@@ -60,15 +60,15 @@ class XercesDOMParserClass extends Class {
60
60
/**
61
61
* The `SAXParser` class.
62
62
*/
63
- class SAXParserClass extends Class {
64
- SAXParserClass ( ) { this .hasName ( "SAXParser" ) }
63
+ class SaxParserClass extends Class {
64
+ SaxParserClass ( ) { this .hasName ( "SAXParser" ) }
65
65
}
66
66
67
67
/**
68
68
* The `SAX2XMLReader` class.
69
69
*/
70
- class SAX2XMLReader extends Class {
71
- SAX2XMLReader ( ) { this .hasName ( "SAX2XMLReader" ) }
70
+ class Sax2XmlReader extends Class {
71
+ Sax2XmlReader ( ) { this .hasName ( "SAX2XMLReader" ) }
72
72
}
73
73
74
74
/**
@@ -120,7 +120,7 @@ class DisableDefaultEntityResolutionTranformer extends XXEFlowStateTranformer {
120
120
call .getTarget ( ) = f and
121
121
(
122
122
f .getDeclaringType ( ) instanceof AbstractDOMParserClass or
123
- f .getDeclaringType ( ) instanceof SAXParserClass
123
+ f .getDeclaringType ( ) instanceof SaxParserClass
124
124
) and
125
125
f .hasName ( "setDisableDefaultEntityResolution" ) and
126
126
this = call .getQualifier ( ) and
@@ -195,7 +195,7 @@ class SetFeatureTranformer extends XXEFlowStateTranformer {
195
195
SetFeatureTranformer ( ) {
196
196
exists ( Call call , Function f |
197
197
call .getTarget ( ) = f and
198
- f .getDeclaringType ( ) instanceof SAX2XMLReader and
198
+ f .getDeclaringType ( ) instanceof Sax2XmlReader and
199
199
f .hasName ( "setFeature" ) and
200
200
this = call .getQualifier ( ) and
201
201
globalValueNumber ( call .getArgument ( 0 ) ) .getAnExpr ( ) .( VariableAccess ) .getTarget ( ) instanceof
@@ -225,8 +225,8 @@ class SetFeatureTranformer extends XXEFlowStateTranformer {
225
225
class ParseFunction extends Function {
226
226
ParseFunction ( ) {
227
227
this .getClassAndName ( "parse" ) instanceof AbstractDOMParserClass or
228
- this .getClassAndName ( "parse" ) instanceof SAXParserClass or
229
- this .getClassAndName ( "parse" ) instanceof SAX2XMLReader
228
+ this .getClassAndName ( "parse" ) instanceof SaxParserClass or
229
+ this .getClassAndName ( "parse" ) instanceof Sax2XmlReader
230
230
}
231
231
}
232
232
@@ -245,10 +245,10 @@ class CreateLSParser extends Function {
245
245
* The `createXMLReader` function that returns a newly created `SAX2XMLReader`
246
246
* object.
247
247
*/
248
- class CreateXMLReader extends Function {
249
- CreateXMLReader ( ) {
248
+ class CreateXmlReader extends Function {
249
+ CreateXmlReader ( ) {
250
250
this .hasName ( "createXMLReader" ) and
251
- this .getUnspecifiedType ( ) .( PointerType ) .getBaseType ( ) instanceof SAX2XMLReader // returns a `SAX2XMLReader *`.
251
+ this .getUnspecifiedType ( ) .( PointerType ) .getBaseType ( ) instanceof Sax2XmlReader // returns a `SAX2XMLReader *`.
252
252
}
253
253
}
254
254
@@ -314,15 +314,15 @@ class XXEConfiguration extends DataFlow::Configuration {
314
314
// source is the write on `this` of a call to the `SAXParser`
315
315
// constructor.
316
316
exists ( CallInstruction call |
317
- call .getStaticCallTarget ( ) = any ( SAXParserClass c ) .getAConstructor ( ) and
317
+ call .getStaticCallTarget ( ) = any ( SaxParserClass c ) .getAConstructor ( ) and
318
318
node .asInstruction ( ) .( WriteSideEffectInstruction ) .getDestinationAddress ( ) =
319
319
call .getThisArgument ( ) and
320
320
encodeXercesFlowState ( flowstate , 0 , 1 ) // default configuration
321
321
)
322
322
or
323
323
// source is the result of a call to `createXMLReader`.
324
324
exists ( Call call |
325
- call .getTarget ( ) instanceof CreateXMLReader and
325
+ call .getTarget ( ) instanceof CreateXmlReader and
326
326
call = node .asExpr ( ) and
327
327
encodeXercesFlowState ( flowstate , 0 , 1 ) // default configuration
328
328
)
0 commit comments