Skip to content

Commit b3d218a

Browse files
Jami CogswellJami Cogswell
authored andcommitted
Java: condense 'replacementKind' code
1 parent 06c83ee commit b3d218a

File tree

1 file changed

+14
-29
lines changed

1 file changed

+14
-29
lines changed

java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll

Lines changed: 14 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -277,50 +277,35 @@ module ModelValidation {
277277
}
278278

279279
private string replacementKind() {
280-
this = "sql" and result = "\"sql-injection\""
280+
this = ["sql", "xpath", "groovy", "jexl", "mvel", "xslt", "ldap"] and
281+
result = this + "-injection"
281282
or
282-
this = "url-redirect" and result = "\"url-redirection\""
283+
this = "url-redirect" and result = "url-redirection"
283284
or
284-
this = "xpath" and result = "\"xpath-injection\""
285+
this = "ssti" and result = "template-injection"
285286
or
286-
this = "ssti" and result = "\"template-injection\""
287+
this = "logging" and result = "log-injection"
287288
or
288-
this = "logging" and result = "\"log-injection\""
289+
this = "pending-intent-sent" and result = "pending-intents"
289290
or
290-
this = "groovy" and result = "\"groovy-injection\""
291+
this = "intent-start" and result = "intent-redirection"
291292
or
292-
this = "jexl" and result = "\"jexl-injection\""
293+
this = "set-hostname-verifier" and result = "hostname-verification"
293294
or
294-
this = "mvel" and result = "\"mvel-injection\""
295+
this = "header-splitting" and result = "response-splitting"
295296
or
296-
this = "xslt" and result = "\"xslt-injection\""
297+
this = "xss" and result = "html-injection\" or \"js-injection"
297298
or
298-
this = "ldap" and result = "\"ldap-injection\""
299+
this = "write-file" and result = "file-content-store"
299300
or
300-
this = "pending-intent-sent" and result = "\"pending-intents\""
301+
this = ["create-file", "read-file"] and result = "path-injection"
301302
or
302-
this = "intent-start" and result = "\"intent-redirection\""
303-
or
304-
this = "set-hostname-verifier" and result = "\"hostname-verification\""
305-
or
306-
this = "header-splitting" and result = "\"response-splitting\""
307-
or
308-
this = "xss" and result = "\"html-injection\" or \"js-injection\""
309-
or
310-
this = "write-file" and result = "\"file-content-store\""
311-
or
312-
this = "create-file" and result = "\"path-injection\""
313-
or
314-
this = "read-file" and result = "\"path-injection\""
315-
or
316-
this = "open-url" and result = "\"request-forgery\""
317-
or
318-
this = "jdbc-url" and result = "\"request-forgery\""
303+
this = ["open-url", "jdbc-url"] and result = "request-forgery"
319304
}
320305

321306
string deprecationMessage() {
322307
result =
323-
"The kind \"" + this + "\" is deprecated. Use " + this.replacementKind() + " instead."
308+
"The kind \"" + this + "\" is deprecated. Use \"" + this.replacementKind() + "\" instead."
324309
}
325310
}
326311

0 commit comments

Comments
 (0)