WIP: Xerces XXE

Robert Marsh · geoffw0 · commit 9b6c1bc69115 · 2022-04-06T12:55:52.000+01:00
diff --git a/cpp/ql/src/Security/CWE/CWE-611/XercesXXE.ql b/cpp/ql/src/Security/CWE/CWE-611/XercesXXE.ql
@@ -0,0 +1,30 @@
+/**
+ * @name External Entity Expansion
+ * @description
+ * @kind problem
+ * @id cpp/external-entity-expansion
+ * @problem.severity warning
+ * @tags security
+ *       external/cwe/cwe-611
+ */
+
+import cpp
+
+class XercesDOMParser extends Class {
+  XercesDOMParser() { this.hasName("XercesDOMParser") }
+}
+
+class AbstractDOMParser extends Class {
+    AbstractDOMParser() { this.hasName("AbstractDOMParser") }
+}
+
+/*
+parser created
+needs doSchema set?
+needs validation set?
+needs namespaces?
+(
+no security manager
+OR
+no 
+ */
