File tree Expand file tree Collapse file tree 7 files changed +6
-62
lines changed
python/ql/src/experimental/Security-old-dataflow Expand file tree Collapse file tree 7 files changed +6
-62
lines changed Original file line number Diff line number Diff line change 11/**
2- * @name Uncontrolled data used in path expression
2+ * @name OLD QUERY: Uncontrolled data used in path expression
33 * @description Accessing paths influenced by users can allow an attacker to access unexpected resources.
44 * @kind path-problem
5- * @problem.severity error
6- * @sub-severity high
7- * @precision high
8- * @id py/path-injection
9- * @tags correctness
10- * security
11- * external/owasp/owasp-a1
12- * external/cwe/cwe-022
13- * external/cwe/cwe-023
14- * external/cwe/cwe-036
15- * external/cwe/cwe-073
16- * external/cwe/cwe-099
175 */
186
197import python
Original file line number Diff line number Diff line change 11/**
2- * @name Uncontrolled command line
2+ * @name OLD QUERY: Uncontrolled command line
33 * @description Using externally controlled strings in a command line may allow a malicious
44 * user to change the meaning of the command.
55 * @kind path-problem
6- * @problem.severity error
7- * @sub-severity high
8- * @precision high
9- * @id py/command-line-injection
10- * @tags correctness
11- * security
12- * external/owasp/owasp-a1
13- * external/cwe/cwe-078
14- * external/cwe/cwe-088
156 */
167
178import python
Original file line number Diff line number Diff line change 11/**
2- * @name Reflected server-side cross-site scripting
2+ * @name OLD QUERY: Reflected server-side cross-site scripting
33 * @description Writing user input directly to a web page
44 * allows for a cross-site scripting vulnerability.
55 * @kind path-problem
6- * @problem.severity error
7- * @sub-severity high
8- * @precision high
9- * @id py/reflective-xss
10- * @tags security
11- * external/cwe/cwe-079
12- * external/cwe/cwe-116
136 */
147
158import python
Original file line number Diff line number Diff line change 11/**
2- * @name SQL query built from user-controlled sources
2+ * @name OLD QUERY: SQL query built from user-controlled sources
33 * @description Building a SQL query from user-controlled sources is vulnerable to insertion of
44 * malicious SQL code by the user.
55 * @kind path-problem
6- * @problem.severity error
7- * @precision high
8- * @id py/sql-injection
9- * @tags security
10- * external/cwe/cwe-089
11- * external/owasp/owasp-a1
126 */
137
148import python
Original file line number Diff line number Diff line change 33 * @description Interpreting unsanitized user input as code allows a malicious user arbitrary
44 * code execution.
55 * @kind path-problem
6- * @problem.severity error
7- * @sub-severity high
8- * @precision high
9- * @id py/code-injection
10- * @tags security
11- * external/owasp/owasp-a1
12- * external/cwe/cwe-094
13- * external/cwe/cwe-095
14- * external/cwe/cwe-116
156 */
167
178import python
Original file line number Diff line number Diff line change 11/**
2- * @name Deserializing untrusted input
2+ * @name OLD QUERY: Deserializing untrusted input
33 * @description Deserializing user-controlled data may allow attackers to execute arbitrary code.
44 * @kind path-problem
5- * @id py/unsafe-deserialization
6- * @problem.severity error
7- * @sub-severity high
8- * @precision high
9- * @tags external/cwe/cwe-502
10- * security
11- * serialization
125 */
136
147import python
Original file line number Diff line number Diff line change 11/**
2- * @name URL redirection from remote source
2+ * @name OLD QUERY: URL redirection from remote source
33 * @description URL redirection based on unvalidated user input
44 * may cause redirection to malicious web sites.
55 * @kind path-problem
6- * @problem.severity error
7- * @sub-severity low
8- * @id py/url-redirection
9- * @tags security
10- * external/cwe/cwe-601
11- * @precision high
126 */
137
148import python
You can’t perform that action at this time.
0 commit comments