Skip to content

Commit 532f6a5

Browse files
committed
Removed @kind path-problem in comment. Added text message in select.
1 parent 2059235 commit 532f6a5

File tree

1 file changed

+1
-5
lines changed

1 file changed

+1
-5
lines changed

java/ql/src/experimental/Security/CWE/CWE-470/LoadClassNoSignatureCheck.ql

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,6 @@
44
* package signature but only rely on package name.
55
* This makes it susceptible to package namespace squatting
66
* potentially leading to arbitrary code execution.
7-
* @kind path-problem
87
* @problem.severity error
98
* @precision high
109
* @id java/unsafe-reflection
@@ -59,16 +58,13 @@ from
5958
where
6059
maCreatePackageContext.getCallee().getDeclaringType().getQualifiedName() = "android.content.ContextWrapper" and
6160
maCreatePackageContext.getCallee().getName() = "createPackageContext" and
62-
6361
not isSignaturesChecked(maCreatePackageContext) and
64-
6562
lvdePackageContext.getEnclosingStmt() = maCreatePackageContext.getEnclosingStmt() and
6663
TaintTracking::localTaint(DataFlow::exprNode(lvdePackageContext.getAnAccess()), sinkPackageContext) and
67-
6864
doesPackageContextLeadToInvokeMethod(sinkPackageContext, maInvoke)
6965
select
7066
lvdePackageContext,
7167
sinkPackageContext,
7268
maInvoke,
73-
maCreatePackageContext.getArgument(0)
69+
"Potential arbitary code execution due to class loading without package signature checking."
7470

0 commit comments

Comments
 (0)