Skip to content

Java: Promote regex injection query from experimental #11070

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jcogs33 merged 23 commits into from
Nov 21, 2022
Merged

Java: Promote regex injection query from experimental #11070

Changes from 1 commit
Commits
Show all changes
23 commits
Select commit Hold shift + click to select a range
32b1400
move files out of experimental
Oct 24, 2022
25436fe
update options and qlref files
Oct 24, 2022
833c5ed
move to .qll file and switch to InlineExpectations tests
Oct 24, 2022
6545cff
add Pattern.quote sanitizer
Oct 25, 2022
6ba7449
adjust imports
Oct 27, 2022
037a05c
add classes for Pattern, Matcher, and RegExUtils
Oct 27, 2022
f6f26fe
refactor code; add change note
Oct 31, 2022
50d638d
create RegexInjection.qll file
Oct 31, 2022
91491d9
refactor into more classes; add more test cases; add LITERAL sanitizer
Oct 31, 2022
5b089bb
split sanitizer into three
Nov 1, 2022
81ad10b
update sink names
Nov 1, 2022
eb30e8f
move Pattern.quote and Pattern.LITERAL models to Regex.qll
Nov 1, 2022
32f7348
update help file
Nov 1, 2022
5dcd3b2
clean up files
Nov 1, 2022
be548c1
switch sink to use csv models
Nov 3, 2022
5402001
remove original sanitizer
Nov 3, 2022
695d6f0
move files to regexp directory
Nov 3, 2022
0e93e71
update tests
Nov 3, 2022
e49c521
update change note
Nov 3, 2022
b99a1d2
update sink and tests
Nov 4, 2022
bada986
apply review comments
Nov 8, 2022
13decd3
update sink
Nov 8, 2022
9e2ec9d
apply docs review suggestion
Nov 21, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
apply docs review suggestion
  • Loading branch information
Jami Cogswell Jami Cogswell
Jami Cogswell authored and Jami Cogswell committed Nov 21, 2022
commit 9e2ec9d12f599408f20a28d036163316b6eb077a
2 changes: 1 addition & 1 deletion java/ql/src/Security/CWE/CWE-730/RegexInjection.qhelp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@ The following example shows an HTTP request parameter that is used to construct
</p>
<p>
In the first case the user-provided regex is not escaped.
If a malicious user provides a regex that has exponential worst case performance,
If a malicious user provides a regex whose worst-case performance is exponential,
then this could lead to a Denial of Service.
</p>
<p>
Expand Down