Skip to content

Commit 3d69868

Browse files
committed
Change ID and description of cloned query
This should be cleaned up more effectively soon, but this suffices to fix the clashing-id problem.
1 parent a1c38b7 commit 3d69868

File tree

1 file changed

+4
-3
lines changed

1 file changed

+4
-3
lines changed

java/ql/src/experimental/Security/CWE/CWE-078/ExecTainted.ql

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
/**
2-
* @name Uncontrolled command line
2+
* @name Uncontrolled command line (experimental sinks)
33
* @description Using externally controlled strings in a command line is vulnerable to malicious
4-
* changes in the strings.
4+
* changes in the strings (includes experimental sinks).
55
* @kind path-problem
66
* @problem.severity error
77
* @precision high
8-
* @id java/command-line-injection
8+
* @id java/command-line-injection-experimental
99
* @tags security
1010
* external/cwe/cwe-078
1111
* external/cwe/cwe-088
@@ -18,6 +18,7 @@ import ExecCommon
1818
import JSchOSInjection
1919
import DataFlow::PathGraph
2020

21+
// This is a clone of query `java/command-line-injection` that also includes experimental sinks.
2122
from DataFlow::PathNode source, DataFlow::PathNode sink, ArgumentToExec execArg
2223
where execTainted(source, sink, execArg)
2324
select execArg, source, sink, "$@ flows to here and is used in a command.", source.getNode(),

0 commit comments

Comments
 (0)