Salah Baddou f5131f9bc6
Java: Add XXE sink model for Woodstox WstxInputFactory ...
`com.ctc.wstx.stax.WstxInputFactory` overrides `createXMLStreamReader`,
`createXMLEventReader` and `setProperty` from `XMLInputFactory`, so the
existing `XmlInputFactory` model in `XmlParsers.qll` does not match calls
where the static receiver type is `WstxInputFactory` (or its supertype
`org.codehaus.stax2.XMLInputFactory2`). Woodstox is vulnerable to XXE in
its default configuration, so these missed sinks were false negatives in
`java/xxe`.
This adds a scoped framework model under
`semmle/code/java/frameworks/woodstox/WoodstoxXml.qll` (registered in the
`Frameworks` module of `XmlParsers.qll`) that recognises these calls as
XXE sinks and treats the factory as safe when both
`javax.xml.stream.supportDTD` and
`javax.xml.stream.isSupportingExternalEntities` are disabled — mirroring
the existing `XMLInputFactory` safe-configuration logic.
2026-04-17 18:46:51 +04:00
2020-10-22 20:20:49 +05:30
2020-06-17 02:46:02 +00:00
2022-01-19 16:43:01 +01:00
2023-03-14 17:41:20 +01:00
2024-08-15 17:26:38 +01:00
2023-03-14 18:21:38 +01:00
2020-04-28 11:26:43 +02:00
2021-09-27 16:24:41 +01:00
2023-03-10 12:35:13 +01:00
2021-09-10 13:49:31 +01:00
2020-06-09 20:12:05 +00:00
2025-12-29 07:09:31 +00:00
2023-03-14 12:50:09 +01:00
2023-03-14 17:04:14 +01:00
2021-05-03 12:44:53 +02:00
2021-02-24 22:31:03 +01:00
2023-03-14 18:21:38 +01:00
2022-03-02 12:50:38 -05:00
2021-11-03 17:26:13 +01:00
2022-08-13 12:39:15 +01:00
2021-03-04 11:11:55 +00:00
2023-08-25 11:17:51 +02:00
2022-09-08 17:38:21 +02:00
2023-03-01 09:48:33 +01:00
2023-03-13 09:36:53 +01:00
2023-05-26 18:55:13 -04:00
2020-01-30 11:27:33 +01:00
2021-11-03 17:26:13 +01:00
2021-12-17 09:17:04 +01:00
2023-10-13 20:30:28 +01:00
2022-09-08 17:38:21 +02:00
2025-03-14 11:36:03 +01:00
2022-05-04 23:09:48 +00:00
2021-05-07 13:16:41 +00:00
2021-06-18 15:54:13 +08:00
2023-03-10 12:35:13 +01:00
2021-05-12 12:37:16 +08:00
2018-08-30 10:48:05 +01:00
2026-01-13 22:33:01 +01:00
2023-03-15 11:33:02 +01:00
2021-02-20 02:00:42 +00:00
2023-12-11 11:18:39 -05:00
2021-02-18 18:11:10 +08:00
2021-09-10 16:27:23 +01:00
2021-11-03 17:26:13 +01:00
2022-08-13 12:39:15 +01:00
2024-02-12 13:49:45 +00:00
2023-05-19 17:45:47 +02:00
2023-05-30 17:52:00 +02:00
2022-05-04 15:41:35 +01:00
2019-02-15 20:01:08 -05:00
2019-02-15 20:01:08 -05:00
2019-10-29 17:52:13 +00:00
2021-05-12 12:37:16 +08:00
2022-03-12 16:35:32 +04:00
2019-08-17 16:31:18 +01:00
2022-08-13 12:39:15 +01:00
2021-08-04 15:35:50 +01:00
2021-10-18 12:21:11 -04:00
2021-10-18 12:21:11 -04:00
2021-06-30 15:04:15 +01:00
2021-10-05 09:18:47 +02:00
2025-04-01 17:13:23 +01:00
2024-09-27 19:24:40 +00:00
2021-04-08 20:41:43 +03:00
2023-03-15 12:43:45 +01:00
2020-06-09 20:12:05 +00:00
2023-06-14 12:34:52 +02:00
2021-09-14 11:47:32 +01:00
2021-06-30 15:04:15 +01:00
2023-03-15 12:43:45 +01:00
2026-02-12 16:57:04 +00:00
2021-09-10 16:36:34 +01:00
2021-09-10 16:36:34 +01:00
2021-04-19 10:58:21 +02:00
2023-03-14 17:04:14 +01:00
2023-08-24 13:37:15 +02:00
2021-11-03 17:26:13 +01:00
2022-04-29 02:31:43 +00:00
2022-03-12 16:35:32 +04:00
2018-08-30 10:48:05 +01:00
2023-06-14 12:34:52 +02:00
2022-02-08 04:02:27 +00:00
2022-09-08 17:38:21 +02:00
2023-03-15 14:47:27 +01:00
2022-04-26 13:34:21 +01:00
2021-08-05 16:01:14 +01:00
2022-08-13 12:39:15 +01:00
2021-05-12 12:37:16 +08:00
2021-07-19 17:57:27 +01:00
2021-06-08 15:12:04 +01:00
2020-06-05 17:17:43 +03:00
2021-07-13 15:26:37 +02:00
2021-03-21 21:19:39 +03:00
2018-08-30 10:48:05 +01:00
2025-08-11 13:43:36 +02:00
2025-03-23 19:49:55 -04:00
2023-05-04 16:52:40 -04:00
2021-05-12 12:37:16 +08:00
2021-05-04 02:54:49 +00:00
2021-05-05 17:38:34 -04:00
2024-07-18 17:41:02 -04:00
2023-07-31 11:13:17 +02:00
2025-08-11 13:43:36 +02:00
2022-08-15 12:08:14 +01:00
2023-02-13 19:44:02 -05:00
2021-06-02 09:58:30 +02:00
2023-12-13 11:15:27 +01:00
2021-05-12 12:32:38 +02:00
2022-12-09 13:41:17 +00:00
2025-01-30 10:14:14 -05:00
2022-09-08 17:38:21 +02:00
2023-05-26 12:43:58 +02:00
2022-03-12 16:35:32 +04:00
2021-07-01 03:34:14 +04:00
2022-04-26 13:34:24 +01:00
2021-11-25 12:55:32 -05:00
2022-05-02 15:42:15 +02:00
2021-09-10 13:49:31 +01:00
2021-09-27 11:57:53 +02:00
2023-03-14 18:21:38 +01:00
2021-11-03 17:26:13 +01:00
2021-05-18 16:12:22 +00:00
2023-06-23 18:19:43 +02:00
2021-12-02 04:00:29 +00:00
2021-09-30 14:26:14 +01:00
2022-01-21 17:47:15 +01:00
2018-08-30 10:48:05 +01:00
2021-11-03 17:26:13 +01:00
2018-08-30 10:48:05 +01:00
2021-07-14 04:57:56 -07:00
2022-03-12 16:35:32 +04:00
2022-01-24 09:34:43 +01:00
2025-12-09 14:13:02 +00:00
2022-08-13 12:39:15 +01:00
2025-01-30 10:14:11 -05:00
2021-05-11 15:42:13 +02:00
2022-09-08 17:38:21 +02:00
2022-08-13 12:39:15 +01:00
2020-01-30 11:27:33 +01:00
2022-04-29 02:31:43 +00:00
2020-10-27 15:56:26 +01:00
2026-04-17 18:46:51 +04:00
2018-08-30 10:48:05 +01:00
2021-05-12 12:37:16 +08:00
2019-08-17 18:57:50 +01:00
f5131f9bc6