github
/
codeql
зеркало из https://github.com/github/codeql.git
1
0
Форкнуть 0
Код Задачи Пакеты Проекты Релизы Вики Активность

Add test case for PR-11368

This commit is contained in:
ka1n4t 2022-11-23 11:05:58 +08:00
Родитель ce2ba21240
Коммит d113fb23c8
4 изменённых файлов: 48 добавлений и 9 удалений
Показать статистику Скачать Patch файл Скачать Diff файл Показать все файлы Свернуть все файлы

14
java/ql/test/experimental/query-tests/security/CWE-089/src/main/MyBatisAnnotationSqlInjection.expected
Просмотреть файл

@ -1,16 +1,30 @@
edges
| MybatisSqlInjection.java:62:19:62:43 | name : String | MybatisSqlInjection.java:63:35:63:38 | name : String |
| MybatisSqlInjection.java:63:35:63:38 | name : String | MybatisSqlInjectionService.java:48:19:48:29 | name : String |
| MybatisSqlInjection.java:94:21:94:45 | name : String | MybatisSqlInjection.java:95:37:95:40 | name : String |
| MybatisSqlInjection.java:95:37:95:40 | name : String | MybatisSqlInjectionService.java:76:21:76:31 | name : String |
| MybatisSqlInjection.java:99:21:99:44 | age : String | MybatisSqlInjection.java:100:37:100:39 | age : String |
| MybatisSqlInjection.java:100:37:100:39 | age : String | MybatisSqlInjectionService.java:80:21:80:30 | age : String |
| MybatisSqlInjectionService.java:48:19:48:29 | name : String | MybatisSqlInjectionService.java:50:23:50:26 | name : String |
| MybatisSqlInjectionService.java:50:3:50:9 | hashMap [post update] [<map.value>] : String | MybatisSqlInjectionService.java:51:27:51:33 | hashMap |
| MybatisSqlInjectionService.java:50:23:50:26 | name : String | MybatisSqlInjectionService.java:50:3:50:9 | hashMap [post update] [<map.value>] : String |
| MybatisSqlInjectionService.java:76:21:76:31 | name : String | MybatisSqlInjectionService.java:77:29:77:32 | name |
| MybatisSqlInjectionService.java:80:21:80:30 | age : String | MybatisSqlInjectionService.java:81:29:81:31 | age |
nodes
| MybatisSqlInjection.java:62:19:62:43 | name : String | semmle.label | name : String |
| MybatisSqlInjection.java:63:35:63:38 | name : String | semmle.label | name : String |
| MybatisSqlInjection.java:94:21:94:45 | name : String | semmle.label | name : String |
| MybatisSqlInjection.java:95:37:95:40 | name : String | semmle.label | name : String |
| MybatisSqlInjection.java:99:21:99:44 | age : String | semmle.label | age : String |
| MybatisSqlInjection.java:100:37:100:39 | age : String | semmle.label | age : String |
| MybatisSqlInjectionService.java:48:19:48:29 | name : String | semmle.label | name : String |
| MybatisSqlInjectionService.java:50:3:50:9 | hashMap [post update] [<map.value>] : String | semmle.label | hashMap [post update] [<map.value>] : String |
| MybatisSqlInjectionService.java:50:23:50:26 | name : String | semmle.label | name : String |
| MybatisSqlInjectionService.java:51:27:51:33 | hashMap | semmle.label | hashMap |
| MybatisSqlInjectionService.java:76:21:76:31 | name : String | semmle.label | name : String |
| MybatisSqlInjectionService.java:77:29:77:32 | name | semmle.label | name |
| MybatisSqlInjectionService.java:80:21:80:30 | age : String | semmle.label | age : String |
| MybatisSqlInjectionService.java:81:29:81:31 | age | semmle.label | age |
subpaths
#select
| MybatisSqlInjectionService.java:51:27:51:33 | hashMap | MybatisSqlInjection.java:62:19:62:43 | name : String | MybatisSqlInjectionService.java:51:27:51:33 | hashMap | MyBatis annotation SQL injection might include code from $@ to $@. | MybatisSqlInjection.java:62:19:62:43 | name | this user input | SqlInjectionMapper.java:33:2:33:54 | Select | this SQL operation |

10
java/ql/test/experimental/query-tests/security/CWE-089/src/main/MybatisSqlInjection.java
Просмотреть файл

@ -89,4 +89,14 @@ public class MybatisSqlInjection {
public void badInsert(@RequestParam String name) {
mybatisSqlInjectionService.badInsert(name);
}
@GetMapping(value = "kkbad1")
public void kkbad1(@RequestParam String name, @RequestParam Integer age) {
mybatisSqlInjectionService.kkbad1(name, age);
}
@GetMapping(value = "kkbad2")
public void kkbad2(@RequestParam String age) {
mybatisSqlInjectionService.kkbad2(age);
}
}

8
java/ql/test/experimental/query-tests/security/CWE-089/src/main/MybatisSqlInjectionService.java
Просмотреть файл

@ -72,4 +72,12 @@ public class MybatisSqlInjectionService {
public void badInsert(String input) {
sqlInjectionMapper.badInsert(input);
}
public void kkbad1(String name, Integer age){
sqlInjectionMapper.kkbad1(name, age);
}
public void kkbad2(String age){
sqlInjectionMapper.kkbad2(age);
}
}

23
java/ql/test/experimental/query-tests/security/CWE-089/src/main/SqlInjectionMapper.java
Просмотреть файл

@ -37,26 +37,33 @@ public interface SqlInjectionMapper {
//using providers
@SelectProvider(
type = MyBatisProvider.class,
method = "badSelect"
type = MyBatisProvider.class,
method = "badSelect"
)
String badSelect(String input);
@DeleteProvider(
type = MyBatisProvider.class,
method = "badDelete"
type = MyBatisProvider.class,
method = "badDelete"
)
void badDelete(String input);
@UpdateProvider(
type = MyBatisProvider.class,
method = "badUpdate"
type = MyBatisProvider.class,
method = "badUpdate"
)
void badUpdate(String input);
@InsertProvider(
type = MyBatisProvider.class,
method = "badInsert"
type = MyBatisProvider.class,
method = "badInsert"
)
void badInsert(String input);
@Select("select * from user_info where name = #{name} and age = ${age}")
String kkbad1(@Param("name") String name, Integer age);
@Select("select * from user_info where age = #{age}")
String kkbad2(@Param("age") String age);
}