Merge pull request #4044 from aschackmull/java/xsssink-printwriter-format

codeql-ci · web-flow · commit 82f982696699 · 2020-08-14T08:34:48.000+01:00
Approved by aibaars
diff --git a/java/ql/src/semmle/code/java/security/XSS.qll b/java/ql/src/semmle/code/java/security/XSS.qll
@@ -97,6 +97,7 @@ class WritingMethod extends Method {
     (
       this.getName().matches("print%") or
       this.getName() = "append" or
+      this.getName() = "format" or
       this.getName() = "write"
     )
   }

Original file line number	Diff line number	Diff line change
`@@ -97,6 +97,7 @@ class WritingMethod extends Method {`
`97`	`97`	`(`
`98`	`98`	`this.getName().matches("print%") or`
`99`	`99`	`this.getName() = "append" or`
	`100`	`+ this.getName() = "format" or`
`100`	`101`	`this.getName() = "write"`
`101`	`102`	`)`
`102`	`103`	`}`