hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-26 01:05:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #17023 from jcogs33/jcogs33/java/add-apache-ant-path-inj-sinks

Browse Source 
Java: add apache-ant `Property` path injection sinks
This commit is contained in:
Jami
2024-07-31 11:04:13 -04:00
committed by GitHub
parent 20672acb74 4fb29c4473
commit f9f57e9122
2 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
java/ql/lib/change-notes/2024-07-19-apache-ant-property-sinks.md Normal file
View File

@@ -0,0 +1,4 @@
---
category: minorAnalysis
---
* Added path-injection sinks for `org.apache.tools.ant.taskdefs.Property.setFile` and `org.apache.tools.ant.taskdefs.Property.setResource`.

2
java/ql/lib/ext/org.apache.tools.ant.taskdefs.model.yml
View File

@@ -10,3 +10,5 @@ extensions:
- ["org.apache.tools.ant.taskdefs", "Execute", False, "runCommand", "(Task,String[])", "", "Argument[1]", "command-injection", "ai-manual"]
- ["org.apache.tools.ant.taskdefs", "Expand", True, "setDest", "(File)", "", "Argument[0]", "path-injection", "ai-manual"]
- ["org.apache.tools.ant.taskdefs", "Expand", True, "setSrc", "(File)", "", "Argument[0]", "path-injection", "ai-manual"]
- ["org.apache.tools.ant.taskdefs", "Property", True, "setFile", "(File)", "", "Argument[0]", "path-injection", "manual"]
- ["org.apache.tools.ant.taskdefs", "Property", True, "setResource", "(String)", "", "Argument[0]", "path-injection", "manual"]