hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-03-05 15:16:47 +01:00
Code Issues Packages Projects Releases Wiki Activity

Java: add remote user input for Apache Thrift framework

Browse Source
This commit is contained in:
yh-semmle
2019-02-05 21:20:29 -05:00
parent 751bbbf583
commit fc4aa16905
2 changed files with 36 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
java/ql/src/semmle/code/java/dataflow/FlowSources.qll
View File

@@ -19,6 +19,7 @@ import semmle.code.java.frameworks.android.Intent
import semmle.code.java.frameworks.SpringWeb
import semmle.code.java.frameworks.Guice
import semmle.code.java.frameworks.struts.StrutsActions
import semmle.code.java.frameworks.Thrift
/** Class for `tainted` user input. */
abstract class UserInput extends DataFlow::Node { }
@@ -78,6 +79,8 @@ class RemoteUserInput extends UserInput {
)
or
exists(Struts2ActionSupportClass c | c.getASetterMethod().getField() = this.asExpr().(FieldRead).getField())
or
exists(ThriftIface i | i.getAnImplementingMethod().getAParameter() = this.asParameter())
}
/**