CVE
There is no CVE for this.
Report
This query adds Xslt injection query to codeql-python. It models the lxml package.
It detects the following code patterns.
root = etree.XML("<xmlContent>")
find_text = etree.XSLT("`sink`")sink = etree.XML(xsltQuery)
tree = etree.parse(f)
result_tree = tree.xslt(sink)
The PR also includes necessary tests for the same.
Link to the corresponding PR: [github/codeql#3521]
CVE
There is no CVE for this.
Report
This query adds Xslt injection query to codeql-python. It models the
lxmlpackage.It detects the following code patterns.
The PR also includes necessary tests for the same.
Link to the corresponding PR: [github/codeql#3521]