Switch source and sink in TrustBoundaryViolation.ql

github · May 23, 2024 · b5b5fef · b5b5fef
1 parent 5c4eb3c
commit b5b5fef
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/java/ql/src/Security/CWE/CWE-501/TrustBoundaryViolation.ql b/java/ql/src/Security/CWE/CWE-501/TrustBoundaryViolation.ql
@@ -16,5 +16,5 @@ import TrustBoundaryFlow::PathGraph
 
 from TrustBoundaryFlow::PathNode source, TrustBoundaryFlow::PathNode sink
 where TrustBoundaryFlow::flowPath(source, sink)
-select sink.getNode(), sink, source,
+select sink.getNode(), source, sink,
   "This servlet reads data from a $@ and writes it to a session variable.", source, "remote source"