects Releases Wiki Activity

Java: remove more path-injection related classes (will maybe add some of these back in a separate PR)

Browse Source
This commit is contained in:
Jami Cogswell
2023-11-30 11:31:39 -05:00
parent 2a682995ae
commit 4ff884e26c
4 changed files with 0 additions and 60 deletions
Download Patch File Download Diff File Expand all files Collapse all files

35
java/ql/lib/semmle/code/java/Jsf.qll
View File

@@ -1,35 +0,0 @@
/**
* Provides classes and predicates for working with the Java Server Faces (JSF).
*/
// TODO: COMBINE WITH EXISTING JSF-RELATED QLL FILES!
import java
/**
* The JSF class `ExternalContext` for processing HTTP requests.
*/
class ExternalContext extends RefType {
ExternalContext() {
this.hasQualifiedName(["javax.faces.context", "jakarta.faces.context"], "ExternalContext")
}
}
/**
* The method `getResource()` declared in JSF `ExternalContext`.
*/
class GetFacesResourceMethod extends Method {
GetFacesResourceMethod() {
this.getDeclaringType().getASupertype*() instanceof ExternalContext and
this.hasName("getResource")
}
}
/**
* The method `getResourceAsStream()` declared in JSF `ExternalContext`.
*/
class GetFacesResourceAsStreamMethod extends Method {
GetFacesResourceAsStreamMethod() {
this.getDeclaringType().getASupertype*() instanceof ExternalContext and
this.hasName("getResourceAsStream")
}
}

22
java/ql/lib/semmle/code/java/SpringResource.qll
View File

@@ -1,22 +0,0 @@
/**
* Provides classes for working with resource loading in Spring.
*/
// TODO: COMBINE WITH EXISTING SPRING-RELATED QLL FILES!
import java
private import semmle.code.java.dataflow.FlowSources
/** A utility class for resolving resource locations to files in the file system in the Spring framework. */
class ResourceUtils extends Class {
ResourceUtils() { this.hasQualifiedName("org.springframework.util", "ResourceUtils") }
}
/**
* A method declared in `org.springframework.util.ResourceUtils` that loads Spring resources.
*/
class GetResourceUtilsMethod extends Method {
GetResourceUtilsMethod() {
this.getDeclaringType().getASupertype*() instanceof ResourceUtils and
this.hasName(["extractArchiveURL", "extractJarFileURL", "getFile", "getURL"])
}
}

2
java/ql/lib/semmle/code/java/security/UnsafeUrlForward.qll
View File

@@ -1,10 +1,8 @@
import java
private import semmle.code.java.Jsf
private import semmle.code.java.dataflow.ExternalFlow
private import semmle.code.java.dataflow.FlowSources
private import semmle.code.java.dataflow.StringPrefixes
private import semmle.code.java.frameworks.javaee.ejb.EJBRestrictions
private import semmle.code.java.SpringResource
/** A sink for unsafe URL forward vulnerabilities. */
abstract class UnsafeUrlForwardSink extends DataFlow::Node { }

1
java/ql/lib/semmle/code/java/security/UnsafeUrlForwardQuery.qll
View File

@@ -4,7 +4,6 @@ import java
import semmle.code.java.security.UnsafeUrlForward
import semmle.code.java.dataflow.FlowSources
import semmle.code.java.dataflow.TaintTracking
import semmle.code.java.Jsf
import semmle.code.java.security.PathSanitizer
/**