File tree Expand file tree Collapse file tree
java/ql/src/experimental/semmle/code/java/security Expand file tree Collapse file tree Original file line number Diff line number Diff line change @@ -2,14 +2,6 @@ import java
22private import semmle.code.java.dataflow.TaintTracking
33
44module DecompressionBomb {
5- newtype DecompressionState =
6- Zip4j ( ) or
7- Inflator ( ) or
8- ApacheCommons ( ) or
9- XerialSnappy ( ) or
10- UtilZip ( ) or
11- ZipFile ( )
12-
135 /**
146 * The Decompression bomb Sink
157 *
Original file line number Diff line number Diff line change 1- import semmle.code.java.dataflow.FlowSources
21import experimental.semmle.code.java.security.FileAndFormRemoteSource
3- import semmle.code.java.dataflow.TaintTracking
42import experimental.semmle.code.java.security.DecompressionBomb:: DecompressionBomb
53
64module DecompressionBombsConfig implements DataFlow:: ConfigSig {
Original file line number Diff line number Diff line change 11import java
2- import semmle.code.java.dataflow.DataFlow
32import semmle.code.java.dataflow.FlowSources
43
54class CommonsFileUploadAdditionalTaintStep extends Unit {
@@ -31,7 +30,7 @@ module ApacheCommonsFileUpload {
3130 ServletFileUpload ( ) {
3231 exists ( MethodAccess ma |
3332 ma .getReceiverType ( ) instanceof TypeServletFileUpload and
34- ma .getCallee ( ) .hasName ( [ "parseRequest" ] ) and
33+ ma .getCallee ( ) .hasName ( "parseRequest" ) and
3534 this .asExpr ( ) = ma
3635 )
3736 }
You can’t perform that action at this time.
0 commit comments