hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-26 01:05:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

Refactor XSS and SpringJDBC tests to lib configurations

Browse Source
This commit is contained in:
Ed Minnix
2023-04-17 23:43:19 -04:00
parent 49521f6de8
commit e6a2528c38
2 changed files with 6 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
java/ql/test/query-tests/security/CWE-079/semmle/tests/XSS.ql
View File

@@ -1,23 +1,7 @@
import java
import semmle.code.java.dataflow.TaintTracking
import semmle.code.java.dataflow.FlowSources
import semmle.code.java.security.XSS
import semmle.code.java.security.XssQuery
import TestUtilities.InlineExpectationsTest
module XssConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
predicate isSink(DataFlow::Node sink) { sink instanceof XssSink }
predicate isBarrier(DataFlow::Node node) { node instanceof XssSanitizer }
predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
any(XssAdditionalTaintStep s).step(node1, node2)
}
}
module XssFlow = TaintTracking::Global<XssConfig>;
class XssTest extends InlineExpectationsTest {
XssTest() { this = "XssTest" }

24
java/ql/test/query-tests/security/CWE-089/semmle/examples/springjdbc.ql
View File

@@ -1,28 +1,14 @@
import java
import semmle.code.java.dataflow.TaintTracking
import semmle.code.java.security.QueryInjection
import semmle.code.java.dataflow.FlowSources
import semmle.code.java.security.SqlInjectionQuery
import TestUtilities.InlineExpectationsTest
private module QueryInjectionFlowConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node src) {
src.asExpr() = any(MethodAccess ma | ma.getMethod().hasName("source"))
}
private class SourceMethodSource extends RemoteFlowSource {
SourceMethodSource() { this.asExpr().(MethodAccess).getMethod().hasName("source") }
predicate isSink(DataFlow::Node sink) { sink instanceof QueryInjectionSink }
predicate isBarrier(DataFlow::Node node) {
node.getType() instanceof PrimitiveType or
node.getType() instanceof BoxedType or
node.getType() instanceof NumberType
}
predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
any(AdditionalQueryInjectionTaintStep s).step(node1, node2)
}
override string getSourceType() { result = "source" }
}
private module QueryInjectionFlow = TaintTracking::Global<QueryInjectionFlowConfig>;
class HasFlowTest extends InlineExpectationsTest {
HasFlowTest() { this = "HasFlowTest" }