hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-03 04:39:29 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add thymeleaf steps

Browse Source
This commit is contained in:
Tony Torralba
2022-09-12 17:01:16 +02:00
parent 79a32f1a3e
commit f412f433bf
8 changed files with 97 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
java/ql/test/query-tests/security/CWE-094/PebbleSSTI.java
View File

@@ -15,17 +15,15 @@ public class PebbleSSTI {
@GetMapping(value = "bad1")
public void bad1(HttpServletRequest request) {
String code = request.getParameter("code");
String templateName = request.getParameter("templateName");
PebbleEngine engine = new PebbleEngine.Builder().build();
// public PebbleTemplate getTemplate(String templateName)
PebbleTemplate compiledTemplate = engine.getTemplate(code); // $hasTemplateInjection
PebbleTemplate compiledTemplate = engine.getTemplate(templateName); // $hasTemplateInjection
}
@GetMapping(value = "bad2")
public void bad2(HttpServletRequest request) {
String code = request.getParameter("code");
String templateName = request.getParameter("templateName");
PebbleEngine engine = new PebbleEngine.Builder().build();
// public PebbleTemplate getLiteralTemplate(String templateName)
PebbleTemplate compiledTemplate = engine.getLiteralTemplate(code); // $hasTemplateInjection
PebbleTemplate compiledTemplate = engine.getLiteralTemplate(templateName); // $hasTemplateInjection
}
}