Skip to content

Commit 89f9581

Browse files
committed
Mention regex-use sink kind in QLDoc for regexSinkKindInfo
1 parent ff8bb2b commit 89f9581

File tree

1 file changed

+9
-3
lines changed

1 file changed

+9
-3
lines changed

java/ql/lib/semmle/code/java/regex/RegexFlowConfigs.qll

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,9 +13,15 @@ private class ExploitableStringLiteral extends StringLiteral {
1313

1414
/**
1515
* Holds if `kind` is an external sink kind that is relevant for regex flow.
16-
* `full` is true if sinks with this kind match against the full string of its input.
17-
* `strArg` is the index of the argument to methods with this sink kind that contan the string to be matched against,
18-
* where -1 is the qualifier; or -2 if no such argument exists.
16+
* `full` is true if sinks with this kind match against the full string of its
17+
* input.
18+
* `strArg` is the index of the argument to methods with this sink kind that
19+
* contain the string to be matched against, where -1 is the qualifier; or -2
20+
* if no such argument exists.
21+
*
22+
* Note that `regex-use` is deliberately not a possible value for `kind` here,
23+
* as it is used for regular expression injection sinks that should not be used
24+
* as polynomial ReDoS sinks.
1925
*/
2026
private predicate regexSinkKindInfo(string kind, boolean full, int strArg) {
2127
sinkModel(_, _, _, _, _, _, _, kind, _, _) and

0 commit comments

Comments
 (0)