Skip to content

Conversation

@rPraml
Copy link
Contributor

@rPraml rPraml commented Jul 24, 2025

See #1983
use lambda expressions for init

@rPraml rPraml mentioned this pull request Jul 24, 2025
@rPraml
Copy link
Contributor Author

rPraml commented Jul 24, 2025

I'm still struggling with a few CodeQL errors... Does anyone have a tip?

/edit: It happens, because we do not invoke the methods with reflection - and CodeQL "reaches" the methods now. There are some possible dangerous methods like desreialize(obj,'/etc/passwd') (as same as dangerous as new Packages.java.io.File('/etc/passwd').unlink() in liveConnect)

@gbrail
Copy link
Collaborator

gbrail commented Jul 25, 2025

Huh -- this is the first time CodeQL has "gone off" and it noticed some 20-year-old code ;-)

Seriously, I do think that we should add some path-sanitization logic in there, but in the meantime I'll see if I can figure out how to move on with this change...

@rPraml
Copy link
Contributor Author

rPraml commented Jul 25, 2025

I'm totally puzzled now

this is the first time CodeQL has "gone off"

I think I've discovered a bug in CodeQL. I assume. that some weird code in Global.java will block CodeQL from properly working.

@rPraml rPraml marked this pull request as draft July 25, 2025 08:02
@rPraml
Copy link
Contributor Author

rPraml commented Jul 25, 2025

@gbrail I've converted this to a draft. I would like to tidy up/refactor the Global class first and replace the 20 year old code by some modern versions

@rPraml rPraml mentioned this pull request Jul 26, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants