René's URL Explorer Experiment


Title: Java: Add XXE sinks by haby0 · Pull Request #6564 · github/codeql · GitHub

Open Graph Title: Java: Add XXE sinks by haby0 · Pull Request #6564 · github/codeql

X Title: Java: Add XXE sinks by haby0 · Pull Request #6564 · github/codeql

Description: There are many XML parsers for Java, and most of them are vulnerable to XXE because their default settings enable parsing of external entities. This query currently identifies vulnerable XML parsing from the following parsers: javax.xml.validation.Validator, org.dom4j.DocumentHelper, org.apache.commons.digester3.Digester, java.beans.XMLDecoder, org.rundeck.api.parser.ParserHelper, org.apache.commons.digester.Digester, org.apache.tomcat.util.digester.Digester Open source components: vertx-web

Open Graph Description: There are many XML parsers for Java, and most of them are vulnerable to XXE because their default settings enable parsing of external entities. This query currently identifies vulnerable XML parsin...

X Description: There are many XML parsers for Java, and most of them are vulnerable to XXE because their default settings enable parsing of external entities. This query currently identifies vulnerable XML parsin...

Opengraph URL: https://github.com/github/codeql/pull/6564

X: @github

direct link

Domain: github.com

route-pattern/:user_id/:repository/pull/:id/files(.:format)
route-controllerpull_requests
route-actionfiles
fetch-noncev2:b05f2cf1-b08a-575f-b8d7-a94643ccd5ba
current-catalog-service-hashae870bc5e265a340912cde392f23dad3671a0a881730ffdadd82f2f57d81641b
request-idD2E8:217E54:6F03D4:9F0C36:6A4CAC90
html-safe-nonce040912c46c5111a54ffcbcfde13207c6ed89e2547838bb878743f3cdd7970db1
visitor-payloadeyJyZWZlcnJlciI6IiIsInJlcXVlc3RfaWQiOiJEMkU4OjIxN0U1NDo2RjAzRDQ6OUYwQzM2OjZBNENBQzkwIiwidmlzaXRvcl9pZCI6IjczODI2MDk0NTU2OTc2NjkyNjUiLCJyZWdpb25fZWRnZSI6ImlhZCIsInJlZ2lvbl9yZW5kZXIiOiJpYWQifQ==
visitor-hmac37d5af92754a32b6fcfee49a7af89ff08bfdd1295fba4df64e443f4c1a374794
hovercard-subject-tagpull_request:721375479
github-keyboard-shortcutsrepository,pull-request-list,pull-request-conversation,pull-request-files-changed,copilot
google-site-verificationApib7-x98H0j5cPqHWwSMm6dNU4GmODRoqxLiDzdx9I
octolytics-urlhttps://collector.github.com/github/collect
analytics-location///pull_requests/show/files
fb:app_id1401488693436528
apple-itunes-appapp-id=1477376905, app-argument=https://github.com/github/codeql/pull/6564/files
twitter:imagehttps://avatars.githubusercontent.com/u/29876502?s=400&v=4
twitter:cardsummary_large_image
og:imagehttps://avatars.githubusercontent.com/u/29876502?s=400&v=4
og:image:altThere are many XML parsers for Java, and most of them are vulnerable to XXE because their default settings enable parsing of external entities. This query currently identifies vulnerable XML parsin...
og:site_nameGitHub
og:typeobject
hostnamegithub.com
expected-hostnamegithub.com
None3d11bb817438277de2a940854450e83a7d32b6aeb5014e9e6b00a6423900251c
turbo-cache-controlno-preview
diff-viewunified
go-importgithub.com/github/codeql git https://github.com/github/codeql.git
octolytics-dimension-user_id9919
octolytics-dimension-user_logingithub
octolytics-dimension-repository_id143040428
octolytics-dimension-repository_nwogithub/codeql
octolytics-dimension-repository_publictrue
octolytics-dimension-repository_is_forkfalse
octolytics-dimension-repository_network_root_id143040428
octolytics-dimension-repository_network_root_nwogithub/codeql
turbo-body-classeslogged-out env-production page-responsive full-width
disable-turbotrue
browser-stats-urlhttps://api.github.com/_private/browser/stats
browser-errors-urlhttps://api.github.com/_private/browser/errors
releaseae90d426644ca15e89bacceb72e51f4e9dbf85f7
ui-targetfull
theme-color#1e2327
color-schemelight dark

Links:

Skip to contenthttps://github.com/github/codeql/pull/6564/files#start-of-content
https://github.com/
Sign in https://github.com/login?return_to=https%3A%2F%2Fgithub.com%2Fgithub%2Fcodeql%2Fpull%2F6564%2Ffiles
GitHub CopilotWrite better code with AIhttps://github.com/features/copilot
GitHub Copilot appDirect agents from issue to mergehttps://github.com/features/ai/github-app
MCP RegistryNewIntegrate external toolshttps://github.com/mcp
ActionsAutomate any workflowhttps://github.com/features/actions
CodespacesInstant dev environmentshttps://github.com/features/codespaces
IssuesPlan and track workhttps://github.com/features/issues
Code ReviewManage code changeshttps://github.com/features/code-review
GitHub Advanced SecurityFind and fix vulnerabilitieshttps://github.com/security/advanced-security
Code securitySecure your code as you buildhttps://github.com/security/advanced-security/code-security
Secret protectionStop leaks before they starthttps://github.com/security/advanced-security/secret-protection
Why GitHubhttps://github.com/why-github
Documentationhttps://docs.github.com
Bloghttps://github.blog
Changeloghttps://github.blog/changelog
Marketplacehttps://github.com/marketplace
View all featureshttps://github.com/features
Enterpriseshttps://github.com/enterprise
Small and medium teamshttps://github.com/team
Startupshttps://github.com/enterprise/startups
Nonprofitshttps://github.com/solutions/industry/nonprofits
App Modernizationhttps://github.com/solutions/use-case/app-modernization
DevSecOpshttps://github.com/solutions/use-case/devsecops
DevOpshttps://github.com/solutions/use-case/devops
CI/CDhttps://github.com/solutions/use-case/ci-cd
View all use caseshttps://github.com/solutions/use-case
Healthcarehttps://github.com/solutions/industry/healthcare
Financial serviceshttps://github.com/solutions/industry/financial-services
Manufacturinghttps://github.com/solutions/industry/manufacturing
Governmenthttps://github.com/solutions/industry/government
View all industrieshttps://github.com/solutions/industry
View all solutionshttps://github.com/solutions
AIhttps://github.com/resources/articles?topic=ai
Software Developmenthttps://github.com/resources/articles?topic=software-development
DevOpshttps://github.com/resources/articles?topic=devops
Securityhttps://github.com/resources/articles?topic=security
View all topicshttps://github.com/resources/articles
Customer storieshttps://github.com/customer-stories
Events & webinarshttps://github.com/resources/events
Ebooks & reportshttps://github.com/resources/whitepapers
Business insightshttps://github.com/solutions/executive-insights
GitHub Skillshttps://skills.github.com
Documentationhttps://docs.github.com
Customer supporthttps://support.github.com
Community forumhttps://github.com/orgs/community/discussions
Trust centerhttps://github.com/trust-center
Partnershttps://github.com/partners
View all resourceshttps://github.com/resources
GitHub SponsorsFund open source developershttps://github.com/sponsors
Security Labhttps://securitylab.github.com
Maintainer Communityhttps://maintainers.github.com
Acceleratorhttps://github.com/accelerator
GitHub Starshttps://stars.github.com
Archive Programhttps://archiveprogram.github.com
Topicshttps://github.com/topics
Trendinghttps://github.com/trending
Collectionshttps://github.com/collections
Enterprise platformAI-powered developer platformhttps://github.com/enterprise
GitHub Advanced SecurityEnterprise-grade security featureshttps://github.com/security/advanced-security
Copilot for BusinessEnterprise-grade AI featureshttps://github.com/features/copilot/copilot-business
Premium SupportEnterprise-grade 24/7 supporthttps://github.com/premium-support
Pricinghttps://github.com/pricing
Search syntax tipshttps://docs.github.com/search-github/github-code-search/understanding-github-code-search-syntax
documentationhttps://docs.github.com/search-github/github-code-search/understanding-github-code-search-syntax
Sign in https://github.com/login?return_to=https%3A%2F%2Fgithub.com%2Fgithub%2Fcodeql%2Fpull%2F6564%2Ffiles
Sign up https://github.com/signup?ref_cta=Sign+up&ref_loc=header+logged+out&ref_page=%2F%3Cuser-name%3E%2F%3Crepo-name%3E%2Fpull_requests%2Fshow%2Ffiles&source=header-repo&source_repo=github%2Fcodeql
Reloadhttps://github.com/github/codeql/pull/6564/files
Reloadhttps://github.com/github/codeql/pull/6564/files
Reloadhttps://github.com/github/codeql/pull/6564/files
Please reload this pagehttps://github.com/github/codeql/pull/6564/files
github https://github.com/github
codeqlhttps://github.com/github/codeql
Notifications https://github.com/login?return_to=%2Fgithub%2Fcodeql
Fork 2k https://github.com/login?return_to=%2Fgithub%2Fcodeql
Star 9.8k https://github.com/login?return_to=%2Fgithub%2Fcodeql
Code https://github.com/github/codeql
Issues 987 https://github.com/github/codeql/issues
Pull requests 424 https://github.com/github/codeql/pulls
Discussions https://github.com/github/codeql/discussions
Actions https://github.com/github/codeql/actions
Projects https://github.com/github/codeql/projects
Models https://github.com/github/codeql/models
Security and quality 0 https://github.com/github/codeql/security
Insights https://github.com/github/codeql/pulse
Code https://github.com/github/codeql
Issues https://github.com/github/codeql/issues
Pull requests https://github.com/github/codeql/pulls
Discussions https://github.com/github/codeql/discussions
Actions https://github.com/github/codeql/actions
Projects https://github.com/github/codeql/projects
Models https://github.com/github/codeql/models
Security and quality https://github.com/github/codeql/security
Insights https://github.com/github/codeql/pulse
Sign up for GitHub https://github.com/signup?return_to=%2Fgithub%2Fcodeql%2Fissues%2Fnew%2Fchoose
terms of servicehttps://docs.github.com/terms
privacy statementhttps://docs.github.com/privacy
Sign inhttps://github.com/login?return_to=%2Fgithub%2Fcodeql%2Fissues%2Fnew%2Fchoose
smowtonhttps://github.com/smowton
github:mainhttps://github.com/github/codeql/tree/main
Conversation 11 https://github.com/github/codeql/pull/6564
Findings https://github.com/github/codeql/pull/6564/findings
Commits 2 https://github.com/github/codeql/pull/6564/commits
Checks 0 https://github.com/github/codeql/pull/6564/checks
Files changed https://github.com/github/codeql/pull/6564/files
Please reload this pagehttps://github.com/github/codeql/pull/6564/files
Java: Add XXE sinks https://github.com/github/codeql/pull/6564/files#top
Show all changes 2 commits https://github.com/github/codeql/pull/6564/files
2d03840 Add experimental variants of `java/xxe`, incorporating new sinks and … smowton Sep 10, 2021 https://github.com/github/codeql/pull/6564/commits/2d03840fdebcb26ba5b547d751abe5a063ccbcac
29028c5 Update test expectations to account for dataflow subpaths changes smowton Sep 10, 2021 https://github.com/github/codeql/pull/6564/commits/29028c5d4687cb988c6b17d6b31f87fe035d4091
Clear filters https://github.com/github/codeql/pull/6564/files
Please reload this pagehttps://github.com/github/codeql/pull/6564/files
Please reload this pagehttps://github.com/github/codeql/pull/6564/files
XmlParsers.qll https://github.com/github/codeql/pull/6564/files#diff-a0f62217138aaa9280a46b4e1b35b93299d2520cc8a4d3ab7493ad035e8733f7
XXE.java https://github.com/github/codeql/pull/6564/files#diff-8c93ad4a0bef845f3def1e3d8eeecf06860bea257917edb7653665604da0c04a
XXE.qhelp https://github.com/github/codeql/pull/6564/files#diff-e394ea437133384363b8338cdfd896b13ceb964339bc54c470f7ab4c2028d2ea
XXE.ql https://github.com/github/codeql/pull/6564/files#diff-4f04c86f6078cd24b81cca15276d85da2d0da0fd670ae9e9e5eb4f8f8f7ade69
XXELib.qll https://github.com/github/codeql/pull/6564/files#diff-f80d389382ed4bfbbbac8178bc1eca6022062a727d4ecc1693897866bdf398fe
XXELocal.qhelp https://github.com/github/codeql/pull/6564/files#diff-fcc417152e027bf2e060cf250afde4342cfbc68e3e53cdd12a7babd5482866c0
XXELocal.ql https://github.com/github/codeql/pull/6564/files#diff-6a0deaf62340102a7e061863618908cc3b825ef6fe92b204840cc2ac5bf4a3e1
XXE.expected https://github.com/github/codeql/pull/6564/files#diff-449fe70449c3230c6cfb224dd0be9d63e0c0c38631d07c1da3db888adc1850cb
XXE.java https://github.com/github/codeql/pull/6564/files#diff-70d8b8f54c2a1ccc54975880d3d132b7ec1e6fc22fb3bdab0e80b43a3f4bfeb5
XXE.qlref https://github.com/github/codeql/pull/6564/files#diff-d88ba338e14274964fc9e0bbf45190c3e2e89970d85b4468428b9bc30856c438
options https://github.com/github/codeql/pull/6564/files#diff-50b8c5bce716c7d83ae8becf8dca6040d6ba81fc974e38f369078018d69397e6
Digester.java https://github.com/github/codeql/pull/6564/files#diff-779f4f119cb747ac4916e2b588281db76d0b9f41f21607fb4c8f0fa4fb288618
DocumentException.java https://github.com/github/codeql/pull/6564/files#diff-a2bb1f862ac2db32fb3b5566fa765bc2e0bf4dd633eff09cb8e025ce6d49f4a9
DocumentHelper.java https://github.com/github/codeql/pull/6564/files#diff-7785ecabf27184aee76cabde7e1d285c11f09863c573a74acb43a96475fc7d6a
ParserHelper.java https://github.com/github/codeql/pull/6564/files#diff-d812198bb918e0c7c5104b6afdbcdfa93028dd0097094b68582d2b33b846d0f0
https://github.com/github/codeql/blob/main/CODEOWNERS#L16
java/ql/lib/semmle/code/java/security/XmlParsers.qllhttps://github.com/github/codeql/pull/6564/files#diff-a0f62217138aaa9280a46b4e1b35b93299d2520cc8a4d3ab7493ad035e8733f7
View file https://github.com/github/codeql/blob/29028c5d4687cb988c6b17d6b31f87fe035d4091/java/ql/lib/semmle/code/java/security/XmlParsers.qll
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/6564/{{ revealButtonHref }}
https://github.com/github/codeql/pull/6564/files#diff-a0f62217138aaa9280a46b4e1b35b93299d2520cc8a4d3ab7493ad035e8733f7
https://github.com/github/codeql/pull/6564/files#diff-a0f62217138aaa9280a46b4e1b35b93299d2520cc8a4d3ab7493ad035e8733f7
https://github.com/github/codeql/blob/main/CODEOWNERS#L16
java/ql/src/experimental/Security/CWE/CWE-611/XXE.javahttps://github.com/github/codeql/pull/6564/files#diff-8c93ad4a0bef845f3def1e3d8eeecf06860bea257917edb7653665604da0c04a
View file https://github.com/github/codeql/blob/29028c5d4687cb988c6b17d6b31f87fe035d4091/java/ql/src/experimental/Security/CWE/CWE-611/XXE.java
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/6564/{{ revealButtonHref }}
https://github.com/github/codeql/blob/main/CODEOWNERS#L16
java/ql/src/experimental/Security/CWE/CWE-611/XXE.qhelphttps://github.com/github/codeql/pull/6564/files#diff-e394ea437133384363b8338cdfd896b13ceb964339bc54c470f7ab4c2028d2ea
View file https://github.com/github/codeql/blob/29028c5d4687cb988c6b17d6b31f87fe035d4091/java/ql/src/experimental/Security/CWE/CWE-611/XXE.qhelp
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/6564/{{ revealButtonHref }}
https://github.com/github/codeql/blob/main/CODEOWNERS#L16
java/ql/src/experimental/Security/CWE/CWE-611/XXE.qlhttps://github.com/github/codeql/pull/6564/files#diff-4f04c86f6078cd24b81cca15276d85da2d0da0fd670ae9e9e5eb4f8f8f7ade69
View file https://github.com/github/codeql/blob/29028c5d4687cb988c6b17d6b31f87fe035d4091/java/ql/src/experimental/Security/CWE/CWE-611/XXE.ql
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/6564/{{ revealButtonHref }}
smowtonhttps://github.com/smowton
Sep 7, 2021https://github.com/github/codeql/pull/6564/files#r703345959
Learn morehttps://docs.github.com/articles/managing-disruptive-comments/#hiding-a-comment
Please reload this pagehttps://github.com/github/codeql/pull/6564/files
Please reload this pagehttps://github.com/github/codeql/pull/6564/files
https://github.com
Termshttps://docs.github.com/site-policy/github-terms/github-terms-of-service
Privacyhttps://docs.github.com/site-policy/privacy-policies/github-privacy-statement
Securityhttps://github.com/security
Statushttps://www.githubstatus.com/
Communityhttps://github.community/
Docshttps://docs.github.com/
Contacthttps://support.github.com?tags=dotcom-footer

Viewport: width=device-width


URLs of crawlers that visited me.