File tree Expand file tree Collapse file tree 7 files changed +13
-0
lines changed
cpp/ql/src/Security/CWE/CWE-020
csharp/ql/lib/semmle/code/csharp/security/dataflow
go/ql/lib/semmle/go/security
javascript/ql/lib/semmle/javascript/security/dataflow
java/ql/lib/semmle/code/java/security
python/ql/src/Security/CWE-020-ExternalAPIs Expand file tree Collapse file tree 7 files changed +13
-0
lines changed Original file line number Diff line number Diff line change @@ -21,7 +21,9 @@ class UntrustedExternalApiDataNode extends ExternalApiDataNode {
2121/** DEPRECATED: Alias for UntrustedExternalApiDataNode */
2222deprecated class UntrustedExternalAPIDataNode = UntrustedExternalApiDataNode;
2323
24+ /** An external API which is used with untrusted data. */
2425private newtype TExternalApi =
26+ /** An untrusted API method `m` where untrusted data is passed at `index`. */
2527 TExternalApiParameter(Function f, int index) {
2628 exists(UntrustedExternalApiDataNode n |
2729 f = n.getExternalFunction() and
Original file line number Diff line number Diff line change @@ -21,7 +21,9 @@ class UntrustedExternalApiDataNode extends ExternalApiDataNode {
2121/** DEPRECATED: Alias for UntrustedExternalApiDataNode */
2222deprecated class UntrustedExternalAPIDataNode = UntrustedExternalApiDataNode;
2323
24+ /** An external API which is used with untrusted data. */
2425private newtype TExternalApi =
26+ /** An untrusted API method `m` where untrusted data is passed at `index`. */
2527 TExternalApiParameter(Function f, int index) {
2628 exists(UntrustedExternalApiDataNode n |
2729 f = n.getExternalFunction() and
Original file line number Diff line number Diff line change @@ -102,7 +102,9 @@ class UntrustedExternalApiDataNode extends ExternalApiDataNode {
102102/** DEPRECATED: Alias for UntrustedExternalApiDataNode */
103103deprecated class UntrustedExternalAPIDataNode = UntrustedExternalApiDataNode;
104104
105+ /** An external API which is used with untrusted data. */
105106private newtype TExternalApi =
107+ /** An untrusted API method `m` where untrusted data is passed at `index`. */
106108 TExternalApiParameter(Callable m, int index) {
107109 exists(UntrustedExternalApiDataNode n |
108110 m = n.getCallable().getUnboundDeclaration() and
Original file line number Diff line number Diff line change @@ -195,7 +195,9 @@ class UntrustedExternalApiDataNode extends ExternalApiDataNode {
195195/** DEPRECATED: Alias for UntrustedExternalApiDataNode */
196196deprecated class UntrustedExternalAPIDataNode = UntrustedExternalApiDataNode;
197197
198+ /** An external API which is used with untrusted data. */
198199private newtype TExternalApi =
200+ /** An untrusted API method `m` where untrusted data is passed at `index`. */
199201 TExternalApiParameter(Function m, int index) {
200202 exists(UntrustedExternalApiDataNode n |
201203 m = n.getFunction() and
Original file line number Diff line number Diff line change @@ -126,7 +126,9 @@ class UntrustedExternalApiDataNode extends ExternalApiDataNode {
126126/** DEPRECATED: Alias for UntrustedExternalApiDataNode */
127127deprecated class UntrustedExternalAPIDataNode = UntrustedExternalApiDataNode;
128128
129+ /** An external API which is used with untrusted data. */
129130private newtype TExternalApi =
131+ /** An untrusted API method `m` where untrusted data is passed at `index`. */
130132 TExternalApiParameter(Method m, int index) {
131133 exists(UntrustedExternalApiDataNode n |
132134 m = n.getMethod() and
Original file line number Diff line number Diff line change @@ -81,6 +81,7 @@ deprecated class UntrustedExternalAPIDataNode = UntrustedExternalApiDataNode;
8181 * Name of an external API sink, boxed in a newtype for consistency with other languages.
8282 */
8383private newtype TExternalApi =
84+ /** An external API sink with `name`. */
8485 MkExternalApiNode(string name) {
8586 exists(Sink sink |
8687 any(Configuration c).hasFlow(_, sink) and
Original file line number Diff line number Diff line change @@ -129,7 +129,9 @@ class UntrustedExternalApiDataNode extends ExternalApiDataNode {
129129/** DEPRECATED: Alias for UntrustedExternalApiDataNode */
130130deprecated class UntrustedExternalAPIDataNode = UntrustedExternalApiDataNode;
131131
132+ /** An external API which is used with untrusted data. */
132133private newtype TExternalApi =
134+ /** An untrusted API method `m` where untrusted data is passed at `index`. */
133135 TExternalApiParameter(DataFlowPrivate::DataFlowCallable callable, int index) {
134136 exists(UntrustedExternalApiDataNode n |
135137 callable = n.getCallable() and
You can’t perform that action at this time.
0 commit comments