@@ -6,7 +6,7 @@ private import semmle.code.java.dataflow.ExternalFlow
6
6
7
7
/**
8
8
* A sink for Expresssion Language injection vulnerabilities via Jexl,
9
- * i.e. method calls that run evaluation of a JEXL expression.
9
+ * that is, method calls that run evaluation of a JEXL expression.
10
10
*/
11
11
abstract class JexlEvaluationSink extends DataFlow:: ExprNode { }
12
12
@@ -79,7 +79,7 @@ private class DefaultJexlInjectionAdditionalTaintStep extends JexlInjectionAddit
79
79
80
80
/**
81
81
* Holds if `n1` to `n2` is a dataflow step that creates a JEXL script using an unsafe engine
82
- * i.e. `tainted.createScript(jexlExpr)`.
82
+ * by calling `tainted.createScript(jexlExpr)`.
83
83
*/
84
84
private predicate createJexlScriptStep ( DataFlow:: Node n1 , DataFlow:: Node n2 ) {
85
85
exists ( MethodAccess ma , Method m | m = ma .getMethod ( ) and n2 .asExpr ( ) = ma |
@@ -92,7 +92,7 @@ private predicate createJexlScriptStep(DataFlow::Node n1, DataFlow::Node n2) {
92
92
93
93
/**
94
94
* Holds if `n1` to `n2` is a dataflow step that creates a JEXL expression using an unsafe engine
95
- * i.e. `tainted.createExpression(jexlExpr)`.
95
+ * by calling `tainted.createExpression(jexlExpr)`.
96
96
*/
97
97
private predicate createJexlExpressionStep ( DataFlow:: Node n1 , DataFlow:: Node n2 ) {
98
98
exists ( MethodAccess ma , Method m | m = ma .getMethod ( ) and n2 .asExpr ( ) = ma |
@@ -105,7 +105,7 @@ private predicate createJexlExpressionStep(DataFlow::Node n1, DataFlow::Node n2)
105
105
106
106
/**
107
107
* Holds if `n1` to `n2` is a dataflow step that creates a JEXL template using an unsafe engine
108
- * i.e. `tainted.createTemplate(jexlExpr)`.
108
+ * by calling `tainted.createTemplate(jexlExpr)`.
109
109
*/
110
110
private predicate createJexlTemplateStep ( DataFlow:: Node n1 , DataFlow:: Node n2 ) {
111
111
exists ( MethodAccess ma , Method m , RefType taintType |
0 commit comments