Using QL to find a remote code execution vulnerability in Apache Struts

Using QL to find a remote code execution vulnerability in Apache Struts(lgtm.com)

1 points by mossity 8 years ago | 1 comment

mossity 8 years ago |

Reading about CVE-2017-9805 it was really interesting to learn that the company that discovered it was using a Datalog-like language in order to query Java code for vulnerability patterns.

https://en.wikipedia.org/wiki/Semmle

mossity 8 years ago |

Reading about CVE-2017-9805 it was really interesting to learn that the company that discovered it was using a Datalog-like language in order to query Java code for vulnerability patterns.

https://en.wikipedia.org/wiki/Semmle