René's URL Explorer Experiment


Title: Java: Add XXE sinks by haby0 · Pull Request #6564 · github/codeql · GitHub

Open Graph Title: Java: Add XXE sinks by haby0 · Pull Request #6564 · github/codeql

X Title: Java: Add XXE sinks by haby0 · Pull Request #6564 · github/codeql

Description: CodeQL: the libraries and queries that power security researchers around the world, as well as code scanning in GitHub Advanced Security - Java: Add XXE sinks by haby0 · Pull Request #6564 · github/codeql

Open Graph Description: There are many XML parsers for Java, and most of them are vulnerable to XXE because their default settings enable parsing of external entities. This query currently identifies vulnerable XML parsin...

X Description: There are many XML parsers for Java, and most of them are vulnerable to XXE because their default settings enable parsing of external entities. This query currently identifies vulnerable XML parsin...

Opengraph URL: https://github.com/github/codeql/pull/6564

X: @github

direct link

Domain: github.com

route-pattern/_view_fragments/voltron/pull_requests/show/:user_id/:repository/:id/pull_request_layout(.:format)
route-controllervoltron_pull_requests_fragments
route-actionpull_request_layout
fetch-noncev2:3deee219-06da-6113-3f19-66a6a7423e97
current-catalog-service-hashae870bc5e265a340912cde392f23dad3671a0a881730ffdadd82f2f57d81641b
request-idC206:28182:A1E220:DCD7F3:6A4C8BAD
html-safe-nonce8d23d0c3983f78dc09188bdf79f4dcf1b5dc24f05a2394b653e7565004175af8
visitor-payloadeyJyZWZlcnJlciI6IiIsInJlcXVlc3RfaWQiOiJDMjA2OjI4MTgyOkExRTIyMDpEQ0Q3RjM6NkE0QzhCQUQiLCJ2aXNpdG9yX2lkIjoiNDgwMzYxODk0MzIwODgxOTYzMCIsInJlZ2lvbl9lZGdlIjoiaWFkIiwicmVnaW9uX3JlbmRlciI6ImlhZCJ9
visitor-hmac16f604be4eb9a4eb38528f2c6310f566865c6075fa8a3da53dfb0f6cfe68415b
hovercard-subject-tagpull_request:721375479
github-keyboard-shortcutsrepository,pull-request-list,pull-request-conversation,pull-request-files-changed,copilot
google-site-verificationApib7-x98H0j5cPqHWwSMm6dNU4GmODRoqxLiDzdx9I
octolytics-urlhttps://collector.github.com/github/collect
analytics-location///voltron/pull_requests_fragments/pull_request_layout
fb:app_id1401488693436528
apple-itunes-appapp-id=1477376905, app-argument=https://github.com/_view_fragments/voltron/pull_requests/show/github/codeql/6564/pull_request_layout
twitter:imagehttps://opengraph.githubassets.com/6aee38cfdae78626da2dd68c09267ce307fc780d9f72680bf114535078ab3218/github/codeql/pull/6564
twitter:cardsummary_large_image
og:imagehttps://opengraph.githubassets.com/6aee38cfdae78626da2dd68c09267ce307fc780d9f72680bf114535078ab3218/github/codeql/pull/6564
og:image:altThere are many XML parsers for Java, and most of them are vulnerable to XXE because their default settings enable parsing of external entities. This query currently identifies vulnerable XML parsin...
og:image:width1200
og:image:height600
og:site_nameGitHub
og:typeobject
og:author:usernamehaby0
hostnamegithub.com
expected-hostnamegithub.com
None3d11bb817438277de2a940854450e83a7d32b6aeb5014e9e6b00a6423900251c
turbo-cache-controlno-cache
go-importgithub.com/github/codeql git https://github.com/github/codeql.git
octolytics-dimension-user_id9919
octolytics-dimension-user_logingithub
octolytics-dimension-repository_id143040428
octolytics-dimension-repository_nwogithub/codeql
octolytics-dimension-repository_publictrue
octolytics-dimension-repository_is_forkfalse
octolytics-dimension-repository_network_root_id143040428
octolytics-dimension-repository_network_root_nwogithub/codeql
turbo-body-classeslogged-out env-production page-responsive
disable-turbofalse
browser-stats-urlhttps://api.github.com/_private/browser/stats
browser-errors-urlhttps://api.github.com/_private/browser/errors
release7a2dede45637df6b92ddcfe2a557e67d4b5854ae
ui-targetfull
theme-color#1e2327
color-schemelight dark

Links:

Skip to contenthttps://github.com/github/codeql/pull/6564#start-of-content
https://github.com/
Sign in https://github.com/login?return_to=https%3A%2F%2Fgithub.com%2Fgithub%2Fcodeql%2Fpull%2F6564
GitHub CopilotWrite better code with AIhttps://github.com/features/copilot
GitHub Copilot appDirect agents from issue to mergehttps://github.com/features/ai/github-app
MCP RegistryNewIntegrate external toolshttps://github.com/mcp
ActionsAutomate any workflowhttps://github.com/features/actions
CodespacesInstant dev environmentshttps://github.com/features/codespaces
IssuesPlan and track workhttps://github.com/features/issues
Code ReviewManage code changeshttps://github.com/features/code-review
GitHub Advanced SecurityFind and fix vulnerabilitieshttps://github.com/security/advanced-security
Code securitySecure your code as you buildhttps://github.com/security/advanced-security/code-security
Secret protectionStop leaks before they starthttps://github.com/security/advanced-security/secret-protection
Why GitHubhttps://github.com/why-github
Documentationhttps://docs.github.com
Bloghttps://github.blog
Changeloghttps://github.blog/changelog
Marketplacehttps://github.com/marketplace
View all featureshttps://github.com/features
Enterpriseshttps://github.com/enterprise
Small and medium teamshttps://github.com/team
Startupshttps://github.com/enterprise/startups
Nonprofitshttps://github.com/solutions/industry/nonprofits
App Modernizationhttps://github.com/solutions/use-case/app-modernization
DevSecOpshttps://github.com/solutions/use-case/devsecops
DevOpshttps://github.com/solutions/use-case/devops
CI/CDhttps://github.com/solutions/use-case/ci-cd
View all use caseshttps://github.com/solutions/use-case
Healthcarehttps://github.com/solutions/industry/healthcare
Financial serviceshttps://github.com/solutions/industry/financial-services
Manufacturinghttps://github.com/solutions/industry/manufacturing
Governmenthttps://github.com/solutions/industry/government
View all industrieshttps://github.com/solutions/industry
View all solutionshttps://github.com/solutions
AIhttps://github.com/resources/articles?topic=ai
Software Developmenthttps://github.com/resources/articles?topic=software-development
DevOpshttps://github.com/resources/articles?topic=devops
Securityhttps://github.com/resources/articles?topic=security
View all topicshttps://github.com/resources/articles
Customer storieshttps://github.com/customer-stories
Events & webinarshttps://github.com/resources/events
Ebooks & reportshttps://github.com/resources/whitepapers
Business insightshttps://github.com/solutions/executive-insights
GitHub Skillshttps://skills.github.com
Documentationhttps://docs.github.com
Customer supporthttps://support.github.com
Community forumhttps://github.com/orgs/community/discussions
Trust centerhttps://github.com/trust-center
Partnershttps://github.com/partners
View all resourceshttps://github.com/resources
GitHub SponsorsFund open source developershttps://github.com/sponsors
Security Labhttps://securitylab.github.com
Maintainer Communityhttps://maintainers.github.com
Acceleratorhttps://github.com/accelerator
GitHub Starshttps://stars.github.com
Archive Programhttps://archiveprogram.github.com
Topicshttps://github.com/topics
Trendinghttps://github.com/trending
Collectionshttps://github.com/collections
Enterprise platformAI-powered developer platformhttps://github.com/enterprise
GitHub Advanced SecurityEnterprise-grade security featureshttps://github.com/security/advanced-security
Copilot for BusinessEnterprise-grade AI featureshttps://github.com/features/copilot/copilot-business
Premium SupportEnterprise-grade 24/7 supporthttps://github.com/premium-support
Pricinghttps://github.com/pricing
Search syntax tipshttps://docs.github.com/search-github/github-code-search/understanding-github-code-search-syntax
documentationhttps://docs.github.com/search-github/github-code-search/understanding-github-code-search-syntax
Sign in https://github.com/login?return_to=https%3A%2F%2Fgithub.com%2Fgithub%2Fcodeql%2Fpull%2F6564
Sign up https://github.com/signup?ref_cta=Sign+up&ref_loc=header+logged+out&ref_page=%2F%3Cuser-name%3E%2F%3Crepo-name%3E%2Fvoltron%2Fpull_requests_fragments%2Fpull_request_layout&source=header-repo&source_repo=github%2Fcodeql
Reloadhttps://github.com/github/codeql/pull/6564
Reloadhttps://github.com/github/codeql/pull/6564
Reloadhttps://github.com/github/codeql/pull/6564
Please reload this pagehttps://github.com/github/codeql/pull/6564
github https://github.com/github
codeqlhttps://github.com/github/codeql
Notifications https://github.com/login?return_to=%2Fgithub%2Fcodeql
Fork 2k https://github.com/login?return_to=%2Fgithub%2Fcodeql
Star 9.8k https://github.com/login?return_to=%2Fgithub%2Fcodeql
Code https://github.com/github/codeql
Issues 987 https://github.com/github/codeql/issues
Pull requests 424 https://github.com/github/codeql/pulls
Discussions https://github.com/github/codeql/discussions
Actions https://github.com/github/codeql/actions
Projects https://github.com/github/codeql/projects
Models https://github.com/github/codeql/models
Security and quality 0 https://github.com/github/codeql/security
Insights https://github.com/github/codeql/pulse
Code https://github.com/github/codeql
Issues https://github.com/github/codeql/issues
Pull requests https://github.com/github/codeql/pulls
Discussions https://github.com/github/codeql/discussions
Actions https://github.com/github/codeql/actions
Projects https://github.com/github/codeql/projects
Models https://github.com/github/codeql/models
Security and quality https://github.com/github/codeql/security
Insights https://github.com/github/codeql/pulse
smowtonhttps://github.com/smowton
github:mainhttps://github.com/github/codeql/tree/main
Conversationhttps://github.com/github/codeql/pull/6564
Commits2 (2)https://github.com/github/codeql/pull/6564/commits
Checkshttps://github.com/github/codeql/pull/6564/checks
Files changedhttps://github.com/github/codeql/pull/6564/files
Java: Add XXE sinkshttps://github.com/github/codeql/pull/6564#top
smowtonhttps://github.com/smowton
github:mainhttps://github.com/github/codeql/tree/main
https://github.com/haby0
haby0https://github.com/haby0
Aug 27, 2021https://github.com/github/codeql/pull/6564#issue-981299072
vertx-webhttps://github.com/vert-x3/vertx-web/blob/3.5.3/vertx-web-api-contract/src/main/java/io/vertx/ext/web/api/validation/impl/XMLTypeValidator.java#L35
Please reload this pagehttps://github.com/github/codeql/pull/6564
https://github.com/haby0
haby0https://github.com/haby0
code ownerhttps://github.com/github/codeql/blob/48829450bbfb318f9d7703db3000f1373369083a/CODEOWNERS#L3
August 27, 2021 14:19https://github.com/github/codeql/pull/6564#event-5218954505
https://github.com/apps/github-actions
github-actionshttps://github.com/apps/github-actions
documentation https://github.com/github/codeql/issues?q=state%3Aopen%20label%3Adocumentation
Java https://github.com/github/codeql/issues?q=state%3Aopen%20label%3AJava
Aug 27, 2021https://github.com/github/codeql/pull/6564#event-5218955752
[Java]: Add XXE sinks github/securitylab#420 https://github.com/github/securitylab/issues/420
[Java]: Add XXE sinks github/securitylab#426 https://github.com/github/securitylab/issues/426
https://github.com/smowton
smowtonhttps://github.com/smowton
Sep 2, 2021https://github.com/github/codeql/pull/6564#issuecomment-911526946
Please reload this pagehttps://github.com/github/codeql/pull/6564
https://github.com/smowton
smowtonhttps://github.com/smowton
Sep 7, 2021 https://github.com/github/codeql/pull/6564#pullrequestreview-747755852
View reviewed changes https://github.com/github/codeql/pull/6564/files
java/ql/src/experimental/Security/CWE/CWE-611/XXE.qlhttps://github.com/github/codeql/pull/6564/files#diff-4f04c86f6078cd24b81cca15276d85da2d0da0fd670ae9e9e5eb4f8f8f7ade69
smowtonhttps://github.com/smowton
Sep 7, 2021https://github.com/github/codeql/pull/6564#discussion_r703344373
Learn morehttps://docs.github.com/articles/managing-disruptive-comments/#hiding-a-comment
Please reload this pagehttps://github.com/github/codeql/pull/6564
java/ql/src/experimental/Security/CWE/CWE-611/XXE.qlhttps://github.com/github/codeql/pull/6564/files#diff-4f04c86f6078cd24b81cca15276d85da2d0da0fd670ae9e9e5eb4f8f8f7ade69
smowtonhttps://github.com/smowton
Sep 7, 2021https://github.com/github/codeql/pull/6564#discussion_r703344536
Learn morehttps://docs.github.com/articles/managing-disruptive-comments/#hiding-a-comment
Please reload this pagehttps://github.com/github/codeql/pull/6564
java/ql/src/experimental/Security/CWE/CWE-611/XXE.qlhttps://github.com/github/codeql/pull/6564/files#diff-4f04c86f6078cd24b81cca15276d85da2d0da0fd670ae9e9e5eb4f8f8f7ade69
smowtonhttps://github.com/smowton
Sep 7, 2021https://github.com/github/codeql/pull/6564#discussion_r703345959
Learn morehttps://docs.github.com/articles/managing-disruptive-comments/#hiding-a-comment
Please reload this pagehttps://github.com/github/codeql/pull/6564
java/ql/src/experimental/Security/CWE/CWE-611/XXELib.qllhttps://github.com/github/codeql/pull/6564/files#diff-f80d389382ed4bfbbbac8178bc1eca6022062a727d4ecc1693897866bdf398fe
smowtonhttps://github.com/smowton
Sep 7, 2021https://github.com/github/codeql/pull/6564#discussion_r703346687
Learn morehttps://docs.github.com/articles/managing-disruptive-comments/#hiding-a-comment
Please reload this pagehttps://github.com/github/codeql/pull/6564
java/ql/src/experimental/Security/CWE/CWE-611/XXELocal.qlhttps://github.com/github/codeql/pull/6564/files#diff-6a0deaf62340102a7e061863618908cc3b825ef6fe92b204840cc2ac5bf4a3e1
smowtonhttps://github.com/smowton
Sep 7, 2021https://github.com/github/codeql/pull/6564#discussion_r703350959
Learn morehttps://docs.github.com/articles/managing-disruptive-comments/#hiding-a-comment
Please reload this pagehttps://github.com/github/codeql/pull/6564
haby0https://github.com/haby0
Sep 7, 2021https://github.com/github/codeql/pull/6564#discussion_r703382003
Learn morehttps://docs.github.com/articles/managing-disruptive-comments/#hiding-a-comment
Please reload this pagehttps://github.com/github/codeql/pull/6564
java/ql/lib/semmle/code/java/security/XmlParsers.qllhttps://github.com/github/codeql/pull/6564/files#diff-a0f62217138aaa9280a46b4e1b35b93299d2520cc8a4d3ab7493ad035e8733f7
smowtonhttps://github.com/smowton
Sep 7, 2021https://github.com/github/codeql/pull/6564#discussion_r703351237
Learn morehttps://docs.github.com/articles/managing-disruptive-comments/#hiding-a-comment
Please reload this pagehttps://github.com/github/codeql/pull/6564
java/ql/lib/semmle/code/java/security/XmlParsers.qllhttps://github.com/github/codeql/pull/6564/files#diff-a0f62217138aaa9280a46b4e1b35b93299d2520cc8a4d3ab7493ad035e8733f7
smowtonhttps://github.com/smowton
Sep 7, 2021https://github.com/github/codeql/pull/6564#discussion_r703354399
Learn morehttps://docs.github.com/articles/managing-disruptive-comments/#hiding-a-comment
Please reload this pagehttps://github.com/github/codeql/pull/6564
https://github.com/haby0
haby0https://github.com/haby0
smowtonhttps://github.com/smowton
September 7, 2021 10:24https://github.com/github/codeql/pull/6564#event-5264850525
https://github.com/smowton
smowtonhttps://github.com/smowton
Sep 7, 2021 https://github.com/github/codeql/pull/6564#pullrequestreview-747922998
View reviewed changes https://github.com/github/codeql/pull/6564/files
java/ql/lib/semmle/code/java/security/XmlParsers.qllhttps://github.com/github/codeql/pull/6564/files#diff-a0f62217138aaa9280a46b4e1b35b93299d2520cc8a4d3ab7493ad035e8733f7
smowtonhttps://github.com/smowton
Sep 7, 2021https://github.com/github/codeql/pull/6564#discussion_r703471864
Learn morehttps://docs.github.com/articles/managing-disruptive-comments/#hiding-a-comment
Please reload this pagehttps://github.com/github/codeql/pull/6564
https://github.com/haby0
haby0https://github.com/haby0
smowtonhttps://github.com/smowton
September 8, 2021 01:14https://github.com/github/codeql/pull/6564#event-5268850738
https://github.com/smowton
smowtonhttps://github.com/smowton
Sep 10, 2021 https://github.com/github/codeql/pull/6564#pullrequestreview-751281980
View reviewed changes https://github.com/github/codeql/pull/6564/files
java/ql/src/experimental/Security/CWE/CWE-611/XXELocal.qlhttps://github.com/github/codeql/pull/6564/files#diff-6a0deaf62340102a7e061863618908cc3b825ef6fe92b204840cc2ac5bf4a3e1
Please reload this pagehttps://github.com/github/codeql/pull/6564
smowtonhttps://github.com/smowton
September 10, 2021 13:49https://github.com/github/codeql/pull/6564#commits-pushed-2d03840
https://github.com/smowton
Add experimental variants of java/xxe, incorporating new sinks and …https://github.com/github/codeql/pull/6564/commits/2d03840fdebcb26ba5b547d751abe5a063ccbcac
2d03840https://github.com/github/codeql/pull/6564/commits/2d03840fdebcb26ba5b547d751abe5a063ccbcac
@haby0https://github.com/haby0
https://github.com/smowton
Update test expectations to account for dataflow subpaths changeshttps://github.com/github/codeql/pull/6564/commits/29028c5d4687cb988c6b17d6b31f87fe035d4091
29028c5https://github.com/github/codeql/pull/6564/commits/29028c5d4687cb988c6b17d6b31f87fe035d4091
https://github.com/smowton
smowtonhttps://github.com/smowton
Sep 10, 2021 https://github.com/github/codeql/pull/6564#pullrequestreview-751513191
View reviewed changes https://github.com/github/codeql/pull/6564/files/29028c5d4687cb988c6b17d6b31f87fe035d4091
https://github.com/smowton
smowtonhttps://github.com/smowton
0ebbb33https://github.com/github/codeql/commit/0ebbb333ba77b4ce5aeba2f6c7b625f15e035f5b
Sep 10, 2021https://github.com/github/codeql/pull/6564#event-5285024736
https://github.com/haby0
haby0https://github.com/haby0
September 15, 2021 01:49https://github.com/github/codeql/pull/6564#event-5302949732
https://github.com/atorralba
atorralbahttps://github.com/atorralba
Apr 26, 2023 https://github.com/github/codeql/pull/6564#ref-pullrequest-1684747268
Java: Promote experimental XXE sinks #12932 https://github.com/github/codeql/pull/12932
https://github.co/hiddenchars
https://github.com/github/codeql/pull/{{ revealButtonHref }}
Sign up for freehttps://github.com/join?source=comment-repo
Sign in to commenthttps://github.com/login?return_to=https%3A%2F%2Fgithub.com%2Fgithub%2Fcodeql%2Fpull%2F6564
https://github.com/smowton
smowton https://github.com/smowton
https://github.com/github/codeql/pull/6564/files/29028c5d4687cb988c6b17d6b31f87fe035d4091
documentation https://github.com/github/codeql/issues?q=state%3Aopen%20label%3Adocumentation
Java https://github.com/github/codeql/issues?q=state%3Aopen%20label%3AJava
Please reload this pagehttps://github.com/github/codeql/pull/6564
https://github.com/haby0
https://github.com/smowton
https://github.com/aschackmull
https://github.com
Termshttps://docs.github.com/site-policy/github-terms/github-terms-of-service
Privacyhttps://docs.github.com/site-policy/privacy-policies/github-privacy-statement
Securityhttps://github.com/security
Statushttps://www.githubstatus.com/
Communityhttps://github.community/
Docshttps://docs.github.com/
Contacthttps://support.github.com?tags=dotcom-footer

Viewport: width=device-width

URLs of crawlers that visited me.