mirror of
https://github.com/github/codeql.git
synced 2026-04-30 19:26:02 +02:00
Add additional Ratpack test and improve Promise based dataflow tracking
This commit is contained in:
@@ -1,5 +1,7 @@
|
||||
import ratpack.core.handling.Context;
|
||||
import ratpack.core.http.TypedData;
|
||||
import ratpack.core.form.UploadedFile;
|
||||
import java.io.OutputStream;
|
||||
|
||||
class Resource {
|
||||
|
||||
@@ -10,18 +12,45 @@ class Resource {
|
||||
sink(ctx.getRequest().getCookies()); //$hasTaintFlow
|
||||
sink(ctx.getRequest().oneCookie("Magic-Cookie")); //$hasTaintFlow
|
||||
sink(ctx.getRequest().getHeaders()); //$hasTaintFlow
|
||||
sink(ctx.getRequest().getHeaders().get("questionable_header")); //$hasTaintFlow
|
||||
sink(ctx.getRequest().getHeaders().getAll("questionable_header")); //$hasTaintFlow
|
||||
sink(ctx.getRequest().getHeaders().getNames()); //$hasTaintFlow
|
||||
sink(ctx.getRequest().getHeaders().asMultiValueMap()); //$hasTaintFlow
|
||||
sink(ctx.getRequest().getHeaders().asMultiValueMap().get("questionable_header")); //$hasTaintFlow
|
||||
sink(ctx.getRequest().getPath()); //$hasTaintFlow
|
||||
sink(ctx.getRequest().getQuery()); //$hasTaintFlow
|
||||
sink(ctx.getRequest().getQueryParams()); //$hasTaintFlow
|
||||
sink(ctx.getRequest().getQueryParams().get("questionable_parameter")); //$hasTaintFlow
|
||||
sink(ctx.getRequest().getRawUri()); //$hasTaintFlow
|
||||
sink(ctx.getRequest().getUri()); //$hasTaintFlow
|
||||
}
|
||||
|
||||
void test2(TypedData td) {
|
||||
sink(td.getText()); //$hasTaintFlow
|
||||
sink(td.getBuffer()); //$hasTaintFlow
|
||||
sink(td.getBytes()); //$hasTaintFlow
|
||||
sink(td.getContentType()); //$hasTaintFlow
|
||||
sink(td.getInputStream()); //$hasTaintFlow
|
||||
}
|
||||
|
||||
void test2(Context ctx) {
|
||||
void test3(TypedData td, OutputStream os) throws java.io.IOException {
|
||||
sink(os);
|
||||
td.writeTo(os);
|
||||
sink(os); //$hasTaintFlow
|
||||
}
|
||||
|
||||
void test4(UploadedFile uf) {
|
||||
sink(uf.getFileName()); //$hasTaintFlow
|
||||
}
|
||||
|
||||
void test5(Context ctx) {
|
||||
sink(ctx.getRequest().getBody().map(TypedData::getText)); //$hasTaintFlow
|
||||
ctx.getRequest().getBody().map(TypedData::getText).then(this::sink); //$hasTaintFlow
|
||||
ctx
|
||||
.getRequest()
|
||||
.getBody()
|
||||
.map(TypedData::getText)
|
||||
.next(this::sink) //$hasTaintFlow
|
||||
.then(this::sink); //$hasTaintFlow
|
||||
}
|
||||
}
|
||||
37
java/ql/test/stubs/ratpack-1.9.x/ratpack/core/form/UploadedFile.java
generated
Normal file
37
java/ql/test/stubs/ratpack-1.9.x/ratpack/core/form/UploadedFile.java
generated
Normal file
@@ -0,0 +1,37 @@
|
||||
/*
|
||||
* Copyright 2013 the original author or authors.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
package ratpack.core.form;
|
||||
|
||||
import ratpack.core.http.TypedData;
|
||||
import ratpack.func.Nullable;
|
||||
|
||||
/**
|
||||
* A file that was uploaded via a form.
|
||||
*
|
||||
* @see Form
|
||||
*/
|
||||
public interface UploadedFile extends TypedData {
|
||||
|
||||
/**
|
||||
* The name given for the file.
|
||||
*
|
||||
* @return The name given for the file, or {@code null} if no name was provided.
|
||||
*/
|
||||
@Nullable
|
||||
String getFileName();
|
||||
|
||||
}
|
||||
@@ -46,4 +46,6 @@ public interface Promise<T> {
|
||||
<O> Promise<O> map(Function<? super T, ? extends O> transformer);
|
||||
|
||||
void then(Action<? super T> then);
|
||||
|
||||
Promise<T> next(Action<? super T> action);
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user