From d2e29fc72c00c56bdb8002ab92798a67b85b2ef4 Mon Sep 17 00:00:00 2001 From: Artem Smotrakov Date: Sun, 23 May 2021 10:18:40 +0200 Subject: [PATCH] Renamed RmiUnsafeDeserialization.ql -> UnsafeDeserializationRmi.ql --- ...Deserialization.qhelp => UnsafeDeserializationRmi.qhelp} | 0 ...UnsafeDeserialization.ql => UnsafeDeserializationRmi.ql} | 0 .../security/CWE-502/RmiUnsafeDeserialization.qlref | 1 - ...alization.expected => UnsafeDeserializationRmi.expected} | 0 ...feDeserialization.java => UnsafeDeserializationRmi.java} | 6 +++--- .../security/CWE-502/UnsafeDeserializationRmi.qlref | 1 + 6 files changed, 4 insertions(+), 4 deletions(-) rename java/ql/src/experimental/Security/CWE/CWE-502/{RmiUnsafeDeserialization.qhelp => UnsafeDeserializationRmi.qhelp} (100%) rename java/ql/src/experimental/Security/CWE/CWE-502/{RmiUnsafeDeserialization.ql => UnsafeDeserializationRmi.ql} (100%) delete mode 100644 java/ql/test/experimental/query-tests/security/CWE-502/RmiUnsafeDeserialization.qlref rename java/ql/test/experimental/query-tests/security/CWE-502/{RmiUnsafeDeserialization.expected => UnsafeDeserializationRmi.expected} (100%) rename java/ql/test/experimental/query-tests/security/CWE-502/{RmiUnsafeDeserialization.java => UnsafeDeserializationRmi.java} (98%) create mode 100644 java/ql/test/experimental/query-tests/security/CWE-502/UnsafeDeserializationRmi.qlref diff --git a/java/ql/src/experimental/Security/CWE/CWE-502/RmiUnsafeDeserialization.qhelp b/java/ql/src/experimental/Security/CWE/CWE-502/UnsafeDeserializationRmi.qhelp similarity index 100% rename from java/ql/src/experimental/Security/CWE/CWE-502/RmiUnsafeDeserialization.qhelp rename to java/ql/src/experimental/Security/CWE/CWE-502/UnsafeDeserializationRmi.qhelp diff --git a/java/ql/src/experimental/Security/CWE/CWE-502/RmiUnsafeDeserialization.ql b/java/ql/src/experimental/Security/CWE/CWE-502/UnsafeDeserializationRmi.ql similarity index 100% rename from java/ql/src/experimental/Security/CWE/CWE-502/RmiUnsafeDeserialization.ql rename to java/ql/src/experimental/Security/CWE/CWE-502/UnsafeDeserializationRmi.ql diff --git a/java/ql/test/experimental/query-tests/security/CWE-502/RmiUnsafeDeserialization.qlref b/java/ql/test/experimental/query-tests/security/CWE-502/RmiUnsafeDeserialization.qlref deleted file mode 100644 index d750f371002..00000000000 --- a/java/ql/test/experimental/query-tests/security/CWE-502/RmiUnsafeDeserialization.qlref +++ /dev/null @@ -1 +0,0 @@ -experimental/Security/CWE/CWE-502/RmiUnsafeDeserialization.ql \ No newline at end of file diff --git a/java/ql/test/experimental/query-tests/security/CWE-502/RmiUnsafeDeserialization.expected b/java/ql/test/experimental/query-tests/security/CWE-502/UnsafeDeserializationRmi.expected similarity index 100% rename from java/ql/test/experimental/query-tests/security/CWE-502/RmiUnsafeDeserialization.expected rename to java/ql/test/experimental/query-tests/security/CWE-502/UnsafeDeserializationRmi.expected diff --git a/java/ql/test/experimental/query-tests/security/CWE-502/RmiUnsafeDeserialization.java b/java/ql/test/experimental/query-tests/security/CWE-502/UnsafeDeserializationRmi.java similarity index 98% rename from java/ql/test/experimental/query-tests/security/CWE-502/RmiUnsafeDeserialization.java rename to java/ql/test/experimental/query-tests/security/CWE-502/UnsafeDeserializationRmi.java index f8921eda6ce..ee0bc3a1989 100644 --- a/java/ql/test/experimental/query-tests/security/CWE-502/RmiUnsafeDeserialization.java +++ b/java/ql/test/experimental/query-tests/security/CWE-502/UnsafeDeserializationRmi.java @@ -5,8 +5,8 @@ import java.rmi.RemoteException; import java.rmi.registry.LocateRegistry; import java.rmi.registry.Registry; -public class RmiUnsafeDeserialization { - +public class UnsafeDeserializationRmi { + // BAD (bind a remote object that has a vulnerable method that takes Object) public static void testRegistryBindWithObjectParameter() throws Exception { Registry registry = LocateRegistry.createRegistry(1099); @@ -55,4 +55,4 @@ class SafeRemoteObject implements SafeRemoteObjectInterface { public void take(String s) throws RemoteException {} public void take(ObjectInputStream ois) throws RemoteException {} public void safeMethod(Object object) {} // this method is not declared in SafeRemoteObjectInterface -} \ No newline at end of file +} diff --git a/java/ql/test/experimental/query-tests/security/CWE-502/UnsafeDeserializationRmi.qlref b/java/ql/test/experimental/query-tests/security/CWE-502/UnsafeDeserializationRmi.qlref new file mode 100644 index 00000000000..fce2e6c6a4a --- /dev/null +++ b/java/ql/test/experimental/query-tests/security/CWE-502/UnsafeDeserializationRmi.qlref @@ -0,0 +1 @@ +experimental/Security/CWE/CWE-502/UnsafeDeserializationRmi.ql \ No newline at end of file