diff --git a/java/ql/src/Security/CWE/CWE-113/ResponseSplitting.ql b/java/ql/src/Security/CWE/CWE-113/ResponseSplitting.ql index 9b26aff05be..2eab495657e 100644 --- a/java/ql/src/Security/CWE/CWE-113/ResponseSplitting.ql +++ b/java/ql/src/Security/CWE/CWE-113/ResponseSplitting.ql @@ -19,7 +19,7 @@ class ResponseSplittingConfig extends TaintTracking::Configuration { override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource and - not source instanceof TrustedSource + not source instanceof SafeHeaderSplittingSource } override predicate isSink(DataFlow::Node sink) { sink instanceof HeaderSplittingSink } diff --git a/java/ql/src/Security/CWE/CWE-113/ServletResponseSplitting.qll b/java/ql/src/Security/CWE/CWE-113/ServletResponseSplitting.qll index 39c8ff6266e..1589a3f3009 100644 --- a/java/ql/src/Security/CWE/CWE-113/ServletResponseSplitting.qll +++ b/java/ql/src/Security/CWE/CWE-113/ServletResponseSplitting.qll @@ -31,8 +31,8 @@ class ServletHeaderSplittingSink extends HeaderSplittingSink { } } -class TrustedServletSource extends TrustedSource { - TrustedServletSource() { +class ServletSafeHeaderSplittingSource extends SafeHeaderSplittingSource { + ServletSafeHeaderSplittingSource() { this.asExpr().(MethodAccess).getMethod() instanceof HttpServletRequestGetHeaderMethod or this.asExpr().(MethodAccess).getMethod() instanceof CookieGetNameMethod } diff --git a/java/ql/src/semmle/code/java/security/ResponseSplitting.qll b/java/ql/src/semmle/code/java/security/ResponseSplitting.qll index 583833df01e..59224b0ec69 100644 --- a/java/ql/src/semmle/code/java/security/ResponseSplitting.qll +++ b/java/ql/src/semmle/code/java/security/ResponseSplitting.qll @@ -8,4 +8,4 @@ abstract class HeaderSplittingSink extends DataFlow::ExprNode { } /** * Sources that cannot be used to perform a header splitting attack. */ -abstract class TrustedSource extends DataFlow::ExprNode { } +abstract class SafeHeaderSplittingSource extends DataFlow::ExprNode { }