Merge pull request #13235 from atorralba/atorralba/java/hudson-models

Java: Add Hudson models

java/ql/lib/semmle/code/java/dataflow/FlowSources.qll

@@ -36,6 +36,13 @@ abstract class RemoteFlowSource extends DataFlow::Node {
   abstract string getSourceType();
 }
 
+/**
+ * A module for importing frameworks that define flow sources.
+ */
+private module FlowSources {
+  private import semmle.code.java.frameworks.hudson.Hudson
+}
+
 private class ExternalRemoteFlowSource extends RemoteFlowSource {
   ExternalRemoteFlowSource() { sourceNode(this, "remote") }
 

java/ql/lib/semmle/code/java/frameworks/hudson/Hudson.qll

@@ -0,0 +1,29 @@
+/** Provides classes and predicates related to the Hudson framework. */
+
+import java
+private import semmle.code.java.dataflow.FlowSources
+private import semmle.code.java.security.XSS
+
+private class FilePathRead extends LocalUserInput {
+  FilePathRead() {
+    this.asExpr()
+        .(MethodAccess)
+        .getMethod()
+        .hasQualifiedName("hudson", "FilePath",
+          [
+            "newInputStreamDenyingSymlinkAsNeeded", "openInputStream", "read", "readFromOffset",
+            "readToString"
+          ])
+  }
+}
+
+private class HudsonUtilXssSanitizer extends XssSanitizer {
+  HudsonUtilXssSanitizer() {
+    this.asExpr()
+        .(MethodAccess)
+        .getMethod()
+        // Not including xmlEscape because it only accounts for >, <, and &.
+        // It does not account for ", or ', which makes it an incomplete XSS sanitizer.
+        .hasQualifiedName("hudson", "Util", "escape")
+  }
+}

java/ql/lib/semmle/code/java/security/XSS.qll

@@ -6,6 +6,7 @@ import semmle.code.java.frameworks.android.WebView
 import semmle.code.java.frameworks.spring.SpringController
 import semmle.code.java.frameworks.spring.SpringHttp
 import semmle.code.java.frameworks.javaee.jsf.JSFRenderer
+private import semmle.code.java.frameworks.hudson.Hudson
 import semmle.code.java.dataflow.DataFlow
 import semmle.code.java.dataflow.TaintTracking
 private import semmle.code.java.dataflow.ExternalFlow