We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
1 parent ab49397 commit 4ce25c0Copy full SHA for 4ce25c0
java/ql/src/Security/CWE/CWE-352/SpringCSRFProtection.ql
@@ -12,11 +12,11 @@
12
13
import java
14
15
-from MethodAccess call, Method method
+from MethodAccess call
16
where
17
- call.getMethod() = method and
18
- method.hasName("disable") and
19
- method.getDeclaringType().getQualifiedName().regexpMatch(
20
- "org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer<CsrfConfigurer<.*>,.*>"
+ call.getMethod().hasName("disable") and
+ call.getReceiverType().hasQualifiedName(
+ "org.springframework.security.config.annotation.web.configurers",
+ "CsrfConfigurer<HttpSecurity>"
21
)
22
select call, "CSRF vulnerability due to protection being disabled."
0 commit comments