Java: update xslt sink kind to xslt-injection

Jami Cogswell · Jami Cogswell · commit 6d2d25406cae · 2023-05-31T15:49:07.000-04:00
diff --git a/java/ql/lib/ext/javax.xml.transform.model.yml b/java/ql/lib/ext/javax.xml.transform.model.yml
@@ -3,4 +3,4 @@ extensions:
       pack: codeql/java-all
       extensible: sinkModel
     data:
-      - ["javax.xml.transform", "Transformer", False, "transform", "", "", "Argument[this]", "xslt", "manual"]
+      - ["javax.xml.transform", "Transformer", False, "transform", "", "", "Argument[this]", "xslt-injection", "manual"]
diff --git a/java/ql/lib/ext/net.sf.saxon.s9api.model.yml b/java/ql/lib/ext/net.sf.saxon.s9api.model.yml
@@ -3,8 +3,8 @@ extensions:
       pack: codeql/java-all
       extensible: sinkModel
     data:
-      - ["net.sf.saxon.s9api", "Xslt30Transformer", False, "applyTemplates", "", "", "Argument[this]", "xslt", "manual"]
-      - ["net.sf.saxon.s9api", "Xslt30Transformer", False, "callFunction", "", "", "Argument[this]", "xslt", "manual"]
-      - ["net.sf.saxon.s9api", "Xslt30Transformer", False, "callTemplate", "", "", "Argument[this]", "xslt", "manual"]
-      - ["net.sf.saxon.s9api", "Xslt30Transformer", False, "transform", "", "", "Argument[this]", "xslt", "manual"]
-      - ["net.sf.saxon.s9api", "XsltTransformer", False, "transform", "", "", "Argument[this]", "xslt", "manual"]
+      - ["net.sf.saxon.s9api", "Xslt30Transformer", False, "applyTemplates", "", "", "Argument[this]", "xslt-injection", "manual"]
+      - ["net.sf.saxon.s9api", "Xslt30Transformer", False, "callFunction", "", "", "Argument[this]", "xslt-injection", "manual"]
+      - ["net.sf.saxon.s9api", "Xslt30Transformer", False, "callTemplate", "", "", "Argument[this]", "xslt-injection", "manual"]
+      - ["net.sf.saxon.s9api", "Xslt30Transformer", False, "transform", "", "", "Argument[this]", "xslt-injection", "manual"]
+      - ["net.sf.saxon.s9api", "XsltTransformer", False, "transform", "", "", "Argument[this]", "xslt-injection", "manual"]
diff --git a/java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll b/java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll
@@ -277,9 +277,9 @@ module ModelValidation {
           "open-url", "jndi-injection", "ldap", "sql-injection", "jdbc-url", "log-injection",
           "mvel-injection", "xpath-injection", "groovy-injection", "xss", "ognl-injection",
           "intent-start", "pending-intent-sent", "url-redirection", "create-file", "read-file",
-          "write-file", "set-hostname-verifier", "header-splitting", "information-leak", "xslt",
-          "jexl-injection", "bean-validation", "template-injection", "fragment-injection",
-          "command-injection"
+          "write-file", "set-hostname-verifier", "header-splitting", "information-leak",
+          "xslt-injection", "jexl-injection", "bean-validation", "template-injection",
+          "fragment-injection", "command-injection"
         ] and
       not kind.matches("regex-use%") and
       not kind.matches("qltest%") and
diff --git a/java/ql/lib/semmle/code/java/security/XsltInjection.qll b/java/ql/lib/semmle/code/java/security/XsltInjection.qll
@@ -12,7 +12,7 @@ abstract class XsltInjectionSink extends DataFlow::Node { }
 
 /** A default sink representing methods susceptible to XSLT Injection attacks. */
 private class DefaultXsltInjectionSink extends XsltInjectionSink {
-  DefaultXsltInjectionSink() { sinkNode(this, "xslt") }
+  DefaultXsltInjectionSink() { sinkNode(this, "xslt-injection") }
 }
 
 /**

Original file line number	Diff line number	Diff line change
`@@ -12,7 +12,7 @@ abstract class XsltInjectionSink extends DataFlow::Node { }`
`12`	`12`
`13`	`13`	`/** A default sink representing methods susceptible to XSLT Injection attacks. */`
`14`	`14`	`private class DefaultXsltInjectionSink extends XsltInjectionSink {`
`15`		`- DefaultXsltInjectionSink() { sinkNode(this, "xslt") }`
	`15`	`+ DefaultXsltInjectionSink() { sinkNode(this, "xslt-injection") }`
`16`	`16`	`}`
`17`	`17`
`18`	`18`	`/**`