File tree Expand file tree Collapse file tree 2 files changed +12
-12
lines changed
java/ql/src/experimental/Security/CWE/CWE-601 Expand file tree Collapse file tree 2 files changed +12
-12
lines changed Original file line number Diff line number Diff line change @@ -15,6 +15,18 @@ import SpringUrlRedirect
1515import semmle.code.java.dataflow.FlowSources
1616import DataFlow:: PathGraph
1717
18+ private class StartsWithSanitizer extends DataFlow:: BarrierGuard {
19+ StartsWithSanitizer ( ) {
20+ this .( MethodAccess ) .getMethod ( ) .hasName ( "startsWith" ) and
21+ this .( MethodAccess ) .getMethod ( ) .getDeclaringType ( ) instanceof TypeString and
22+ this .( MethodAccess ) .getMethod ( ) .getNumberOfParameters ( ) = 1
23+ }
24+
25+ override predicate checks ( Expr e , boolean branch ) {
26+ e = this .( MethodAccess ) .getQualifier ( ) and branch = true
27+ }
28+ }
29+
1830class SpringUrlRedirectFlowConfig extends TaintTracking:: Configuration {
1931 SpringUrlRedirectFlowConfig ( ) { this = "SpringUrlRedirectFlowConfig" }
2032
Original file line number Diff line number Diff line change @@ -5,18 +5,6 @@ import semmle.code.java.dataflow.DataFlow2
55import semmle.code.java.dataflow.TaintTracking
66import semmle.code.java.frameworks.spring.SpringController
77
8- private class StartsWithSanitizer extends DataFlow:: BarrierGuard {
9- StartsWithSanitizer ( ) {
10- this .( MethodAccess ) .getMethod ( ) .hasName ( "startsWith" ) and
11- this .( MethodAccess ) .getMethod ( ) .getDeclaringType ( ) instanceof TypeString and
12- this .( MethodAccess ) .getMethod ( ) .getNumberOfParameters ( ) = 1
13- }
14-
15- override predicate checks ( Expr e , boolean branch ) {
16- e = this .( MethodAccess ) .getQualifier ( ) and branch = true
17- }
18- }
19-
208/**
219 * A concatenate expression using the string `redirect:` or `ajaxredirect:` or `forward:` on the left.
2210 *
You can’t perform that action at this time.
0 commit comments