hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-20 10:46:30 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix failing checks

Browse Source
This commit is contained in:
Tony Torralba
2021-05-04 11:29:09 +02:00
parent 6b79ca6403
commit f79d2e06f9
5 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
java/change-notes/2021-05-04-jexl-injection-query.md Normal file
View File

@@ -0,0 +1,2 @@
lgtm,codescanning
* The query "Expression language injection (JEXL)" (`java/jexl-expression-injection`) has been promoted from experimental to the main query pack. Its results will now appear by default. This query was originally [submitted as an experimental query by @artem-smotrakov](https://github.com/github/codeql/pull/4965)

0
java/ql/src/experimental/Security/CWE/CWE-094/SaferJexlExpressionEvaluationWithSandbox.java → java/ql/src/Security/CWE/CWE-094/SaferJexlExpressionEvaluationWithSandbox.java
View File

0
java/ql/src/experimental/Security/CWE/CWE-094/SaferJexlExpressionEvaluationWithUberspectSandbox.java → java/ql/src/Security/CWE/CWE-094/SaferJexlExpressionEvaluationWithUberspectSandbox.java
View File

0
java/ql/src/experimental/Security/CWE/CWE-094/UnsafeJexlExpressionEvaluation.java → java/ql/src/Security/CWE/CWE-094/UnsafeJexlExpressionEvaluation.java
View File

2
java/ql/src/semmle/code/java/security/JexlInjection.qll
View File

@@ -1,3 +1,5 @@
/** Provides classes to reason about Expression Langauge (JEXL) injection vulnerabilities. */
import java import java
import semmle.code.java.dataflow.TaintTracking import semmle.code.java.dataflow.TaintTracking
private import semmle.code.java.dataflow.ExternalFlow private import semmle.code.java.dataflow.ExternalFlow