Add properties file references

C++: Fix `chmod` prototype in toctou test and additional test

cpp/ql/test/query-tests/Security/CWE/CWE-367/semmle/test2.cpp

@@ -19,7 +19,7 @@ bool stat(const char *path, stat_data *buf);
 bool fstat(int file, stat_data *buf);
 bool lstat(const char *path, stat_data *buf);
 bool fstatat(int dir, const char *path, stat_data *buf);
-void chmod(const char *path, int setting);
+int chmod(const char *path, int setting);
 int rename(const char *from, const char *to);
 bool remove(const char *path);
 
@@ -408,3 +408,8 @@ void test7_1(const char *path1, const char *path2)
 		chmod(path2, 1234); // BAD
 	}
 }
+
+int test8(const char *path, int mode)
+{
+    return (chmod(path, mode) == 0 ? 1 : 0); // GOOD
+}

go/ql/test/query-tests/InconsistentCode/UnhandledCloseWritableHandle/UnhandledCloseWritableHandle.expected

@@ -1,56 +1,46 @@
 edges
-| tests.go:9:2:9:74 | ... := ...[0] | tests.go:10:9:10:9 | f |
+| tests.go:8:24:8:24 | definition of f | tests.go:9:8:9:8 | f |
-| tests.go:10:9:10:9 | f | tests.go:43:5:43:38 | ... := ...[0] |
+| tests.go:12:32:12:32 | definition of f | tests.go:13:13:13:13 | capture variable f |
-| tests.go:10:9:10:9 | f | tests.go:60:5:60:38 | ... := ...[0] |
+| tests.go:13:13:13:13 | capture variable f | tests.go:14:3:14:3 | f |
-| tests.go:10:9:10:9 | f | tests.go:108:5:108:38 | ... := ...[0] |
+| tests.go:31:5:31:78 | ... := ...[0] | tests.go:32:21:32:21 | f |
-| tests.go:10:9:10:9 | f | tests.go:124:5:124:38 | ... := ...[0] |
+| tests.go:31:5:31:78 | ... := ...[0] | tests.go:33:29:33:29 | f |
-| tests.go:18:2:18:69 | return statement[0] | tests.go:53:5:53:42 | ... := ...[0] |
+| tests.go:32:21:32:21 | f | tests.go:8:24:8:24 | definition of f |
-| tests.go:18:2:18:69 | return statement[0] | tests.go:70:5:70:42 | ... := ...[0] |
+| tests.go:33:29:33:29 | f | tests.go:12:32:12:32 | definition of f |
-| tests.go:21:24:21:24 | definition of f | tests.go:22:8:22:8 | f |
+| tests.go:45:5:45:76 | ... := ...[0] | tests.go:46:21:46:21 | f |
-| tests.go:25:32:25:32 | definition of f | tests.go:26:13:26:13 | capture variable f |
+| tests.go:45:5:45:76 | ... := ...[0] | tests.go:47:29:47:29 | f |
-| tests.go:26:13:26:13 | capture variable f | tests.go:27:3:27:3 | f |
+| tests.go:46:21:46:21 | f | tests.go:8:24:8:24 | definition of f |
-| tests.go:43:5:43:38 | ... := ...[0] | tests.go:44:21:44:21 | f |
+| tests.go:47:29:47:29 | f | tests.go:12:32:12:32 | definition of f |
-| tests.go:43:5:43:38 | ... := ...[0] | tests.go:45:29:45:29 | f |
+| tests.go:54:5:54:78 | ... := ...[0] | tests.go:56:3:56:3 | f |
-| tests.go:44:21:44:21 | f | tests.go:21:24:21:24 | definition of f |
+| tests.go:66:5:66:76 | ... := ...[0] | tests.go:68:3:68:3 | f |
-| tests.go:45:29:45:29 | f | tests.go:25:32:25:32 | definition of f |
+| tests.go:108:5:108:78 | ... := ...[0] | tests.go:110:9:110:9 | f |
-| tests.go:53:5:53:42 | ... := ...[0] | tests.go:54:21:54:21 | f |
+| tests.go:125:5:125:78 | ... := ...[0] | tests.go:129:3:129:3 | f |
-| tests.go:53:5:53:42 | ... := ...[0] | tests.go:55:29:55:29 | f |
-| tests.go:54:21:54:21 | f | tests.go:21:24:21:24 | definition of f |
-| tests.go:55:29:55:29 | f | tests.go:25:32:25:32 | definition of f |
-| tests.go:60:5:60:38 | ... := ...[0] | tests.go:62:3:62:3 | f |
-| tests.go:70:5:70:42 | ... := ...[0] | tests.go:72:3:72:3 | f |
-| tests.go:108:5:108:38 | ... := ...[0] | tests.go:110:9:110:9 | f |
-| tests.go:124:5:124:38 | ... := ...[0] | tests.go:128:3:128:3 | f |
 nodes
-| tests.go:9:2:9:74 | ... := ...[0] | semmle.label | ... := ...[0] |
+| tests.go:8:24:8:24 | definition of f | semmle.label | definition of f |
-| tests.go:10:9:10:9 | f | semmle.label | f |
+| tests.go:9:8:9:8 | f | semmle.label | f |
-| tests.go:18:2:18:69 | return statement[0] | semmle.label | return statement[0] |
+| tests.go:12:32:12:32 | definition of f | semmle.label | definition of f |
-| tests.go:21:24:21:24 | definition of f | semmle.label | definition of f |
+| tests.go:13:13:13:13 | capture variable f | semmle.label | capture variable f |
-| tests.go:22:8:22:8 | f | semmle.label | f |
+| tests.go:14:3:14:3 | f | semmle.label | f |
-| tests.go:25:32:25:32 | definition of f | semmle.label | definition of f |
+| tests.go:31:5:31:78 | ... := ...[0] | semmle.label | ... := ...[0] |
-| tests.go:26:13:26:13 | capture variable f | semmle.label | capture variable f |
+| tests.go:32:21:32:21 | f | semmle.label | f |
-| tests.go:27:3:27:3 | f | semmle.label | f |
+| tests.go:33:29:33:29 | f | semmle.label | f |
-| tests.go:43:5:43:38 | ... := ...[0] | semmle.label | ... := ...[0] |
+| tests.go:45:5:45:76 | ... := ...[0] | semmle.label | ... := ...[0] |
-| tests.go:44:21:44:21 | f | semmle.label | f |
+| tests.go:46:21:46:21 | f | semmle.label | f |
-| tests.go:45:29:45:29 | f | semmle.label | f |
+| tests.go:47:29:47:29 | f | semmle.label | f |
-| tests.go:53:5:53:42 | ... := ...[0] | semmle.label | ... := ...[0] |
+| tests.go:54:5:54:78 | ... := ...[0] | semmle.label | ... := ...[0] |
-| tests.go:54:21:54:21 | f | semmle.label | f |
+| tests.go:56:3:56:3 | f | semmle.label | f |
-| tests.go:55:29:55:29 | f | semmle.label | f |
+| tests.go:66:5:66:76 | ... := ...[0] | semmle.label | ... := ...[0] |
-| tests.go:60:5:60:38 | ... := ...[0] | semmle.label | ... := ...[0] |
+| tests.go:68:3:68:3 | f | semmle.label | f |
-| tests.go:62:3:62:3 | f | semmle.label | f |
+| tests.go:108:5:108:78 | ... := ...[0] | semmle.label | ... := ...[0] |
-| tests.go:70:5:70:42 | ... := ...[0] | semmle.label | ... := ...[0] |
-| tests.go:72:3:72:3 | f | semmle.label | f |
-| tests.go:108:5:108:38 | ... := ...[0] | semmle.label | ... := ...[0] |
 | tests.go:110:9:110:9 | f | semmle.label | f |
-| tests.go:124:5:124:38 | ... := ...[0] | semmle.label | ... := ...[0] |
+| tests.go:125:5:125:78 | ... := ...[0] | semmle.label | ... := ...[0] |
-| tests.go:128:3:128:3 | f | semmle.label | f |
+| tests.go:129:3:129:3 | f | semmle.label | f |
 subpaths
 #select
-| tests.go:22:8:22:8 | f | tests.go:9:2:9:74 | ... := ...[0] | tests.go:22:8:22:8 | f | File handle may be writable as a result of data flow from a $@ and closing it may result in data loss upon failure, which is not handled explicitly. | tests.go:9:12:9:74 | call to OpenFile | call to OpenFile |
+| tests.go:9:8:9:8 | f | tests.go:31:5:31:78 | ... := ...[0] | tests.go:9:8:9:8 | f | File handle may be writable as a result of data flow from a $@ and closing it may result in data loss upon failure, which is not handled explicitly. | tests.go:31:15:31:78 | call to OpenFile | call to OpenFile |
-| tests.go:22:8:22:8 | f | tests.go:18:2:18:69 | return statement[0] | tests.go:22:8:22:8 | f | File handle may be writable as a result of data flow from a $@ and closing it may result in data loss upon failure, which is not handled explicitly. | tests.go:18:9:18:69 | call to OpenFile | call to OpenFile |
+| tests.go:9:8:9:8 | f | tests.go:45:5:45:76 | ... := ...[0] | tests.go:9:8:9:8 | f | File handle may be writable as a result of data flow from a $@ and closing it may result in data loss upon failure, which is not handled explicitly. | tests.go:45:15:45:76 | call to OpenFile | call to OpenFile |
-| tests.go:27:3:27:3 | f | tests.go:9:2:9:74 | ... := ...[0] | tests.go:27:3:27:3 | f | File handle may be writable as a result of data flow from a $@ and closing it may result in data loss upon failure, which is not handled explicitly. | tests.go:9:12:9:74 | call to OpenFile | call to OpenFile |
+| tests.go:14:3:14:3 | f | tests.go:31:5:31:78 | ... := ...[0] | tests.go:14:3:14:3 | f | File handle may be writable as a result of data flow from a $@ and closing it may result in data loss upon failure, which is not handled explicitly. | tests.go:31:15:31:78 | call to OpenFile | call to OpenFile |
-| tests.go:27:3:27:3 | f | tests.go:18:2:18:69 | return statement[0] | tests.go:27:3:27:3 | f | File handle may be writable as a result of data flow from a $@ and closing it may result in data loss upon failure, which is not handled explicitly. | tests.go:18:9:18:69 | call to OpenFile | call to OpenFile |
+| tests.go:14:3:14:3 | f | tests.go:45:5:45:76 | ... := ...[0] | tests.go:14:3:14:3 | f | File handle may be writable as a result of data flow from a $@ and closing it may result in data loss upon failure, which is not handled explicitly. | tests.go:45:15:45:76 | call to OpenFile | call to OpenFile |
-| tests.go:62:3:62:3 | f | tests.go:9:2:9:74 | ... := ...[0] | tests.go:62:3:62:3 | f | File handle may be writable as a result of data flow from a $@ and closing it may result in data loss upon failure, which is not handled explicitly. | tests.go:9:12:9:74 | call to OpenFile | call to OpenFile |
+| tests.go:56:3:56:3 | f | tests.go:54:5:54:78 | ... := ...[0] | tests.go:56:3:56:3 | f | File handle may be writable as a result of data flow from a $@ and closing it may result in data loss upon failure, which is not handled explicitly. | tests.go:54:15:54:78 | call to OpenFile | call to OpenFile |
-| tests.go:72:3:72:3 | f | tests.go:18:2:18:69 | return statement[0] | tests.go:72:3:72:3 | f | File handle may be writable as a result of data flow from a $@ and closing it may result in data loss upon failure, which is not handled explicitly. | tests.go:18:9:18:69 | call to OpenFile | call to OpenFile |
+| tests.go:68:3:68:3 | f | tests.go:66:5:66:76 | ... := ...[0] | tests.go:68:3:68:3 | f | File handle may be writable as a result of data flow from a $@ and closing it may result in data loss upon failure, which is not handled explicitly. | tests.go:66:15:66:76 | call to OpenFile | call to OpenFile |
-| tests.go:110:9:110:9 | f | tests.go:9:2:9:74 | ... := ...[0] | tests.go:110:9:110:9 | f | File handle may be writable as a result of data flow from a $@ and closing it may result in data loss upon failure, which is not handled explicitly. | tests.go:9:12:9:74 | call to OpenFile | call to OpenFile |
+| tests.go:110:9:110:9 | f | tests.go:108:5:108:78 | ... := ...[0] | tests.go:110:9:110:9 | f | File handle may be writable as a result of data flow from a $@ and closing it may result in data loss upon failure, which is not handled explicitly. | tests.go:108:15:108:78 | call to OpenFile | call to OpenFile |
-| tests.go:128:3:128:3 | f | tests.go:9:2:9:74 | ... := ...[0] | tests.go:128:3:128:3 | f | File handle may be writable as a result of data flow from a $@ and closing it may result in data loss upon failure, which is not handled explicitly. | tests.go:9:12:9:74 | call to OpenFile | call to OpenFile |
+| tests.go:129:3:129:3 | f | tests.go:125:5:125:78 | ... := ...[0] | tests.go:129:3:129:3 | f | File handle may be writable as a result of data flow from a $@ and closing it may result in data loss upon failure, which is not handled explicitly. | tests.go:125:15:125:78 | call to OpenFile | call to OpenFile |

go/ql/test/query-tests/InconsistentCode/UnhandledCloseWritableHandle/tests.go

@@ -5,19 +5,6 @@ import (
 	"os"
 )
 
-func openFileWrite(filename string) (*os.File, error) {
-	f, err := os.OpenFile(filename, os.O_WRONLY|os.O_TRUNC|os.O_CREATE, 0666)
-	return f, err
-}
-
-func openFileRead(filename string) (*os.File, error) {
-	return os.OpenFile(filename, os.O_RDONLY|os.O_CREATE, 0666)
-}
-
-func openFileReadWrite(filename string) (*os.File, error) {
-	return os.OpenFile(filename, os.O_RDWR|os.O_TRUNC|os.O_CREATE, 0666)
-}
-
 func closeFileDeferred(f *os.File) {
 	defer f.Close() // NOT OK, if `f` is writable
 }
@@ -40,41 +27,51 @@ func closeFileDeferredIndirectReturn(f *os.File) {
 }
 
 func deferredCalls() {
-	if f, err := openFileWrite("foo.txt"); err != nil {
+	// open file for writing
+	if f, err := os.OpenFile("foo.txt", os.O_WRONLY|os.O_TRUNC|os.O_CREATE, 0666); err != nil {
 		closeFileDeferred(f)               // NOT OK
 		closeFileDeferredIndirect(f)       // NOT OK
+		closeFileDeferredIndirectReturn(f) // OK - the error is not discarded at the call to Close (though it is discarded later)
 	}
 
-	if f, err := openFileRead("foo.txt"); err != nil {
+	// open file for reading
+	if f, err := os.OpenFile("foo.txt", os.O_RDONLY|os.O_CREATE, 0666); err != nil {
 		closeFileDeferred(f)               // OK
 		closeFileDeferredIndirect(f)       // OK
+		closeFileDeferredIndirectReturn(f) // OK
 	}
 
-	if f, err := openFileReadWrite("foo.txt"); err != nil {
+	// open file for reading and writing
+	if f, err := os.OpenFile("foo.txt", os.O_RDWR|os.O_TRUNC|os.O_CREATE, 0666); err != nil {
 		closeFileDeferred(f)               // NOT OK
 		closeFileDeferredIndirect(f)       // NOT OK
+		closeFileDeferredIndirectReturn(f) // OK - the error is not discarded at the call to Close (though it is discarded later)
 	}
 }
 
 func notDeferred() {
-	if f, err := openFileWrite("foo.txt"); err != nil {
+	// open file for writing
+	if f, err := os.OpenFile("foo.txt", os.O_WRONLY|os.O_TRUNC|os.O_CREATE, 0666); err != nil {
 		// the handle is write-only and we don't check if `Close` succeeds
 		f.Close() // NOT OK
 	}
 
-	if f, err := openFileRead("foo.txt"); err != nil {
+	// open file for reading
+	if f, err := os.OpenFile("foo.txt", os.O_RDONLY|os.O_CREATE, 0666); err != nil {
 		// the handle is read-only, so this is ok
 		f.Close() // OK
 	}
 
-	if f, err := openFileReadWrite("foo.txt"); err != nil {
+	// open file for reading and writing
+	if f, err := os.OpenFile("foo.txt", os.O_RDWR|os.O_TRUNC|os.O_CREATE, 0666); err != nil {
 		// the handle is read-write and we don't check if `Close` succeeds
 		f.Close() // NOT OK
 	}
 }
 
 func foo() error {
-	if f, err := openFileWrite("foo.txt"); err != nil {
+	// open file for writing
+	if f, err := os.OpenFile("foo.txt", os.O_WRONLY|os.O_TRUNC|os.O_CREATE, 0666); err != nil {
 		// the result of the call to `Close` is returned to the caller
 		return f.Close() // OK
 	}
@@ -83,7 +80,8 @@ func foo() error {
 }
 
 func isSyncedFirst() {
-	if f, err := openFileWrite("foo.txt"); err != nil {
+	// open file for writing
+	if f, err := os.OpenFile("foo.txt", os.O_WRONLY|os.O_TRUNC|os.O_CREATE, 0666); err != nil {
 		// we have a call to `Sync` and check whether it was successful before proceeding
 		if err := f.Sync(); err != nil {
 			f.Close() // OK
@@ -93,7 +91,8 @@ func isSyncedFirst() {
 }
 
 func deferredCloseWithSync() {
-	if f, err := openFileWrite("foo.txt"); err != nil {
+	// open file for writing
+	if f, err := os.OpenFile("foo.txt", os.O_WRONLY|os.O_TRUNC|os.O_CREATE, 0666); err != nil {
 		// a call to `Close` is deferred, but we have a call to `Sync` later which
 		// precedes the call to `Close` during execution
 		defer f.Close() // OK
@@ -105,7 +104,8 @@ func deferredCloseWithSync() {
 }
 
 func deferredCloseWithSyncEarlyReturn(n int) {
-	if f, err := openFileWrite("foo.txt"); err != nil {
+	// open file for writing
+	if f, err := os.OpenFile("foo.txt", os.O_WRONLY|os.O_TRUNC|os.O_CREATE, 0666); err != nil {
 		// a call to `Close` is deferred
 		defer f.Close() // NOT OK
 
@@ -121,7 +121,8 @@ func deferredCloseWithSyncEarlyReturn(n int) {
 }
 
 func unhandledSync() {
-	if f, err := openFileWrite("foo.txt"); err != nil {
+	// open file for writing
+	if f, err := os.OpenFile("foo.txt", os.O_WRONLY|os.O_TRUNC|os.O_CREATE, 0666); err != nil {
 		// we have a call to `Sync` which precedes the call to `Close`, but there is no check
 		// to see if `Sync` may have failed
 		f.Sync()

java/ql/integration-tests/all-platforms/java/buildless-maven/test.expected

@@ -1,8 +1,10 @@
+#select
+| src/main/java/com/example/App.java:0:0:0:0 | App |
+| src/test/java/com/example/AppTest.java:0:0:0:0 | AppTest |
 xmlFiles
 | pom.xml:0:0:0:0 | pom.xml |
 | src/main/resources/page.xml:0:0:0:0 | src/main/resources/page.xml |
 | src/main/resources/struts.xml:0:0:0:0 | src/main/resources/struts.xml |
 propertiesFiles
-#select
+| src/main/resources/my-app.properties:0:0:0:0 | src/main/resources/my-app.properties |
-| src/main/java/com/example/App.java:0:0:0:0 | App |
+| test-db/log/ext/javac.properties:0:0:0:0 | test-db/log/ext/javac.properties |
-| src/test/java/com/example/AppTest.java:0:0:0:0 | AppTest |

java/ql/integration-tests/all-platforms/java/buildless/test.expected

@@ -1,7 +1,9 @@
+#select
+| src/main/java/com/example/App.java:0:0:0:0 | App |
+| src/test/java/com/example/AppTest.java:0:0:0:0 | AppTest |
 xmlFiles
 | src/main/resources/page.xml:0:0:0:0 | src/main/resources/page.xml |
 | src/main/resources/struts.xml:0:0:0:0 | src/main/resources/struts.xml |
 propertiesFiles
-#select
+| src/main/resources/my-app.properties:0:0:0:0 | src/main/resources/my-app.properties |
-| src/main/java/com/example/App.java:0:0:0:0 | App |
+| test-db/log/ext/javac.properties:0:0:0:0 | test-db/log/ext/javac.properties |
-| src/test/java/com/example/AppTest.java:0:0:0:0 | AppTest |

java/ql/integration-tests/all-platforms/java/maven-sample/test.expected

@@ -1,3 +1,6 @@
+#select
+| src/main/java/com/example/App.java:0:0:0:0 | App |
+| src/test/java/com/example/AppTest.java:0:0:0:0 | AppTest |
 xmlFiles
 | pom.xml:0:0:0:0 | pom.xml |
 | src/main/resources/page.xml:0:0:0:0 | src/main/resources/page.xml |
@@ -5,6 +8,8 @@ xmlFiles
 | target/classes/page.xml:0:0:0:0 | target/classes/page.xml |
 | target/classes/struts.xml:0:0:0:0 | target/classes/struts.xml |
 propertiesFiles
-#select
+| src/main/resources/my-app.properties:0:0:0:0 | src/main/resources/my-app.properties |
-| src/main/java/com/example/App.java:0:0:0:0 | App |
+| target/classes/my-app.properties:0:0:0:0 | target/classes/my-app.properties |
-| src/test/java/com/example/AppTest.java:0:0:0:0 | AppTest |
+| target/maven-archiver/pom.properties:0:0:0:0 | target/maven-archiver/pom.properties |
+| test-db/log/ext/javac-1.properties:0:0:0:0 | test-db/log/ext/javac-1.properties |
+| test-db/log/ext/javac.properties:0:0:0:0 | test-db/log/ext/javac.properties |

java/ql/lib/change-notes/2023-11-29-new-spring-models.md

@@ -0,0 +1,5 @@
+---
+category: minorAnalysis
+---
+* Added a sink model for the `createRelative` method of the `org.springframework.core.io.Resource` interface.
+* Added source models for methods of the `org.springframework.web.util.UrlPathHelper` class and removed their taint flow models.

java/ql/lib/ext/org.springframework.core.io.model.yml

@@ -3,5 +3,6 @@ extensions:
       pack: codeql/java-all
       extensible: sinkModel
     data:
+      - ["org.springframework.core.io", "Resource", True, "createRelative", "(String)", "", "Argument[0]", "path-injection", "manual"]
       - ["org.springframework.core.io", "ResourceLoader", True, "getResource", "(String)", "", "Argument[0]", "path-injection", "ai-manual"]
       - ["org.springframework.core.io", "ResourceLoader", True, "getResource", "(String)", "", "Argument[0]", "request-forgery", "manual"]

java/ql/lib/ext/org.springframework.web.util.model.yml

@@ -1,4 +1,18 @@
 extensions:
+  - addsTo:
+      pack: codeql/java-all
+      extensible: sourceModel
+    data:
+      - ["org.springframework.web.util", "UrlPathHelper", False, "getLookupPathForRequest", "", "", "ReturnValue", "remote", "manual"]
+      - ["org.springframework.web.util", "UrlPathHelper", False, "getOriginatingQueryString", "", "", "ReturnValue", "remote", "manual"]
+      - ["org.springframework.web.util", "UrlPathHelper", False, "getOriginatingRequestUri", "", "", "ReturnValue", "remote", "manual"]
+      - ["org.springframework.web.util", "UrlPathHelper", False, "getPathWithinApplication", "", "", "ReturnValue", "remote", "manual"]
+      - ["org.springframework.web.util", "UrlPathHelper", False, "getPathWithinServletMapping", "", "", "ReturnValue", "remote", "manual"]
+      - ["org.springframework.web.util", "UrlPathHelper", False, "getRequestUri", "", "", "ReturnValue", "remote", "manual"]
+      - ["org.springframework.web.util", "UrlPathHelper", False, "getResolvedLookupPath", "", "", "ReturnValue", "remote", "manual"]
+      - ["org.springframework.web.util", "UrlPathHelper", False, "getServletPath", "", "", "ReturnValue", "remote", "manual"]
+      - ["org.springframework.web.util", "UrlPathHelper", False, "resolveAndCacheLookupPath", "", "", "ReturnValue", "remote", "manual"]
+
   - addsTo:
       pack: codeql/java-all
       extensible: summaryModel
@@ -147,15 +161,7 @@ extensions:
       - ["org.springframework.web.util", "UrlPathHelper", False, "decodeRequestString", "", "", "Argument[1]", "ReturnValue", "taint", "manual"]
       - ["org.springframework.web.util", "UrlPathHelper", False, "getContextPath", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
       - ["org.springframework.web.util", "UrlPathHelper", False, "getOriginatingContextPath", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
-      - ["org.springframework.web.util", "UrlPathHelper", False, "getOriginatingQueryString", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
-      - ["org.springframework.web.util", "UrlPathHelper", False, "getOriginatingRequestUri", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
-      - ["org.springframework.web.util", "UrlPathHelper", False, "getPathWithinApplication", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
-      - ["org.springframework.web.util", "UrlPathHelper", False, "getPathWithinServletMapping", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
-      - ["org.springframework.web.util", "UrlPathHelper", False, "getRequestUri", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
-      - ["org.springframework.web.util", "UrlPathHelper", False, "getResolvedLookupPath", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
-      - ["org.springframework.web.util", "UrlPathHelper", False, "getServletPath", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
       - ["org.springframework.web.util", "UrlPathHelper", False, "removeSemicolonContent", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
-      - ["org.springframework.web.util", "UrlPathHelper", False, "resolveAndCacheLookupPath", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
       - ["org.springframework.web.util", "WebUtils", False, "findParameterValue", "(Map,String)", "", "Argument[0].MapValue", "ReturnValue", "value", "manual"]
       - ["org.springframework.web.util", "WebUtils", False, "findParameterValue", "(ServletRequest,String)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
       - ["org.springframework.web.util", "WebUtils", False, "getCookie", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]

java/ql/test/library-tests/frameworks/spring/webutil/Test.java

@@ -2396,45 +2396,6 @@ public class Test {
 			out = instance.getOriginatingContextPath(in);
 			sink(out); // $hasTaintFlow
 		}
-		{
-			// "org.springframework.web.util;UrlPathHelper;false;getOriginatingQueryString;;;Argument[0];ReturnValue;taint;manual"
-			String out = null;
-			HttpServletRequest in = (HttpServletRequest)source();
-			UrlPathHelper instance = null;
-			out = instance.getOriginatingQueryString(in);
-			sink(out); // $hasTaintFlow
-		}
-		{
-			// "org.springframework.web.util;UrlPathHelper;false;getOriginatingRequestUri;;;Argument[0];ReturnValue;taint;manual"
-			String out = null;
-			HttpServletRequest in = (HttpServletRequest)source();
-			UrlPathHelper instance = null;
-			out = instance.getOriginatingRequestUri(in);
-			sink(out); // $hasTaintFlow
-		}
-		{
-			// "org.springframework.web.util;UrlPathHelper;false;getRequestUri;;;Argument[0];ReturnValue;taint;manual"
-			String out = null;
-			HttpServletRequest in = (HttpServletRequest)source();
-			UrlPathHelper instance = null;
-			out = instance.getRequestUri(in);
-			sink(out); // $hasTaintFlow
-		}
-		{
-			// "org.springframework.web.util;UrlPathHelper;false;getResolvedLookupPath;;;Argument[0];ReturnValue;taint;manual"
-			String out = null;
-			ServletRequest in = (ServletRequest)source();
-			out = UrlPathHelper.getResolvedLookupPath(in);
-			sink(out); // $hasTaintFlow
-		}
-		{
-			// "org.springframework.web.util;UrlPathHelper;false;getServletPath;;;Argument[0];ReturnValue;taint;manual"
-			String out = null;
-			HttpServletRequest in = (HttpServletRequest)source();
-			UrlPathHelper instance = null;
-			out = instance.getServletPath(in);
-			sink(out); // $hasTaintFlow
-		}
 		{
 			// "org.springframework.web.util;UrlPathHelper;false;removeSemicolonContent;;;Argument[0];ReturnValue;taint;manual"
 			String out = null;
@@ -2443,14 +2404,6 @@ public class Test {
 			out = instance.removeSemicolonContent(in);
 			sink(out); // $hasTaintFlow
 		}
-		{
-			// "org.springframework.web.util;UrlPathHelper;false;resolveAndCacheLookupPath;;;Argument[0];ReturnValue;taint;manual"
-			String out = null;
-			HttpServletRequest in = (HttpServletRequest)source();
-			UrlPathHelper instance = null;
-			out = instance.resolveAndCacheLookupPath(in);
-			sink(out); // $hasTaintFlow
-		}
 		{
 			// "org.springframework.web.util;WebUtils;false;findParameterValue;(Map,String);;MapValue of Argument[0];ReturnValue;value;manual"
 			String out = null;
@@ -2605,22 +2558,6 @@ public class Test {
 			out = in.toString();
 			sink(out); // $ hasTaintFlow
 		}
-		{
-			// "org.springframework.web.util;UrlPathHelper;false;getPathWithinApplication;;;Argument[0];ReturnValue;taint;manual"
-			String out = null;
-			HttpServletRequest in = (HttpServletRequest)source();
-			UrlPathHelper instance = null;
-			out = instance.getPathWithinApplication(in);
-			sink(out); // $ hasTaintFlow
-		}
-		{
-			// "org.springframework.web.util;UrlPathHelper;false;getPathWithinServletMapping;;;Argument[0];ReturnValue;taint;manual"
-			String out = null;
-			HttpServletRequest in = (HttpServletRequest)source();
-			UrlPathHelper instance = null;
-			out = instance.getPathWithinServletMapping(in);
-			sink(out); // $ hasTaintFlow
-		}
 		{
 			// "org.springframework.web.util;WebUtils;false;setSessionAttribute;;;Argument[2];Argument[0];taint;manual"
 			HttpServletRequest out = null;