hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-02 12:15:17 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #7702 from atorralba/atorralba/fix-jndi-injection-sinks

Browse Source 
Java: Remove some JNDI Injection sinks
This commit is contained in:
Anders Schack-Mulligen
2022-01-24 10:53:58 +01:00
committed by GitHub
parent 9bd2ac96ea 908b7c43f2
commit 7af6dc7164
33 changed files with 704 additions and 175 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
java/ql/test/query-tests/security/CWE-074/JndiInjectionTest.java
View File

@@ -110,7 +110,17 @@ public class JndiInjectionTest {
LdapTemplate ctx = new LdapTemplate();
Name name = new CompositeName().add(nameStr);
ctx.lookup(name); // $hasJndiInjection
ctx.lookup(name, (AttributesMapper) null); // Safe
ctx.lookup(name, (ContextMapper) null); // $hasJndiInjection
ctx.lookup(name, new String[] {}, (AttributesMapper) null); // Safe
ctx.lookup(name, new String[] {}, (ContextMapper) null); // $hasJndiInjection
ctx.lookup(nameStr); // $hasJndiInjection
ctx.lookup(nameStr, (AttributesMapper) null); // Safe
ctx.lookup(nameStr, (ContextMapper) null); // $hasJndiInjection
ctx.lookup(nameStr, new String[] {}, (AttributesMapper) null); // Safe
ctx.lookup(nameStr, new String[] {}, (ContextMapper) null); // $hasJndiInjection
ctx.lookupContext(name); // $hasJndiInjection
ctx.lookupContext(nameStr); // $hasJndiInjection
ctx.findByDn(name, null); // $hasJndiInjection
ctx.rename(name, null); // $hasJndiInjection

2
java/ql/test/query-tests/security/CWE-074/options
View File

@@ -1 +1 @@
//semmle-extractor-options: --javac-args -cp ${testdir}/../../../stubs/springframework-5.3.8:${testdir}/../../../stubs/shiro-core-1.5.2:${testdir}/../../../stubs/spring-ldap-2.3.2:${testdir}/../../../stubs/Saxon-HE-9.9.1-7
//semmle-extractor-options: --javac-args -cp ${testdir}/../../../stubs/springframework-5.3.8:${testdir}/../../../stubs/shiro-core-1.5.2:${testdir}/../../../stubs/spring-ldap-2.3.2:${testdir}/../../../stubs/Saxon-HE-9.9.1-7:${testdir}/../../../stubs/apache-commons-logging-1.2