mirror of
https://github.com/github/codeql.git
synced 2026-04-25 08:45:14 +02:00
Java: Clean up MVEL injection query
This commit is contained in:
@@ -23,6 +23,7 @@ The following example uses untrusted data to build a MVEL expression
|
||||
and then runs it in the default powerfull context.
|
||||
</p>
|
||||
<sample src="UnsafeMvelExpressionEvaluation.java" />
|
||||
</example>
|
||||
|
||||
<references>
|
||||
<li>
|
||||
|
||||
@@ -100,10 +100,6 @@ predicate createCompiledAccExpressionStep(DataFlow::Node node1, DataFlow::Node n
|
||||
)
|
||||
}
|
||||
|
||||
predicate test() {
|
||||
exists(ConstructorCall cc | cc.getConstructedType() instanceof CompiledAccExpression)
|
||||
}
|
||||
|
||||
/**
|
||||
* Holds if `node1` to `node2` is a dataflow step that compiles a MVEL expression
|
||||
* by calling `ExpressionCompiler.compile()`.
|
||||
|
||||
Reference in New Issue
Block a user