Skip to content

Commit cea97b3

Browse files
Jami CogswellJami Cogswell
Jami Cogswell
authored and
Jami Cogswell
committed
Java: update mvel sink kind to mvel-injection
1 parent 6cee0c4 commit cea97b3

File tree

7 files changed

+23
-22
lines changed

7 files changed

+23
-22
lines changed

‎java/ql/lib/ext/javax.script.model.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,4 +3,4 @@ extensions:
33
pack: codeql/java-all
44
extensible: sinkModel
55
data:
6-
- ["javax.script", "CompiledScript", False, "eval", "", "", "Argument[this]", "mvel", "manual"]
6+
- ["javax.script", "CompiledScript", False, "eval", "", "", "Argument[this]", "mvel-injection", "manual"]

‎java/ql/lib/ext/org.mvel2.compiler.model.yml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ extensions:
33
pack: codeql/java-all
44
extensible: sinkModel
55
data:
6-
- ["org.mvel2.compiler", "Accessor", False, "getValue", "", "", "Argument[this]", "mvel", "manual"]
7-
- ["org.mvel2.compiler", "CompiledAccExpression", False, "getValue", "", "", "Argument[this]", "mvel", "manual"]
8-
- ["org.mvel2.compiler", "CompiledExpression", False, "getDirectValue", "", "", "Argument[this]", "mvel", "manual"]
9-
- ["org.mvel2.compiler", "ExecutableStatement", False, "getValue", "", "", "Argument[this]", "mvel", "manual"]
6+
- ["org.mvel2.compiler", "Accessor", False, "getValue", "", "", "Argument[this]", "mvel-injection", "manual"]
7+
- ["org.mvel2.compiler", "CompiledAccExpression", False, "getValue", "", "", "Argument[this]", "mvel-injection", "manual"]
8+
- ["org.mvel2.compiler", "CompiledExpression", False, "getDirectValue", "", "", "Argument[this]", "mvel-injection", "manual"]
9+
- ["org.mvel2.compiler", "ExecutableStatement", False, "getValue", "", "", "Argument[this]", "mvel-injection", "manual"]

‎java/ql/lib/ext/org.mvel2.jsr223.model.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,6 @@ extensions:
33
pack: codeql/java-all
44
extensible: sinkModel
55
data:
6-
- ["org.mvel2.jsr223", "MvelCompiledScript", False, "eval", "", "", "Argument[this]", "mvel", "manual"]
7-
- ["org.mvel2.jsr223", "MvelScriptEngine", False, "eval", "", "", "Argument[0]", "mvel", "manual"]
8-
- ["org.mvel2.jsr223", "MvelScriptEngine", False, "evaluate", "", "", "Argument[0]", "mvel", "manual"]
6+
- ["org.mvel2.jsr223", "MvelCompiledScript", False, "eval", "", "", "Argument[this]", "mvel-injection", "manual"]
7+
- ["org.mvel2.jsr223", "MvelScriptEngine", False, "eval", "", "", "Argument[0]", "mvel-injection", "manual"]
8+
- ["org.mvel2.jsr223", "MvelScriptEngine", False, "evaluate", "", "", "Argument[0]", "mvel-injection", "manual"]

‎java/ql/lib/ext/org.mvel2.model.yml

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,10 @@ extensions:
33
pack: codeql/java-all
44
extensible: sinkModel
55
data:
6-
- ["org.mvel2", "MVEL", False, "eval", "", "", "Argument[0]", "mvel", "manual"]
7-
- ["org.mvel2", "MVEL", False, "evalToBoolean", "", "", "Argument[0]", "mvel", "manual"]
8-
- ["org.mvel2", "MVEL", False, "evalToString", "", "", "Argument[0]", "mvel", "manual"]
9-
- ["org.mvel2", "MVEL", False, "executeAllExpression", "", "", "Argument[0]", "mvel", "manual"]
10-
- ["org.mvel2", "MVEL", False, "executeExpression", "", "", "Argument[0]", "mvel", "manual"]
11-
- ["org.mvel2", "MVEL", False, "executeSetExpression", "", "", "Argument[0]", "mvel", "manual"]
12-
- ["org.mvel2", "MVELRuntime", False, "execute", "", "", "Argument[1]", "mvel", "manual"]
6+
- ["org.mvel2", "MVEL", False, "eval", "", "", "Argument[0]", "mvel-injection", "manual"]
7+
- ["org.mvel2", "MVEL", False, "evalToBoolean", "", "", "Argument[0]", "mvel-injection", "manual"]
8+
- ["org.mvel2", "MVEL", False, "evalToString", "", "", "Argument[0]", "mvel-injection", "manual"]
9+
- ["org.mvel2", "MVEL", False, "executeAllExpression", "", "", "Argument[0]", "mvel-injection", "manual"]
10+
- ["org.mvel2", "MVEL", False, "executeExpression", "", "", "Argument[0]", "mvel-injection", "manual"]
11+
- ["org.mvel2", "MVEL", False, "executeSetExpression", "", "", "Argument[0]", "mvel-injection", "manual"]
12+
- ["org.mvel2", "MVELRuntime", False, "execute", "", "", "Argument[1]", "mvel-injection", "manual"]

‎java/ql/lib/ext/org.mvel2.templates.model.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,5 +3,5 @@ extensions:
33
pack: codeql/java-all
44
extensible: sinkModel
55
data:
6-
- ["org.mvel2.templates", "TemplateRuntime", False, "eval", "", "", "Argument[0]", "mvel", "manual"]
7-
- ["org.mvel2.templates", "TemplateRuntime", False, "execute", "", "", "Argument[0]", "mvel", "manual"]
6+
- ["org.mvel2.templates", "TemplateRuntime", False, "eval", "", "", "Argument[0]", "mvel-injection", "manual"]
7+
- ["org.mvel2.templates", "TemplateRuntime", False, "execute", "", "", "Argument[0]", "mvel-injection", "manual"]

‎java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -275,10 +275,11 @@ module ModelValidation {
275275
not kind =
276276
[
277277
"open-url", "jndi-injection", "ldap", "sql-injection", "jdbc-url", "log-injection",
278-
"mvel", "xpath-injection", "groovy-injection", "xss", "ognl-injection", "intent-start",
279-
"pending-intent-sent", "url-redirection", "create-file", "read-file", "write-file",
280-
"set-hostname-verifier", "header-splitting", "information-leak", "xslt", "jexl-injection",
281-
"bean-validation", "template-injection", "fragment-injection", "command-injection"
278+
"mvel-injection", "xpath-injection", "groovy-injection", "xss", "ognl-injection",
279+
"intent-start", "pending-intent-sent", "url-redirection", "create-file", "read-file",
280+
"write-file", "set-hostname-verifier", "header-splitting", "information-leak", "xslt",
281+
"jexl-injection", "bean-validation", "template-injection", "fragment-injection",
282+
"command-injection"
282283
] and
283284
not kind.matches("regex-use%") and
284285
not kind.matches("qltest%") and

‎java/ql/lib/semmle/code/java/security/MvelInjection.qll

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ class MvelInjectionAdditionalTaintStep extends Unit {
2525

2626
/** Default sink for MVEL injection vulnerabilities. */
2727
private class DefaultMvelEvaluationSink extends MvelEvaluationSink {
28-
DefaultMvelEvaluationSink() { sinkNode(this, "mvel") }
28+
DefaultMvelEvaluationSink() { sinkNode(this, "mvel-injection") }
2929
}
3030

3131
/** A default sanitizer that considers numeric and boolean typed data safe for building MVEL expressions */

0 commit comments

Comments
 (0)