hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-25 08:45:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

More variety of test cases

Browse Source
This commit is contained in:
Ed Minnix
2023-08-07 00:04:31 -04:00
parent ba3c38c226
commit fb875f5095
2 changed files with 23 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
java/ql/test/query-tests/security/CWE-330/WeakRandomCookies.java
View File

@@ -7,6 +7,7 @@ import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.Cookie;
import org.apache.commons.lang3.RandomStringUtils;
public class WeakRandomCookies extends HttpServlet {
HttpServletResponse response;
@@ -42,5 +43,26 @@ public class WeakRandomCookies extends HttpServlet {
Cookie cookie5 = new Cookie("name", Integer.toString(tlr.nextInt()));
response.addCookie(cookie5); // $hasWeakRandomFlow
Cookie cookie6 = new Cookie("name", RandomStringUtils.random(10));
response.addCookie(cookie6); // $hasWeakRandomFlow
Cookie cookie7 = new Cookie("name", RandomStringUtils.randomAscii(10));
response.addCookie(cookie7); // $hasWeakRandomFlow
long c3 = r.nextLong();
// BAD: The cookie value may be predictable.
Cookie cookie8 = new Cookie("name", Long.toString(c3 * 5));
response.addCookie(cookie8); // $hasWeakRandomFlow
double c4 = Math.random();
// BAD: The cookie value may be predictable.
Cookie cookie9 = new Cookie("name", Double.toString(c4));
response.addCookie(cookie9); // $hasWeakRandomFlow
double c5 = Math.random();
// BAD: The cookie value may be predictable.
Cookie cookie10 = new Cookie("name", Double.toString(++c5));
response.addCookie(cookie10); // $hasWeakRandomFlow
}
}

2
java/ql/test/query-tests/security/CWE-330/options
View File

@@ -1 +1 @@
//semmle-extractor-options: --javac-args -cp ${testdir}/../../../stubs/servlet-api-2.4
//semmle-extractor-options: --javac-args -cp ${testdir}/../../../stubs/servlet-api-2.4:${testdir}/../../../stubs/apache-commons-lang3-3.7