hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-05 21:55:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

C++: Repair the LSParser sinks.

Browse Source
This commit is contained in:
Geoffrey White
2022-05-05 16:54:27 +01:00
parent 8852043558
commit e3be7749ea
3 changed files with 61 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
cpp/ql/src/Security/CWE/CWE-611/XXE.ql
View File

@@ -57,6 +57,13 @@ class XercesDOMParserClass extends Class {
XercesDOMParserClass() { this.hasName("XercesDOMParser") }
}
/**
* The `DOMLSParser` class.
*/
class DOMLSParserClass extends Class {
DOMLSParserClass() { this.hasName("DOMLSParser") }
}
/**
* The `SAXParser` class.
*/
@@ -217,12 +224,12 @@ class SetFeatureTranformer extends XXEFlowStateTranformer {
}
/**
* The `AbstractDOMParser.parse`, `SAXParser.parse` or `SAX2XMLReader.parse`
* method.
* The `AbstractDOMParser.parse`, `DOMLSParserClass.parse`, `SAXParser.parse` or `SAX2XMLReader.parse` method.
*/
class ParseFunction extends Function {
ParseFunction() {
this.getClassAndName("parse") instanceof AbstractDOMParserClass or
this.getClassAndName("parse") instanceof DOMLSParserClass or
this.getClassAndName("parse") instanceof SaxParserClass or
this.getClassAndName("parse") instanceof Sax2XmlReader
}
@@ -235,7 +242,7 @@ class ParseFunction extends Function {
class CreateLSParser extends Function {
CreateLSParser() {
this.hasName("createLSParser") and
this.getUnspecifiedType().(PointerType).getBaseType().getName() = "DOMLSParser" // returns a `DOMLSParser *`.
this.getUnspecifiedType().(PointerType).getBaseType() instanceof DOMLSParserClass // returns a `DOMLSParser *`.
}
}