Add properties file references

Merge pull request #14996 from jketema/toctou-test
C++: Fix `chmod` prototype in toctou test and additional test
2026-07-07 20:45:28 +02:00 · 2023-12-04 13:00:55 -05:00 · 2023-12-04 17:42:52 +00:00 · 2023-12-04 16:56:09 +00:00 · 2023-12-04 17:53:08 +01:00 · 2023-12-04 10:18:50 -05:00
10 changed files with 116 additions and 162 deletions
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-367/semmle/test2.cpp
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-367/semmle/test2.cpp
@@ -19,7 +19,7 @@ bool stat(const char *path, stat_data *buf);
 bool fstat(int file, stat_data *buf);
 bool lstat(const char *path, stat_data *buf);
 bool fstatat(int dir, const char *path, stat_data *buf);
-void chmod(const char *path, int setting);
+int chmod(const char *path, int setting);
 int rename(const char *from, const char *to);
 bool remove(const char *path);

@@ -408,3 +408,8 @@ void test7_1(const char *path1, const char *path2)
 		chmod(path2, 1234); // BAD
 	}
 }
+
+int test8(const char *path, int mode)
+{
+    return (chmod(path, mode) == 0 ? 1 : 0); // GOOD
+}
--- a/go/ql/test/query-tests/InconsistentCode/UnhandledCloseWritableHandle/UnhandledCloseWritableHandle.expected
+++ b/go/ql/test/query-tests/InconsistentCode/UnhandledCloseWritableHandle/UnhandledCloseWritableHandle.expected
@@ -1,56 +1,46 @@
 edges
-| tests.go:9:2:9:74 | ... := ...[0] | tests.go:10:9:10:9 | f |
-| tests.go:10:9:10:9 | f | tests.go:43:5:43:38 | ... := ...[0] |
-| tests.go:10:9:10:9 | f | tests.go:60:5:60:38 | ... := ...[0] |
-| tests.go:10:9:10:9 | f | tests.go:108:5:108:38 | ... := ...[0] |
-| tests.go:10:9:10:9 | f | tests.go:124:5:124:38 | ... := ...[0] |
-| tests.go:18:2:18:69 | return statement[0] | tests.go:53:5:53:42 | ... := ...[0] |
-| tests.go:18:2:18:69 | return statement[0] | tests.go:70:5:70:42 | ... := ...[0] |
-| tests.go:21:24:21:24 | definition of f | tests.go:22:8:22:8 | f |
-| tests.go:25:32:25:32 | definition of f | tests.go:26:13:26:13 | capture variable f |
-| tests.go:26:13:26:13 | capture variable f | tests.go:27:3:27:3 | f |
-| tests.go:43:5:43:38 | ... := ...[0] | tests.go:44:21:44:21 | f |
-| tests.go:43:5:43:38 | ... := ...[0] | tests.go:45:29:45:29 | f |
-| tests.go:44:21:44:21 | f | tests.go:21:24:21:24 | definition of f |
-| tests.go:45:29:45:29 | f | tests.go:25:32:25:32 | definition of f |
-| tests.go:53:5:53:42 | ... := ...[0] | tests.go:54:21:54:21 | f |
-| tests.go:53:5:53:42 | ... := ...[0] | tests.go:55:29:55:29 | f |
-| tests.go:54:21:54:21 | f | tests.go:21:24:21:24 | definition of f |
-| tests.go:55:29:55:29 | f | tests.go:25:32:25:32 | definition of f |
-| tests.go:60:5:60:38 | ... := ...[0] | tests.go:62:3:62:3 | f |
-| tests.go:70:5:70:42 | ... := ...[0] | tests.go:72:3:72:3 | f |
-| tests.go:108:5:108:38 | ... := ...[0] | tests.go:110:9:110:9 | f |
-| tests.go:124:5:124:38 | ... := ...[0] | tests.go:128:3:128:3 | f |
+| tests.go:8:24:8:24 | definition of f | tests.go:9:8:9:8 | f |
+| tests.go:12:32:12:32 | definition of f | tests.go:13:13:13:13 | capture variable f |
+| tests.go:13:13:13:13 | capture variable f | tests.go:14:3:14:3 | f |
+| tests.go:31:5:31:78 | ... := ...[0] | tests.go:32:21:32:21 | f |
+| tests.go:31:5:31:78 | ... := ...[0] | tests.go:33:29:33:29 | f |
+| tests.go:32:21:32:21 | f | tests.go:8:24:8:24 | definition of f |
+| tests.go:33:29:33:29 | f | tests.go:12:32:12:32 | definition of f |
+| tests.go:45:5:45:76 | ... := ...[0] | tests.go:46:21:46:21 | f |
+| tests.go:45:5:45:76 | ... := ...[0] | tests.go:47:29:47:29 | f |
+| tests.go:46:21:46:21 | f | tests.go:8:24:8:24 | definition of f |
+| tests.go:47:29:47:29 | f | tests.go:12:32:12:32 | definition of f |
+| tests.go:54:5:54:78 | ... := ...[0] | tests.go:56:3:56:3 | f |
+| tests.go:66:5:66:76 | ... := ...[0] | tests.go:68:3:68:3 | f |
+| tests.go:108:5:108:78 | ... := ...[0] | tests.go:110:9:110:9 | f |
+| tests.go:125:5:125:78 | ... := ...[0] | tests.go:129:3:129:3 | f |
 nodes
-| tests.go:9:2:9:74 | ... := ...[0] | semmle.label | ... := ...[0] |
-| tests.go:10:9:10:9 | f | semmle.label | f |
-| tests.go:18:2:18:69 | return statement[0] | semmle.label | return statement[0] |
-| tests.go:21:24:21:24 | definition of f | semmle.label | definition of f |
-| tests.go:22:8:22:8 | f | semmle.label | f |
-| tests.go:25:32:25:32 | definition of f | semmle.label | definition of f |
-| tests.go:26:13:26:13 | capture variable f | semmle.label | capture variable f |
-| tests.go:27:3:27:3 | f | semmle.label | f |
-| tests.go:43:5:43:38 | ... := ...[0] | semmle.label | ... := ...[0] |
-| tests.go:44:21:44:21 | f | semmle.label | f |
-| tests.go:45:29:45:29 | f | semmle.label | f |
-| tests.go:53:5:53:42 | ... := ...[0] | semmle.label | ... := ...[0] |
-| tests.go:54:21:54:21 | f | semmle.label | f |
-| tests.go:55:29:55:29 | f | semmle.label | f |
-| tests.go:60:5:60:38 | ... := ...[0] | semmle.label | ... := ...[0] |
-| tests.go:62:3:62:3 | f | semmle.label | f |
-| tests.go:70:5:70:42 | ... := ...[0] | semmle.label | ... := ...[0] |
-| tests.go:72:3:72:3 | f | semmle.label | f |
-| tests.go:108:5:108:38 | ... := ...[0] | semmle.label | ... := ...[0] |
+| tests.go:8:24:8:24 | definition of f | semmle.label | definition of f |
+| tests.go:9:8:9:8 | f | semmle.label | f |
+| tests.go:12:32:12:32 | definition of f | semmle.label | definition of f |
+| tests.go:13:13:13:13 | capture variable f | semmle.label | capture variable f |
+| tests.go:14:3:14:3 | f | semmle.label | f |
+| tests.go:31:5:31:78 | ... := ...[0] | semmle.label | ... := ...[0] |
+| tests.go:32:21:32:21 | f | semmle.label | f |
+| tests.go:33:29:33:29 | f | semmle.label | f |
+| tests.go:45:5:45:76 | ... := ...[0] | semmle.label | ... := ...[0] |
+| tests.go:46:21:46:21 | f | semmle.label | f |
+| tests.go:47:29:47:29 | f | semmle.label | f |
+| tests.go:54:5:54:78 | ... := ...[0] | semmle.label | ... := ...[0] |
+| tests.go:56:3:56:3 | f | semmle.label | f |
+| tests.go:66:5:66:76 | ... := ...[0] | semmle.label | ... := ...[0] |
+| tests.go:68:3:68:3 | f | semmle.label | f |
+| tests.go:108:5:108:78 | ... := ...[0] | semmle.label | ... := ...[0] |
 | tests.go:110:9:110:9 | f | semmle.label | f |
-| tests.go:124:5:124:38 | ... := ...[0] | semmle.label | ... := ...[0] |
-| tests.go:128:3:128:3 | f | semmle.label | f |
+| tests.go:125:5:125:78 | ... := ...[0] | semmle.label | ... := ...[0] |
+| tests.go:129:3:129:3 | f | semmle.label | f |
 subpaths
 #select
-| tests.go:22:8:22:8 | f | tests.go:9:2:9:74 | ... := ...[0] | tests.go:22:8:22:8 | f | File handle may be writable as a result of data flow from a $@ and closing it may result in data loss upon failure, which is not handled explicitly. | tests.go:9:12:9:74 | call to OpenFile | call to OpenFile |
-| tests.go:22:8:22:8 | f | tests.go:18:2:18:69 | return statement[0] | tests.go:22:8:22:8 | f | File handle may be writable as a result of data flow from a $@ and closing it may result in data loss upon failure, which is not handled explicitly. | tests.go:18:9:18:69 | call to OpenFile | call to OpenFile |
-| tests.go:27:3:27:3 | f | tests.go:9:2:9:74 | ... := ...[0] | tests.go:27:3:27:3 | f | File handle may be writable as a result of data flow from a $@ and closing it may result in data loss upon failure, which is not handled explicitly. | tests.go:9:12:9:74 | call to OpenFile | call to OpenFile |
-| tests.go:27:3:27:3 | f | tests.go:18:2:18:69 | return statement[0] | tests.go:27:3:27:3 | f | File handle may be writable as a result of data flow from a $@ and closing it may result in data loss upon failure, which is not handled explicitly. | tests.go:18:9:18:69 | call to OpenFile | call to OpenFile |
-| tests.go:62:3:62:3 | f | tests.go:9:2:9:74 | ... := ...[0] | tests.go:62:3:62:3 | f | File handle may be writable as a result of data flow from a $@ and closing it may result in data loss upon failure, which is not handled explicitly. | tests.go:9:12:9:74 | call to OpenFile | call to OpenFile |
-| tests.go:72:3:72:3 | f | tests.go:18:2:18:69 | return statement[0] | tests.go:72:3:72:3 | f | File handle may be writable as a result of data flow from a $@ and closing it may result in data loss upon failure, which is not handled explicitly. | tests.go:18:9:18:69 | call to OpenFile | call to OpenFile |
-| tests.go:110:9:110:9 | f | tests.go:9:2:9:74 | ... := ...[0] | tests.go:110:9:110:9 | f | File handle may be writable as a result of data flow from a $@ and closing it may result in data loss upon failure, which is not handled explicitly. | tests.go:9:12:9:74 | call to OpenFile | call to OpenFile |
-| tests.go:128:3:128:3 | f | tests.go:9:2:9:74 | ... := ...[0] | tests.go:128:3:128:3 | f | File handle may be writable as a result of data flow from a $@ and closing it may result in data loss upon failure, which is not handled explicitly. | tests.go:9:12:9:74 | call to OpenFile | call to OpenFile |
+| tests.go:9:8:9:8 | f | tests.go:31:5:31:78 | ... := ...[0] | tests.go:9:8:9:8 | f | File handle may be writable as a result of data flow from a $@ and closing it may result in data loss upon failure, which is not handled explicitly. | tests.go:31:15:31:78 | call to OpenFile | call to OpenFile |
+| tests.go:9:8:9:8 | f | tests.go:45:5:45:76 | ... := ...[0] | tests.go:9:8:9:8 | f | File handle may be writable as a result of data flow from a $@ and closing it may result in data loss upon failure, which is not handled explicitly. | tests.go:45:15:45:76 | call to OpenFile | call to OpenFile |
+| tests.go:14:3:14:3 | f | tests.go:31:5:31:78 | ... := ...[0] | tests.go:14:3:14:3 | f | File handle may be writable as a result of data flow from a $@ and closing it may result in data loss upon failure, which is not handled explicitly. | tests.go:31:15:31:78 | call to OpenFile | call to OpenFile |
+| tests.go:14:3:14:3 | f | tests.go:45:5:45:76 | ... := ...[0] | tests.go:14:3:14:3 | f | File handle may be writable as a result of data flow from a $@ and closing it may result in data loss upon failure, which is not handled explicitly. | tests.go:45:15:45:76 | call to OpenFile | call to OpenFile |
+| tests.go:56:3:56:3 | f | tests.go:54:5:54:78 | ... := ...[0] | tests.go:56:3:56:3 | f | File handle may be writable as a result of data flow from a $@ and closing it may result in data loss upon failure, which is not handled explicitly. | tests.go:54:15:54:78 | call to OpenFile | call to OpenFile |
+| tests.go:68:3:68:3 | f | tests.go:66:5:66:76 | ... := ...[0] | tests.go:68:3:68:3 | f | File handle may be writable as a result of data flow from a $@ and closing it may result in data loss upon failure, which is not handled explicitly. | tests.go:66:15:66:76 | call to OpenFile | call to OpenFile |
+| tests.go:110:9:110:9 | f | tests.go:108:5:108:78 | ... := ...[0] | tests.go:110:9:110:9 | f | File handle may be writable as a result of data flow from a $@ and closing it may result in data loss upon failure, which is not handled explicitly. | tests.go:108:15:108:78 | call to OpenFile | call to OpenFile |
+| tests.go:129:3:129:3 | f | tests.go:125:5:125:78 | ... := ...[0] | tests.go:129:3:129:3 | f | File handle may be writable as a result of data flow from a $@ and closing it may result in data loss upon failure, which is not handled explicitly. | tests.go:125:15:125:78 | call to OpenFile | call to OpenFile |
--- a/go/ql/test/query-tests/InconsistentCode/UnhandledCloseWritableHandle/tests.go
+++ b/go/ql/test/query-tests/InconsistentCode/UnhandledCloseWritableHandle/tests.go
@@ -5,19 +5,6 @@ import (
 	"os"
 )

-func openFileWrite(filename string) (*os.File, error) {
-	f, err := os.OpenFile(filename, os.O_WRONLY|os.O_TRUNC|os.O_CREATE, 0666)
-	return f, err
-}
-
-func openFileRead(filename string) (*os.File, error) {
-	return os.OpenFile(filename, os.O_RDONLY|os.O_CREATE, 0666)
-}
-
-func openFileReadWrite(filename string) (*os.File, error) {
-	return os.OpenFile(filename, os.O_RDWR|os.O_TRUNC|os.O_CREATE, 0666)
-}
-
 func closeFileDeferred(f *os.File) {
 	defer f.Close() // NOT OK, if `f` is writable
 }
@@ -40,41 +27,51 @@ func closeFileDeferredIndirectReturn(f *os.File) {
 }

 func deferredCalls() {
-	if f, err := openFileWrite("foo.txt"); err != nil {
-		closeFileDeferred(f)         // NOT OK
-		closeFileDeferredIndirect(f) // NOT OK
+	// open file for writing
+	if f, err := os.OpenFile("foo.txt", os.O_WRONLY|os.O_TRUNC|os.O_CREATE, 0666); err != nil {
+		closeFileDeferred(f)               // NOT OK
+		closeFileDeferredIndirect(f)       // NOT OK
+		closeFileDeferredIndirectReturn(f) // OK - the error is not discarded at the call to Close (though it is discarded later)
 	}

-	if f, err := openFileRead("foo.txt"); err != nil {
-		closeFileDeferred(f)         // OK
-		closeFileDeferredIndirect(f) // OK
+	// open file for reading
+	if f, err := os.OpenFile("foo.txt", os.O_RDONLY|os.O_CREATE, 0666); err != nil {
+		closeFileDeferred(f)               // OK
+		closeFileDeferredIndirect(f)       // OK
+		closeFileDeferredIndirectReturn(f) // OK
 	}

-	if f, err := openFileReadWrite("foo.txt"); err != nil {
-		closeFileDeferred(f)         // NOT OK
-		closeFileDeferredIndirect(f) // NOT OK
+	// open file for reading and writing
+	if f, err := os.OpenFile("foo.txt", os.O_RDWR|os.O_TRUNC|os.O_CREATE, 0666); err != nil {
+		closeFileDeferred(f)               // NOT OK
+		closeFileDeferredIndirect(f)       // NOT OK
+		closeFileDeferredIndirectReturn(f) // OK - the error is not discarded at the call to Close (though it is discarded later)
 	}
 }

 func notDeferred() {
-	if f, err := openFileWrite("foo.txt"); err != nil {
+	// open file for writing
+	if f, err := os.OpenFile("foo.txt", os.O_WRONLY|os.O_TRUNC|os.O_CREATE, 0666); err != nil {
 		// the handle is write-only and we don't check if `Close` succeeds
 		f.Close() // NOT OK
 	}

-	if f, err := openFileRead("foo.txt"); err != nil {
+	// open file for reading
+	if f, err := os.OpenFile("foo.txt", os.O_RDONLY|os.O_CREATE, 0666); err != nil {
 		// the handle is read-only, so this is ok
 		f.Close() // OK
 	}

-	if f, err := openFileReadWrite("foo.txt"); err != nil {
+	// open file for reading and writing
+	if f, err := os.OpenFile("foo.txt", os.O_RDWR|os.O_TRUNC|os.O_CREATE, 0666); err != nil {
 		// the handle is read-write and we don't check if `Close` succeeds
 		f.Close() // NOT OK
 	}
 }

 func foo() error {
-	if f, err := openFileWrite("foo.txt"); err != nil {
+	// open file for writing
+	if f, err := os.OpenFile("foo.txt", os.O_WRONLY|os.O_TRUNC|os.O_CREATE, 0666); err != nil {
 		// the result of the call to `Close` is returned to the caller
 		return f.Close() // OK
 	}
@@ -83,7 +80,8 @@ func foo() error {
 }

 func isSyncedFirst() {
-	if f, err := openFileWrite("foo.txt"); err != nil {
+	// open file for writing
+	if f, err := os.OpenFile("foo.txt", os.O_WRONLY|os.O_TRUNC|os.O_CREATE, 0666); err != nil {
 		// we have a call to `Sync` and check whether it was successful before proceeding
 		if err := f.Sync(); err != nil {
 			f.Close() // OK
@@ -93,7 +91,8 @@ func isSyncedFirst() {
 }

 func deferredCloseWithSync() {
-	if f, err := openFileWrite("foo.txt"); err != nil {
+	// open file for writing
+	if f, err := os.OpenFile("foo.txt", os.O_WRONLY|os.O_TRUNC|os.O_CREATE, 0666); err != nil {
 		// a call to `Close` is deferred, but we have a call to `Sync` later which
 		// precedes the call to `Close` during execution
 		defer f.Close() // OK
@@ -105,7 +104,8 @@ func deferredCloseWithSync() {
 }

 func deferredCloseWithSyncEarlyReturn(n int) {
-	if f, err := openFileWrite("foo.txt"); err != nil {
+	// open file for writing
+	if f, err := os.OpenFile("foo.txt", os.O_WRONLY|os.O_TRUNC|os.O_CREATE, 0666); err != nil {
 		// a call to `Close` is deferred
 		defer f.Close() // NOT OK

@@ -121,7 +121,8 @@ func deferredCloseWithSyncEarlyReturn(n int) {
 }

 func unhandledSync() {
-	if f, err := openFileWrite("foo.txt"); err != nil {
+	// open file for writing
+	if f, err := os.OpenFile("foo.txt", os.O_WRONLY|os.O_TRUNC|os.O_CREATE, 0666); err != nil {
 		// we have a call to `Sync` which precedes the call to `Close`, but there is no check
 		// to see if `Sync` may have failed
 		f.Sync()
--- a/java/ql/integration-tests/all-platforms/java/buildless-maven/test.expected
+++ b/java/ql/integration-tests/all-platforms/java/buildless-maven/test.expected
@@ -1,8 +1,10 @@
+#select
+| src/main/java/com/example/App.java:0:0:0:0 | App |
+| src/test/java/com/example/AppTest.java:0:0:0:0 | AppTest |
 xmlFiles
 | pom.xml:0:0:0:0 | pom.xml |
 | src/main/resources/page.xml:0:0:0:0 | src/main/resources/page.xml |
 | src/main/resources/struts.xml:0:0:0:0 | src/main/resources/struts.xml |
 propertiesFiles
-#select
-| src/main/java/com/example/App.java:0:0:0:0 | App |
-| src/test/java/com/example/AppTest.java:0:0:0:0 | AppTest |
+| src/main/resources/my-app.properties:0:0:0:0 | src/main/resources/my-app.properties |
+| test-db/log/ext/javac.properties:0:0:0:0 | test-db/log/ext/javac.properties |
--- a/java/ql/integration-tests/all-platforms/java/buildless/test.expected
+++ b/java/ql/integration-tests/all-platforms/java/buildless/test.expected
@@ -1,7 +1,9 @@
+#select
+| src/main/java/com/example/App.java:0:0:0:0 | App |
+| src/test/java/com/example/AppTest.java:0:0:0:0 | AppTest |
 xmlFiles
 | src/main/resources/page.xml:0:0:0:0 | src/main/resources/page.xml |
 | src/main/resources/struts.xml:0:0:0:0 | src/main/resources/struts.xml |
 propertiesFiles
-#select
-| src/main/java/com/example/App.java:0:0:0:0 | App |
-| src/test/java/com/example/AppTest.java:0:0:0:0 | AppTest |
+| src/main/resources/my-app.properties:0:0:0:0 | src/main/resources/my-app.properties |
+| test-db/log/ext/javac.properties:0:0:0:0 | test-db/log/ext/javac.properties |
--- a/java/ql/integration-tests/all-platforms/java/maven-sample/test.expected
+++ b/java/ql/integration-tests/all-platforms/java/maven-sample/test.expected
@@ -1,3 +1,6 @@
+#select
+| src/main/java/com/example/App.java:0:0:0:0 | App |
+| src/test/java/com/example/AppTest.java:0:0:0:0 | AppTest |
 xmlFiles
 | pom.xml:0:0:0:0 | pom.xml |
 | src/main/resources/page.xml:0:0:0:0 | src/main/resources/page.xml |
@@ -5,6 +8,8 @@ xmlFiles
 | target/classes/page.xml:0:0:0:0 | target/classes/page.xml |
 | target/classes/struts.xml:0:0:0:0 | target/classes/struts.xml |
 propertiesFiles
-#select
-| src/main/java/com/example/App.java:0:0:0:0 | App |
-| src/test/java/com/example/AppTest.java:0:0:0:0 | AppTest |
+| src/main/resources/my-app.properties:0:0:0:0 | src/main/resources/my-app.properties |
+| target/classes/my-app.properties:0:0:0:0 | target/classes/my-app.properties |
+| target/maven-archiver/pom.properties:0:0:0:0 | target/maven-archiver/pom.properties |
+| test-db/log/ext/javac-1.properties:0:0:0:0 | test-db/log/ext/javac-1.properties |
+| test-db/log/ext/javac.properties:0:0:0:0 | test-db/log/ext/javac.properties |
--- a/java/ql/lib/change-notes/2023-11-29-new-spring-models.md
+++ b/java/ql/lib/change-notes/2023-11-29-new-spring-models.md
@@ -0,0 +1,5 @@
+---
+category: minorAnalysis
+---
+* Added a sink model for the `createRelative` method of the `org.springframework.core.io.Resource` interface.
+* Added source models for methods of the `org.springframework.web.util.UrlPathHelper` class and removed their taint flow models.
--- a/java/ql/lib/ext/org.springframework.core.io.model.yml
+++ b/java/ql/lib/ext/org.springframework.core.io.model.yml
@@ -3,5 +3,6 @@ extensions:
      pack: codeql/java-all
      extensible: sinkModel
    data:
+      - ["org.springframework.core.io", "Resource", True, "createRelative", "(String)", "", "Argument[0]", "path-injection", "manual"]
      - ["org.springframework.core.io", "ResourceLoader", True, "getResource", "(String)", "", "Argument[0]", "path-injection", "ai-manual"]
      - ["org.springframework.core.io", "ResourceLoader", True, "getResource", "(String)", "", "Argument[0]", "request-forgery", "manual"]
--- a/java/ql/lib/ext/org.springframework.web.util.model.yml
+++ b/java/ql/lib/ext/org.springframework.web.util.model.yml
@@ -1,4 +1,18 @@
 extensions:
+  - addsTo:
+      pack: codeql/java-all
+      extensible: sourceModel
+    data:
+      - ["org.springframework.web.util", "UrlPathHelper", False, "getLookupPathForRequest", "", "", "ReturnValue", "remote", "manual"]
+      - ["org.springframework.web.util", "UrlPathHelper", False, "getOriginatingQueryString", "", "", "ReturnValue", "remote", "manual"]
+      - ["org.springframework.web.util", "UrlPathHelper", False, "getOriginatingRequestUri", "", "", "ReturnValue", "remote", "manual"]
+      - ["org.springframework.web.util", "UrlPathHelper", False, "getPathWithinApplication", "", "", "ReturnValue", "remote", "manual"]
+      - ["org.springframework.web.util", "UrlPathHelper", False, "getPathWithinServletMapping", "", "", "ReturnValue", "remote", "manual"]
+      - ["org.springframework.web.util", "UrlPathHelper", False, "getRequestUri", "", "", "ReturnValue", "remote", "manual"]
+      - ["org.springframework.web.util", "UrlPathHelper", False, "getResolvedLookupPath", "", "", "ReturnValue", "remote", "manual"]
+      - ["org.springframework.web.util", "UrlPathHelper", False, "getServletPath", "", "", "ReturnValue", "remote", "manual"]
+      - ["org.springframework.web.util", "UrlPathHelper", False, "resolveAndCacheLookupPath", "", "", "ReturnValue", "remote", "manual"]
+
  - addsTo:
      pack: codeql/java-all
      extensible: summaryModel
@@ -147,15 +161,7 @@ extensions:
      - ["org.springframework.web.util", "UrlPathHelper", False, "decodeRequestString", "", "", "Argument[1]", "ReturnValue", "taint", "manual"]
      - ["org.springframework.web.util", "UrlPathHelper", False, "getContextPath", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
      - ["org.springframework.web.util", "UrlPathHelper", False, "getOriginatingContextPath", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
-      - ["org.springframework.web.util", "UrlPathHelper", False, "getOriginatingQueryString", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
-      - ["org.springframework.web.util", "UrlPathHelper", False, "getOriginatingRequestUri", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
-      - ["org.springframework.web.util", "UrlPathHelper", False, "getPathWithinApplication", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
-      - ["org.springframework.web.util", "UrlPathHelper", False, "getPathWithinServletMapping", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
-      - ["org.springframework.web.util", "UrlPathHelper", False, "getRequestUri", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
-      - ["org.springframework.web.util", "UrlPathHelper", False, "getResolvedLookupPath", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
-      - ["org.springframework.web.util", "UrlPathHelper", False, "getServletPath", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
      - ["org.springframework.web.util", "UrlPathHelper", False, "removeSemicolonContent", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
-      - ["org.springframework.web.util", "UrlPathHelper", False, "resolveAndCacheLookupPath", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
      - ["org.springframework.web.util", "WebUtils", False, "findParameterValue", "(Map,String)", "", "Argument[0].MapValue", "ReturnValue", "value", "manual"]
      - ["org.springframework.web.util", "WebUtils", False, "findParameterValue", "(ServletRequest,String)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
      - ["org.springframework.web.util", "WebUtils", False, "getCookie", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
--- a/java/ql/test/library-tests/frameworks/spring/webutil/Test.java
+++ b/java/ql/test/library-tests/frameworks/spring/webutil/Test.java
@@ -2396,45 +2396,6 @@ public class Test {
 			out = instance.getOriginatingContextPath(in);
 			sink(out); // $hasTaintFlow
 		}
-		{
-			// "org.springframework.web.util;UrlPathHelper;false;getOriginatingQueryString;;;Argument[0];ReturnValue;taint;manual"
-			String out = null;
-			HttpServletRequest in = (HttpServletRequest)source();
-			UrlPathHelper instance = null;
-			out = instance.getOriginatingQueryString(in);
-			sink(out); // $hasTaintFlow
-		}
-		{
-			// "org.springframework.web.util;UrlPathHelper;false;getOriginatingRequestUri;;;Argument[0];ReturnValue;taint;manual"
-			String out = null;
-			HttpServletRequest in = (HttpServletRequest)source();
-			UrlPathHelper instance = null;
-			out = instance.getOriginatingRequestUri(in);
-			sink(out); // $hasTaintFlow
-		}
-		{
-			// "org.springframework.web.util;UrlPathHelper;false;getRequestUri;;;Argument[0];ReturnValue;taint;manual"
-			String out = null;
-			HttpServletRequest in = (HttpServletRequest)source();
-			UrlPathHelper instance = null;
-			out = instance.getRequestUri(in);
-			sink(out); // $hasTaintFlow
-		}
-		{
-			// "org.springframework.web.util;UrlPathHelper;false;getResolvedLookupPath;;;Argument[0];ReturnValue;taint;manual"
-			String out = null;
-			ServletRequest in = (ServletRequest)source();
-			out = UrlPathHelper.getResolvedLookupPath(in);
-			sink(out); // $hasTaintFlow
-		}
-		{
-			// "org.springframework.web.util;UrlPathHelper;false;getServletPath;;;Argument[0];ReturnValue;taint;manual"
-			String out = null;
-			HttpServletRequest in = (HttpServletRequest)source();
-			UrlPathHelper instance = null;
-			out = instance.getServletPath(in);
-			sink(out); // $hasTaintFlow
-		}
 		{
 			// "org.springframework.web.util;UrlPathHelper;false;removeSemicolonContent;;;Argument[0];ReturnValue;taint;manual"
 			String out = null;
@@ -2443,14 +2404,6 @@ public class Test {
 			out = instance.removeSemicolonContent(in);
 			sink(out); // $hasTaintFlow
 		}
-		{
-			// "org.springframework.web.util;UrlPathHelper;false;resolveAndCacheLookupPath;;;Argument[0];ReturnValue;taint;manual"
-			String out = null;
-			HttpServletRequest in = (HttpServletRequest)source();
-			UrlPathHelper instance = null;
-			out = instance.resolveAndCacheLookupPath(in);
-			sink(out); // $hasTaintFlow
-		}
 		{
 			// "org.springframework.web.util;WebUtils;false;findParameterValue;(Map,String);;MapValue of Argument[0];ReturnValue;value;manual"
 			String out = null;
@@ -2605,22 +2558,6 @@ public class Test {
 			out = in.toString();
 			sink(out); // $ hasTaintFlow
 		}
-		{
-			// "org.springframework.web.util;UrlPathHelper;false;getPathWithinApplication;;;Argument[0];ReturnValue;taint;manual"
-			String out = null;
-			HttpServletRequest in = (HttpServletRequest)source();
-			UrlPathHelper instance = null;
-			out = instance.getPathWithinApplication(in);
-			sink(out); // $ hasTaintFlow
-		}
-		{
-			// "org.springframework.web.util;UrlPathHelper;false;getPathWithinServletMapping;;;Argument[0];ReturnValue;taint;manual"
-			String out = null;
-			HttpServletRequest in = (HttpServletRequest)source();
-			UrlPathHelper instance = null;
-			out = instance.getPathWithinServletMapping(in);
-			sink(out); // $ hasTaintFlow
-		}
 		{
 			// "org.springframework.web.util;WebUtils;false;setSessionAttribute;;;Argument[2];Argument[0];taint;manual"
 			HttpServletRequest out = null;
Author	SHA1	Message	Date
Ed Minnix	ef746adbf9	Add properties file references	2023-12-04 13:00:55 -05:00
Mathias Vorreiter Pedersen	6dd941ee20	Merge pull request #14996 from jketema/toctou-test C++: Fix `chmod` prototype in toctou test and additional test	2023-12-04 17:42:52 +00:00
Owen Mansel-Chan	570538b4ec	Merge pull request #14938 from owen-mc/go/improve-test-unhandled-close-writable-handle Go: improve test unhandled close writable handle	2023-12-04 16:56:09 +00:00
Jeroen Ketema	7f1bd499ce	C++: Add test annotation	2023-12-04 17:53:08 +01:00
Jami	651653998c	Merge pull request #14913 from jcogs33/jcogs33/unsafe-url-forward_path-inj-related_cve-2019-3799 Java: add Spring models	2023-12-04 10:18:50 -05:00
Jeroen Ketema	3e2397a3d1	C++: Fix `chmod` prototype in toctou test and additional test	2023-12-04 16:15:44 +01:00
Owen Mansel-Chan	e958a75223	Add comments indicating whether results are expected at new calls	2023-11-30 11:48:10 +00:00
Jami Cogswell	7e869b9cd1	Java: add change note	2023-11-29 16:48:57 -05:00
Jami Cogswell	d5fd2db1bd	Java update UrlPathHelper tests	2023-11-29 15:23:11 -05:00
Jami Cogswell	ba3548b317	Java: switch to createRelative sink and add UrlPathHelper sources	2023-11-29 14:46:28 -05:00
Jami Cogswell	efa5ab18c1	Java: add taint steps for getResource sink	2023-11-29 14:46:27 -05:00
Owen Mansel-Chan	de87dd5dee	Test no result if deferred function returns error	2023-11-28 14:23:37 +00:00
Owen Mansel-Chan	57dafd3732	Improve test for UnhandledCloseWritableHandle Now the different paths won't have the same two sources.	2023-11-28 14:21:43 +00:00