Java: update set-hostname-verifier sink kind to hostname-verification

Jami Cogswell · Jami Cogswell · commit 51df84ed1cdc · 2023-05-31T15:49:07.000-04:00
diff --git a/java/ql/lib/ext/javax.net.ssl.model.yml b/java/ql/lib/ext/javax.net.ssl.model.yml
@@ -3,5 +3,5 @@ extensions:
       pack: codeql/java-all
       extensible: sinkModel
     data:
-      - ["javax.net.ssl", "HttpsURLConnection", True, "setDefaultHostnameVerifier", "", "", "Argument[0]", "set-hostname-verifier", "manual"]
-      - ["javax.net.ssl", "HttpsURLConnection", True, "setHostnameVerifier", "", "", "Argument[0]", "set-hostname-verifier", "manual"]
+      - ["javax.net.ssl", "HttpsURLConnection", True, "setDefaultHostnameVerifier", "", "", "Argument[0]", "hostname-verification", "manual"]
+      - ["javax.net.ssl", "HttpsURLConnection", True, "setHostnameVerifier", "", "", "Argument[0]", "hostname-verification", "manual"]
diff --git a/java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll b/java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll
@@ -277,7 +277,7 @@ module ModelValidation {
           "open-url", "jndi-injection", "ldap-injection", "sql-injection", "jdbc-url",
           "log-injection", "mvel-injection", "xpath-injection", "groovy-injection", "xss",
           "ognl-injection", "intent-redirection", "pending-intents", "url-redirection",
-          "create-file", "read-file", "write-file", "set-hostname-verifier", "header-splitting",
+          "create-file", "read-file", "write-file", "hostname-verification", "header-splitting",
           "information-leak", "xslt-injection", "jexl-injection", "bean-validation",
           "template-injection", "fragment-injection", "command-injection"
         ] and
diff --git a/java/ql/lib/semmle/code/java/security/UnsafeHostnameVerificationQuery.qll b/java/ql/lib/semmle/code/java/security/UnsafeHostnameVerificationQuery.qll
@@ -74,7 +74,7 @@ module TrustAllHostnameVerifierFlow = DataFlow::Global<TrustAllHostnameVerifierC
  * A sink that sets the `HostnameVerifier` on `HttpsURLConnection`.
  */
 private class HostnameVerifierSink extends DataFlow::Node {
-  HostnameVerifierSink() { sinkNode(this, "set-hostname-verifier") }
+  HostnameVerifierSink() { sinkNode(this, "hostname-verification") }
 }
 
 /**

Original file line number	Diff line number	Diff line change
`@@ -74,7 +74,7 @@ module TrustAllHostnameVerifierFlow = DataFlow::Global<TrustAllHostnameVerifierC`
`74`	`74`	* A sink that sets the `HostnameVerifier` on `HttpsURLConnection`.
`75`	`75`	`*/`
`76`	`76`	`private class HostnameVerifierSink extends DataFlow::Node {`
`77`		`- HostnameVerifierSink() { sinkNode(this, "set-hostname-verifier") }`
	`77`	`+ HostnameVerifierSink() { sinkNode(this, "hostname-verification") }`
`78`	`78`	`}`
`79`	`79`
`80`	`80`	`/**`