зеркало из https://github.com/github/codeql.git
Move `UrlRedirectSink` into importable library
- The `UrlRedirect` class is renamed to `ServletUrlRedirect`. - Abstract class `UrlRedirectSink` is defined that can be imported and used to customise CWE-601 via Customizations.qll
This commit is contained in:
Родитель
c166fee198
Коммит
170be9ffe8
|
@ -1,12 +1,13 @@
|
|||
import java
|
||||
import semmle.code.java.frameworks.Servlets
|
||||
import semmle.code.java.dataflow.DataFlow
|
||||
import semmle.code.java.security.UrlRedirect
|
||||
|
||||
/**
|
||||
* A URL redirection sink.
|
||||
* A Servlet URL redirection sink.
|
||||
*/
|
||||
class UrlRedirectSink extends DataFlow::ExprNode {
|
||||
UrlRedirectSink() {
|
||||
class ServletUrlRedirectSink extends UrlRedirectSink {
|
||||
ServletUrlRedirectSink() {
|
||||
exists(MethodAccess ma |
|
||||
ma.getMethod() instanceof HttpServletResponseSendRedirectMethod and
|
||||
this.asExpr() = ma.getArgument(0)
|
|
@ -12,7 +12,7 @@
|
|||
|
||||
import java
|
||||
import semmle.code.java.dataflow.FlowSources
|
||||
import UrlRedirect
|
||||
import ServletUrlRedirect
|
||||
import DataFlow::PathGraph
|
||||
|
||||
class UrlRedirectConfig extends TaintTracking::Configuration {
|
||||
|
|
|
@ -12,7 +12,7 @@
|
|||
|
||||
import java
|
||||
import semmle.code.java.dataflow.FlowSources
|
||||
import UrlRedirect
|
||||
import ServletUrlRedirect
|
||||
import DataFlow::PathGraph
|
||||
|
||||
class UrlRedirectLocalConfig extends TaintTracking::Configuration {
|
||||
|
|
|
@ -0,0 +1,5 @@
|
|||
import java
|
||||
import semmle.code.java.dataflow.DataFlow
|
||||
|
||||
/** A URL redirection sink */
|
||||
abstract class UrlRedirectSink extends DataFlow::ExprNode { }
|
Загрузка…
Ссылка в новой задаче