Add mkdirs check

github · Dec 8, 2020 · b1aeb99 · b1aeb99
1 parent 15f29c6
commit b1aeb99
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 1 deletion.
diff --git a/java/ql/src/Security/CWE/CWE-200/TempDirLocalInformationDisclosure2.ql b/java/ql/src/Security/CWE/CWE-200/TempDirLocalInformationDisclosure2.ql
@@ -16,7 +16,7 @@ private class MethodFileSystemFileCreation extends Method {
   MethodFileSystemFileCreation() {
     getDeclaringType() instanceof TypeFile and
     (
-      hasName("mkdir") or
+      hasName(["mkdir", "mkdirs"]) or
       hasName("createNewFile")
     )
   }

diff --git a/java/ql/test/query-tests/security/CWE-200/semmle/tests/Test.java b/java/ql/test/query-tests/security/CWE-200/semmle/tests/Test.java
@@ -50,6 +50,11 @@ void vulnerableFileCreateTempFileMkdirTainted() {
         tempDirChild.mkdir();
     }
 
+    void vulnerableFileCreateTempFileMkdirsTainted() {
+        File tempDirChild = new File(System.getProperty("java.io.tmpdir"), "/child");
+        tempDirChild.mkdir();
+    }
+
     void vulnerableFileCreateTempFilesWrite1() {
         File tempDirChild = new File(System.getProperty("java.io.tmpdir"), "/child");
         Files.write(tempDirChild.toPath(), Arrays.asList("secret"), StandardCharsets.UTF_8, StandardOpenOption.CREATE);