CVE
There is no CVE for this.
Report
This query adds Xpath injection query to codeql-python. It models the lxml package.
It detects the following code patterns.
f = StringIO('<foo><bar></bar></foo>')
tree = etree.parse(f)
r = tree.xpath('`sink`')root = etree.XML("<xmlContent>")
find_text = etree.XPath("`sink`")root = etree.XML("<xmlContent>")
find_text = etree.EtXPath("`sink`")The PR also includes necessary tests for the same.
Link to the corresponding PR [github/codeql#3522]
CVE
There is no CVE for this.
Report
This query adds Xpath injection query to codeql-python. It models the
lxmlpackage.It detects the following code patterns.
The PR also includes necessary tests for the same.
Link to the corresponding PR [github/codeql#3522]