hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-29 18:55:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Java: add test for qhelp good example

Browse Source
This commit is contained in:
Jami Cogswell
2025-02-23 23:37:05 -05:00
parent 9e51b014d2
commit f65a5b9a66
3 changed files with 15 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
java/ql/test/query-tests/security/CWE-016/SpringBootActuatorsTest.java
View File

@@ -271,4 +271,11 @@ public class SpringBootActuatorsTest {
http.securityMatcher(EndpointRequest.toAnyEndpoint());
http.authorizeHttpRequests((requests) -> requests.anyRequest().permitAll()); // $ hasExposedSpringBootActuator
}
// QHelp Good example
protected void configureQhelpGood(HttpSecurity http) throws Exception {
// GOOD: only users with ENDPOINT_ADMIN role are allowed to access the actuator endpoints
http.requestMatcher(EndpointRequest.toAnyEndpoint()).authorizeRequests((requests) ->
requests.anyRequest().hasRole("ENDPOINT_ADMIN"));
}
}

4
java/ql/test/stubs/springframework-5.3.8/org/springframework/security/config/annotation/web/configurers/AuthorizeHttpRequestsConfigurer.java generated
View File

@@ -14,5 +14,9 @@ public final class AuthorizeHttpRequestsConfigurer<H extends HttpSecurityBuilder
public AuthorizationManagerRequestMatcherRegistry permitAll() {
return null;
}
public AuthorizationManagerRequestMatcherRegistry hasRole(String role) {
return null;
}
}
}

4
java/ql/test/stubs/springframework-5.3.8/org/springframework/security/config/annotation/web/configurers/ExpressionUrlAuthorizationConfigurer.java generated
View File

@@ -12,5 +12,9 @@ public final class ExpressionUrlAuthorizationConfigurer<H extends HttpSecurityBu
public ExpressionInterceptUrlRegistry permitAll() {
return null;
}
public ExpressionInterceptUrlRegistry hasRole(String role) {
return null;
}
}
}