hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-03-01 21:34:50 +01:00
Code Issues Packages Projects Releases Wiki Activity

Java: add remote user input for Struts 2 ActionSupport

Browse Source
This commit is contained in:
yh-semmle
2019-02-05 20:58:56 -05:00
parent a436369846
commit 751bbbf583
2 changed files with 24 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
java/ql/src/semmle/code/java/dataflow/FlowSources.qll
View File

@@ -18,6 +18,7 @@ import semmle.code.java.frameworks.JaxWS
import semmle.code.java.frameworks.android.Intent
import semmle.code.java.frameworks.SpringWeb
import semmle.code.java.frameworks.Guice
import semmle.code.java.frameworks.struts.StrutsActions
/** Class for `tainted` user input. */
abstract class UserInput extends DataFlow::Node { }
@@ -75,6 +76,8 @@ class RemoteUserInput extends UserInput {
a = this.asParameter().getAnAnnotation() or
a = this.asExpr().(FieldRead).getField().getAnAnnotation()
)
or
exists(Struts2ActionSupportClass c | c.getASetterMethod().getField() = this.asExpr().(FieldRead).getField())
}
/**