Skip to content

Python : Add support for detecting XSLT Injection #3521

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
ghost wants to merge 4 commits into from
Closed

Python : Add support for detecting XSLT Injection #3521

Changes from 1 commit
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
1ceb963
Python : Add support for detecting XSLT Injection
May 19, 2020
6dd9106
Update XSLT.qll
Jun 7, 2020
33a9fb6
Python: Reorder XSLT qhelp to be valid
RasmusWL Jun 11, 2020
a24974b
Python: Add missing <p> to qhelp
RasmusWL Jun 11, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Python: Add missing <p> to qhelp
  • Loading branch information
@RasmusWL
RasmusWL authored Jun 11, 2020
commit a24974b1946ab8e1ed72b02622f460b51d988173
4 changes: 3 additions & 1 deletion python/ql/src/experimental/CWE-643/Xslt.qhelp
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,9 @@
<!DOCTYPE qhelp SYSTEM "qhelp.dtd">
<qhelp>
<overview>
Processing an unvalidated XSL stylesheet can allow an attacker to change the structure and contents of the resultant XML, include arbitrary files from the file system, or execute arbitrary code.
<p>
Processing an unvalidated XSL stylesheet can allow an attacker to change the structure and contents of the resultant XML, include arbitrary files from the file system, or execute arbitrary code.
</p>
</overview>
<recommendation>
<p>
Expand Down