@@ -10,10 +10,8 @@ import semmle.code.java.security.InsecureLdapAuth
10
10
* A taint-tracking configuration for `ldap://` URL in LDAP authentication.
11
11
*/
12
12
private module InsecureUrlFlowConfig implements DataFlow:: ConfigSig {
13
- /** Source of `ldap://` connection string. */
14
13
predicate isSource ( DataFlow:: Node src ) { src .asExpr ( ) instanceof InsecureLdapUrl }
15
14
16
- /** Sink of directory context creation. */
17
15
predicate isSink ( DataFlow:: Node sink ) {
18
16
exists ( ConstructorCall cc |
19
17
cc .getConstructedType ( ) .getAnAncestor ( ) instanceof TypeDirContext and
@@ -37,14 +35,12 @@ module InsecureUrlFlowConfiguration = TaintTracking::Make<InsecureUrlFlowConfig>
37
35
* A taint-tracking configuration for `simple` basic-authentication in LDAP configuration.
38
36
*/
39
37
private module BasicAuthFlowConfig implements DataFlow:: ConfigSig {
40
- /** Source of `simple` configuration. */
41
38
predicate isSource ( DataFlow:: Node src ) {
42
39
exists ( MethodAccess ma |
43
40
isBasicAuthEnv ( ma ) and ma .getQualifier ( ) = src .( PostUpdateNode ) .getPreUpdateNode ( ) .asExpr ( )
44
41
)
45
42
}
46
43
47
- /** Sink of directory context creation. */
48
44
predicate isSink ( DataFlow:: Node sink ) {
49
45
exists ( ConstructorCall cc |
50
46
cc .getConstructedType ( ) .getAnAncestor ( ) instanceof TypeDirContext and
@@ -59,14 +55,12 @@ module BasicAuthFlowConfiguration = DataFlow::Make<BasicAuthFlowConfig>;
59
55
* A taint-tracking configuration for `ssl` configuration in LDAP authentication.
60
56
*/
61
57
private module SslFlowConfig implements DataFlow:: ConfigSig {
62
- /** Source of `ssl` configuration. */
63
58
predicate isSource ( DataFlow:: Node src ) {
64
59
exists ( MethodAccess ma |
65
60
isSslEnv ( ma ) and ma .getQualifier ( ) = src .( PostUpdateNode ) .getPreUpdateNode ( ) .asExpr ( )
66
61
)
67
62
}
68
63
69
- /** Sink of directory context creation. */
70
64
predicate isSink ( DataFlow:: Node sink ) {
71
65
exists ( ConstructorCall cc |
72
66
cc .getConstructedType ( ) .getAnAncestor ( ) instanceof TypeDirContext and
0 commit comments