Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 6dd776b

Browse files
RasmusWLRasmusWL
committed
Python: Only produce one alert per vulnerable XML sink
This made it much easier to debug the current alerts on tests at least. Notice that it's important that we have `strictconcat` and not just `concat`, since `concat` will also allow flow to sinks that are not vulnerable to any kind of XML vulnerability :|
1 parent 16e482b commit 6dd776b

2 files changed

Lines changed: 26 additions & 40 deletions

File tree

‎python/ql/src/experimental/Security/CWE-611/XmlEntityInjection.ql‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -17,10 +17,15 @@ import DataFlow::PathGraph
1717

1818
from
1919
XmlEntityInjection::XmlEntityInjectionConfiguration config, DataFlow::PathNode source,
20-
DataFlow::PathNode sink, string kind
20+
DataFlow::PathNode sink, string kinds
2121
where
2222
config.hasFlowPath(source, sink) and
23-
kind = sink.getNode().(XmlEntityInjection::Sink).getVulnerableKind()
23+
kinds =
24+
strictconcat(string kind |
25+
kind = sink.getNode().(XmlEntityInjection::Sink).getVulnerableKind()
26+
|
27+
kind, ", "
28+
)
2429
select sink.getNode(), source, sink,
25-
"$@ XML input is constructed from a $@ and is vulnerable to " + kind + ".", sink.getNode(),
30+
"$@ XML input is constructed from a $@ and is vulnerable to: " + kinds + ".", sink.getNode(),
2631
"This", source.getNode(), "user-provided value"

0 commit comments

Comments
 (0)