mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-17 03:59:28 +00:00
32 lines
606 B
TOML
32 lines
606 B
TOML
|
version = "1"
|
||
|
|
language = "java"
|
||
|
|
|
||
|
|
[[source]]
|
||
|
|
id = "servlet"
|
||
|
|
patterns = ["getParameter", "getHeader", "getCookies", "readLine", "getQueryString"]
|
||
|
|
|
||
|
|
[[sink]]
|
||
|
|
id = "exec"
|
||
|
|
cwe = "CWE-78"
|
||
|
|
calls = ["exec"]
|
||
|
|
rule_ids = ["java-command-exec"]
|
||
|
|
|
||
|
|
[[sink]]
|
||
|
|
id = "executeQuery"
|
||
|
|
cwe = "CWE-89"
|
||
|
|
calls = ["executeQuery", "execute", "prepareCall"]
|
||
|
|
rule_ids = ["java-sql-injection"]
|
||
|
|
|
||
|
|
[[sink]]
|
||
|
|
id = "readObject"
|
||
|
|
cwe = "CWE-502"
|
||
|
|
calls = ["readObject"]
|
||
|
|
rule_ids = ["java-deserialization"]
|
||
|
|
|
||
|
|
[[sink]]
|
||
|
|
id = "MessageDigest"
|
||
|
|
cwe = "CWE-327"
|
||
|
|
calls = ["getInstance"]
|
||
|
|
rule_ids = ["java-weak-hash"]
|
||
|
|
weak_literals = ["MD5", "SHA-1", "SHA1"]
|