Skip to content

Commit e46de44

Browse files
committed
Solve errors caused by private ownership
1 parent caf5f4d commit e46de44

File tree

2 files changed

+12
-12
lines changed

2 files changed

+12
-12
lines changed

java/ql/src/experimental/Security/CWE/CWE-601/SpringUrlRedirect.ql

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,18 @@ import SpringUrlRedirect
1515
import semmle.code.java.dataflow.FlowSources
1616
import DataFlow::PathGraph
1717

18+
private class StartsWithSanitizer extends DataFlow::BarrierGuard {
19+
StartsWithSanitizer() {
20+
this.(MethodAccess).getMethod().hasName("startsWith") and
21+
this.(MethodAccess).getMethod().getDeclaringType() instanceof TypeString and
22+
this.(MethodAccess).getMethod().getNumberOfParameters() = 1
23+
}
24+
25+
override predicate checks(Expr e, boolean branch) {
26+
e = this.(MethodAccess).getQualifier() and branch = true
27+
}
28+
}
29+
1830
class SpringUrlRedirectFlowConfig extends TaintTracking::Configuration {
1931
SpringUrlRedirectFlowConfig() { this = "SpringUrlRedirectFlowConfig" }
2032

java/ql/src/experimental/Security/CWE/CWE-601/SpringUrlRedirect.qll

Lines changed: 0 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -5,18 +5,6 @@ import semmle.code.java.dataflow.DataFlow2
55
import semmle.code.java.dataflow.TaintTracking
66
import semmle.code.java.frameworks.spring.SpringController
77

8-
private class StartsWithSanitizer extends DataFlow::BarrierGuard {
9-
StartsWithSanitizer() {
10-
this.(MethodAccess).getMethod().hasName("startsWith") and
11-
this.(MethodAccess).getMethod().getDeclaringType() instanceof TypeString and
12-
this.(MethodAccess).getMethod().getNumberOfParameters() = 1
13-
}
14-
15-
override predicate checks(Expr e, boolean branch) {
16-
e = this.(MethodAccess).getQualifier() and branch = true
17-
}
18-
}
19-
208
/**
219
* A concatenate expression using the string `redirect:` or `ajaxredirect:` or `forward:` on the left.
2210
*

0 commit comments

Comments
 (0)