|
1 | 1 | /** |
2 | | - * @name Setting a SECURITY_DESCRIPTOR’s DACL to NULL |
3 | | - * @description Setting a SECURITY_DESCRIPTOR’s DACL to NULL will result in an unprotected object. |
| 2 | + * @name Setting a SECURITY_DESCRIPTOR's DACL to NULL |
| 3 | + * @description Setting a SECURITY_DESCRIPTOR's DACL to NULL will result in an unprotected object. |
4 | 4 | * If the DACL that belongs to the security descriptor of an object is set to NULL, a null DACL is created. |
5 | 5 | * A null DACL grants full access to any user who requests it; |
6 | 6 | * normal security checking is not performed with respect to the object. |
@@ -49,12 +49,12 @@ class SetSecurityDescriptorDaclFunctionConfiguration extends DataFlow::Configura |
49 | 49 |
|
50 | 50 | from SetSecurityDescriptorDaclFunctionCall call, string message |
51 | 51 | where exists( NullValue nullExpr | |
52 | | - message = "Setting a SECURITY_DESCRIPTOR’s DACL to NULL will result in an unprotected object." | |
| 52 | + message = "Setting a SECURITY_DESCRIPTOR's DACL to NULL will result in an unprotected object." | |
53 | 53 | call.getArgument(1).getValue().toInt() != 0 |
54 | 54 | and call.getArgument(2) = nullExpr |
55 | 55 | ) or exists( Expr constassign, VariableAccess var, |
56 | 56 | SetSecurityDescriptorDaclFunctionConfiguration config | |
57 | | - message = "Setting a SECURITY_DESCRIPTOR’s DACL using variable " + var + " that is set to NULL will result in an unprotected object." | |
| 57 | + message = "Setting a SECURITY_DESCRIPTOR's DACL using variable " + var + " that is set to NULL will result in an unprotected object." | |
58 | 58 | var = call.getArgument(2) |
59 | 59 | and config.hasFlow(DataFlow::exprNode(constassign), DataFlow::exprNode(var)) |
60 | 60 | ) |
|
0 commit comments