hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-29 02:35:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

Java: convert TemplateInjection test to .qlref

Browse Source
This commit is contained in:
Nora Dimitrijević
2025-06-23 12:34:18 +02:00
parent b8c7bd29c3
commit c77875d834
10 changed files with 225 additions and 67 deletions
Download Patch File Download Diff File Expand all files Collapse all files

44
java/ql/test/query-tests/security/CWE-094/TemplateInjection/JinJavaSSTI.java Normal file
View File

@@ -0,0 +1,44 @@
import javax.servlet.http.HttpServletRequest;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.GetMapping;
import java.lang.String;
import java.io.Reader;
import java.io.StringReader;
import java.util.HashMap;
import java.util.Map;
import com.hubspot.jinjava.*;
import com.hubspot.jinjava.JinjavaConfig;
import com.hubspot.jinjava.interpret.*;
@Controller
public class JinJavaSSTI {
String sourceName = "sourceName";
@GetMapping(value = "bad1")
public void bad1(HttpServletRequest request) {
String template = request.getParameter("template"); // $ Source
Jinjava jinjava = new Jinjava();
Map<String, Object> context = new HashMap<>();
String renderedTemplate = jinjava.render(template, context); // $ Alert
}
@GetMapping(value = "bad2")
public void bad2(HttpServletRequest request) {
String template = request.getParameter("template"); // $ Source
Jinjava jinjava = new Jinjava();
Map<String, Object> bindings = new HashMap<>();
RenderResult renderResult = jinjava.renderForResult(template, bindings); // $ Alert
}
@GetMapping(value = "bad3")
public void bad3(HttpServletRequest request) {
String template = request.getParameter("template"); // $ Source
Jinjava jinjava = new Jinjava();
Map<String, Object> bindings = new HashMap<>();
JinjavaConfig renderConfig = new JinjavaConfig();
RenderResult renderResult = jinjava.renderForResult(template, bindings, renderConfig); // $ Alert
}
}