From bed6a9886f080b5a2f99af2c2c84d3d398fbc4bb Mon Sep 17 00:00:00 2001 From: Grzegorz Golawski Date: Wed, 22 Jan 2020 21:42:47 +0100 Subject: [PATCH] Query to detect LDAP injections in Java Autoformat --- java/ql/src/Security/CWE/CWE-90/LdapInjection.ql | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/java/ql/src/Security/CWE/CWE-90/LdapInjection.ql b/java/ql/src/Security/CWE/CWE-90/LdapInjection.ql index be247b58e57..5ecff4a55b2 100644 --- a/java/ql/src/Security/CWE/CWE-90/LdapInjection.ql +++ b/java/ql/src/Security/CWE/CWE-90/LdapInjection.ql @@ -15,8 +15,7 @@ import semmle.code.java.dataflow.FlowSources import LdapInjectionLib import DataFlow::PathGraph -from - DataFlow::PathNode source, DataFlow::PathNode sink, LdapInjectionFlowConfig conf +from DataFlow::PathNode source, DataFlow::PathNode sink, LdapInjectionFlowConfig conf where conf.hasFlowPath(source, sink) select sink.getNode(), source, sink, "LDAP query might include code from $@.", source.getNode(), "this user input"