Join GitHub today
GitHub is home to over 50 million developers working together to host and review code, manage projects, and build software together.
Sign upJava : Add query to detect Server Side Template Injection #94
Labels
Comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
CVE
This query has not been tested against all lgtm projects. So, there is no CVE found using this PR.
Report
This query detects instances where user input is embedded in a template in an unsafe manner.
The PR adds support for multiple Java templating engines. As of now it covers
I also plan on including the Jinjava Templating Engine
The PR is as of now a WIP. I can't get the unit tests to run properly as the stubs for the libraries are not yet included. I had raised this concern over slack a few days back but I haven't received any responses yet.
Link to the PR:[github/codeql#3353]