hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-03-01 05:13:41 +01:00
Code Issues Packages Projects Releases Wiki Activity

Join ServletUrlRedirectSink with UrlRedirectSink

Browse Source
This commit is contained in:
Remco Vermeulen
2020-07-09 14:08:43 +02:00
parent 88f4b224c3
commit ba9f3e2a1e
4 changed files with 21 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
java/ql/src/semmle/code/java/security/UrlRedirect.qll
View File

@@ -1,5 +1,24 @@
import java
import semmle.code.java.dataflow.DataFlow
import semmle.code.java.frameworks.Servlets
/** A URL redirection sink */
abstract class UrlRedirectSink extends DataFlow::Node { }
/** A Servlet URL redirection sink. */
class ServletUrlRedirectSink extends UrlRedirectSink {
ServletUrlRedirectSink() {
exists(MethodAccess ma |
ma.getMethod() instanceof HttpServletResponseSendRedirectMethod and
this.asExpr() = ma.getArgument(0)
)
or
exists(MethodAccess ma |
ma.getMethod() instanceof ResponseSetHeaderMethod or
ma.getMethod() instanceof ResponseAddHeaderMethod
|
ma.getArgument(0).(CompileTimeConstantExpr).getStringValue() = "Location" and
this.asExpr() = ma.getArgument(1)
)
}
}