hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-03 20:58:03 +02:00
Code Issues Packages Projects Releases Wiki Activity

Java: Add HttpRequestHandler as a remote flow source

Browse Source
This commit is contained in:
Joe Farebrother
2021-01-28 15:17:08 +00:00
parent 2551aace89
commit 4184ebd091
2 changed files with 22 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
java/ql/src/semmle/code/java/dataflow/FlowSources.qll
View File

@@ -163,6 +163,14 @@ private class GuiceRequestParameterSource extends RemoteFlowSource {
override string getSourceType() { result = "Guice request parameter" }
}
private class ApacheHttpRequestParameterSource extends RemoteFlowSource {
ApacheHttpRequestParameterSource() {
this.asParameter() instanceof ApacheHttpRequestHandlerParameter
}
override string getSourceType() { result = "Apache HTTP request parameter" }
}
private class Struts2ActionSupportClassFieldReadSource extends RemoteFlowSource {
Struts2ActionSupportClassFieldReadSource() {
exists(Struts2ActionSupportClass c |

14
java/ql/src/semmle/code/java/frameworks/ApacheHttp.qll
View File

@@ -39,3 +39,17 @@ class TypeApacheHttpRequestBuilder extends Class {
this.hasQualifiedName("org.apache.http.client.methods", "RequestBuilder")
}
}
/**
* The `request` parameter of an implementation of `org.apache.http.protocol.HttpRequestHandler.handle`
*/
class ApacheHttpRequestHandlerParameter extends Parameter {
ApacheHttpRequestHandlerParameter() {
exists(Method m, Interface i |
i.hasQualifiedName("org.apache.http.protocol", "HttpRequestHandler") and
m.getDeclaringType().extendsOrImplements+(i) and
m.hasName("handle") and
this = m.getParameter(0)
)
}
}