File tree Expand file tree Collapse file tree 7 files changed +6
-62
lines changed
python/ql/src/experimental/Security-old-dataflow Expand file tree Collapse file tree 7 files changed +6
-62
lines changed Original file line number Diff line number Diff line change 1
1
/**
2
- * @name Uncontrolled data used in path expression
2
+ * @name OLD QUERY: Uncontrolled data used in path expression
3
3
* @description Accessing paths influenced by users can allow an attacker to access unexpected resources.
4
4
* @kind path-problem
5
- * @problem.severity error
6
- * @sub-severity high
7
- * @precision high
8
- * @id py/path-injection
9
- * @tags correctness
10
- * security
11
- * external/owasp/owasp-a1
12
- * external/cwe/cwe-022
13
- * external/cwe/cwe-023
14
- * external/cwe/cwe-036
15
- * external/cwe/cwe-073
16
- * external/cwe/cwe-099
17
5
*/
18
6
19
7
import python
Original file line number Diff line number Diff line change 1
1
/**
2
- * @name Uncontrolled command line
2
+ * @name OLD QUERY: Uncontrolled command line
3
3
* @description Using externally controlled strings in a command line may allow a malicious
4
4
* user to change the meaning of the command.
5
5
* @kind path-problem
6
- * @problem.severity error
7
- * @sub-severity high
8
- * @precision high
9
- * @id py/command-line-injection
10
- * @tags correctness
11
- * security
12
- * external/owasp/owasp-a1
13
- * external/cwe/cwe-078
14
- * external/cwe/cwe-088
15
6
*/
16
7
17
8
import python
Original file line number Diff line number Diff line change 1
1
/**
2
- * @name Reflected server-side cross-site scripting
2
+ * @name OLD QUERY: Reflected server-side cross-site scripting
3
3
* @description Writing user input directly to a web page
4
4
* allows for a cross-site scripting vulnerability.
5
5
* @kind path-problem
6
- * @problem.severity error
7
- * @sub-severity high
8
- * @precision high
9
- * @id py/reflective-xss
10
- * @tags security
11
- * external/cwe/cwe-079
12
- * external/cwe/cwe-116
13
6
*/
14
7
15
8
import python
Original file line number Diff line number Diff line change 1
1
/**
2
- * @name SQL query built from user-controlled sources
2
+ * @name OLD QUERY: SQL query built from user-controlled sources
3
3
* @description Building a SQL query from user-controlled sources is vulnerable to insertion of
4
4
* malicious SQL code by the user.
5
5
* @kind path-problem
6
- * @problem.severity error
7
- * @precision high
8
- * @id py/sql-injection
9
- * @tags security
10
- * external/cwe/cwe-089
11
- * external/owasp/owasp-a1
12
6
*/
13
7
14
8
import python
Original file line number Diff line number Diff line change 3
3
* @description Interpreting unsanitized user input as code allows a malicious user arbitrary
4
4
* code execution.
5
5
* @kind path-problem
6
- * @problem.severity error
7
- * @sub-severity high
8
- * @precision high
9
- * @id py/code-injection
10
- * @tags security
11
- * external/owasp/owasp-a1
12
- * external/cwe/cwe-094
13
- * external/cwe/cwe-095
14
- * external/cwe/cwe-116
15
6
*/
16
7
17
8
import python
Original file line number Diff line number Diff line change 1
1
/**
2
- * @name Deserializing untrusted input
2
+ * @name OLD QUERY: Deserializing untrusted input
3
3
* @description Deserializing user-controlled data may allow attackers to execute arbitrary code.
4
4
* @kind path-problem
5
- * @id py/unsafe-deserialization
6
- * @problem.severity error
7
- * @sub-severity high
8
- * @precision high
9
- * @tags external/cwe/cwe-502
10
- * security
11
- * serialization
12
5
*/
13
6
14
7
import python
Original file line number Diff line number Diff line change 1
1
/**
2
- * @name URL redirection from remote source
2
+ * @name OLD QUERY: URL redirection from remote source
3
3
* @description URL redirection based on unvalidated user input
4
4
* may cause redirection to malicious web sites.
5
5
* @kind path-problem
6
- * @problem.severity error
7
- * @sub-severity low
8
- * @id py/url-redirection
9
- * @tags security
10
- * external/cwe/cwe-601
11
- * @precision high
12
6
*/
13
7
14
8
import python
You can’t perform that action at this time.
0 commit comments