apunkt/nyx
1
0
Fork 0
mirror of https://github.com/elicpeter/nyx.git synced 2026-06-18 20:15:14 +02:00
Code Issues Projects Releases Packages Wiki Activity

Critical bug fixes and recall improvements (#68)

Browse source
This commit is contained in:
Eli Peter 2026-05-11 12:42:39 -04:00 • committed by GitHub
parent 7d0e7320e2
commit 55247b7fcd
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
352 changed files with 60069 additions and 900 deletions
Download patch file Download diff file Expand all files Collapse all files

21
tests/fixtures/realistic/sqli_xlang/SqliJavaHibernateNamedSession.java vendored Normal file
View file

@ -0,0 +1,21 @@
// Hibernate `session.createNativeQuery` SQLi via arbitrary-named
// receiver bound from `sessionFactory.openSession()`. The flat
// `session.createNativeQuery` matcher in `labels/java.rs` only fires
// when the receiver is literally named `session`; for any other name
// (`sess` here) the type-qualified `HibernateSession.createNativeQuery`
// rule fires via the `TypeKind::HibernateSession` fact attached to the
// SSA value returned by `sessionFactory.openSession()`.
package com.example;
import javax.servlet.http.HttpServletRequest;
import org.hibernate.Session;
import org.hibernate.SessionFactory;
public class SqliJavaHibernateNamedSession {
public void lookup(HttpServletRequest request, SessionFactory sf) {
String name = request.getParameter("name");
String sql = String.format("SELECT * FROM users WHERE name = '%s'", name);
Session sess = sf.openSession();
sess.createNativeQuery(sql);
}
}