Skip to content

/ securitylab

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Java : add MongoDB injection sinks #95

Open
porcupineyhairs opened this issue May 21, 2020 · 2 comments
Open

Java : add MongoDB injection sinks #95

porcupineyhairs opened this issue May 21, 2020 · 2 comments
Labels
All For One

Comments

@porcupineyhairs
Copy link

@porcupineyhairs porcupineyhairs commented May 21, 2020

CVE

There is no CVE for this.

Report

This query adds MongoDB NoSQL injection sinks. It models the official mongodb-java driver.

It detects the following code patterns.

DBObject databaseQuery = (DBObject) JSON.parse('sink');

and

BasicDBObject bdb = BasicDBObject.parse('sink');

Link to the PR:[github/codeql#3542]
@porcupineyhairs
Copy link
Author

@porcupineyhairs porcupineyhairs commented Jun 24, 2020

I can't find a CVE for this. However, I can see this being found in an intentionally vulnerable application here
@ghsecuritylab
Copy link
Collaborator

@ghsecuritylab ghsecuritylab commented Sep 1, 2020

Your submission is now in status SecLab finalize.

For information, the evaluation workflow is the following:
CodeQL initial assessment > SecLab review > CodeQL review > SecLab finalize > Pay > Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
All For One
Projects
None yet
Milestone
No milestone
Linked pull requests

Successfully merging a pull request may close this issue.

None yet
2 participants
@ghsecuritylab @porcupineyhairs
You can’t perform that action at this time.