hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-27 09:45:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1724 from aschackmull/java/google-xmlreader

Browse Source 
Java: Treat SecureJDKXercesXMLReader as a secure XMLReader.
This commit is contained in:
yh-semmle
2019-08-13 09:52:32 -04:00
committed by GitHub
parent 36043d04bd 41763e6025
commit 5e910a4808
1 changed files with 11 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
java/ql/src/Security/CWE/CWE-611/XmlParsers.qll
View File

@@ -725,21 +725,27 @@ private class CreatedSafeXMLReaderFlowConfig extends DataFlow3::Configuration {
}
/** An `XMLReader` that is obtained from a safe source. */
class CreatedSafeXMLReader extends MethodAccess {
class CreatedSafeXMLReader extends Call {
CreatedSafeXMLReader() {
//Obtained from SAXParser
exists(SafeSAXParserFlowConfig safeParser |
this.getMethod().getDeclaringType() instanceof SAXParser and
this.getMethod().hasName("getXMLReader") and
this.(MethodAccess).getMethod().getDeclaringType() instanceof SAXParser and
this.(MethodAccess).getMethod().hasName("getXMLReader") and
safeParser.hasFlowToExpr(this.getQualifier())
)
or
//Obtained from SAXReader
exists(SafeSAXReaderFlowConfig safeReader |
this.getMethod().getDeclaringType() instanceof SAXReader and
this.getMethod().hasName("getXMLReader") and
this.(MethodAccess).getMethod().getDeclaringType() instanceof SAXReader and
this.(MethodAccess).getMethod().hasName("getXMLReader") and
safeReader.hasFlowToExpr(this.getQualifier())
)
or
exists(RefType secureReader, string package |
this.(ClassInstanceExpr).getConstructedType() = secureReader and
secureReader.hasQualifiedName(package, "SecureJDKXercesXMLReader") and
package.matches("com.google.%common.xml.parsing")
)
}
predicate flowsTo(SafeXMLReaderFlowSink sink) {