-
Notifications
You must be signed in to change notification settings - Fork 371
Description
I downloaded standalone-ext and tested it. When I ran the query cpg.call.name("print.*") .where(_.argument(1).ast.isCall.reachableByFlows(source)) .map(call => (s" POTENTIAL FLAW: Display of data in web page without any encoding or validation " + call.code + " at line " + call.lineNumber.getOrElse("unknown") + " in file : " + call.file.name.l.headOption .getOrElse("unknown"))).l.foreach(println) it returned the result in the following code
response.getWriter().println(request.getParameter("name");, but nothing was returned in the next code data = request.getParameter("name"); response.getWriter().println(data); despite trying all the functions
...(_.argument(0).reachableBy(source)); ..(_.argument(0).reachableByFlows(source); ...(_.argument(0).reachableByDetailed(source);
how to fix this issue