hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 19:26:02 +02:00
Code Issues Packages Projects Releases Wiki Activity

Refactor tests to use InlineFlowTest

Browse Source
This commit is contained in:
Tony Torralba
2023-04-26 12:19:59 +02:00
parent db73e16b70
commit e54eaed26f
19 changed files with 246 additions and 605 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
java/ql/test/query-tests/security/CWE-611/UnmarshallerTests.java
View File

@@ -16,15 +16,16 @@ public class UnmarshallerTests {
spf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
spf.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
JAXBContext jc = JAXBContext.newInstance(Object.class);
Source xmlSource = new SAXSource(spf.newSAXParser().getXMLReader(), new InputSource(sock.getInputStream()));
Source xmlSource =
new SAXSource(spf.newSAXParser().getXMLReader(), new InputSource(sock.getInputStream()));
Unmarshaller um = jc.createUnmarshaller();
um.unmarshal(xmlSource); //safe
um.unmarshal(xmlSource); // safe
}
public void unsafeUnmarshal(Socket sock) throws Exception {
SAXParserFactory spf = SAXParserFactory.newInstance();
JAXBContext jc = JAXBContext.newInstance(Object.class);
Unmarshaller um = jc.createUnmarshaller();
um.unmarshal(sock.getInputStream()); //unsafe
um.unmarshal(sock.getInputStream()); // $ hasTaintFlow
}
}