Need help on JNDI injection query, does not work for log4j test project
Offen
question
- Vorherrschende Sprache
- CodeQL
- Sterne
- 10.1k
- Forks
- 2.1k
- Ø Merge
- 2 T. 15 Std.
- Gemergte PRs (30 T.)
- 141
Beschreibung
I've created a simple log4j project: [log4j-test.zip](https://github.com/github/codeql/files/7886955/log4j-test.zip)
It uses log4j 2.11 which is vulnerable to JNDI injection, and I've verified the vulnerability exists. Now I need to verify codeql also works. So I created the java database with:
```
codeql database create java-database -l=java -c="mvn clean install -file pom.xml" --overwrite
```
Then I opened the starter project and uses `ql/java/ql/src/Security/CWE/CWE-074/JndiInjection.ql` to test it, but no results came out.
What was wrong?
Beitragsleitfaden
Bewertung
Dieses Issue wurde noch nicht bewertet.