Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 35ccba2

Browse files
RasmusWLRasmusWL
committed
Python: Promote XMLParsing concept test
1 parent e45288e commit 35ccba2

9 files changed

Lines changed: 95 additions & 98 deletions

File tree

python/ql/test/experimental/library-tests/frameworks/XML/ExperimentalXmlConceptsTests.expected renamed to python/ql/test/experimental/library-tests/frameworks/XML/ConceptsTest.expected

File renamed without changes.

‎python/ql/test/experimental/library-tests/frameworks/XML/ConceptsTest.ql‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
import python
2+
import experimental.meta.ConceptsTest
3+
import experimental.semmle.python.frameworks.Xml // needed until modeling have been promoted

‎python/ql/test/experimental/library-tests/frameworks/XML/ExperimentalXmlConceptsTests.ql‎

Lines changed: 0 additions & 33 deletions
This file was deleted.

‎python/ql/test/experimental/library-tests/frameworks/XML/lxml_etree.py‎

Lines changed: 20 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -4,51 +4,51 @@
44
x = "some xml"
55

66
# different parsing methods
7-
lxml.etree.fromstring(x) # $ input=x vuln='XXE'
8-
lxml.etree.fromstring(text=x) # $ input=x vuln='XXE'
7+
lxml.etree.fromstring(x) # $ xmlInput=x xmlVuln='XXE'
8+
lxml.etree.fromstring(text=x) # $ xmlInput=x xmlVuln='XXE'
99

10-
lxml.etree.fromstringlist([x]) # $ input=List vuln='XXE'
11-
lxml.etree.fromstringlist(strings=[x]) # $ input=List vuln='XXE'
10+
lxml.etree.fromstringlist([x]) # $ xmlInput=List xmlVuln='XXE'
11+
lxml.etree.fromstringlist(strings=[x]) # $ xmlInput=List xmlVuln='XXE'
1212

13-
lxml.etree.XML(x) # $ input=x vuln='XXE'
14-
lxml.etree.XML(text=x) # $ input=x vuln='XXE'
13+
lxml.etree.XML(x) # $ xmlInput=x xmlVuln='XXE'
14+
lxml.etree.XML(text=x) # $ xmlInput=x xmlVuln='XXE'
1515

16-
lxml.etree.parse(StringIO(x)) # $ input=StringIO(..) vuln='XXE'
17-
lxml.etree.parse(source=StringIO(x)) # $ input=StringIO(..) vuln='XXE'
16+
lxml.etree.parse(StringIO(x)) # $ xmlInput=StringIO(..) xmlVuln='XXE'
17+
lxml.etree.parse(source=StringIO(x)) # $ xmlInput=StringIO(..) xmlVuln='XXE'
1818

19-
lxml.etree.parseid(StringIO(x)) # $ input=StringIO(..) vuln='XXE'
20-
lxml.etree.parseid(source=StringIO(x)) # $ input=StringIO(..) vuln='XXE'
19+
lxml.etree.parseid(StringIO(x)) # $ xmlInput=StringIO(..) xmlVuln='XXE'
20+
lxml.etree.parseid(source=StringIO(x)) # $ xmlInput=StringIO(..) xmlVuln='XXE'
2121

2222
# With default parsers (nothing changed)
2323
parser = lxml.etree.XMLParser()
24-
lxml.etree.fromstring(x, parser=parser) # $ input=x vuln='XXE'
24+
lxml.etree.fromstring(x, parser=parser) # $ xmlInput=x xmlVuln='XXE'
2525

2626
parser = lxml.etree.get_default_parser()
27-
lxml.etree.fromstring(x, parser=parser) # $ input=x vuln='XXE'
27+
lxml.etree.fromstring(x, parser=parser) # $ xmlInput=x xmlVuln='XXE'
2828

2929
# manual use of feed method
3030
parser = lxml.etree.XMLParser()
31-
parser.feed(x) # $ input=x vuln='XXE'
32-
parser.feed(data=x) # $ input=x vuln='XXE'
31+
parser.feed(x) # $ xmlInput=x xmlVuln='XXE'
32+
parser.feed(data=x) # $ xmlInput=x xmlVuln='XXE'
3333
parser.close()
3434

3535
# XXE-safe
3636
parser = lxml.etree.XMLParser(resolve_entities=False)
37-
lxml.etree.fromstring(x, parser) # $ input=x
38-
lxml.etree.fromstring(x, parser=parser) # $ input=x
37+
lxml.etree.fromstring(x, parser) # $ xmlInput=x
38+
lxml.etree.fromstring(x, parser=parser) # $ xmlInput=x
3939

4040
# XXE-vuln
4141
parser = lxml.etree.XMLParser(resolve_entities=True)
42-
lxml.etree.fromstring(x, parser=parser) # $ input=x vuln='XXE'
42+
lxml.etree.fromstring(x, parser=parser) # $ xmlInput=x xmlVuln='XXE'
4343

4444
# Billion laughs vuln (also XXE)
4545
parser = lxml.etree.XMLParser(huge_tree=True)
46-
lxml.etree.fromstring(x, parser=parser) # $ input=x vuln='Billion Laughs' vuln='Quadratic Blowup' vuln='XXE'
46+
lxml.etree.fromstring(x, parser=parser) # $ xmlInput=x xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup' xmlVuln='XXE'
4747

4848
# Safe for both Billion laughs and XXE
4949
parser = lxml.etree.XMLParser(resolve_entities=False, huge_tree=True)
50-
lxml.etree.fromstring(x, parser=parser) # $ input=x
50+
lxml.etree.fromstring(x, parser=parser) # $ xmlInput=x
5151

5252
# DTD retrival vuln (also XXE)
5353
parser = lxml.etree.XMLParser(load_dtd=True, no_network=False)
54-
lxml.etree.fromstring(x, parser=parser) # $ input=x vuln='DTD retrieval' vuln='XXE'
54+
lxml.etree.fromstring(x, parser=parser) # $ xmlInput=x xmlVuln='DTD retrieval' xmlVuln='XXE'

‎python/ql/test/experimental/library-tests/frameworks/XML/xml_dom.py‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -6,26 +6,26 @@
66
x = "some xml"
77

88
# minidom
9-
xml.dom.minidom.parse(StringIO(x)) # $ input=StringIO(..) vuln='Billion Laughs' vuln='Quadratic Blowup'
10-
xml.dom.minidom.parse(file=StringIO(x)) # $ input=StringIO(..) vuln='Billion Laughs' vuln='Quadratic Blowup'
9+
xml.dom.minidom.parse(StringIO(x)) # $ xmlInput=StringIO(..) xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup'
10+
xml.dom.minidom.parse(file=StringIO(x)) # $ xmlInput=StringIO(..) xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup'
1111

12-
xml.dom.minidom.parseString(x) # $ input=x vuln='Billion Laughs' vuln='Quadratic Blowup'
13-
xml.dom.minidom.parseString(string=x) # $ input=x vuln='Billion Laughs' vuln='Quadratic Blowup'
12+
xml.dom.minidom.parseString(x) # $ xmlInput=x xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup'
13+
xml.dom.minidom.parseString(string=x) # $ xmlInput=x xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup'
1414

1515

1616
# pulldom
17-
xml.dom.pulldom.parse(StringIO(x))['START_DOCUMENT'][1] # $ input=StringIO(..) vuln='Billion Laughs' vuln='Quadratic Blowup'
18-
xml.dom.pulldom.parse(stream_or_string=StringIO(x))['START_DOCUMENT'][1] # $ input=StringIO(..) vuln='Billion Laughs' vuln='Quadratic Blowup'
17+
xml.dom.pulldom.parse(StringIO(x))['START_DOCUMENT'][1] # $ xmlInput=StringIO(..) xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup'
18+
xml.dom.pulldom.parse(stream_or_string=StringIO(x))['START_DOCUMENT'][1] # $ xmlInput=StringIO(..) xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup'
1919

20-
xml.dom.pulldom.parseString(x)['START_DOCUMENT'][1] # $ input=x vuln='Billion Laughs' vuln='Quadratic Blowup'
21-
xml.dom.pulldom.parseString(string=x)['START_DOCUMENT'][1] # $ input=x vuln='Billion Laughs' vuln='Quadratic Blowup'
20+
xml.dom.pulldom.parseString(x)['START_DOCUMENT'][1] # $ xmlInput=x xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup'
21+
xml.dom.pulldom.parseString(string=x)['START_DOCUMENT'][1] # $ xmlInput=x xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup'
2222

2323

2424
# These are based on SAX parses, and you can specify your own, so you can expose yourself to XXE (yay/)
2525
parser = xml.sax.make_parser()
2626
parser.setFeature(xml.sax.handler.feature_external_ges, True)
27-
xml.dom.minidom.parse(StringIO(x), parser) # $ input=StringIO(..) vuln='Billion Laughs' vuln='DTD retrieval' vuln='Quadratic Blowup' vuln='XXE'
28-
xml.dom.minidom.parse(StringIO(x), parser=parser) # $ input=StringIO(..) vuln='Billion Laughs' vuln='DTD retrieval' vuln='Quadratic Blowup' vuln='XXE'
27+
xml.dom.minidom.parse(StringIO(x), parser) # $ xmlInput=StringIO(..) xmlVuln='Billion Laughs' xmlVuln='DTD retrieval' xmlVuln='Quadratic Blowup' xmlVuln='XXE'
28+
xml.dom.minidom.parse(StringIO(x), parser=parser) # $ xmlInput=StringIO(..) xmlVuln='Billion Laughs' xmlVuln='DTD retrieval' xmlVuln='Quadratic Blowup' xmlVuln='XXE'
2929

30-
xml.dom.pulldom.parse(StringIO(x), parser) # $ input=StringIO(..) vuln='Billion Laughs' vuln='DTD retrieval' vuln='Quadratic Blowup' vuln='XXE'
31-
xml.dom.pulldom.parse(StringIO(x), parser=parser) # $ input=StringIO(..) vuln='Billion Laughs' vuln='DTD retrieval' vuln='Quadratic Blowup' vuln='XXE'
30+
xml.dom.pulldom.parse(StringIO(x), parser) # $ xmlInput=StringIO(..) xmlVuln='Billion Laughs' xmlVuln='DTD retrieval' xmlVuln='Quadratic Blowup' xmlVuln='XXE'
31+
xml.dom.pulldom.parse(StringIO(x), parser=parser) # $ xmlInput=StringIO(..) xmlVuln='Billion Laughs' xmlVuln='DTD retrieval' xmlVuln='Quadratic Blowup' xmlVuln='XXE'

‎python/ql/test/experimental/library-tests/frameworks/XML/xml_etree.py‎

Lines changed: 17 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -4,39 +4,39 @@
44
x = "some xml"
55

66
# Parsing in different ways
7-
xml.etree.ElementTree.fromstring(x) # $ input=x vuln='Billion Laughs' vuln='Quadratic Blowup'
8-
xml.etree.ElementTree.fromstring(text=x) # $ input=x vuln='Billion Laughs' vuln='Quadratic Blowup'
7+
xml.etree.ElementTree.fromstring(x) # $ xmlInput=x xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup'
8+
xml.etree.ElementTree.fromstring(text=x) # $ xmlInput=x xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup'
99

10-
xml.etree.ElementTree.fromstringlist([x]) # $ input=List vuln='Billion Laughs' vuln='Quadratic Blowup'
11-
xml.etree.ElementTree.fromstringlist(sequence=[x]) # $ input=List vuln='Billion Laughs' vuln='Quadratic Blowup'
10+
xml.etree.ElementTree.fromstringlist([x]) # $ xmlInput=List xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup'
11+
xml.etree.ElementTree.fromstringlist(sequence=[x]) # $ xmlInput=List xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup'
1212

13-
xml.etree.ElementTree.XML(x) # $ input=x vuln='Billion Laughs' vuln='Quadratic Blowup'
14-
xml.etree.ElementTree.XML(text=x) # $ input=x vuln='Billion Laughs' vuln='Quadratic Blowup'
13+
xml.etree.ElementTree.XML(x) # $ xmlInput=x xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup'
14+
xml.etree.ElementTree.XML(text=x) # $ xmlInput=x xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup'
1515

16-
xml.etree.ElementTree.XMLID(x) # $ input=x vuln='Billion Laughs' vuln='Quadratic Blowup'
17-
xml.etree.ElementTree.XMLID(text=x) # $ input=x vuln='Billion Laughs' vuln='Quadratic Blowup'
16+
xml.etree.ElementTree.XMLID(x) # $ xmlInput=x xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup'
17+
xml.etree.ElementTree.XMLID(text=x) # $ xmlInput=x xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup'
1818

19-
xml.etree.ElementTree.parse(StringIO(x)) # $ input=StringIO(..) vuln='Billion Laughs' vuln='Quadratic Blowup'
20-
xml.etree.ElementTree.parse(source=StringIO(x)) # $ input=StringIO(..) vuln='Billion Laughs' vuln='Quadratic Blowup'
19+
xml.etree.ElementTree.parse(StringIO(x)) # $ xmlInput=StringIO(..) xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup'
20+
xml.etree.ElementTree.parse(source=StringIO(x)) # $ xmlInput=StringIO(..) xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup'
2121

22-
xml.etree.ElementTree.iterparse(StringIO(x)) # $ input=StringIO(..) vuln='Billion Laughs' vuln='Quadratic Blowup'
23-
xml.etree.ElementTree.iterparse(source=StringIO(x)) # $ input=StringIO(..) vuln='Billion Laughs' vuln='Quadratic Blowup'
22+
xml.etree.ElementTree.iterparse(StringIO(x)) # $ xmlInput=StringIO(..) xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup'
23+
xml.etree.ElementTree.iterparse(source=StringIO(x)) # $ xmlInput=StringIO(..) xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup'
2424

2525

2626
# With parsers (no options available to disable/enable security features)
2727
parser = xml.etree.ElementTree.XMLParser()
28-
xml.etree.ElementTree.fromstring(x, parser=parser) # $ input=x vuln='Billion Laughs' vuln='Quadratic Blowup'
28+
xml.etree.ElementTree.fromstring(x, parser=parser) # $ xmlInput=x xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup'
2929

3030
# manual use of feed method
3131
parser = xml.etree.ElementTree.XMLParser()
32-
parser.feed(x) # $ input=x vuln='Billion Laughs' vuln='Quadratic Blowup'
33-
parser.feed(data=x) # $ input=x vuln='Billion Laughs' vuln='Quadratic Blowup'
32+
parser.feed(x) # $ xmlInput=x xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup'
33+
parser.feed(data=x) # $ xmlInput=x xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup'
3434
parser.close()
3535

3636
# manual use of feed method on XMLPullParser
3737
parser = xml.etree.ElementTree.XMLPullParser()
38-
parser.feed(x) # $ input=x vuln='Billion Laughs' vuln='Quadratic Blowup'
39-
parser.feed(data=x) # $ input=x vuln='Billion Laughs' vuln='Quadratic Blowup'
38+
parser.feed(x) # $ xmlInput=x xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup'
39+
parser.feed(data=x) # $ xmlInput=x xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup'
4040
parser.close()
4141

4242
# note: it's technically possible to use the thing wrapper func `fromstring` with an

‎python/ql/test/experimental/library-tests/frameworks/XML/xml_sax.py‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -10,49 +10,49 @@ def __init__(self):
1010
def characters(self, data):
1111
self._result.append(data)
1212

13-
xml.sax.parse(StringIO(x)) # $ input=StringIO(..) vuln='Billion Laughs' vuln='Quadratic Blowup'
14-
xml.sax.parse(source=StringIO(x)) # $ input=StringIO(..) vuln='Billion Laughs' vuln='Quadratic Blowup'
13+
xml.sax.parse(StringIO(x)) # $ xmlInput=StringIO(..) xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup'
14+
xml.sax.parse(source=StringIO(x)) # $ xmlInput=StringIO(..) xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup'
1515

16-
xml.sax.parseString(x) # $ input=x vuln='Billion Laughs' vuln='Quadratic Blowup'
17-
xml.sax.parseString(string=x) # $ input=x vuln='Billion Laughs' vuln='Quadratic Blowup'
16+
xml.sax.parseString(x) # $ xmlInput=x xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup'
17+
xml.sax.parseString(string=x) # $ xmlInput=x xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup'
1818

1919
parser = xml.sax.make_parser()
20-
parser.parse(StringIO(x)) # $ input=StringIO(..) vuln='Billion Laughs' vuln='Quadratic Blowup'
21-
parser.parse(source=StringIO(x)) # $ input=StringIO(..) vuln='Billion Laughs' vuln='Quadratic Blowup'
20+
parser.parse(StringIO(x)) # $ xmlInput=StringIO(..) xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup'
21+
parser.parse(source=StringIO(x)) # $ xmlInput=StringIO(..) xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup'
2222

2323
# You can make it vuln to both XXE and DTD retrieval by setting this flag
2424
# see https://docs.python.org/3/library/xml.sax.handler.html#xml.sax.handler.feature_external_ges
2525
parser = xml.sax.make_parser()
2626
parser.setFeature(xml.sax.handler.feature_external_ges, True)
27-
parser.parse(StringIO(x)) # $ input=StringIO(..) vuln='Billion Laughs' vuln='DTD retrieval' vuln='Quadratic Blowup' vuln='XXE'
27+
parser.parse(StringIO(x)) # $ xmlInput=StringIO(..) xmlVuln='Billion Laughs' xmlVuln='DTD retrieval' xmlVuln='Quadratic Blowup' xmlVuln='XXE'
2828

2929
parser = xml.sax.make_parser()
3030
parser.setFeature(xml.sax.handler.feature_external_ges, False)
31-
parser.parse(StringIO(x)) # $ input=StringIO(..) vuln='Billion Laughs' vuln='Quadratic Blowup'
31+
parser.parse(StringIO(x)) # $ xmlInput=StringIO(..) xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup'
3232

3333
# Forward Type Tracking test
3434
def func(cond):
3535
parser = xml.sax.make_parser()
3636
if cond:
3737
parser.setFeature(xml.sax.handler.feature_external_ges, True)
38-
parser.parse(StringIO(x)) # $ input=StringIO(..) vuln='Billion Laughs' vuln='DTD retrieval' vuln='Quadratic Blowup' vuln='XXE'
38+
parser.parse(StringIO(x)) # $ xmlInput=StringIO(..) xmlVuln='Billion Laughs' xmlVuln='DTD retrieval' xmlVuln='Quadratic Blowup' xmlVuln='XXE'
3939
else:
40-
parser.parse(StringIO(x)) # $ input=StringIO(..) vuln='Billion Laughs' vuln='Quadratic Blowup'
40+
parser.parse(StringIO(x)) # $ xmlInput=StringIO(..) xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup'
4141

4242
# make it vuln, then making it safe
4343
# a bit of an edge-case, but is nice to be able to handle.
4444
parser = xml.sax.make_parser()
4545
parser.setFeature(xml.sax.handler.feature_external_ges, True)
4646
parser.setFeature(xml.sax.handler.feature_external_ges, False)
47-
parser.parse(StringIO(x)) # $ input=StringIO(..) vuln='Billion Laughs' vuln='Quadratic Blowup'
47+
parser.parse(StringIO(x)) # $ xmlInput=StringIO(..) xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup'
4848

4949
def check_conditional_assignment(cond):
5050
parser = xml.sax.make_parser()
5151
if cond:
5252
parser.setFeature(xml.sax.handler.feature_external_ges, True)
5353
else:
5454
parser.setFeature(xml.sax.handler.feature_external_ges, False)
55-
parser.parse(StringIO(x)) # $ input=StringIO(..) vuln='Billion Laughs' vuln='DTD retrieval' vuln='Quadratic Blowup' vuln='XXE'
55+
parser.parse(StringIO(x)) # $ xmlInput=StringIO(..) xmlVuln='Billion Laughs' xmlVuln='DTD retrieval' xmlVuln='Quadratic Blowup' xmlVuln='XXE'
5656

5757
def check_conditional_assignment2(cond):
5858
parser = xml.sax.make_parser()
@@ -61,4 +61,4 @@ def check_conditional_assignment2(cond):
6161
else:
6262
flag_value = False
6363
parser.setFeature(xml.sax.handler.feature_external_ges, flag_value)
64-
parser.parse(StringIO(x)) # $ input=StringIO(..) vuln='Billion Laughs' vuln='DTD retrieval' vuln='Quadratic Blowup' vuln='XXE'
64+
parser.parse(StringIO(x)) # $ xmlInput=StringIO(..) xmlVuln='Billion Laughs' xmlVuln='DTD retrieval' xmlVuln='Quadratic Blowup' xmlVuln='XXE'

‎python/ql/test/experimental/library-tests/frameworks/XML/xmltodict.py‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
x = "some xml"
44

5-
xmltodict.parse(x) # $ input=x
6-
xmltodict.parse(xml_input=x) # $ input=x
5+
xmltodict.parse(x) # $ xmlInput=x
6+
xmltodict.parse(xml_input=x) # $ xmlInput=x
77

8-
xmltodict.parse(x, disable_entities=False) # $ input=x vuln='Billion Laughs' vuln='Quadratic Blowup'
8+
xmltodict.parse(x, disable_entities=False) # $ xmlInput=x xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup'

‎python/ql/test/experimental/meta/ConceptsTest.qll‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -539,3 +539,30 @@ class HttpClientRequestTest extends InlineExpectationsTest {
539539
)
540540
}
541541
}
542+
543+
class XmlParsingTest extends InlineExpectationsTest {
544+
XmlParsingTest() { this = "XmlParsingTest" }
545+
546+
override string getARelevantTag() { result in ["xmlInput", "xmlVuln"] }
547+
548+
override predicate hasActualResult(Location location, string element, string tag, string value) {
549+
exists(location.getFile().getRelativePath()) and
550+
exists(XML::XMLParsing parsing |
551+
exists(DataFlow::Node input |
552+
input = parsing.getAnInput() and
553+
location = input.getLocation() and
554+
element = input.toString() and
555+
value = prettyNodeForInlineTest(input) and
556+
tag = "xmlInput"
557+
)
558+
or
559+
exists(XML::XMLParsingVulnerabilityKind kind |
560+
parsing.vulnerableTo(kind) and
561+
location = parsing.getLocation() and
562+
element = parsing.toString() and
563+
value = "'" + kind + "'" and
564+
tag = "xmlVuln"
565+
)
566+
)
567+
}
568+
}

0 commit comments

Comments
 (0)