hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-22 19:56:32 +01:00
Code Issues Packages Projects Releases Wiki Activity

java: sharpen java/maven/non-https-url to allow localhost URLs

Browse Source
This commit is contained in:
Esben Sparre Andreasen
2020-01-24 08:51:54 +01:00
parent a5558809f4
commit 57b3a55b48
2 changed files with 1 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
java/ql/src/Security/CWE/CWE-829/InsecureDependencyResolution.ql
View File

@@ -25,8 +25,7 @@ private class DeclaredRepository extends PomElement {
string getUrl() { result = getAChild("url").(PomElement).getValue() } string getUrl() { result = getAChild("url").(PomElement).getValue() }
predicate isInsecureRepositoryUsage() { predicate isInsecureRepositoryUsage() {
getUrl().matches("http://%") or getUrl().regexpMatch("(?i)^(http|ftp)://(?!localhost[:/]).*")
getUrl().matches("ftp://%")
} }
} }

3
java/ql/test/query-tests/security/CWE-829/semmle/tests/InsecureDependencyResolution.expected
View File

@@ -3,6 +3,3 @@
| insecure-pom.xml:31:9:36:30 | snapshotRepository | Downloading or uploading artifacts over insecure protocol (eg. http or ftp) to/from repository http://localhost.example | | insecure-pom.xml:31:9:36:30 | snapshotRepository | Downloading or uploading artifacts over insecure protocol (eg. http or ftp) to/from repository http://localhost.example |
| insecure-pom.xml:39:9:44:22 | repository | Downloading or uploading artifacts over insecure protocol (eg. http or ftp) to/from repository http://insecure-repository.example | | insecure-pom.xml:39:9:44:22 | repository | Downloading or uploading artifacts over insecure protocol (eg. http or ftp) to/from repository http://insecure-repository.example |
| insecure-pom.xml:47:9:52:28 | pluginRepository | Downloading or uploading artifacts over insecure protocol (eg. http or ftp) to/from repository http://insecure-repository.example | | insecure-pom.xml:47:9:52:28 | pluginRepository | Downloading or uploading artifacts over insecure protocol (eg. http or ftp) to/from repository http://insecure-repository.example |
| secure-pom.xml:31:9:36:30 | snapshotRepository | Downloading or uploading artifacts over insecure protocol (eg. http or ftp) to/from repository http://localhost/snaphots |
| secure-pom.xml:37:9:42:30 | snapshotRepository | Downloading or uploading artifacts over insecure protocol (eg. http or ftp) to/from repository http://localhost:82 |
| secure-pom.xml:51:9:55:22 | repository | Downloading or uploading artifacts over insecure protocol (eg. http or ftp) to/from repository http://localhost:${deploy.webserver.port}/repo |