Salah Baddou
f5131f9bc6
Java: Add XXE sink model for Woodstox WstxInputFactory
...
`com.ctc.wstx.stax.WstxInputFactory` overrides `createXMLStreamReader`,
`createXMLEventReader` and `setProperty` from `XMLInputFactory`, so the
existing `XmlInputFactory` model in `XmlParsers.qll` does not match calls
where the static receiver type is `WstxInputFactory` (or its supertype
`org.codehaus.stax2.XMLInputFactory2`). Woodstox is vulnerable to XXE in
its default configuration, so these missed sinks were false negatives in
`java/xxe`.
This adds a scoped framework model under
`semmle/code/java/frameworks/woodstox/WoodstoxXml.qll` (registered in the
`Frameworks` module of `XmlParsers.qll`) that recognises these calls as
XXE sinks and treats the factory as safe when both
`javax.xml.stream.supportDTD` and
`javax.xml.stream.isSupportingExternalEntities` are disabled — mirroring
the existing `XMLInputFactory` safe-configuration logic.
2026-04-17 18:46:51 +04:00
Owen Mansel-Chan
805e31fdb9
Update test expectations
2025-07-16 15:25:45 +01:00
Nora Dimitrijević
162b1c51a9
Java: convert XXE test to .qlref
2025-06-24 16:42:21 +02:00
Jami Cogswell
e17486a9d8
Java: rename springframework stubs directory from 5.3.8 to 5.8.x
2025-03-11 15:20:58 -04:00
Michael Nebel
0a1d2d0bbb
Java: Update all test util paths to point to the new location.
2024-12-12 13:21:25 +01:00
Anders Schack-Mulligen
8ee1f8ae69
Java: Add missing flow step for ThreadLocal.initialValue.
2023-09-22 13:33:45 +02:00
Anders Schack-Mulligen
5c40d553b4
Java: Switch XmlParsers lib to lightweight data flow.
2023-09-20 10:21:53 +02:00
Jeroen Ketema
9d573e5544
Consolidate all InlineFlowTest libraries in the dataflow qlpack
2023-08-24 21:38:46 +02:00
Tony Torralba
2cbb7ed296
Java: Add XXE sinks for MDHT
2023-07-31 11:13:17 +02:00
Jeroen Ketema
742eb8dd12
Java: Rewrite InlineFlowTest as a parameterized module
2023-06-15 10:52:10 +02:00
Tony Torralba
770099f210
Merge branch 'main' into atorralba/java/promote-xxe-experimental-sinks
2023-05-16 09:49:34 +02:00
Tony Torralba
7d79d87d48
Add XPath.evaluate as XXE sink
2023-05-15 17:39:35 +02:00
Tony Torralba
e54eaed26f
Refactor tests to use InlineFlowTest
2023-04-26 12:19:59 +02:00
Tony Torralba
db73e16b70
Add tests
2023-04-26 12:12:10 +02:00
erik-krogh
46b5bf32f9
update alert-messsages of java queries
2022-09-26 12:15:25 +02:00
erik-krogh
7e0bd5bde4
update expected output of tests
2022-08-22 21:41:47 +02:00
Chris Smowton
9540beeda9
Update java/ql/test/query-tests/security/CWE-611/DocumentBuilderTests.java
...
Co-authored-by: intrigus-lgtm <60750685+intrigus-lgtm@users.noreply.github.com >
2021-11-25 12:52:08 +00:00
Chris Smowton
9eb9eb606e
Note that FEATURE_SECURE_PROCESSING isn't a sufficient defence against XXE
2021-11-25 12:22:48 +00:00
Benjamin Muskalla
9d5e48430e
Merge branch 'main' into charSeqSubSeq
2021-09-09 16:04:36 +02:00
Anders Schack-Mulligen
f30dad7705
Dataflow: Update test expected outputs.
2021-09-07 13:02:20 +02:00
Benjamin Muskalla
d178fe4e5d
Fix failing tests
2021-09-01 15:41:16 +02:00
Tony Torralba
f1fab854c4
Fix tests for XXE, introduced a dependency with jaxen
2021-05-06 12:11:55 +02:00
Anders Schack-Mulligen
175c71221a
Java: Adjust some test output with more edges/nodes.
2021-04-19 14:06:27 +02:00
Anders Schack-Mulligen
c5193cf03f
Apply suggestions from code review
2021-04-19 13:14:56 +02:00
Anders Schack-Mulligen
06514159be
Java: Add XXE tests.
2021-04-19 10:58:21 +02:00
yo-h
e194411cfa
Java: fix javac errors in test code
2021-02-09 09:16:57 -05:00
Joe Farebrother
24dc631a8f
Java: Fix false positive in XXE query
2020-12-08 16:38:42 +00:00
Joe Farebrother
2fd5d26b1b
Add FP as a test case
2020-12-08 16:37:53 +00:00
Tom Hvitved
7f6e253425
Java: Update expected test output
2019-10-04 11:09:44 +02:00
Tom Hvitved
6318cc9a71
Java: Update expected test output
2019-09-18 13:36:15 +02:00
Anders Schack-Mulligen
2d620698d8
Java: Adjust qltest expected output.
2019-09-12 11:00:49 +02:00
Anders Schack-Mulligen
deb61d6f29
Java: Update test output.
2018-11-16 13:48:50 +01:00
yh-semmle
c0fcf7fc9b
Java: move a few more tests
2018-11-05 12:08:43 -05:00
Pavel Avgustinov
846c9d5860
Migrate Java code to separate QL repo.
2018-08-30 10:48:05 +01:00
