hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 11:15:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

Removed LocalUserInput in JexlInjectionLib.ql

Browse Source
This commit is contained in:
Artem Smotrakov
2021-01-29 12:38:51 +01:00
parent 8d701e604a
commit 59f48ecea3
1 changed files with 1 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
java/ql/src/experimental/Security/CWE/CWE-094/JexlInjectionLib.qll
View File

@@ -12,8 +12,7 @@ class JexlInjectionConfig extends TaintTracking::Configuration {
override predicate isSource(DataFlow::Node source) {
source instanceof TaintedSpringRequestBody or
source instanceof RemoteFlowSource or
source instanceof LocalUserInput
source instanceof RemoteFlowSource
}
override predicate isSink(DataFlow::Node sink) { sink instanceof JexlEvaluationSink }