hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-29 18:55:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Rename TrustedSource to SafeHeaderSplittingSource

Browse Source
This commit is contained in:
Remco Vermeulen
2020-07-09 14:36:23 +02:00
parent 5f560e0465
commit fed506a12f
3 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
java/ql/src/Security/CWE/CWE-113/ResponseSplitting.ql
View File

@@ -19,7 +19,7 @@ class ResponseSplittingConfig extends TaintTracking::Configuration {
override predicate isSource(DataFlow::Node source) {
source instanceof RemoteFlowSource and
not source instanceof TrustedSource
not source instanceof SafeHeaderSplittingSource
}
override predicate isSink(DataFlow::Node sink) { sink instanceof HeaderSplittingSink }

4
java/ql/src/Security/CWE/CWE-113/ServletResponseSplitting.qll
View File

@@ -31,8 +31,8 @@ class ServletHeaderSplittingSink extends HeaderSplittingSink {
}
}
class TrustedServletSource extends TrustedSource {
TrustedServletSource() {
class ServletSafeHeaderSplittingSource extends SafeHeaderSplittingSource {
ServletSafeHeaderSplittingSource() {
this.asExpr().(MethodAccess).getMethod() instanceof HttpServletRequestGetHeaderMethod or
this.asExpr().(MethodAccess).getMethod() instanceof CookieGetNameMethod
}

2
java/ql/src/semmle/code/java/security/ResponseSplitting.qll
View File

@@ -8,4 +8,4 @@ abstract class HeaderSplittingSink extends DataFlow::ExprNode { }
/**
* Sources that cannot be used to perform a header splitting attack.
*/
abstract class TrustedSource extends DataFlow::ExprNode { }
abstract class SafeHeaderSplittingSource extends DataFlow::ExprNode { }