hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-24 16:25:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add type for java.net.URL

Browse Source
This commit is contained in:
Peter Stöckli
2020-02-23 12:35:03 +01:00
parent e1e03e326b
commit e81d3ce0b4
2 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
java/ql/src/Security/CWE/CWE-036/OpenStream.ql
View File

@@ -12,7 +12,7 @@ import semmle.code.java.dataflow.FlowSources
import DataFlow::PathGraph
class URLConstructor extends ClassInstanceExpr {
URLConstructor() { this.getConstructor().getDeclaringType().getQualifiedName() = "java.net.URL" }
URLConstructor() { this.getConstructor().getDeclaringType() instanceof TypeUrl }
Expr stringArg() {
// Query only in URL's that were constructed by calling the single parameter string constructor.
@@ -26,7 +26,7 @@ class URLConstructor extends ClassInstanceExpr {
class URLOpenStreamMethod extends Method {
URLOpenStreamMethod() {
this.getDeclaringType().getQualifiedName() = "java.net.URL" and
this.getDeclaringType() instanceof TypeUrl and
this.getName() = "openStream"
}
}

4
java/ql/src/semmle/code/java/frameworks/Networking.qll
View File

@@ -12,6 +12,10 @@ class TypeSocket extends RefType {
TypeSocket() { hasQualifiedName("java.net", "Socket") }
}
class TypeUrl extends RefType {
TypeUrl() { hasQualifiedName("java.net", "URL") }
}
class URLConnectionGetInputStreamMethod extends Method {
URLConnectionGetInputStreamMethod() {
getDeclaringType() instanceof TypeUrlConnection and