hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-19 14:04:09 +02:00
Code Issues Packages Projects Releases Wiki Activity

Java: update url-redirect sink kind to url-redirection

Browse Source
This commit is contained in:
Jami Cogswell
2023-05-09 11:58:07 -04:00
parent d24d8b1626
commit 55be2e5b67
6 changed files with 8 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
java/ql/lib/ext/jakarta.ws.rs.core.model.yml
View File

@@ -3,8 +3,8 @@ extensions:
pack: codeql/java-all
extensible: sinkModel
data:
- ["jakarta.ws.rs.core", "Response", True, "seeOther", "", "", "Argument[0]", "url-redirect", "manual"]
- ["jakarta.ws.rs.core", "Response", True, "temporaryRedirect", "", "", "Argument[0]", "url-redirect", "manual"]
- ["jakarta.ws.rs.core", "Response", True, "seeOther", "", "", "Argument[0]", "url-redirection", "manual"]
- ["jakarta.ws.rs.core", "Response", True, "temporaryRedirect", "", "", "Argument[0]", "url-redirection", "manual"]
- addsTo:
pack: codeql/java-all
extensible: summaryModel

4
java/ql/lib/ext/javax.ws.rs.core.model.yml
View File

@@ -3,8 +3,8 @@ extensions:
pack: codeql/java-all
extensible: sinkModel
data:
- ["javax.ws.rs.core", "Response", True, "seeOther", "", "", "Argument[0]", "url-redirect", "manual"]
- ["javax.ws.rs.core", "Response", True, "temporaryRedirect", "", "", "Argument[0]", "url-redirect", "manual"]
- ["javax.ws.rs.core", "Response", True, "seeOther", "", "", "Argument[0]", "url-redirection", "manual"]
- ["javax.ws.rs.core", "Response", True, "temporaryRedirect", "", "", "Argument[0]", "url-redirection", "manual"]
- ["javax.ws.rs.core", "ResponseBuilder", False, "header", "", "", "Argument[1]", "header-splitting", "manual"]
- addsTo:
pack: codeql/java-all

2
java/ql/lib/ext/org.geogebra.web.full.main.model.yml
View File

@@ -4,4 +4,4 @@ extensions:
pack: codeql/java-all
extensible: sinkModel
data:
- ["org.geogebra.web.full.main", "FileManager", True, "open", "(String,String)", "", "Argument[0]", "url-redirect", "ai-manual"]
- ["org.geogebra.web.full.main", "FileManager", True, "open", "(String,String)", "", "Argument[0]", "url-redirection", "ai-manual"]

2
java/ql/lib/ext/org.kohsuke.stapler.model.yml
View File

@@ -3,5 +3,5 @@ extensions:
pack: codeql/java-all
extensible: sinkModel
data:
- ["org.kohsuke.stapler", "HttpResponses", True, "redirectTo", "(String)", "", "Argument[0]", "url-redirect", "ai-manual"]
- ["org.kohsuke.stapler", "HttpResponses", True, "redirectTo", "(String)", "", "Argument[0]", "url-redirection", "ai-manual"]
- ["org.kohsuke.stapler", "HttpResponses", True, "staticResource", "(URL)", "", "Argument[0]", "open-url", "ai-manual"]

2
java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll
View File

@@ -276,7 +276,7 @@ module ModelValidation {
[
"open-url", "jndi-injection", "ldap", "sql-injection", "jdbc-url", "logging", "mvel",
"xpath", "groovy", "xss", "ognl-injection", "intent-start", "pending-intent-sent",
"url-redirect", "create-file", "read-file", "write-file", "set-hostname-verifier",
"url-redirection", "create-file", "read-file", "write-file", "set-hostname-verifier",
"header-splitting", "information-leak", "xslt", "jexl", "bean-validation", "ssti",
"fragment-injection", "command-injection"
] and

2
java/ql/lib/semmle/code/java/security/UrlRedirect.qll
View File

@@ -12,7 +12,7 @@ abstract class UrlRedirectSink extends DataFlow::Node { }
/** A default sink represeting methods susceptible to URL redirection attacks. */
private class DefaultUrlRedirectSink extends UrlRedirectSink {
DefaultUrlRedirectSink() { sinkNode(this, "url-redirect") }
DefaultUrlRedirectSink() { sinkNode(this, "url-redirection") }
}
/** A Servlet URL redirection sink. */