Java: Convert ServletRequestGetBodyMethod to CSV based flow source

tamasvajk · tamasvajk · commit 86cf1430292e · 2021-03-09T11:41:32.000+01:00
diff --git a/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll b/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll
@@ -128,8 +128,11 @@ private predicate sourceModelCsv(string row) {
       "org.springframework.web.context.request;WebRequest;false;getParameter;;;ReturnValue;remote",
       "org.springframework.web.context.request;WebRequest;false;getParameterMap;;;ReturnValue;remote",
       "org.springframework.web.context.request;WebRequest;false;getParameterNames;;;ReturnValue;remote",
-      "org.springframework.web.context.request;WebRequest;false;getParameterValues;;;ReturnValue;remote"
+      "org.springframework.web.context.request;WebRequest;false;getParameterValues;;;ReturnValue;remote",
       // TODO consider org.springframework.web.context.request.WebRequest.getRemoteUser
+      // ServletRequestGetBodyMethod
+      "javax.servlet;ServletRequest;false;getInputStream;();;ReturnValue;remote",
+      "javax.servlet;ServletRequest;false;getReader;();;ReturnValue;remote"
     ]
 }
 
diff --git a/java/ql/src/semmle/code/java/dataflow/FlowSources.qll b/java/ql/src/semmle/code/java/dataflow/FlowSources.qll
@@ -216,7 +216,6 @@ private class RemoteTaintedMethod extends Method {
   RemoteTaintedMethod() {
     this instanceof PlayRequestGetMethod or
     this instanceof SpringRestTemplateResponseEntityMethod or
-    this instanceof ServletRequestGetBodyMethod or
     this instanceof CookieGetValueMethod or
     this instanceof CookieGetNameMethod or
     this instanceof CookieGetCommentMethod or

Original file line number	Diff line number	Diff line change
`@@ -128,8 +128,11 @@ private predicate sourceModelCsv(string row) {`
`128`	`128`	`"org.springframework.web.context.request;WebRequest;false;getParameter;;;ReturnValue;remote",`
`129`	`129`	`"org.springframework.web.context.request;WebRequest;false;getParameterMap;;;ReturnValue;remote",`
`130`	`130`	`"org.springframework.web.context.request;WebRequest;false;getParameterNames;;;ReturnValue;remote",`
`131`		`- "org.springframework.web.context.request;WebRequest;false;getParameterValues;;;ReturnValue;remote"`
	`131`	`+ "org.springframework.web.context.request;WebRequest;false;getParameterValues;;;ReturnValue;remote",`
`132`	`132`	`// TODO consider org.springframework.web.context.request.WebRequest.getRemoteUser`
	`133`	`+ // ServletRequestGetBodyMethod`
	`134`	`+ "javax.servlet;ServletRequest;false;getInputStream;();;ReturnValue;remote",`
	`135`	`+ "javax.servlet;ServletRequest;false;getReader;();;ReturnValue;remote"`
`133`	`136`	`]`
`134`	`137`	`}`
`135`	`138`