Java: Convert SpringMultipartRequestSource to CSV based flow source

tamasvajk · tamasvajk · commit 80b4d63d4b14 · 2021-03-09T11:39:47.000+01:00
diff --git a/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll b/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll
@@ -95,7 +95,14 @@ private predicate sourceModelCsv(string row) {
       // SocketGetInputStreamMethod
       "java.net;Socket;false;getInputStream;();;ReturnValue;remote",
       // BeanValidationSource
-      "javax.validation;ConstraintValidator;true;isValid;;;Parameter[0];remote"
+      "javax.validation;ConstraintValidator;true;isValid;;;Parameter[0];remote",
+      // SpringMultipartRequestSource
+      "org.springframework.web.multipart;MultipartRequest;true;getFile;(String);;ReturnValue;remote",
+      "org.springframework.web.multipart;MultipartRequest;true;getFileMap;();;ReturnValue;remote",
+      "org.springframework.web.multipart;MultipartRequest;true;getFileNames;();;ReturnValue;remote",
+      "org.springframework.web.multipart;MultipartRequest;true;getFiles;(String);;ReturnValue;remote",
+      "org.springframework.web.multipart;MultipartRequest;true;getMultiFileMap;();;ReturnValue;remote",
+      "org.springframework.web.multipart;MultipartRequest;true;getMultipartContentType;(String);;ReturnValue;remote"
     ]
 }
 
diff --git a/java/ql/src/semmle/code/java/dataflow/FlowSources.qll b/java/ql/src/semmle/code/java/dataflow/FlowSources.qll
@@ -115,21 +115,6 @@ private class MessageBodyReaderParameterSource extends RemoteFlowSource {
   override string getSourceType() { result = "MessageBodyReader parameter" }
 }
 
-private class SpringMultipartRequestSource extends RemoteFlowSource {
-  SpringMultipartRequestSource() {
-    exists(MethodAccess ma, Method m |
-      ma = this.asExpr() and
-      m = ma.getMethod() and
-      m.getDeclaringType()
-          .getASourceSupertype*()
-          .hasQualifiedName("org.springframework.web.multipart", "MultipartRequest") and
-      m.getName().matches("get%")
-    )
-  }
-
-  override string getSourceType() { result = "Spring MultipartRequest getter" }
-}
-
 private class PlayParameterSource extends RemoteFlowSource {
   PlayParameterSource() { exists(PlayActionMethodQueryParameter p | p = this.asParameter()) }
 
