hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-22 15:25:18 +02:00
Code Issues Packages Projects Releases Wiki Activity

Revert "Add additional example."

Browse Source 
This reverts commit 947b094387.
This commit is contained in:
Max Schaefer
2023-11-16 11:54:16 +00:00
parent 143e1680bd
commit a5e7ef424e
3 changed files with 0 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
java/ql/src/Security/CWE/CWE-022/TaintedPath.qhelp
View File

@@ -46,11 +46,6 @@ not contain ".." and starts with the public folder.</p>
<sample src="TaintedPathGood.java" />
<p>Alternatively, if you only want to allow simple filenames without a path component, you can remove all path
separators ("/" or "\") and all ".." sequences from the input before using it to construct a file path.</p>
<sample src="TaintedPathGood2.java" />
</example>
<references>

13
java/ql/src/Security/CWE/CWE-022/TaintedPathGood2.java
View File

@@ -1,13 +0,0 @@
public void sendUserFileGood(Socket sock, String user) {
BufferedReader filenameReader = new BufferedReader(
new InputStreamReader(sock.getInputStream(), "UTF-8"));
String filename = filenameReader.readLine();
// GOOD: remove all ".." sequences and path separators from the filename
filename = filename.replaceAll("\\.\\.|[/\\\\]", "");
BufferedReader fileReader = new BufferedReader(new FileReader(filename));
String fileLine = fileReader.readLine();
while(fileLine != null) {
sock.getOutputStream().write(fileLine.getBytes());
fileLine = fileReader.readLine();
}
}

13
java/ql/test/query-tests/security/CWE-022/semmle/tests/TaintedPath.java
View File

@@ -32,17 +32,4 @@ public class TaintedPath {
}
}
}
public void sendUserFileGood2(Socket sock, String user) throws IOException {
BufferedReader filenameReader = new BufferedReader(new InputStreamReader(sock.getInputStream(), "UTF-8"));
String filename = filenameReader.readLine();
// GOOD: remove all ".." sequences and path separators from the filename
filename = filename.replaceAll("\\.\\.|[/\\\\]", "");
BufferedReader fileReader = new BufferedReader(new FileReader(filename));
String fileLine = fileReader.readLine();
while(fileLine != null) {
sock.getOutputStream().write(fileLine.getBytes());
fileLine = fileReader.readLine();
}
}
}