hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-01 03:35:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

Apply suggestions from code review

Browse Source 
Co-authored-by: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com>
This commit is contained in:
Jorge
2021-10-16 10:04:50 +02:00
committed by GitHub
parent 320a00be31
commit be424704a6
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
python/ql/src/experimental/semmle/python/frameworks/XML.qll
View File

@@ -69,8 +69,9 @@ private module XML {
* ```
*
* `this` would be `xml.sax.make_parser()`, `getAnInput()` would return `StringIO(xml_content)`
* and `mayBeDangerous()` would succeed since `xml.sax.handler.feature_external_ges` is set to
* `False` and so it's vulnerable.
* and `mayBeDangerous()` would not hold since `xml.sax.handler.feature_external_ges` is set to
* `False` and so is not vulnerable.
* see https://docs.python.org/3/library/xml.sax.handler.html#xml.sax.handler.feature_external_ges
*/
private class XMLSaxParser extends DataFlow::CallCfgNode, XMLParser::Range {
DataFlow::CallCfgNode attrCall;