Join GitHub today
GitHub is home to over 50 million developers working together to host and review code, manage projects, and build software together.
Sign upJava: Add SSRF query for Java #84
Open
Labels
Comments
|
@porcupineyhairs You might want to test your query against CVE-2019-10686, which was fixed by: ctripcorp/apollo@5691937 |
|
Thats a good point, I sholuld have added Spring's RestTemplate to the list in github/codeql#3452 (comment) |
|
I have now added |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
CVE ID(s)
There are no CVE's found with this query yet as this has not been tested against projects on lgtm.
Report
*An SSRF vulnerability allows an attacker to make the victim server communicate with attacker controlled server. This is usually a critical issue which can lead to an RCE.
My PR adds support for the following API's
java.net.httppackageIt also models flows through
URIandURLclasses.It also includes library tests, query tests and
qhelpfiles along with nicely documented code.Please note, github/codeql#3452 tackles a similar issue. but there are quite a few difference between this one and that. i have written a brief over here
Link to corresponding PR: [github/codeql#3454]
Are you planning to discuss this vulnerability submission publicly? (Blog Post, social networks, etc). We would love to have you spread the word about the good work you are doing
Yes, I have around 10 PR's open as of now across both the codeql repos. I also have a few more ideas which I plan to write a query for. Once, I am done with those, I plan on writing a set of blogs documenting the process of writing the query from the scratch. That would ideally help attract newcomers to codeql.