@@ -20,8 +20,18 @@ import semmle.code.java.dataflow.TaintTracking2
2020//import DataFlow::PathGraph
2121import github.LocalSources
2222
23+ module XXELocalConfig implements DataFlow:: ConfigSig {
24+ predicate isSource ( DataFlow:: Node source ) {
25+ source instanceof LocalUserInput and
26+ not exists ( DataFlow:: Node src | src .asExpr ( ) instanceof SafeSaxSource ) }
2327
24- module SafeSAXSourceFlowConfig implements DataFlow:: ConfigSig {
28+ predicate isSink ( DataFlow:: Node sink ) { sink instanceof UnsafeXxeSink }
29+ }
30+
31+ module XXELocalFlow = TaintTracking:: Global< XXELocalConfig > ;
32+ import XXELocalFlow:: PathGraph
33+
34+ module SafeSAXSourceFlowConfig implements DataFlow:: ConfigSig {
2535 predicate isSource ( DataFlow:: Node src ) { src .asExpr ( ) instanceof SafeSaxSource }
2636
2737 predicate isSink ( DataFlow:: Node sink ) {
@@ -42,18 +52,6 @@ class UnsafeXxeSink extends DataFlow::ExprNode {
4252 )
4353 }
4454}
45-
46- module XXELocalConfig implements DataFlow:: ConfigSig {
47- predicate isSource ( DataFlow:: Node source ) {
48- source instanceof LocalUserInput and
49- not exists ( DataFlow:: Node src | src .asExpr ( ) instanceof SafeSaxSource ) }
50-
51- predicate isSink ( DataFlow:: Node sink ) { sink instanceof UnsafeXxeSink }
52- }
53-
54- module XXELocalFlow = TaintTracking:: Global< XXELocalConfig > ;
55- import XXELocalFlow:: PathGraph
56-
5755from XXELocalFlow:: PathNode source , XXELocalFlow:: PathNode sink
5856where XXELocalFlow:: flowPath ( source , sink )
5957select sink .getNode ( ) , source , sink , "Unsafe parsing of XML file from $@." , source .getNode ( ) ,
0 commit comments