Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 034d197

Browse files
erik-krogherik-krogh
committed
update {java/rb}/xxe to match python/javascript
1 parent 2d0a4c3 commit 034d197

2 files changed

Lines changed: 6 additions & 4 deletions

File tree

  • java/ql/src/Security/CWE/CWE-611
  • ruby/ql/src/queries/security/cwe-611

‎java/ql/src/Security/CWE/CWE-611/XXE.ql‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -51,5 +51,6 @@ class XxeConfig extends TaintTracking::Configuration {
5151

5252
from DataFlow::PathNode source, DataFlow::PathNode sink, XxeConfig conf
5353
where conf.hasFlowPath(source, sink)
54-
select sink.getNode(), source, sink, "Unsafe parsing of XML file from $@.", source.getNode(),
55-
"user input"
54+
select sink.getNode(), source, sink,
55+
"A $@ is parsed as XML without guarding against external entity expansion.", source.getNode(),
56+
"user-provided value"

‎ruby/ql/src/queries/security/cwe-611/Xxe.ql‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -39,5 +39,6 @@ class XxeConfig extends TaintTracking::Configuration {
3939

4040
from DataFlow::PathNode source, DataFlow::PathNode sink, XxeConfig conf
4141
where conf.hasFlowPath(source, sink)
42-
select sink.getNode(), source, sink, "Unsafe parsing of XML file from $@.", source.getNode(),
43-
"user input"
42+
select sink.getNode(), source, sink,
43+
"A $@ is parsed as XML without guarding against external entity expansion.", source.getNode(),
44+
"user-provided value"

0 commit comments

Comments
 (0)