Java: Convert permissve-dot-regex-query to data extensions. · github/codeql@b96540c · GitHub

github / codeql Public

• Notifications You must be signed in to change notification settings
• Fork 2.1k
• Star 10k

• Code
• Issues 998
• Pull requests 467
• Discussions
• Actions
• Projects
• Security and quality
• Insights

Additional navigation options

Commit b96540c

Browse filesBrowse the repository at this point in the historyBrowse files

michaelnebel

committed

Java: Convert permissve-dot-regex-query to data extensions.

1 parent 91840c6 commit b96540c
Copy full SHA for b96540c

2 files changed

+14-14Lines changed: 14 additions & 14 deletions

File tree

Expand file treeCollapse file tree

Open diff view settings

Filter options

• java/ql
  • lib/ext/experimental
    • javax.servlet.http.model.yml
  • src/experimental/Security/CWE/CWE-625
    • PermissiveDotRegexQuery.qll

Expand file treeCollapse file tree

Open diff view settings

Collapse file

‎java/ql/lib/ext/experimental/javax.servlet.http.model.yml‎

Copy file name to clipboardExpand all lines: java/ql/lib/ext/experimental/javax.servlet.http.model.yml

+10Lines changed: 10 additions & 0 deletions

Original file line number	Diff line number	Diff line change
@@ -4,3 +4,13 @@ extensions:
4	4	extensible: extExperimentalSourceModel
5	5	data:
6	6	- ["javax.servlet.http", "HttpServletRequest", True, "getServletPath", "", "", "ReturnValue", "remote", "manual", "unsafe-url-forward"]
	7	+ - addsTo:
	8	+ pack: codeql/java-all
	9	+ extensible: extExperimentalSourceModel
	10	+ data:
	11	+ - ["javax.servlet.http", "HttpServletRequest", False, "getPathInfo", "()", "", "ReturnValue", "uri-path", "manual", "permissive-dot-regex-query"]
	12	+ - ["javax.servlet.http", "HttpServletRequest", False, "getPathTranslated", "()", "", "ReturnValue", "uri-path", "manual", "permissive-dot-regex-query"]
	13	+ - ["javax.servlet.http", "HttpServletRequest", False, "getRequestURI", "()", "", "ReturnValue", "uri-path", "manual", "permissive-dot-regex-query"]
	14	+ - ["javax.servlet.http", "HttpServletRequest", False, "getRequestURL", "()", "", "ReturnValue", "uri-path", "manual", "permissive-dot-regex-query"]
	15	+ - ["javax.servlet.http", "HttpServletRequest", False, "getServletPath", "()", "", "ReturnValue", "uri-path", "manual", "permissive-dot-regex-query"]
	16	+

Collapse file

‎java/ql/src/experimental/Security/CWE/CWE-625/PermissiveDotRegexQuery.qll‎

Copy file name to clipboardExpand all lines: java/ql/src/experimental/Security/CWE/CWE-625/PermissiveDotRegexQuery.qll

+4-14Lines changed: 4 additions & 14 deletions

Original file line number	Diff line number	Diff line change
@@ -8,6 +8,10 @@ import semmle.code.java.controlflow.Guards
8	8	import semmle.code.java.security.UrlRedirect
9	9	import Regex
10	10
	11	+ private class ActivateModels extends ActiveExperimentalModels {
	12	+ ActivateModels() { this = "permissive-dot-regex-query" }
	13	+ }
	14	+
11	15	/** A string that ends with `.*` not prefixed with `\`. */
12	16	private class PermissiveDotStr extends StringLiteral {
13	17	PermissiveDotStr() {
@@ -19,20 +23,6 @@ private class PermissiveDotStr extends StringLiteral {
19	23	}
20	24	}
21	25
22		- /** Remote flow sources obtained from the URI of a servlet request. */
23		- private class GetServletUriSource extends SourceModelCsv {
24		- override predicate row(string row) {
25		- row =
26		- [
27		- "javax.servlet.http;HttpServletRequest;false;getPathInfo;();;ReturnValue;uri-path;manual",
28		- "javax.servlet.http;HttpServletRequest;false;getPathTranslated;();;ReturnValue;uri-path;manual",
29		- "javax.servlet.http;HttpServletRequest;false;getRequestURI;();;ReturnValue;uri-path;manual",
30		- "javax.servlet.http;HttpServletRequest;false;getRequestURL;();;ReturnValue;uri-path;manual",
31		- "javax.servlet.http;HttpServletRequest;false;getServletPath;();;ReturnValue;uri-path;manual"
32		- ]
33		- }
34		- }
35		-
36	26	/** The qualifier of a request dispatch method call. */
37	27	private class UrlDispatchSink extends UrlRedirectSink {
38	28	UrlDispatchSink() {

0 commit comments

Comments

0 (0)