hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-26 17:25:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

Sinks for CloseableThreadContext

Browse Source
This commit is contained in:
Tony Torralba
2021-12-17 09:16:19 +01:00
parent 8fabbd697e
commit 6f2d91a8ad
4 changed files with 5045 additions and 4982 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9982
java/ql/test/experimental/query-tests/security/CWE-020/Log4jInjectionTest.expected
View File

File diff suppressed because it is too large Load Diff

12
java/ql/test/experimental/query-tests/security/CWE-020/Log4jJndiInjectionTest.java
View File

@@ -3,17 +3,18 @@ import java.util.HashMap;
import javax.servlet.http.HttpServletRequest;
import org.apache.logging.log4j.CloseableThreadContext;
import org.apache.logging.log4j.Level;
import org.apache.logging.log4j.LogBuilder;
import org.apache.logging.log4j.Logger;
import org.apache.logging.log4j.Marker;
import org.apache.logging.log4j.ThreadContext;
import org.apache.logging.log4j.message.EntryMessage;
import org.apache.logging.log4j.message.MapMessage;
import org.apache.logging.log4j.message.StringMapMessage;
import org.apache.logging.log4j.message.Message;
import org.apache.logging.log4j.util.MessageSupplier;
import org.apache.logging.log4j.util.Supplier;
import org.apache.logging.log4j.ThreadContext;
public class Log4jJndiInjectionTest {
@@ -1111,5 +1112,14 @@ public class Log4jJndiInjectionTest {
mmsg.putAll(map);
logger.error(mmsg);
}
{
CloseableThreadContext.put("username", (String) source());
CloseableThreadContext.put("safe", "safe").put("username", (String) source());
Map<String, String> map = new HashMap<String, String>();
map.put("username", (String) source());
CloseableThreadContext.putAll(map);
CloseableThreadContext.put("safe", "safe").putAll(map);
}
}
}

26
java/ql/test/stubs/apache-log4j-2.14.1/org/apache/logging/log4j/CloseableThreadContext.java generated Normal file
View File

@@ -0,0 +1,26 @@
// Generated automatically from org.apache.logging.log4j.CloseableThreadContext for testing purposes
package org.apache.logging.log4j;
import java.util.List;
import java.util.Map;
public class CloseableThreadContext
{
protected CloseableThreadContext() {}
public static CloseableThreadContext.Instance push(String p0){ return null; }
public static CloseableThreadContext.Instance push(String p0, Object... p1){ return null; }
public static CloseableThreadContext.Instance pushAll(List<String> p0){ return null; }
public static CloseableThreadContext.Instance put(String p0, String p1){ return null; }
public static CloseableThreadContext.Instance putAll(Map<String, String> p0){ return null; }
static public class Instance implements AutoCloseable
{
protected Instance() {}
public CloseableThreadContext.Instance push(String p0){ return null; }
public CloseableThreadContext.Instance push(String p0, Object[] p1){ return null; }
public CloseableThreadContext.Instance pushAll(List<String> p0){ return null; }
public CloseableThreadContext.Instance put(String p0, String p1){ return null; }
public CloseableThreadContext.Instance putAll(Map<String, String> p0){ return null; }
public void close(){}
}
}