codeql

mirror of https://github.com/github/codeql.git synced 2026-05-14 19:29:28 +02:00

Files

Salah Baddou f5131f9bc6 Java: Add XXE sink model for Woodstox WstxInputFactory

`com.ctc.wstx.stax.WstxInputFactory` overrides `createXMLStreamReader`,
`createXMLEventReader` and `setProperty` from `XMLInputFactory`, so the
existing `XmlInputFactory` model in `XmlParsers.qll` does not match calls
where the static receiver type is `WstxInputFactory` (or its supertype
`org.codehaus.stax2.XMLInputFactory2`). Woodstox is vulnerable to XXE in
its default configuration, so these missed sinks were false negatives in
`java/xxe`.

This adds a scoped framework model under
`semmle/code/java/frameworks/woodstox/WoodstoxXml.qll` (registered in the
`Frameworks` module of `XmlParsers.qll`) that recognises these calls as
XXE sinks and treats the factory as safe when both
`javax.xml.stream.supportDTD` and
`javax.xml.stream.isSupportingExternalEntities` are disabled — mirroring
the existing `XMLInputFactory` safe-configuration logic.

2026-04-17 18:46:51 +04:00

experimental

Java: Update test expectations

2026-03-04 12:44:56 +00:00

ext

Java: Inline expectation should have space after $

2026-03-04 12:44:54 +00:00

library-tests

Java: Accept new test results after JDK 26 extractor upgrade

2026-04-07 09:28:20 +02:00

query-tests

Java: Add XXE sink model for Woodstox WstxInputFactory