hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-24 04:36:35 +01:00
Code Issues Packages Projects Releases Wiki Activity

Add doc comments

Browse Source
This commit is contained in:
Chris Smowton
2021-04-01 16:34:31 +01:00
parent 26e10f3ad5
commit e6249eed79
1 changed files with 11 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
java/ql/src/Security/CWE/CWE-918/RequestForgery.qll
View File

@@ -8,6 +8,9 @@ import semmle.code.java.dataflow.DataFlow
import semmle.code.java.dataflow.TaintTracking import semmle.code.java.dataflow.TaintTracking
private import semmle.code.java.StringFormat private import semmle.code.java.StringFormat
/**
* Holds if taint is propagated from `pred` to `succ`.
*/
predicate requestForgeryStep(DataFlow::Node pred, DataFlow::Node succ) { predicate requestForgeryStep(DataFlow::Node pred, DataFlow::Node succ) {
// propagate to a URI when its host is assigned to // propagate to a URI when its host is assigned to
exists(UriCreation c | c.getHostArg() = pred.asExpr() | succ.asExpr() = c) exists(UriCreation c | c.getHostArg() = pred.asExpr() | succ.asExpr() = c)
@@ -205,6 +208,9 @@ private class HostnameSanitzingPrefix extends CompileTimeConstantExpr {
) )
} }
/**
* Gets the offset in this constant string where a sanitizing substring begins.
*/
int getOffset() { result = offset } int getOffset() { result = offset }
} }
@@ -241,6 +247,11 @@ private MethodAccess getAChainedAppend(Expr e) {
result.getCallee().getName() = "append" result.getCallee().getName() = "append"
} }
/**
* An expression that is sanitized because it is concatenated onto a string that looks like
* a hostname or a URL separator, preventing the appended string from arbitrarily controlling
* the addressed server.
*/
class HostnameSanitizedExpr extends Expr { class HostnameSanitizedExpr extends Expr {
HostnameSanitizedExpr() { HostnameSanitizedExpr() {
// Sanitize expressions that come after a sanitizing prefix in a tree of string additions: // Sanitize expressions that come after a sanitizing prefix in a tree of string additions: