Fix RequestResponseFlowConfig.isSink error

haby0 · haby0 · commit 37dae67a0d57 · 2021-04-14T09:55:24.000+08:00
diff --git a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.ql b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.ql
@@ -52,7 +52,7 @@ class RequestResponseFlowConfig extends TaintTracking::Configuration {
 
   override predicate isSink(DataFlow::Node sink) {
     sink instanceof XssSink and
-    any(RequestGetMethod m).polyCalls*(source.getEnclosingCallable())
+    any(RequestGetMethod m).polyCalls*(sink.getEnclosingCallable())
   }
 
   override predicate isAdditionalTaintStep(DataFlow::Node pred, DataFlow::Node succ) {
diff --git a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
@@ -77,10 +77,13 @@ class SpringControllerRequestMappingGetMethod extends SpringControllerGetMethod
     this.getAnAnnotation()
         .getType()
         .hasQualifiedName("org.springframework.web.bind.annotation", "RequestMapping") and
-    this.getAnAnnotation().getValue("method").toString().regexpMatch("RequestMethod.GET|\\{...\\}") and
+    (
+      this.getAnAnnotation().getValue("method").(VarAccess).getVariable().getName() = "GET" or
+      this.getAnAnnotation().getValue("method").(ArrayInit).getSize() = 0 //Java code example: @RequestMapping(value = "test")
+    ) and
     not exists(MethodAccess ma |
       ma.getMethod() instanceof ServletRequestGetBodyMethod and
-      this = getACallingCallableOrSelf(ma.getEnclosingCallable())
+      any(this).polyCalls*(ma.getEnclosingCallable())
     ) and
     not this.getAParamType().getName() = "MultipartFile"
   }

Original file line number	Diff line number	Diff line change
`@@ -52,7 +52,7 @@ class RequestResponseFlowConfig extends TaintTracking::Configuration {`
`52`	`52`
`53`	`53`	`override predicate isSink(DataFlow::Node sink) {`
`54`	`54`	`sink instanceof XssSink and`
`55`		`- any(RequestGetMethod m).polyCalls*(source.getEnclosingCallable())`
	`55`	`+ any(RequestGetMethod m).polyCalls*(sink.getEnclosingCallable())`
`56`	`56`	`}`
`57`	`57`
`58`	`58`	`override predicate isAdditionalTaintStep(DataFlow::Node pred, DataFlow::Node succ) {`