Factor isGetServletMethod into the servlet library

luchua-bc · luchua-bc · commit 496db4b42f66 · 2021-01-04T16:14:13.000Z
diff --git a/java/ql/src/experimental/Security/CWE/CWE-598/SensitiveGetQuery.ql b/java/ql/src/experimental/Security/CWE/CWE-598/SensitiveGetQuery.ql
@@ -23,18 +23,13 @@ class SensitiveInfoExpr extends Expr {
   }
 }
 
-/** GET servlet method of `javax.servlet.http.Servlet` and subtypes. */
-private predicate isGetServletMethod(Callable c) {
-  c.getDeclaringType() instanceof ServletClass and
-  c.getNumberOfParameters() = 2 and
-  c.getParameter(1).getType() instanceof ServletResponse and
-  c.getName() = "doGet"
-}
+/** Holds if `c` is a call to some override of `HttpServlet.doGet`. */
+private predicate isGetServletMethod(Callable c) { isServletMethod(c, "doGet") }
 
 /** Sink of GET servlet requests. */
 class GetServletMethodSink extends DataFlow::ExprNode {
   GetServletMethodSink() {
-    exists(Method m, MethodAccess ma | ma.getMethod() = m |
+    exists(MethodAccess ma |
       isGetServletMethod(ma.getEnclosingCallable()) and
       ma.getAnArgument() = this.getExpr()
     )
diff --git a/java/ql/src/semmle/code/java/frameworks/Servlets.qll b/java/ql/src/semmle/code/java/frameworks/Servlets.qll
@@ -322,3 +322,12 @@ class ServletWebXMLListenerType extends RefType {
     //  - `HttpSessionBindingListener`
   }
 }
+
+/** Holds if `c` is a call to some override of methods of `HttpServlet`, for example `doGet` or `doPost`. */
+predicate isServletMethod(Callable c, string methodName) {
+  c.getDeclaringType() instanceof ServletClass and
+  c.getNumberOfParameters() = 2 and
+  c.getParameter(0).getType() instanceof ServletRequest and
+  c.getParameter(1).getType() instanceof ServletResponse and
+  c.getName() = methodName
+}

Original file line number	Diff line number	Diff line change
`@@ -322,3 +322,12 @@ class ServletWebXMLListenerType extends RefType {`
`322`	`322`	// - `HttpSessionBindingListener`
`323`	`323`	`}`
`324`	`324`	`}`
	`325`	`+`
	`326`	+/** Holds if `c` is a call to some override of methods of `HttpServlet`, for example `doGet` or `doPost`. */
	`327`	`+predicate isServletMethod(Callable c, string methodName) {`
	`328`	`+ c.getDeclaringType() instanceof ServletClass and`
	`329`	`+ c.getNumberOfParameters() = 2 and`
	`330`	`+ c.getParameter(0).getType() instanceof ServletRequest and`
	`331`	`+ c.getParameter(1).getType() instanceof ServletResponse and`
	`332`	`+ c.getName() = methodName`
	`333`	`+}`