hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-29 10:45:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

Java: Remove MultipartFile.getSize/isEmpty from remote flow sources

Browse Source
This commit is contained in:
Tamas Vajk
2021-03-09 12:23:47 +01:00
parent 0d405c293a
commit 5480a31b68
2 changed files with 0 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll
View File

@@ -110,8 +110,6 @@ private predicate sourceModelCsv(string row) {
"org.springframework.web.multipart;MultipartFile;true;getName;();;ReturnValue;remote",
"org.springframework.web.multipart;MultipartFile;true;getOriginalFilename;();;ReturnValue;remote",
"org.springframework.web.multipart;MultipartFile;true;getResource;();;ReturnValue;remote",
"org.springframework.web.multipart;MultipartFile;true;getSize;();;ReturnValue;remote",
"org.springframework.web.multipart;MultipartFile;true;isEmpty;();;ReturnValue;remote",
// HttpServletRequest.get*
"javax.servlet.http;HttpServletRequest;false;getHeader;(String);;ReturnValue;remote",
"javax.servlet.http;HttpServletRequest;false;getHeaders;(String);;ReturnValue;remote",

1
java/ql/test/library-tests/dataflow/taintsources/remote.expected
View File

@@ -36,7 +36,6 @@
| RmiFlowImpl.java:4:30:4:40 | path | RmiFlowImpl.java:5:28:5:31 | path |
| RmiFlowImpl.java:4:30:4:40 | path | RmiFlowImpl.java:6:29:6:35 | command |
| SpringMultiPart.java:8:3:8:17 | getBytes(...) | SpringMultiPart.java:8:3:8:17 | getBytes(...) |
| SpringMultiPart.java:9:3:9:16 | isEmpty(...) | SpringMultiPart.java:9:3:9:16 | isEmpty(...) |
| SpringMultiPart.java:10:3:10:23 | getInputStream(...) | SpringMultiPart.java:10:3:10:23 | getInputStream(...) |
| SpringMultiPart.java:11:3:11:20 | getResource(...) | SpringMultiPart.java:11:3:11:20 | getResource(...) |
| SpringMultiPart.java:12:3:12:16 | getName(...) | SpringMultiPart.java:12:3:12:16 | getName(...) |