Need help on JNDI injection query, does not work for log4j test project
Abierto
question
- Lenguaje dominante
- CodeQL
- Estrellas
- 10.1k
- Forks
- 2.1k
- Merge medio
- 2 d 15 h
- PR fusionados (30 d)
- 141
Descripción
I've created a simple log4j project: [log4j-test.zip](https://github.com/github/codeql/files/7886955/log4j-test.zip)
It uses log4j 2.11 which is vulnerable to JNDI injection, and I've verified the vulnerability exists. Now I need to verify codeql also works. So I created the java database with:
```
codeql database create java-database -l=java -c="mvn clean install -file pom.xml" --overwrite
```
Then I opened the starter project and uses `ql/java/ql/src/Security/CWE/CWE-074/JndiInjection.ql` to test it, but no results came out.
What was wrong?
Guía de contribución
Evaluación
Este issue todavía no se ha evaluado.