codeql/java/ql/lib/change-notes/2023-05-05-java-sink-kind-revamp.md

category

category
minorAnalysis

• Updated the following Java sink kind names. Any custom data extensions will need to be updated accordingly in order to continue working.
  • sql to sql-injection
  • url-redirect to url-redirection
  • xpath to xpath-injection
  • ssti to template-injection
  • logging to log-injection
  • groovy to groovy-injection
  • jexl to jexl-injection
  • mvel to mvel-injection
  • xslt to xslt-injection
  • ldap to ldap-injection
  • pending-intent-sent to pending-intents
  • intent-start to intent-redirection
  • set-hostname-verifier to hostname-verification
  • header-splitting to response-splitting
  • xss to html-injection and js-injection
  • write-file to file-system-store
  • create-file and read-file to path-injection
  • open-url and jdbc-url to request-forgery