hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-22 03:36:30 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #2725 from aschackmull/java/sqlinjection-number-barrier

Browse Source 
Java: Add java.lang.Number as a sanitizer for SQL injection.
This commit is contained in:
yo-h
2020-01-30 18:25:24 -05:00
committed by GitHub
parent b542b08c95 2a0a568cbb
commit 7ca7bdfc46
3 changed files with 13 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
java/ql/src/Security/CWE/CWE-089/SqlInjectionLib.qll
View File

@@ -54,7 +54,9 @@ private class QueryInjectionFlowConfig extends TaintTracking::Configuration {
override predicate isSink(DataFlow::Node sink) { sink instanceof QueryInjectionSink }
override predicate isSanitizer(DataFlow::Node node) {
node.getType() instanceof PrimitiveType or node.getType() instanceof BoxedType
node.getType() instanceof PrimitiveType or
node.getType() instanceof BoxedType or
node.getType() instanceof NumberType
}
}