Add failing test for @pattern validation

Author: owen-mc

java/ql/test/query-tests/security/CWE-918/RequestForgery.expected

@@ -2,8 +2,9 @@
 import java.net.URI;
 import java.net.http.HttpClient;
 import java.net.http.HttpRequest;
-import java.util.regex.Pattern;
 import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+import java.util.List;
 
 import javax.servlet.ServletException;
 import javax.servlet.http.HttpServlet;
@@ -147,6 +148,32 @@ protected void doGet(HttpServletRequest request, HttpServletResponse response)
                 HttpRequest r13 = HttpRequest.newBuilder(new URI(param13)).build();
                 client.send(r13, null);
             }
+
+            // GOOD: sanitisation by @Pattern annotation on a field
+            AnnotatedFieldObject obj14 = new AnnotatedFieldObject(request.getParameter("uri14"));
+            HttpRequest r14a = HttpRequest.newBuilder(new URI(obj14.uri)).build();
+            client.send(r14a, null);
+            HttpRequest r14b = HttpRequest.newBuilder(new URI(obj14.getUri())).build();
+            client.send(r14b, null);
+
+            // GOOD: sanitisation by @Pattern annotation on a parameter of a constructor
+            AnnotatedParameterObject obj15 = new AnnotatedParameterObject(request.getParameter("uri15"));
+            HttpRequest r15a = HttpRequest.newBuilder(new URI(obj15.uri)).build();
+            client.send(r15a, null);
+            HttpRequest r15b = HttpRequest.newBuilder(new URI(obj15.getUri())).build();
+            client.send(r15b, null);
+
+            // GOOD: sanitisation by @Pattern annotation on a parameter of a method
+            HttpRequest r16 = HttpRequest.newBuilder(new URI(identity1(request.getParameter("uri16")))).build();
+            client.send(r16, null);
+
+            // GOOD: sanitisation by @Pattern annotation on a method (which constrains the return value)
+            HttpRequest r17 = HttpRequest.newBuilder(new URI(identity2(request.getParameter("uri17")))).build();
+            client.send(r17, null);
+
+            // GOOD: sanitisation by @Pattern annotation on a type (we do not recognise this, so we get an FP)
+            HttpRequest r18 = HttpRequest.newBuilder(new URI(getFromList(List.of(request.getParameter("uri18"))))).build(); // $ SPURIOUS: Source Alert
+            client.send(r18, null); // $ SPURIOUS: Alert
         } catch (Exception e) {
             // TODO: handle exception
         }
@@ -157,4 +184,44 @@ private void validate(String s) {
             throw new IllegalArgumentException("Invalid ID");
         }
     }
+
+    public String identity1(@javax.validation.constraints.Pattern(regexp = "[a-zA-Z0-9_-]+") String uri) {
+        return uri;
+    }
+
+    @javax.validation.constraints.Pattern(regexp = "[a-zA-Z0-9_-]+")
+    public String identity2(String uri) {
+        return uri;
+    }
+
+    public String getFromList(List<@javax.validation.constraints.Pattern(regexp = "[a-zA-Z0-9_-]+") String> list) {
+        return list.get(0);
+    }
+
+    public class AnnotatedFieldObject {
+        @javax.validation.constraints.Pattern(regexp = "[a-zA-Z0-9_-]+")
+        String uri;
+
+        String otherField;
+
+        public AnnotatedFieldObject(String uri) {
+            this.uri = uri;
+        }
+
+        public String getUri() {
+            return uri;
+        }
+    }
+
+    public class AnnotatedParameterObject {
+        String uri;
+
+        public AnnotatedParameterObject(@javax.validation.constraints.Pattern(regexp = "[a-zA-Z0-9_-]+") String uri) {
+            this.uri = uri;
+        }
+
+        public String getUri() {
+            return uri;
+        }
+    }
 }

java/ql/test/query-tests/security/CWE-918/SanitizationTests.java

@@ -1 +1 @@
-//semmle-extractor-options: --javac-args -source 11 -target 11 -cp ${testdir}/../../../stubs/springframework-5.8.x:${testdir}/../../../stubs/javax-ws-rs-api-2.1.1:${testdir}/../../../stubs/javax-ws-rs-api-3.0.0:${testdir}/../../../stubs/apache-http-4.4.13/:${testdir}/../../../stubs/projectreactor-3.4.3/:${testdir}/../../../stubs/postgresql-42.3.3/:${testdir}/../../../stubs/HikariCP-3.4.5/:${testdir}/../../../stubs/spring-jdbc-5.3.8/:${testdir}/../../../stubs/jdbi3-core-3.27.2/:${testdir}/../../../stubs/cargo:${testdir}/../../../stubs/javafx-web:${testdir}/../../../stubs/apache-commons-jelly-1.0.1:${testdir}/../../../stubs/dom4j-2.1.1:${testdir}/../../../stubs/jaxen-1.2.0:${testdir}/../../../stubs/stapler-1.263:${testdir}/../../../stubs/javax-servlet-2.5:${testdir}/../../../stubs/apache-commons-fileupload-1.4:${testdir}/../../../stubs/saxon-xqj-9.x:${testdir}/../../../stubs/apache-commons-beanutils:${testdir}/../../../stubs/apache-commons-lang:${testdir}/../../../stubs/apache-http-5:${testdir}/../../../stubs/playframework-2.6.x:${testdir}/../../../stubs/jaxws-api-2.0:${testdir}/../../../stubs/apache-cxf
+//semmle-extractor-options: --javac-args -source 11 -target 11 -cp ${testdir}/../../../stubs/javax-validation-constraints:${testdir}/../../../stubs/springframework-5.8.x:${testdir}/../../../stubs/javax-ws-rs-api-2.1.1:${testdir}/../../../stubs/javax-ws-rs-api-3.0.0:${testdir}/../../../stubs/apache-http-4.4.13/:${testdir}/../../../stubs/projectreactor-3.4.3/:${testdir}/../../../stubs/postgresql-42.3.3/:${testdir}/../../../stubs/HikariCP-3.4.5/:${testdir}/../../../stubs/spring-jdbc-5.3.8/:${testdir}/../../../stubs/jdbi3-core-3.27.2/:${testdir}/../../../stubs/cargo:${testdir}/../../../stubs/javafx-web:${testdir}/../../../stubs/apache-commons-jelly-1.0.1:${testdir}/../../../stubs/dom4j-2.1.1:${testdir}/../../../stubs/jaxen-1.2.0:${testdir}/../../../stubs/stapler-1.263:${testdir}/../../../stubs/javax-servlet-2.5:${testdir}/../../../stubs/apache-commons-fileupload-1.4:${testdir}/../../../stubs/saxon-xqj-9.x:${testdir}/../../../stubs/apache-commons-beanutils:${testdir}/../../../stubs/apache-commons-lang:${testdir}/../../../stubs/apache-http-5:${testdir}/../../../stubs/playframework-2.6.x:${testdir}/../../../stubs/jaxws-api-2.0:${testdir}/../../../stubs/apache-cxf

java/ql/test/query-tests/security/CWE-918/options

@@ -0,0 +1,13 @@
+<project>
+  <modelVersion>4.0.0</modelVersion>
+  <groupId>com.example</groupId>
+  <artifactId>stub-generation</artifactId>
+  <version>1.0-SNAPSHOT</version>
+  <dependencies>
+    <dependency>
+      <groupId>javax.validation</groupId>
+      <artifactId>validation-api</artifactId>
+      <version>2.0.1.Final</version>
+    </dependency>
+  </dependencies>
+</project>