hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-03 12:45:27 +02:00
Code Issues Packages Projects Releases Wiki Activity

Model UriInfo.relativize and resolve.

Browse Source
This commit is contained in:
Chris Smowton
2021-08-17 10:19:21 +01:00
parent 62ecab8432
commit 5e7a3ca2e6
3 changed files with 19 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
java/ql/test/library-tests/frameworks/JaxWs/JakartaRsFlow.java
View File

@@ -196,7 +196,7 @@ public class JakartaRsFlow {
sink(taint(ps2).getPath()); // $ hasTaintFlow
}
void testUriInfo(UriInfo ui) {
void testUriInfo(UriInfo ui, UriInfo untaintedUriInfo) throws Exception {
ui = taint(ui);
sink(ui.getPathParameters()); // $ hasTaintFlow
sink(ui.getPathSegments()); // $ hasTaintFlow
@@ -206,6 +206,11 @@ public class JakartaRsFlow {
sink(ui.getQueryParameters().getFirst("someKey")); // $ hasTaintFlow
sink(ui.getRequestUri()); // $ hasTaintFlow
sink(ui.getRequestUriBuilder().build()); // $ hasTaintFlow
URI taintedUri = UriSource.taint();
URI untaintedUri = new URI("");
sink(untaintedUriInfo.relativize(taintedUri)); // $ hasTaintFlow
sink(untaintedUriInfo.resolve(taintedUri)); // $ hasTaintFlow
sink(ui.resolve(untaintedUri)); // $ hasTaintFlow
}
void testCookie() {

7
java/ql/test/library-tests/frameworks/JaxWs/JaxRsFlow.java
View File

@@ -192,7 +192,7 @@ public class JaxRsFlow {
sink(taint(ps2).getPath()); // $ hasTaintFlow
}
void testUriInfo(UriInfo ui) {
void testUriInfo(UriInfo ui, UriInfo untaintedUriInfo) throws Exception {
ui = taint(ui);
sink(ui.getPathParameters()); // $ hasTaintFlow
sink(ui.getPathSegments()); // $ hasTaintFlow
@@ -202,6 +202,11 @@ public class JaxRsFlow {
sink(ui.getQueryParameters().getFirst("someKey")); // $ hasTaintFlow
sink(ui.getRequestUri()); // $ hasTaintFlow
sink(ui.getRequestUriBuilder().build()); // $ hasTaintFlow
URI taintedUri = UriSource.taint();
URI untaintedUri = new URI("");
sink(untaintedUriInfo.relativize(taintedUri)); // $ hasTaintFlow
sink(untaintedUriInfo.resolve(taintedUri)); // $ hasTaintFlow
sink(ui.resolve(untaintedUri)); // $ hasTaintFlow
}
void testCookie() {