hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-20 18:56:32 +01:00
Code Issues Packages Projects Releases Wiki Activity

Java: Fix failing tests

Browse Source
This commit is contained in:
Joe Farebrother
2020-10-06 13:49:02 +01:00
parent ff6c5c219c
commit ca60f2cc18
2 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
java/ql/src/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll
View File

@@ -457,7 +457,7 @@ private predicate unsafeEscape(MethodAccess ma) {
// Removing `<script>` tags using a string-replace method is // Removing `<script>` tags using a string-replace method is
// unsafe if such a tag is embedded inside another one (e.g. `<scr<script>ipt>`). // unsafe if such a tag is embedded inside another one (e.g. `<scr<script>ipt>`).
exists(StringReplaceMethod m | ma.getMethod() = m | exists(StringReplaceMethod m | ma.getMethod() = m |
ma.getArgument(0).(StringLiteral).getRepresentedString() = "<script>" and ma.getArgument(0).(StringLiteral).getRepresentedString() = "(<script>)" and
ma.getArgument(1).(StringLiteral).getRepresentedString() = "" ma.getArgument(1).(StringLiteral).getRepresentedString() = ""
) )
} }

1
java/ql/test/library-tests/dataflow/taint-format/test.expected
View File

@@ -13,6 +13,7 @@
| A.java:20:22:20:28 | taint(...) | A.java:24:9:24:27 | new ..[] { .. } | | A.java:20:22:20:28 | taint(...) | A.java:24:9:24:27 | new ..[] { .. } |
| A.java:20:22:20:28 | taint(...) | A.java:24:24:24:26 | bad | | A.java:20:22:20:28 | taint(...) | A.java:24:24:24:26 | bad |
| A.java:20:22:20:28 | taint(...) | A.java:25:9:25:9 | f | | A.java:20:22:20:28 | taint(...) | A.java:25:9:25:9 | f |
| A.java:20:22:20:28 | taint(...) | A.java:25:9:25:20 | toString(...) |
| A.java:29:22:29:28 | taint(...) | A.java:29:22:29:28 | taint(...) | | A.java:29:22:29:28 | taint(...) | A.java:29:22:29:28 | taint(...) |
| A.java:29:22:29:28 | taint(...) | A.java:33:9:33:10 | sb | | A.java:29:22:29:28 | taint(...) | A.java:33:9:33:10 | sb |
| A.java:29:22:29:28 | taint(...) | A.java:33:9:33:21 | toString(...) | | A.java:29:22:29:28 | taint(...) | A.java:33:9:33:21 | toString(...) |