Skip to content

Commit 1b216f8

Browse files
committed
Add mkdirs check
1 parent e0b0f91 commit 1b216f8

File tree

2 files changed

+6
-1
lines changed

2 files changed

+6
-1
lines changed

java/ql/src/Security/CWE/CWE-200/TempDirLocalInformationDisclosure2.ql

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ private class MethodFileSystemFileCreation extends Method {
1616
MethodFileSystemFileCreation() {
1717
getDeclaringType() instanceof TypeFile and
1818
(
19-
hasName("mkdir") or
19+
hasName(["mkdir", "mkdirs"]) or
2020
hasName("createNewFile")
2121
)
2222
}

java/ql/test/query-tests/security/CWE-200/semmle/tests/Test.java

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,11 @@ void vulnerableFileCreateTempFileMkdirTainted() {
5050
tempDirChild.mkdir();
5151
}
5252

53+
void vulnerableFileCreateTempFileMkdirsTainted() {
54+
File tempDirChild = new File(System.getProperty("java.io.tmpdir"), "/child");
55+
tempDirChild.mkdir();
56+
}
57+
5358
void vulnerableFileCreateTempFilesWrite1() {
5459
File tempDirChild = new File(System.getProperty("java.io.tmpdir"), "/child");
5560
Files.write(tempDirChild.toPath(), Arrays.asList("secret"), StandardCharsets.UTF_8, StandardOpenOption.CREATE);

0 commit comments

Comments
 (0)