@@ -109,9 +109,8 @@ class DisableDefaultEntityResolutionTranformer extends XXEFlowStateTranformer {
109
109
}
110
110
111
111
final override XXEFlowState transform ( XXEFlowState flowstate ) {
112
- exists ( int disabledDefaultEntityResolution , int createEntityReferenceNodes |
113
- encodeXercesDOMFlowState ( flowstate , disabledDefaultEntityResolution ,
114
- createEntityReferenceNodes ) and
112
+ exists ( int createEntityReferenceNodes |
113
+ encodeXercesDOMFlowState ( flowstate , _, createEntityReferenceNodes ) and
115
114
(
116
115
newValue .getValue ( ) .toInt ( ) = 1 and // true
117
116
encodeXercesDOMFlowState ( result , 1 , createEntityReferenceNodes )
@@ -142,9 +141,8 @@ class CreateEntityReferenceNodesTranformer extends XXEFlowStateTranformer {
142
141
}
143
142
144
143
final override XXEFlowState transform ( XXEFlowState flowstate ) {
145
- exists ( int disabledDefaultEntityResolution , int createEntityReferenceNodes |
146
- encodeXercesDOMFlowState ( flowstate , disabledDefaultEntityResolution ,
147
- createEntityReferenceNodes ) and
144
+ exists ( int disabledDefaultEntityResolution |
145
+ encodeXercesDOMFlowState ( flowstate , disabledDefaultEntityResolution , _) and
148
146
(
149
147
newValue .getValue ( ) .toInt ( ) = 1 and // true
150
148
encodeXercesDOMFlowState ( result , disabledDefaultEntityResolution , 1 )
@@ -208,5 +206,4 @@ class XXEConfiguration extends DataFlow::Configuration {
208
206
from XXEConfiguration conf , DataFlow:: PathNode source , DataFlow:: PathNode sink
209
207
where conf .hasFlowPath ( source , sink )
210
208
select sink , source , sink ,
211
- "This $@ is not configured to prevent an XML external entity (XXE) attack." , source ,
212
- "XML parser"
209
+ "This $@ is not configured to prevent an XML external entity (XXE) attack." , source , "XML parser"
0 commit comments