hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-02-26 20:03:51 +01:00
Code Issues Packages Projects Releases Wiki Activity

Java: update open/jdbc-url sink kinds to request-forgery

Browse Source
This commit is contained in:
Jami Cogswell
2023-05-31 15:50:31 -04:00
parent cb10f4976b
commit 5dbb698481
50 changed files with 395 additions and 396 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll
View File

@@ -274,13 +274,12 @@ module ModelValidation {
exists(string kind | sinkModel(_, _, _, _, _, _, _, kind, _) |
not kind =
[
"open-url", "jndi-injection", "ldap-injection", "sql-injection", "jdbc-url",
"log-injection", "mvel-injection", "xpath-injection", "groovy-injection",
"html-injection", "js-injection", "ognl-injection", "intent-redirection",
"pending-intents", "url-redirection", "path-injection", "file-content-store",
"hostname-verification", "response-splitting", "information-leak", "xslt-injection",
"jexl-injection", "bean-validation", "template-injection", "fragment-injection",
"command-injection"
"request-forgery", "jndi-injection", "ldap-injection", "sql-injection", "log-injection",
"mvel-injection", "xpath-injection", "groovy-injection", "html-injection", "js-injection",
"ognl-injection", "intent-redirection", "pending-intents", "url-redirection",
"path-injection", "file-content-store", "hostname-verification", "response-splitting",
"information-leak", "xslt-injection", "jexl-injection", "bean-validation",
"template-injection", "fragment-injection", "command-injection"
] and
not kind.matches("regex-use%") and
not kind.matches("qltest%") and