Skip to content

Commit a342efc

Browse files
committed
Revert accidental change
1 parent 1233d81 commit a342efc

File tree

1 file changed

+6
-11
lines changed

1 file changed

+6
-11
lines changed

actions/ql/src/Security/CWE-094/CodeInjectionMedium.ql

Lines changed: 6 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
* @name Code injection
33
* @description Interpreting unsanitized user input as code allows a malicious user to perform arbitrary
44
* code execution.
5-
* @ kind path-problem
5+
* @kind path-problem
66
* @problem.severity warning
77
* @security-severity 5.0
88
* @precision medium
@@ -18,13 +18,8 @@ import actions
1818
import codeql.actions.security.CodeInjectionQuery
1919
import CodeInjectionFlow::PathGraph
2020

21-
// from CodeInjectionFlow::PathNode source, CodeInjectionFlow::PathNode sink
22-
// where mediumSeverityCodeInjection(source, sink)
23-
// select sink.getNode(), source, sink,
24-
// "Potential code injection in $@, which may be controlled by an external user.", sink,
25-
// sink.getNode().asExpr().(Expression).getRawExpression()
26-
from string test
27-
where
28-
test.regexpMatch("(python[\\d\\.]*)\\s+([^\\s]+)\\.py\\b") and
29-
test = "python -m dir" //go run main/main.go //go run .
30-
select test
21+
from CodeInjectionFlow::PathNode source, CodeInjectionFlow::PathNode sink
22+
where mediumSeverityCodeInjection(source, sink)
23+
select sink.getNode(), source, sink,
24+
"Potential code injection in $@, which may be controlled by an external user.", sink,
25+
sink.getNode().asExpr().(Expression).getRawExpression()

0 commit comments

Comments
 (0)