Add more servlet methods and fix formatting errors

luchua-bc · luchua-bc · commit 1d0232b4649e · 2020-07-02T03:07:19.000Z
diff --git a/java/ql/src/experimental/Security/CWE/CWE-600/UncaughtServletException.java b/java/ql/src/experimental/Security/CWE/CWE-600/UncaughtServletException.java
@@ -30,9 +30,9 @@ public void doGet(HttpServletRequest request, HttpServletResponse response) thro
     // GOOD
     {
         public void doGet(HttpServletRequest request, HttpServletResponse response) throws IOException, ServletException {
-		    String ip = "10.100.10.81";
+            String ip = "10.100.10.81";
             InetAddress addr = InetAddress.getByName(ip); // OK: Hard-coded variable value or system property is not controlled by attacker.
         }
-	}
+    }
 
 }
diff --git a/java/ql/src/experimental/Security/CWE/CWE-600/UncaughtServletException.qhelp b/java/ql/src/experimental/Security/CWE/CWE-600/UncaughtServletException.qhelp
@@ -4,7 +4,7 @@
 <qhelp>
 <overview>
 <p>
-Even though the signatures for methods in a servlet include throws IOException, ServletException, it's a bad idea to let such exceptions be thrown. Failure to catch exceptions in a servlet could leave a system in a vulnerable state, possibly resulting in denial-of-service attacks, or the exposure of sensitive information because when a servlet throws an exception, the servlet container typically sends debugging information back to the user. And that information could be very valuable to an attacker.
+Even though the signatures for methods in a servlet include `throws IOException, ServletException`, it's a bad idea to let such exceptions be thrown. Failure to catch exceptions in a servlet could leave a system in a vulnerable state, possibly resulting in denial-of-service attacks, or the exposure of sensitive information because when a servlet throws an exception, the servlet container typically sends debugging information back to the user. And that information could be very valuable to an attacker.
 </p>
 </overview>
 
diff --git a/java/ql/src/experimental/Security/CWE/CWE-600/UncaughtServletException.ql b/java/ql/src/experimental/Security/CWE/CWE-600/UncaughtServletException.ql
@@ -36,7 +36,11 @@ private predicate isServletMethod(Callable c) {
     c.getName() = "doGet" or
     c.getName() = "doPost" or
     c.getName() = "doPut" or
-    c.getName() = "doDelete"
+    c.getName() = "doDelete" or
+    c.getName() = "doHead" or
+    c.getName() = "doOptions" or
+    c.getName() = "doTrace" or
+    c.getName() = "service"
   )
 }
 
diff --git a/java/ql/test/experimental/query-tests/security/CWE-600/UncaughtServletException.java b/java/ql/test/experimental/query-tests/security/CWE-600/UncaughtServletException.java
@@ -22,7 +22,8 @@ public void doPost(HttpServletRequest request, HttpServletResponse response) thr
 			InetAddress addr = InetAddress.getByName(ip);
 		} catch (UnknownHostException uhex) {
 			uhex.printStackTrace();
-		}}
+		}
+	}
 
 	public void doPut(HttpServletRequest request, HttpServletResponse response) throws IOException, ServletException {
 		String ip = "10.100.10.81";

Original file line number	Diff line number	Diff line change
`@@ -30,9 +30,9 @@ public void doGet(HttpServletRequest request, HttpServletResponse response) thro`
`30`	`30`	`// GOOD`
`31`	`31`	`{`
`32`	`32`	`public void doGet(HttpServletRequest request, HttpServletResponse response) throws IOException, ServletException {`
`33`		`- String ip = "10.100.10.81";`
	`33`	`+ String ip = "10.100.10.81";`
`34`	`34`	`InetAddress addr = InetAddress.getByName(ip); // OK: Hard-coded variable value or system property is not controlled by attacker.`
`35`	`35`	`}`
`36`		`- }`
	`36`	`+ }`
`37`	`37`
`38`	`38`	`}`
Original file line number	Diff line number	Diff line change
`@@ -36,7 +36,11 @@ private predicate isServletMethod(Callable c) {`
`36`	`36`	`c.getName() = "doGet" or`
`37`	`37`	`c.getName() = "doPost" or`
`38`	`38`	`c.getName() = "doPut" or`
`39`		`- c.getName() = "doDelete"`
	`39`	`+ c.getName() = "doDelete" or`
	`40`	`+ c.getName() = "doHead" or`
	`41`	`+ c.getName() = "doOptions" or`
	`42`	`+ c.getName() = "doTrace" or`
	`43`	`+ c.getName() = "service"`
`40`	`44`	`)`
`41`	`45`	`}`
`42`	`46`