hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-22 11:46:32 +01:00
Code Issues Packages Projects Releases Wiki Activity

Refactor Hudson file methods to MaD

Browse Source
This commit is contained in:
Edward Minnix III
2023-09-02 15:15:59 -04:00
committed by Ed Minnix
parent 3a75c0fde7
commit a1d3667f1c
2 changed files with 5 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
java/ql/lib/ext/hudson.model.yml
View File

@@ -36,6 +36,11 @@ extensions:
pack: codeql/java-all
extensible: sourceModel
data:
- ["hudson", "FilePath", False, "newInputStreamDenyingSymlinkAsNeeded", "", "", "ReturnValue", "file", "manual"]
- ["hudson", "FilePath", False, "openInputStream", "", "", "ReturnValue", "file", "manual"]
- ["hudson", "FilePath", False, "read", "", "", "ReturnValue", "file", "manual"]
- ["hudson", "FilePath", False, "readFromOffset", "", "", "ReturnValue", "file", "manual"]
- ["hudson", "FilePath", False, "readToString", "", "", "ReturnValue", "file", "manual"]
- ["hudson", "Plugin", True, "configure", "", "", "Parameter", "remote", "manual"]
- ["hudson", "Plugin", True, "newInstance", "", "", "Parameter", "remote", "manual"]
- addsTo:

15
java/ql/lib/semmle/code/java/frameworks/hudson/Hudson.qll
View File

@@ -13,21 +13,6 @@ class HudsonWebMethod extends Method {
}
}
private class FilePathRead extends LocalUserInput {
FilePathRead() {
this.asExpr()
.(MethodAccess)
.getMethod()
.hasQualifiedName("hudson", "FilePath",
[
"newInputStreamDenyingSymlinkAsNeeded", "openInputStream", "read", "readFromOffset",
"readToString"
])
}
override string getThreatModel() { result = "file" }
}
private class HudsonUtilXssSanitizer extends XssSanitizer {
HudsonUtilXssSanitizer() {
this.asExpr()