Skip to content

Commit 6c24699

Browse files
Cover both javax.el and jakarta.el packages
1 parent adb1ed3 commit 6c24699

File tree

1 file changed

+13
-9
lines changed

1 file changed

+13
-9
lines changed

java/ql/src/experimental/Security/CWE/CWE-094/JakartaExpressionInjectionLib.qll

Lines changed: 13 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -77,22 +77,26 @@ private class TaintPropagatingCall extends Call {
7777
}
7878
}
7979

80-
private class ELProcessor extends RefType {
81-
ELProcessor() { hasQualifiedName("javax.el", "ELProcessor") }
80+
private class JakartaType extends RefType {
81+
JakartaType() { getPackage().hasName(["javax.el", "jakarta.el"]) }
8282
}
8383

84-
private class ExpressionFactory extends RefType {
85-
ExpressionFactory() { hasQualifiedName("javax.el", "ExpressionFactory") }
84+
private class ELProcessor extends JakartaType {
85+
ELProcessor() { hasName("ELProcessor") }
8686
}
8787

88-
private class ValueExpression extends RefType {
89-
ValueExpression() { hasQualifiedName("javax.el", "ValueExpression") }
88+
private class ExpressionFactory extends JakartaType {
89+
ExpressionFactory() { hasName("ExpressionFactory") }
9090
}
9191

92-
private class MethodExpression extends RefType {
93-
MethodExpression() { hasQualifiedName("javax.el", "MethodExpression") }
92+
private class ValueExpression extends JakartaType {
93+
ValueExpression() { hasName("ValueExpression") }
94+
}
95+
96+
private class MethodExpression extends JakartaType {
97+
MethodExpression() { hasName("MethodExpression") }
9498
}
9599

96100
private class LambdaExpression extends RefType {
97-
LambdaExpression() { hasQualifiedName("javax.el", "LambdaExpression") }
101+
LambdaExpression() { hasName("LambdaExpression") }
98102
}

0 commit comments

Comments
 (0)