Skip to content

Commit fc58d10

Browse files
Jami CogswellJami Cogswell
Jami Cogswell
authored and
Jami Cogswell
committed
Java: update xpath sink kind to xpath-injection
1 parent 55be2e5 commit fc58d10

File tree

6 files changed

+28
-28
lines changed

6 files changed

+28
-28
lines changed

‎java/ql/lib/ext/javax.xml.xpath.model.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,6 @@ extensions:
33
pack: codeql/java-all
44
extensible: sinkModel
55
data:
6-
- ["javax.xml.xpath", "XPath", True, "compile", "", "", "Argument[0]", "xpath", "manual"]
7-
- ["javax.xml.xpath", "XPath", True, "evaluate", "", "", "Argument[0]", "xpath", "manual"]
8-
- ["javax.xml.xpath", "XPath", True, "evaluateExpression", "", "", "Argument[0]", "xpath", "manual"]
6+
- ["javax.xml.xpath", "XPath", True, "compile", "", "", "Argument[0]", "xpath-injection", "manual"]
7+
- ["javax.xml.xpath", "XPath", True, "evaluate", "", "", "Argument[0]", "xpath-injection", "manual"]
8+
- ["javax.xml.xpath", "XPath", True, "evaluateExpression", "", "", "Argument[0]", "xpath-injection", "manual"]

‎java/ql/lib/ext/org.dom4j.model.yml

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -3,18 +3,18 @@ extensions:
33
pack: codeql/java-all
44
extensible: sinkModel
55
data:
6-
- ["org.dom4j", "DocumentFactory", True, "createPattern", "", "", "Argument[0]", "xpath", "manual"]
7-
- ["org.dom4j", "DocumentFactory", True, "createXPath", "", "", "Argument[0]", "xpath", "manual"]
8-
- ["org.dom4j", "DocumentFactory", True, "createXPathFilter", "", "", "Argument[0]", "xpath", "manual"]
9-
- ["org.dom4j", "DocumentHelper", False, "createPattern", "", "", "Argument[0]", "xpath", "manual"]
10-
- ["org.dom4j", "DocumentHelper", False, "createXPath", "", "", "Argument[0]", "xpath", "manual"]
11-
- ["org.dom4j", "DocumentHelper", False, "createXPathFilter", "", "", "Argument[0]", "xpath", "manual"]
12-
- ["org.dom4j", "DocumentHelper", False, "selectNodes", "", "", "Argument[0]", "xpath", "manual"]
13-
- ["org.dom4j", "DocumentHelper", False, "sort", "", "", "Argument[1]", "xpath", "manual"]
14-
- ["org.dom4j", "Node", True, "createXPath", "", "", "Argument[0]", "xpath", "manual"]
15-
- ["org.dom4j", "Node", True, "matches", "", "", "Argument[0]", "xpath", "manual"]
16-
- ["org.dom4j", "Node", True, "numberValueOf", "", "", "Argument[0]", "xpath", "manual"]
17-
- ["org.dom4j", "Node", True, "selectNodes", "", "", "Argument[0..1]", "xpath", "manual"]
18-
- ["org.dom4j", "Node", True, "selectObject", "", "", "Argument[0]", "xpath", "manual"]
19-
- ["org.dom4j", "Node", True, "selectSingleNode", "", "", "Argument[0]", "xpath", "manual"]
20-
- ["org.dom4j", "Node", True, "valueOf", "", "", "Argument[0]", "xpath", "manual"]
6+
- ["org.dom4j", "DocumentFactory", True, "createPattern", "", "", "Argument[0]", "xpath-injection", "manual"]
7+
- ["org.dom4j", "DocumentFactory", True, "createXPath", "", "", "Argument[0]", "xpath-injection", "manual"]
8+
- ["org.dom4j", "DocumentFactory", True, "createXPathFilter", "", "", "Argument[0]", "xpath-injection", "manual"]
9+
- ["org.dom4j", "DocumentHelper", False, "createPattern", "", "", "Argument[0]", "xpath-injection", "manual"]
10+
- ["org.dom4j", "DocumentHelper", False, "createXPath", "", "", "Argument[0]", "xpath-injection", "manual"]
11+
- ["org.dom4j", "DocumentHelper", False, "createXPathFilter", "", "", "Argument[0]", "xpath-injection", "manual"]
12+
- ["org.dom4j", "DocumentHelper", False, "selectNodes", "", "", "Argument[0]", "xpath-injection", "manual"]
13+
- ["org.dom4j", "DocumentHelper", False, "sort", "", "", "Argument[1]", "xpath-injection", "manual"]
14+
- ["org.dom4j", "Node", True, "createXPath", "", "", "Argument[0]", "xpath-injection", "manual"]
15+
- ["org.dom4j", "Node", True, "matches", "", "", "Argument[0]", "xpath-injection", "manual"]
16+
- ["org.dom4j", "Node", True, "numberValueOf", "", "", "Argument[0]", "xpath-injection", "manual"]
17+
- ["org.dom4j", "Node", True, "selectNodes", "", "", "Argument[0..1]", "xpath-injection", "manual"]
18+
- ["org.dom4j", "Node", True, "selectObject", "", "", "Argument[0]", "xpath-injection", "manual"]
19+
- ["org.dom4j", "Node", True, "selectSingleNode", "", "", "Argument[0]", "xpath-injection", "manual"]
20+
- ["org.dom4j", "Node", True, "valueOf", "", "", "Argument[0]", "xpath-injection", "manual"]

‎java/ql/lib/ext/org.dom4j.tree.model.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,5 +3,5 @@ extensions:
33
pack: codeql/java-all
44
extensible: sinkModel
55
data:
6-
- ["org.dom4j.tree", "AbstractNode", True, "createPattern", "", "", "Argument[0]", "xpath", "manual"]
7-
- ["org.dom4j.tree", "AbstractNode", True, "createXPathFilter", "", "", "Argument[0]", "xpath", "manual"]
6+
- ["org.dom4j.tree", "AbstractNode", True, "createPattern", "", "", "Argument[0]", "xpath-injection", "manual"]
7+
- ["org.dom4j.tree", "AbstractNode", True, "createXPathFilter", "", "", "Argument[0]", "xpath-injection", "manual"]

‎java/ql/lib/ext/org.dom4j.util.model.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,6 @@ extensions:
33
pack: codeql/java-all
44
extensible: sinkModel
55
data:
6-
- ["org.dom4j.util", "ProxyDocumentFactory", True, "createPattern", "", "", "Argument[0]", "xpath", "manual"]
7-
- ["org.dom4j.util", "ProxyDocumentFactory", True, "createXPath", "", "", "Argument[0]", "xpath", "manual"]
8-
- ["org.dom4j.util", "ProxyDocumentFactory", True, "createXPathFilter", "", "", "Argument[0]", "xpath", "manual"]
6+
- ["org.dom4j.util", "ProxyDocumentFactory", True, "createPattern", "", "", "Argument[0]", "xpath-injection", "manual"]
7+
- ["org.dom4j.util", "ProxyDocumentFactory", True, "createXPath", "", "", "Argument[0]", "xpath-injection", "manual"]
8+
- ["org.dom4j.util", "ProxyDocumentFactory", True, "createXPathFilter", "", "", "Argument[0]", "xpath-injection", "manual"]

‎java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -275,10 +275,10 @@ module ModelValidation {
275275
not kind =
276276
[
277277
"open-url", "jndi-injection", "ldap", "sql-injection", "jdbc-url", "logging", "mvel",
278-
"xpath", "groovy", "xss", "ognl-injection", "intent-start", "pending-intent-sent",
279-
"url-redirection", "create-file", "read-file", "write-file", "set-hostname-verifier",
280-
"header-splitting", "information-leak", "xslt", "jexl", "bean-validation", "ssti",
281-
"fragment-injection", "command-injection"
278+
"xpath-injection", "groovy", "xss", "ognl-injection", "intent-start",
279+
"pending-intent-sent", "url-redirection", "create-file", "read-file", "write-file",
280+
"set-hostname-verifier", "header-splitting", "information-leak", "xslt", "jexl",
281+
"bean-validation", "ssti", "fragment-injection", "command-injection"
282282
] and
283283
not kind.matches("regex-use%") and
284284
not kind.matches("qltest%") and

‎java/ql/lib/semmle/code/java/security/XPath.qll

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ abstract class XPathInjectionSink extends DataFlow::Node { }
1313
/** A default sink representing methods susceptible to XPath Injection attacks. */
1414
private class DefaultXPathInjectionSink extends XPathInjectionSink {
1515
DefaultXPathInjectionSink() {
16-
sinkNode(this, "xpath")
16+
sinkNode(this, "xpath-injection")
1717
or
1818
exists(ClassInstanceExpr constructor |
1919
constructor.getConstructedType().getASourceSupertype*().hasQualifiedName("org.dom4j", "XPath")

0 commit comments

Comments
 (0)