Need help on JNDI injection query, does not work for log4j test project
未關閉
question
- 主要語言
- CodeQL
- 星號
- 10.1k
- 分支
- 2.1k
- 平均合併
- 2 天 15 小時
- 30 天內合併 PR
- 141
描述
I've created a simple log4j project: [log4j-test.zip](https://github.com/github/codeql/files/7886955/log4j-test.zip)
It uses log4j 2.11 which is vulnerable to JNDI injection, and I've verified the vulnerability exists. Now I need to verify codeql also works. So I created the java database with:
```
codeql database create java-database -l=java -c="mvn clean install -file pom.xml" --overwrite
```
Then I opened the starter project and uses `ql/java/ql/src/Security/CWE/CWE-074/JndiInjection.ql` to test it, but no results came out.
What was wrong?
貢獻指南
評估
這個 Issue 還沒有評估資料。