File tree Expand file tree Collapse file tree 2 files changed +3
-3
lines changed
java/ql/src/Security/CWE/CWE-094 Expand file tree Collapse file tree 2 files changed +3
-3
lines changed Original file line number Diff line number Diff line change @@ -30,7 +30,7 @@ Validator validator = Validation.byDefaultProvider()
3030 .buildValidatorFactory()
3131 .getValidator();
3232</pre ></li >
33- <li >Replace Hibernate Validator with Apache BVal which in its latest version does not interpolate EL expressions by default.
33+ <li >Replace Hibernate Validator with Apache BVal, which in its latest version does not interpolate EL expressions by default.
3434Note that this replacement may not be a simple drop-in replacement.</li >
3535</ul >
3636</recommendation >
@@ -41,7 +41,7 @@ Note that this replacement may not be a simple drop-in replacement.</li>
4141</example >
4242
4343<references >
44- <li >Hibernate Reference Guide:<a href =" https://docs.jboss.org/hibernate/stable/validator/reference/en-US/html_single/#_the_code_constraintvalidatorcontext_code" >ConstraintValidatorContext</a >.</li >
44+ <li >Hibernate Reference Guide: <a href =" https://docs.jboss.org/hibernate/stable/validator/reference/en-US/html_single/#_the_code_constraintvalidatorcontext_code" >ConstraintValidatorContext</a >.</li >
4545<li >GitHub Security Lab research: <a href =" https://securitylab.github.com/research/bean-validation-RCE" >Bean validation</a >.</li >
4646</references >
4747</qhelp >
Original file line number Diff line number Diff line change 11/**
22 * @name Insecure Bean Validation
3- * @description User-controlled data may be evaluated as a Java EL expressions , leading to arbitrary code execution.
3+ * @description User-controlled data may be evaluated as a Java EL expression , leading to arbitrary code execution.
44 * @kind path-problem
55 * @problem.severity error
66 * @precision high
You can’t perform that action at this time.
0 commit comments