You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
publicfinalclassResourceReader {
publicstaticStringread(ClassLoaderclassLoader, Stringpath, StringfileDesc) {
URLresource = classLoader.getResource(path);
if (resource == null) {
thrownewIllegalStateException(String.format("Did not find resource '%s' on classpath.", path));
}
URLConnectionurlConnection;
try {
urlConnection = resource.openConnection();
} catch (IOExceptione) {
thrownewRuntimeException(String.format("Could not open connection for resource '%s'.", path), e);
}
InputStreaminputStream;
try {
inputStream = urlConnection.getInputStream(); // CODEQL FLAGS THIS AS USER INPUT: But it isn't
} catch (IOExceptione) {
thrownewRuntimeException(String.format("Could not get input stream of connection for resource '%s'.", path), e);
}
intlength = urlConnection.getContentLength();
if (length > 1024) {
thrownewIllegalStateException(String.format("'%s' is larger than 1 KiB.", fileDesc));
}
try (BufferedReaderreader = newBufferedReader(newInputStreamReader(inputStream, StandardCharsets.UTF_8), length)) {
returnreader.readLine();
} catch (IOExceptione) {
thrownewRuntimeException(String.format("Error while reading input stream for resource '%s'.", path), e);
}
// ignore
}
privateResourceReader() {
}
}
ClassLoader.getResource can't get an external resource.
@TestvoidresourcesGet() throwsIOException {
URLresource = ResourcesTest.class.getClassLoader().getResource("https://google.com");
assertNotNull(resource); // This test will fail as resource is null
}
I think that if urlConnection.getInputStream() comes from a class loader, it shouldn't be considered a valid source.
The text was updated successfully, but these errors were encountered:
JLLeitschuh
changed the title
false positive - Code Scanning - Java
false positive - Code Scanning - Java - urlConnection.getInputStream() not remote user input
Jan 21, 2021
JLLeitschuh
changed the title
false positive - Code Scanning - Java - urlConnection.getInputStream() not remote user input
false positive - Code Scanning - Java - when urlConnection.getInputStream() is not remote user input
Jan 21, 2021
This false positive, as well as other uses of getInputStream() where user input isn't involved, is so common that, at this point, if I see urlConnection.getInputStream() as the taint source, I don't look any further. I've found this "user-input" is over-classified as a user input. The scenarios where it's considered a "user-input" should be reduced in general.
Description of the false positive
The following is not valid remote user input.
ClassLoader.getResourcecan't get an external resource.I think that if
urlConnection.getInputStream()comes from a class loader, it shouldn't be considered a valid source.The text was updated successfully, but these errors were encountered: