codeql/java/ql/test/experimental/query-tests/security/CWE-502/SpringExporterUnsafeDeserialization.java

import org.springframework.boot.SpringBootConfiguration;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.remoting.caucho.HessianServiceExporter;
import org.springframework.remoting.httpinvoker.HttpInvokerServiceExporter;
import org.springframework.remoting.rmi.RemoteInvocationSerializingExporter;
import org.springframework.remoting.rmi.RmiServiceExporter;

@Configuration
public class SpringExporterUnsafeDeserialization {

    @Bean(name = "/unsafeRmiServiceExporter")
    RmiServiceExporter unsafeRmiServiceExporter() {
        RmiServiceExporter exporter = new RmiServiceExporter();
        exporter.setServiceInterface(AccountService.class);
        exporter.setService(new AccountServiceImpl());
        exporter.setServiceName(AccountService.class.getSimpleName());
        exporter.setRegistryPort(1099); 
        return exporter;
    }

    @Bean(name = "/unsafeHessianServiceExporter")
    HessianServiceExporter unsafeHessianServiceExporter() {
        HessianServiceExporter exporter = new HessianServiceExporter();
        exporter.setService(new AccountServiceImpl());
        exporter.setServiceInterface(AccountService.class);
        return exporter;
    }

    @Bean(name = "/unsafeHttpInvokerServiceExporter")
    HttpInvokerServiceExporter unsafeHttpInvokerServiceExporter() {
        HttpInvokerServiceExporter exporter = new HttpInvokerServiceExporter();
        exporter.setService(new AccountServiceImpl());
        exporter.setServiceInterface(AccountService.class);
        return exporter;
    }

    @Bean(name = "/unsafeCustomeRemoteInvocationSerializingExporter")
    RemoteInvocationSerializingExporter unsafeCustomeRemoteInvocationSerializingExporter() {
        return new CustomeRemoteInvocationSerializingExporter();
    }

    HttpInvokerServiceExporter notABean() {
        HttpInvokerServiceExporter exporter = new HttpInvokerServiceExporter();
        exporter.setService(new AccountServiceImpl());
        exporter.setServiceInterface(AccountService.class);
        return exporter;
    }
}

@SpringBootApplication
class SpringBootTestApplication {

    @Bean(name = "/unsafeHttpInvokerServiceExporter")
    HttpInvokerServiceExporter unsafeHttpInvokerServiceExporter() {
        HttpInvokerServiceExporter exporter = new HttpInvokerServiceExporter();
        exporter.setService(new AccountServiceImpl());
        exporter.setServiceInterface(AccountService.class);
        return exporter;
    }
}

@SpringBootConfiguration
class SpringBootTestConfiguration {

    @Bean(name = "/unsafeHttpInvokerServiceExporter")
    HttpInvokerServiceExporter unsafeHttpInvokerServiceExporter() {
        HttpInvokerServiceExporter exporter = new HttpInvokerServiceExporter();
        exporter.setService(new AccountServiceImpl());
        exporter.setServiceInterface(AccountService.class);
        return exporter;
    }
}

class CustomeRemoteInvocationSerializingExporter extends RemoteInvocationSerializingExporter {}

class NotAConfiguration {

    @Bean(name = "/notAnEndpoint")
    HttpInvokerServiceExporter notAnEndpoint() {
        HttpInvokerServiceExporter exporter = new HttpInvokerServiceExporter();
        exporter.setService(new AccountServiceImpl());
        exporter.setServiceInterface(AccountService.class);
        return exporter;
    }
}

class AccountServiceImpl implements AccountService {

    @Override
    public String echo(String data) {
        return data;
    }
}

interface AccountService {
    String echo(String data);
}