hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-23 15:55:18 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add BAD markers to samples

Browse Source
This commit is contained in:
Ed Minnix
2023-12-13 12:55:23 -05:00
parent 709649e9df
commit e14be0e971
2 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
java/ql/src/Security/CWE/CWE-078/ExecTaintedEnvironmentName.java
View File

@@ -3,7 +3,8 @@ public void doGet(HttpServletRequest request, HttpServletResponse response) {
String value = request.getParameter("value");
Map<String, String> env = processBuilder.environment();
env.put(attribute, value);
// BAD: attr and value are tainted and being added to the environment
env.put(attr, value);
processBuilder.start();
}

1
java/ql/src/Security/CWE/CWE-078/ExecTaintedEnvironmentValue.java
View File

@@ -2,6 +2,7 @@ public void doGet(HttpServletRequest request, HttpServletResponse response) {
String path = request.getParameter("path");
Map<String, String> env = processBuilder.environment();
// BAD: path is tainted and being added to the environment
env.put("PATH", path);
processBuilder.start();