hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-02 12:15:17 +02:00
Code Issues Packages Projects Releases Wiki Activity

Java: Convert WebSocketMessageParameterSource to CSV based flow source

Browse Source
This commit is contained in:
Tamas Vajk
2021-03-09 11:35:11 +01:00
parent 193458eb3d
commit e0b1a86038
2 changed files with 3 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll
View File

@@ -170,7 +170,9 @@ private predicate sourceModelCsv(string row) {
// SpringRestTemplateResponseEntityMethod
"org.springframework.web.client;RestTemplate;false;exchange;;;ReturnValue;remote",
"org.springframework.web.client;RestTemplate;false;getForEntity;;;ReturnValue;remote",
"org.springframework.web.client;RestTemplate;false;postForEntity;;;ReturnValue;remote"
"org.springframework.web.client;RestTemplate;false;postForEntity;;;ReturnValue;remote",
// WebSocketMessageParameterSource
"java.net.http;WebSocket$Listener;true;onText;(WebSocket,CharSequence,boolean);;Parameter[1];remote"
]
}

8
java/ql/src/semmle/code/java/dataflow/FlowSources.qll
View File

@@ -158,14 +158,6 @@ private class ThriftIfaceParameterSource extends RemoteFlowSource {
override string getSourceType() { result = "Thrift Iface parameter" }
}
private class WebSocketMessageParameterSource extends RemoteFlowSource {
WebSocketMessageParameterSource() {
exists(WebsocketOnText t | t.getParameter(1) = this.asParameter())
}
override string getSourceType() { result = "Websocket onText parameter" }
}
/** Class for `tainted` user input. */
abstract class UserInput extends DataFlow::Node { }