Skip to content

Commit 0ac8453

Browse files
committed
Allow all arguments of methods in ScriptEngineFactory
1 parent e4699f7 commit 0ac8453

File tree

1 file changed

+15
-3
lines changed

1 file changed

+15
-3
lines changed

java/ql/src/experimental/Security/CWE/CWE-094/ScriptInjection.ql

Lines changed: 15 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,17 @@ class ScriptEngineMethod extends Method {
2626
this.getDeclaringType().getASupertype*().hasQualifiedName("javax.script", "ScriptEngineFactory") and
2727
this.hasName(["getProgram", "getMethodCallSyntax"])
2828
}
29+
30+
/** Holds if the index is for an injectable parameter. */
31+
bindingset[index]
32+
predicate isInjectableArgIndex(int index) {
33+
if
34+
this.getDeclaringType()
35+
.getASupertype*()
36+
.hasQualifiedName("javax.script", "ScriptEngineFactory")
37+
then any()
38+
else index = 0
39+
}
2940
}
3041

3142
/** The context class `org.mozilla.javascript.Context` of Rhino Java Script Engine. */
@@ -71,9 +82,10 @@ class RhinoDefineClassMethod extends Method {
7182

7283
/** Holds if `ma` is a method access of `ScriptEngineMethod`. */
7384
predicate scriptEngine(MethodAccess ma, Expr sink) {
74-
exists(Method m | m = ma.getMethod() |
75-
m instanceof ScriptEngineMethod and
76-
sink = ma.getArgument(0)
85+
exists(ScriptEngineMethod m, int index |
86+
m = ma.getMethod() and
87+
m.isInjectableArgIndex(index) and
88+
sink = ma.getArgument(index)
7789
)
7890
}
7991

0 commit comments

Comments
 (0)