Java: Add PrintWriter.format as XSS sink.

aschackmull · aschackmull · commit 21246624b4aa · 2020-08-11T15:15:39.000+02:00
diff --git a/java/ql/src/semmle/code/java/security/XSS.qll b/java/ql/src/semmle/code/java/security/XSS.qll
@@ -97,6 +97,7 @@ class WritingMethod extends Method {
     (
       this.getName().matches("print%") or
       this.getName() = "append" or
+      this.getName() = "format" or
       this.getName() = "write"
     )
   }

Original file line number	Diff line number	Diff line change
`@@ -97,6 +97,7 @@ class WritingMethod extends Method {`
`97`	`97`	`(`
`98`	`98`	`this.getName().matches("print%") or`
`99`	`99`	`this.getName() = "append" or`
	`100`	`+ this.getName() = "format" or`
`100`	`101`	`this.getName() = "write"`
`101`	`102`	`)`
`102`	`103`	`}`