hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-27 01:35:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #7240 from smowton/smowton/admin/derecognise-xxe-secure-processing

Browse Source 
Note that FEATURE_SECURE_PROCESSING isn't a sufficient defence against XXE
This commit is contained in:
Chris Smowton
2021-11-25 19:31:06 +00:00
committed by GitHub
parent aa9a8a0e22 9540beeda9
commit d3a4dadc7d
3 changed files with 6 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
java/ql/lib/semmle/code/java/security/XmlParsers.qll
View File

@@ -159,15 +159,6 @@ private class ConstantStringExpr extends Expr {
Expr singleSafeConfig() {
result.(ConstantStringExpr).getStringValue() =
"http://apache.org/xml/features/disallow-doctype-decl"
or
result.(ConstantStringExpr).getStringValue() =
"http://javax.xml.XMLConstants/feature/secure-processing"
or
exists(Field f |
result = f.getAnAccess() and
f.hasName("FEATURE_SECURE_PROCESSING") and
f.getDeclaringType().hasQualifiedName("javax.xml", "XMLConstants")
)
}
/**