4ra1n / code-inspector Goto Github PK

View Code? Open in Web Editor NEW

308.0 6.0 42.0 950 KB

JavaWeb漏洞审计工具，构建方法调用链并模拟栈帧进行分析

License: MIT License

Java 100.00%

code-inspector's Issues

[bug] 拼接字符串操作应该加入call graph默认规则

现在的情况下是 a->b->c 中

如果b包含拼接字符串，在c中有危险操作，是无法传递到c到

java.lang.IndexOutOfBoundsException: Index: 0, Size: 0 at java.util.ArrayList.rangeCheck(ArrayList.java:659) at java.util.ArrayList.get(ArrayList.java:435) at code.inspector.core.spring.asm.SpringAnnoAdapter.visit(SpringAnnoAdapter.java:22) at org.objectweb.asm.ClassReader.readElementValue(ClassReader.java:3070) at org.objectweb.asm.ClassReader.readElementValues(ClassReader.java:2993) at org.objectweb.asm.ClassReader.readParameterAnnotations(ClassReader.java:2956) at org.objectweb.asm.ClassReader.readMethod(ClassReader.java:1489) at org.objectweb.asm.ClassReader.accept(ClassReader.java:744) at org.objectweb.asm.ClassReader.accept(ClassReader.java:424) at code.inspector.core.service.system.SpringService.start(SpringService.java:22) at code.inspector.core.Application.parseSpring(Application.java:261) at code.inspector.core.Application.start(Application.java:113) at code.inspector.form.CodeInspector.lambda$null$7(CodeInspector.java:212) at java.lang.Thread.run(Thread.java:748)