io.codemodder.codemods.JEXLInjectionCodemod.report.json Maven / Gradle / Ivy

Go to download

Show more of this group Show more artifacts with this name
Show all versions of core-codemods Show documentation

Codemods for fixing common errors across many Java projects

There is a newer version: 0.97.3

{
  "summary" : "Expression language injection (JEXL) (CodeQL)",
  "change": "Added a sandbox to prevent this expression from ever accessing well-known exploitation types",
  "reviewGuidanceJustification" : "This codemod prevents JEXL expressions from accessing dangerous types like `java.lang.Runtime`, so the risk of this change interrupting expected application activity is estimated to be very low.",
  "references" : [
    "https://codeql.github.com/codeql-query-help/java/java-jexl-expression-injection/",
    "https://commons.apache.org/proper/commons-jexl/apidocs/org/apache/commons/jexl3/introspection/JexlSandbox.html",
    "https://cwe.mitre.org/data/definitions/693.html",
    "https://cwe.mitre.org/data/definitions/94.html"
  ]
}