File tree Expand file tree Collapse file tree 2 files changed +2
-2
lines changed
java/ql/src/experimental/Security/CWE/CWE-625 Expand file tree Collapse file tree 2 files changed +2
-2
lines changed Original file line number Diff line number Diff line change 44<qhelp >
55
66<overview >
7- <p >By default, a "dot" (<code >.</code >) in a regular expression matches all characters except the new line characters <code >\n</code > and
7+ <p >By default, a "dot" (<code >.</code >) in a regular expression matches all characters except the newline characters <code >\n</code > and
88<code >\r</code >. Regular expressions containing a dot can be bypassed with the characters <code >\r</code >(<code >%0a</code >) and
99<code >\n</code >(<code >%0d</code >) when the default Java regular expression matching implementations are used. This becomes a security issue
1010if these regular expressions are used to decide whether to grant access to protected application resources.</p >
Original file line number Diff line number Diff line change @@ -19,7 +19,7 @@ private class PermissiveDotStr extends StringLiteral {
1919 }
2020}
2121
22- /** Remote flow sources obtained from the URI of a serlvet request. */
22+ /** Remote flow sources obtained from the URI of a servlet request. */
2323private class GetServletUriSource extends SourceModelCsv {
2424 override predicate row ( string row ) {
2525 row =
You can’t perform that action at this time.
0 commit comments