@@ -109,9 +109,8 @@ class DisableDefaultEntityResolutionTranformer extends XXEFlowStateTranformer {
109109 }
110110
111111 final override XXEFlowState transform ( XXEFlowState flowstate ) {
112- exists ( int disabledDefaultEntityResolution , int createEntityReferenceNodes |
113- encodeXercesDOMFlowState ( flowstate , disabledDefaultEntityResolution ,
114- createEntityReferenceNodes ) and
112+ exists ( int createEntityReferenceNodes |
113+ encodeXercesDOMFlowState ( flowstate , _, createEntityReferenceNodes ) and
115114 (
116115 newValue .getValue ( ) .toInt ( ) = 1 and // true
117116 encodeXercesDOMFlowState ( result , 1 , createEntityReferenceNodes )
@@ -142,9 +141,8 @@ class CreateEntityReferenceNodesTranformer extends XXEFlowStateTranformer {
142141 }
143142
144143 final override XXEFlowState transform ( XXEFlowState flowstate ) {
145- exists ( int disabledDefaultEntityResolution , int createEntityReferenceNodes |
146- encodeXercesDOMFlowState ( flowstate , disabledDefaultEntityResolution ,
147- createEntityReferenceNodes ) and
144+ exists ( int disabledDefaultEntityResolution |
145+ encodeXercesDOMFlowState ( flowstate , disabledDefaultEntityResolution , _) and
148146 (
149147 newValue .getValue ( ) .toInt ( ) = 1 and // true
150148 encodeXercesDOMFlowState ( result , disabledDefaultEntityResolution , 1 )
@@ -208,5 +206,4 @@ class XXEConfiguration extends DataFlow::Configuration {
208206from XXEConfiguration conf , DataFlow:: PathNode source , DataFlow:: PathNode sink
209207where conf .hasFlowPath ( source , sink )
210208select sink , source , sink ,
211- "This $@ is not configured to prevent an XML external entity (XXE) attack." , source ,
212- "XML parser"
209+ "This $@ is not configured to prevent an XML external entity (XXE) attack." , source , "XML parser"
0 commit comments