github / github/codeql

Can CodeQL add support for YAML configuration files parse on java lib?

未关闭
#20,905 1 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
question
主要语言
CodeQL
星标
10.1k
派生
2.1k
平均合并
2 天 15 小时
30 天内合并 PR
141

描述

During the process of auditing a Java project using CodeQL

I discovered that Spring Boot 3 uses YAML as its configuration file format.

However, it seems that the CodeQL Java library does not currently support parsing YAML files.

Can CodeQL add support for YAML configuration files parse on java lib?

application.yml with vuln just like this(actuator endpoint * was exposed)
```yaml
management:
endpoints:
web:
exposure:
include: "*"
```

贡献指南

打开贡献指南

评估

这个 Issue 还没有评估数据。

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。