hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-14 19:29:28 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add SSRF tests and stubs for Apache Http fluent Request models

Browse Source 
Agent-Logs-Url: https://github.com/github/codeql/sessions/bd4fa112-dbc3-47e8-9cef-9b1b13c7e549

Co-authored-by: owen-mc <62447351+owen-mc@users.noreply.github.com>
This commit is contained in:
copilot-swe-agent[bot]
2026-05-06 16:08:02 +00:00
committed by GitHub
parent 26dca558c7
commit f5b17b0b48
3 changed files with 67 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

40
java/ql/test/query-tests/security/CWE-918/ApacheHttpFluentSSRF.java Normal file
View File

@@ -0,0 +1,40 @@
import java.io.IOException;
import java.net.URI;
import org.apache.http.client.fluent.Request;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
public class ApacheHttpFluentSSRF extends HttpServlet {
protected void doGet(HttpServletRequest request, HttpServletResponse response)
throws ServletException, IOException {
try {
String sink = request.getParameter("uri"); // $ Source
URI uri = new URI(sink);
Request.Delete(sink); // $ Alert
Request.Delete(uri); // $ Alert
Request.Get(sink); // $ Alert
Request.Get(uri); // $ Alert
Request.Head(sink); // $ Alert
Request.Head(uri); // $ Alert
Request.Options(sink); // $ Alert
Request.Options(uri); // $ Alert
Request.Patch(sink); // $ Alert
Request.Patch(uri); // $ Alert
Request.Post(sink); // $ Alert
Request.Post(uri); // $ Alert
Request.Put(sink); // $ Alert
Request.Put(uri); // $ Alert
Request.Trace(sink); // $ Alert
Request.Trace(uri); // $ Alert
} catch (Exception e) {
// TODO: handle exception
}
}
}

2
java/ql/test/query-tests/security/CWE-918/options
View File

@@ -1 +1 @@
//semmle-extractor-options: --javac-args -source 11 -target 11 -cp ${testdir}/../../../stubs/javax-validation-constraints:${testdir}/../../../stubs/springframework-5.8.x:${testdir}/../../../stubs/javax-ws-rs-api-2.1.1:${testdir}/../../../stubs/javax-ws-rs-api-3.0.0:${testdir}/../../../stubs/apache-http-4.4.13/:${testdir}/../../../stubs/projectreactor-3.4.3/:${testdir}/../../../stubs/postgresql-42.3.3/:${testdir}/../../../stubs/HikariCP-3.4.5/:${testdir}/../../../stubs/spring-jdbc-5.3.8/:${testdir}/../../../stubs/jdbi3-core-3.27.2/:${testdir}/../../../stubs/cargo:${testdir}/../../../stubs/javafx-web:${testdir}/../../../stubs/apache-commons-jelly-1.0.1:${testdir}/../../../stubs/dom4j-2.1.1:${testdir}/../../../stubs/jaxen-1.2.0:${testdir}/../../../stubs/stapler-1.263:${testdir}/../../../stubs/javax-servlet-2.5:${testdir}/../../../stubs/apache-commons-fileupload-1.4:${testdir}/../../../stubs/saxon-xqj-9.x:${testdir}/../../../stubs/apache-commons-beanutils:${testdir}/../../../stubs/apache-commons-lang:${testdir}/../../../stubs/apache-http-5:${testdir}/../../../stubs/playframework-2.6.x:${testdir}/../../../stubs/jaxws-api-2.0:${testdir}/../../../stubs/apache-cxf
//semmle-extractor-options: --javac-args -source 11 -target 11 -cp ${testdir}/../../../stubs/javax-validation-constraints:${testdir}/../../../stubs/springframework-5.8.x:${testdir}/../../../stubs/javax-ws-rs-api-2.1.1:${testdir}/../../../stubs/javax-ws-rs-api-3.0.0:${testdir}/../../../stubs/apache-http-4.4.13/:${testdir}/../../../stubs/apache-http-fluent-4.5.14:${testdir}/../../../stubs/projectreactor-3.4.3/:${testdir}/../../../stubs/postgresql-42.3.3/:${testdir}/../../../stubs/HikariCP-3.4.5/:${testdir}/../../../stubs/spring-jdbc-5.3.8/:${testdir}/../../../stubs/jdbi3-core-3.27.2/:${testdir}/../../../stubs/cargo:${testdir}/../../../stubs/javafx-web:${testdir}/../../../stubs/apache-commons-jelly-1.0.1:${testdir}/../../../stubs/dom4j-2.1.1:${testdir}/../../../stubs/jaxen-1.2.0:${testdir}/../../../stubs/stapler-1.263:${testdir}/../../../stubs/javax-servlet-2.5:${testdir}/../../../stubs/apache-commons-fileupload-1.4:${testdir}/../../../stubs/saxon-xqj-9.x:${testdir}/../../../stubs/apache-commons-beanutils:${testdir}/../../../stubs/apache-commons-lang:${testdir}/../../../stubs/apache-http-5:${testdir}/../../../stubs/playframework-2.6.x:${testdir}/../../../stubs/jaxws-api-2.0:${testdir}/../../../stubs/apache-cxf

26
java/ql/test/stubs/apache-http-fluent-4.5.14/org/apache/http/client/fluent/Request.java generated Normal file
View File

@@ -0,0 +1,26 @@
// Generated automatically from org.apache.http.client.fluent.Request for testing purposes
package org.apache.http.client.fluent;
import java.net.URI;
public class Request {
protected Request() {}
public static Request Delete(String p0) { return null; }
public static Request Delete(URI p0) { return null; }
public static Request Get(String p0) { return null; }
public static Request Get(URI p0) { return null; }
public static Request Head(String p0) { return null; }
public static Request Head(URI p0) { return null; }
public static Request Options(String p0) { return null; }
public static Request Options(URI p0) { return null; }
public static Request Patch(String p0) { return null; }
public static Request Patch(URI p0) { return null; }
public static Request Post(String p0) { return null; }
public static Request Post(URI p0) { return null; }
public static Request Put(String p0) { return null; }
public static Request Put(URI p0) { return null; }
public static Request Trace(String p0) { return null; }
public static Request Trace(URI p0) { return null; }
}