File tree Expand file tree Collapse file tree 1 file changed +15
-3
lines changed
java/ql/src/experimental/Security/CWE/CWE-094 Expand file tree Collapse file tree 1 file changed +15
-3
lines changed Original file line number Diff line number Diff line change @@ -26,6 +26,17 @@ class ScriptEngineMethod extends Method {
26
26
this .getDeclaringType ( ) .getASupertype * ( ) .hasQualifiedName ( "javax.script" , "ScriptEngineFactory" ) and
27
27
this .hasName ( [ "getProgram" , "getMethodCallSyntax" ] )
28
28
}
29
+
30
+ /** Holds if the index is for an injectable parameter. */
31
+ bindingset [ index]
32
+ predicate isInjectableArgIndex ( int index ) {
33
+ if
34
+ this .getDeclaringType ( )
35
+ .getASupertype * ( )
36
+ .hasQualifiedName ( "javax.script" , "ScriptEngineFactory" )
37
+ then any ( )
38
+ else index = 0
39
+ }
29
40
}
30
41
31
42
/** The context class `org.mozilla.javascript.Context` of Rhino Java Script Engine. */
@@ -71,9 +82,10 @@ class RhinoDefineClassMethod extends Method {
71
82
72
83
/** Holds if `ma` is a method access of `ScriptEngineMethod`. */
73
84
predicate scriptEngine ( MethodAccess ma , Expr sink ) {
74
- exists ( Method m | m = ma .getMethod ( ) |
75
- m instanceof ScriptEngineMethod and
76
- sink = ma .getArgument ( 0 )
85
+ exists ( ScriptEngineMethod m , int index |
86
+ m = ma .getMethod ( ) and
87
+ m .isInjectableArgIndex ( index ) and
88
+ sink = ma .getArgument ( index )
77
89
)
78
90
}
79
91
You can’t perform that action at this time.
0 commit comments