Merge pull request #14515 from atorralba/atorralba/java/spring-csrf-improv

Java: Improve java/spring-disabled-csrf-protection

java/ql/src/Security/CWE/CWE-352/SpringCSRFProtection.ql

@@ -12,11 +12,8 @@
  */
 
 import java
+import semmle.code.java.security.SpringCsrfProtection
 
 from MethodAccess call
-where
-  call.getMethod().hasName("disable") and
-  call.getReceiverType()
-      .hasQualifiedName("org.springframework.security.config.annotation.web.configurers",
-        "CsrfConfigurer<HttpSecurity>")
+where disablesSpringCsrfProtection(call)
 select call, "CSRF vulnerability due to protection being disabled."

java/ql/src/change-notes/2023-10-16-spring-disabled-csrf-protection-improved.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The query `java/spring-disabled-csrf-protection` has been improved to detect more ways of disabling CSRF in Spring.