File tree Expand file tree Collapse file tree 1 file changed +4
-4
lines changed
java/ql/src/semmle/code/java/security Expand file tree Collapse file tree 1 file changed +4
-4
lines changed Original file line number Diff line number Diff line change @@ -6,15 +6,15 @@ import semmle.code.java.dataflow.FlowSources
66import semmle.code.java.frameworks.Servlets
77import semmle.code.java.frameworks.JaxWS
88
9- /** Header-splitting sinks. Expressions that end up in an HTTP header. */
9+ /** A sink that is vulnerable to a HTTP header splitting attack . */
1010abstract class HeaderSplittingSink extends DataFlow:: Node { }
1111
12- /** Sources that cannot be used to perform a header splitting attack . */
12+ /** A source that introduces data considered safe to use by a header splitting source . */
1313abstract class SafeHeaderSplittingSource extends DataFlow:: Node {
1414 SafeHeaderSplittingSource ( ) { this instanceof RemoteFlowSource }
1515}
1616
17- /** Servlet and JaxWS sinks susceptible to header splitting. */
17+ /** A sink that identifies a Java Servlet or JaxWs method that is vulnerable to a HTTP header splitting attack . */
1818private class ServletHeaderSplittingSink extends HeaderSplittingSink {
1919 ServletHeaderSplittingSink ( ) {
2020 exists ( ResponseAddCookieMethod m , MethodAccess ma |
@@ -40,7 +40,7 @@ private class ServletHeaderSplittingSink extends HeaderSplittingSink {
4040 }
4141}
4242
43- /** Sources of data considered safe to use by header splitting sinks . */
43+ /** A default source that introduces data considered safe to use by a header splitting source . */
4444private class DefaultSafeHeaderSplittingSource extends SafeHeaderSplittingSource {
4545 DefaultSafeHeaderSplittingSource ( ) {
4646 this .asExpr ( ) .( MethodAccess ) .getMethod ( ) instanceof HttpServletRequestGetHeaderMethod or
You can’t perform that action at this time.
0 commit comments