Merge pull request #7423 from github/atorralba/log4j-CVE-2021-45046

Java: Cover CVE-2021-45046 in the Log4jJndiInjection query
github · Dec 16, 2021 · e3b2eed · e3b2eed
2 parents 579b58b + 7d6cba7
commit e3b2eed
Show file tree

Hide file tree

Showing 70 changed files with 8,190 additions and 117 deletions.
diff --git a/java/ql/src/experimental/Security/CWE/CWE-020/Log4jJndiInjection.ql b/java/ql/src/experimental/Security/CWE/CWE-020/Log4jJndiInjection.ql
diff --git a/java/ql/test/experimental/query-tests/security/CWE-020/Log4jInjectionTest.expected b/java/ql/test/experimental/query-tests/security/CWE-020/Log4jInjectionTest.expected
diff --git a/java/ql/test/experimental/query-tests/security/CWE-020/Log4jInjectionTest.qlref b/java/ql/test/experimental/query-tests/security/CWE-020/Log4jInjectionTest.qlref
@@ -0,0 +1 @@
+experimental/Security/CWE/CWE-020/Log4jJndiInjection.ql
diff --git a/java/ql/test/experimental/query-tests/security/CWE-020/Log4jJndiInjectionTest.java b/java/ql/test/experimental/query-tests/security/CWE-020/Log4jJndiInjectionTest.java
diff --git a/java/ql/test/experimental/query-tests/security/CWE-020/options b/java/ql/test/experimental/query-tests/security/CWE-020/options
@@ -0,0 +1 @@
+//semmle-extractor-options: --javac-args -cp ${testdir}/../../../../stubs/apache-log4j-2.14.1:${testdir}/../../../../stubs/servlet-api-2.4
diff --git a/java/ql/test/stubs/apache-log4j-2.14.1/javax/servlet/AsyncContext.java b/java/ql/test/stubs/apache-log4j-2.14.1/javax/servlet/AsyncContext.java
diff --git a/java/ql/test/stubs/apache-log4j-2.14.1/javax/servlet/AsyncEvent.java b/java/ql/test/stubs/apache-log4j-2.14.1/javax/servlet/AsyncEvent.java
diff --git a/java/ql/test/stubs/apache-log4j-2.14.1/javax/servlet/AsyncListener.java b/java/ql/test/stubs/apache-log4j-2.14.1/javax/servlet/AsyncListener.java
diff --git a/java/ql/test/stubs/apache-log4j-2.14.1/javax/servlet/DispatcherType.java b/java/ql/test/stubs/apache-log4j-2.14.1/javax/servlet/DispatcherType.java
diff --git a/java/ql/test/stubs/apache-log4j-2.14.1/javax/servlet/Filter.java b/java/ql/test/stubs/apache-log4j-2.14.1/javax/servlet/Filter.java
diff --git a/java/ql/test/stubs/apache-log4j-2.14.1/javax/servlet/FilterChain.java b/java/ql/test/stubs/apache-log4j-2.14.1/javax/servlet/FilterChain.java
diff --git a/java/ql/test/stubs/apache-log4j-2.14.1/javax/servlet/FilterConfig.java b/java/ql/test/stubs/apache-log4j-2.14.1/javax/servlet/FilterConfig.java
diff --git a/java/ql/test/stubs/apache-log4j-2.14.1/javax/servlet/FilterRegistration.java b/java/ql/test/stubs/apache-log4j-2.14.1/javax/servlet/FilterRegistration.java
diff --git a/java/ql/test/stubs/apache-log4j-2.14.1/javax/servlet/HttpConstraintElement.java b/java/ql/test/stubs/apache-log4j-2.14.1/javax/servlet/HttpConstraintElement.java
diff --git a/java/ql/test/stubs/apache-log4j-2.14.1/javax/servlet/HttpMethodConstraintElement.java b/java/ql/test/stubs/apache-log4j-2.14.1/javax/servlet/HttpMethodConstraintElement.java
diff --git a/java/ql/test/stubs/apache-log4j-2.14.1/javax/servlet/MultipartConfigElement.java b/java/ql/test/stubs/apache-log4j-2.14.1/javax/servlet/MultipartConfigElement.java
diff --git a/java/ql/test/stubs/apache-log4j-2.14.1/javax/servlet/ReadListener.java b/java/ql/test/stubs/apache-log4j-2.14.1/javax/servlet/ReadListener.java
diff --git a/java/ql/test/stubs/apache-log4j-2.14.1/javax/servlet/Registration.java b/java/ql/test/stubs/apache-log4j-2.14.1/javax/servlet/Registration.java
diff --git a/java/ql/test/stubs/apache-log4j-2.14.1/javax/servlet/RequestDispatcher.java b/java/ql/test/stubs/apache-log4j-2.14.1/javax/servlet/RequestDispatcher.java
diff --git a/java/ql/test/stubs/apache-log4j-2.14.1/javax/servlet/Servlet.java b/java/ql/test/stubs/apache-log4j-2.14.1/javax/servlet/Servlet.java
diff --git a/java/ql/test/stubs/apache-log4j-2.14.1/javax/servlet/ServletConfig.java b/java/ql/test/stubs/apache-log4j-2.14.1/javax/servlet/ServletConfig.java
diff --git a/java/ql/test/stubs/apache-log4j-2.14.1/javax/servlet/ServletContext.java b/java/ql/test/stubs/apache-log4j-2.14.1/javax/servlet/ServletContext.java
diff --git a/java/ql/test/stubs/apache-log4j-2.14.1/javax/servlet/ServletInputStream.java b/java/ql/test/stubs/apache-log4j-2.14.1/javax/servlet/ServletInputStream.java