mirror of
https://github.com/github/codeql.git
synced 2026-02-16 15:03:41 +01:00
45c732a6f9
Since the main thing it's objecting to is concatenation not lack of escaping (in particular it doesn't look for escaping sanitizers), rename and re-describe it accordingly.
10 lines
441 B
Plaintext
10 lines
441 B
Plaintext
import semmle.code.java.security.SqlConcatenatedLib
|
|
|
|
from StringBuilderVar sbv, Expr uncontrolled, Method method, int methodLine
|
|
where
|
|
uncontrolledStringBuilderQuery(sbv, uncontrolled) and
|
|
method = uncontrolled.getEnclosingCallable() and
|
|
methodLine = method.getLocation().getStartLine()
|
|
select method.getName(), sbv.getLocation().getStartLine() - methodLine, sbv,
|
|
uncontrolled.getLocation().getStartLine() - methodLine, uncontrolled
|