File tree Expand file tree Collapse file tree 1 file changed +5
-3
lines changed
java/ql/src/experimental/Security/CWE/CWE-089 Expand file tree Collapse file tree 1 file changed +5
-3
lines changed Original file line number Diff line number Diff line change @@ -128,13 +128,14 @@ predicate isMybatisXmlOrAnnotationSqlInjection(
128
128
// ```java
129
129
// @Select(select id,name from test order by ${orderby,jdbcType=VARCHAR})
130
130
// void test(@Param("orderby") String name);
131
- //
131
+ //
132
132
// @Select(select id,name from test where name = ${ user . name })
133
133
// void test(@Param("user") User u);
134
134
// ```
135
135
exists ( Annotation annotation |
136
136
unsafeExpression
137
- .regexpMatch ( "\\$\\{\\s*" + annotation .getValue ( "value" ) .( CompileTimeConstantExpr ) .getStringValue ( ) +
137
+ .regexpMatch ( "\\$\\{\\s*" +
138
+ annotation .getValue ( "value" ) .( CompileTimeConstantExpr ) .getStringValue ( ) +
138
139
"\\b[^}]*\\}" ) and
139
140
annotation .getType ( ) instanceof TypeParam and
140
141
ma .getAnArgument ( ) = node .asExpr ( ) and
@@ -157,7 +158,8 @@ predicate isMybatisXmlOrAnnotationSqlInjection(
157
158
or
158
159
unsafeExpression .regexpMatch ( "\\$\\{\\s*arg" + i + "\\b[^}]*\\}" )
159
160
or
160
- unsafeExpression .regexpMatch ( "\\$\\{\\s*" + ma .getMethod ( ) .getParameter ( i ) .getName ( ) + "\\b[^}]*\\}" )
161
+ unsafeExpression
162
+ .regexpMatch ( "\\$\\{\\s*" + ma .getMethod ( ) .getParameter ( i ) .getName ( ) + "\\b[^}]*\\}" )
161
163
) and
162
164
ma .getArgument ( i ) = node .asExpr ( )
163
165
)
You can’t perform that action at this time.
0 commit comments