Java: Convert HttpServletRequest.get* methods to CSV based flow source

tamasvajk · tamasvajk · commit 09bcf878f72f · 2021-03-09T11:40:59.000+01:00
diff --git a/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll b/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll
@@ -111,7 +111,15 @@ private predicate sourceModelCsv(string row) {
       "org.springframework.web.multipart;MultipartFile;true;getOriginalFilename;();;ReturnValue;remote",
       "org.springframework.web.multipart;MultipartFile;true;getResource;();;ReturnValue;remote",
       "org.springframework.web.multipart;MultipartFile;true;getSize;();;ReturnValue;remote",
-      "org.springframework.web.multipart;MultipartFile;true;isEmpty;();;ReturnValue;remote"
+      "org.springframework.web.multipart;MultipartFile;true;isEmpty;();;ReturnValue;remote",
+      // HttpServletRequest.get*
+      "javax.servlet.http;HttpServletRequest;false;getHeader;(String);;ReturnValue;remote",
+      "javax.servlet.http;HttpServletRequest;false;getHeaders;(String);;ReturnValue;remote",
+      "javax.servlet.http;HttpServletRequest;false;getHeaderNames;();;ReturnValue;remote",
+      "javax.servlet.http;HttpServletRequest;false;getPathInfo;();;ReturnValue;remote",
+      "javax.servlet.http;HttpServletRequest;false;getRequestURI;();;ReturnValue;remote",
+      "javax.servlet.http;HttpServletRequest;false;getRequestURL;();;ReturnValue;remote",
+      "javax.servlet.http;HttpServletRequest;false;getRemoteUser;();;ReturnValue;remote"
     ]
 }
 
diff --git a/java/ql/src/semmle/code/java/dataflow/FlowSources.qll b/java/ql/src/semmle/code/java/dataflow/FlowSources.qll
@@ -214,13 +214,6 @@ class DatabaseInput extends LocalUserInput {
 
 private class RemoteTaintedMethod extends Method {
   RemoteTaintedMethod() {
-    this instanceof HttpServletRequestGetHeaderMethod or
-    this instanceof HttpServletRequestGetPathMethod or
-    this instanceof HttpServletRequestGetHeadersMethod or
-    this instanceof HttpServletRequestGetHeaderNamesMethod or
-    this instanceof HttpServletRequestGetRequestURIMethod or
-    this instanceof HttpServletRequestGetRequestURLMethod or
-    this instanceof HttpServletRequestGetRemoteUserMethod or
     this instanceof PlayRequestGetMethod or
     this instanceof SpringWebRequestGetMethod or
     this instanceof SpringRestTemplateResponseEntityMethod or
