On Tue, 16 Jan 2007, Matt wrote:
> Currently, the SqlInjection detector will flag an unsafe append if a
> previous instruction isn't an LDC or a GETSTATIC. I had a false positive
> where there was a NOP instruction, which while not LDC or GET STATIC, does
> not imply a vulnerability. I added a method to iterate backwards until a
> non-NOP was found or a null was found.
Just wanted to make sure this didn't get forgotten :)
If there's any issues with the patch I need to address before it gets
applied, please let me know.
Thanks!
--
tangled strands of DNA explain the way that I behave.
http://www.clock.org/~matt
|
