Java: Clean up MVEL injection query

This commit is contained in:
Artem Smotrakov
2020-06-05 17:22:45 +03:00
parent 2842aeee72
commit b7c3dd666c
2 changed files with 1 additions and 4 deletions

View File

@@ -23,6 +23,7 @@ The following example uses untrusted data to build a MVEL expression
and then runs it in the default powerfull context.
</p>
<sample src="UnsafeMvelExpressionEvaluation.java" />
</example>
<references>
<li>

View File

@@ -100,10 +100,6 @@ predicate createCompiledAccExpressionStep(DataFlow::Node node1, DataFlow::Node n
)
}
predicate test() {
exists(ConstructorCall cc | cc.getConstructedType() instanceof CompiledAccExpression)
}
/**
* Holds if `node1` to `node2` is a dataflow step that compiles a MVEL expression
* by calling `ExpressionCompiler.compile()`.