From a8889ff0569096e7ed5ae0f49f87cc5d44528ae4 Mon Sep 17 00:00:00 2001 From: Sid Gawri Date: Thu, 14 Aug 2025 16:10:49 -0400 Subject: [PATCH 1/2] add extensions for remote sources --- java/ql/lib/ext/jakarta.servlet.http.model.yml | 12 ++++++++++++ java/ql/lib/ext/jakarta.servlet.model.yml | 10 ++++++++++ 2 files changed, 22 insertions(+) diff --git a/java/ql/lib/ext/jakarta.servlet.http.model.yml b/java/ql/lib/ext/jakarta.servlet.http.model.yml index 5a83b1ac08d8..fabbe4a3eb0e 100644 --- a/java/ql/lib/ext/jakarta.servlet.http.model.yml +++ b/java/ql/lib/ext/jakarta.servlet.http.model.yml @@ -4,3 +4,15 @@ extensions: extensible: sourceModel data: - ["jakarta.servlet.http", "HttpServletRequest", True, "getServletPath", "", "", "ReturnValue", "remote", "manual"] + - ["jakarta.servlet.http", "HttpServletRequest", False, "getHeader", "(String)", "", "ReturnValue", "remote", "manual"] + - ["jakarta.servlet.http", "HttpServletRequest", False, "getHeaderNames", "()", "", "ReturnValue", "remote", "manual"] + - ["jakarta.servlet.http", "HttpServletRequest", False, "getHeaders", "(String)", "", "ReturnValue", "remote", "manual"] + - ["jakarta.servlet.http", "HttpServletRequest", False, "getParameter", "(String)", "", "ReturnValue", "remote", "manual"] + - ["jakarta.servlet.http", "HttpServletRequest", False, "getParameterMap", "()", "", "ReturnValue", "remote", "manual"] + - ["jakarta.servlet.http", "HttpServletRequest", False, "getParameterNames", "()", "", "ReturnValue", "remote", "manual"] + - ["jakarta.servlet.http", "HttpServletRequest", False, "getParameterValues", "(String)", "", "ReturnValue", "remote", "manual"] + - ["jakarta.servlet.http", "HttpServletRequest", False, "getPathInfo", "()", "", "ReturnValue", "remote", "manual"] + - ["jakarta.servlet.http", "HttpServletRequest", False, "getQueryString", "()", "", "ReturnValue", "remote", "manual"] + - ["jakarta.servlet.http", "HttpServletRequest", False, "getRemoteUser", "()", "", "ReturnValue", "remote", "manual"] + - ["jakarta.servlet.http", "HttpServletRequest", False, "getRequestURI", "()", "", "ReturnValue", "remote", "manual"] + - ["jakarta.servlet.http", "HttpServletRequest", False, "getRequestURL", "()", "", "ReturnValue", "remote", "manual"] diff --git a/java/ql/lib/ext/jakarta.servlet.model.yml b/java/ql/lib/ext/jakarta.servlet.model.yml index be2feeb3c375..ad1a38bb4bfe 100644 --- a/java/ql/lib/ext/jakarta.servlet.model.yml +++ b/java/ql/lib/ext/jakarta.servlet.model.yml @@ -1,4 +1,14 @@ extensions: + - addsTo: + pack: codeql/java-all + extensible: sourceModel + data: + - ["jakarta.servlet", "ServletRequest", False, "getInputStream", "()", "", "ReturnValue", "remote", "manual"] + - ["jakarta.servlet", "ServletRequest", False, "getParameter", "(String)", "", "ReturnValue", "remote", "manual"] + - ["jakarta.servlet", "ServletRequest", False, "getParameterMap", "()", "", "ReturnValue", "remote", "manual"] + - ["jakarta.servlet", "ServletRequest", False, "getParameterNames", "()", "", "ReturnValue", "remote", "manual"] + - ["jakarta.servlet", "ServletRequest", False, "getParameterValues", "(String)", "", "ReturnValue", "remote", "manual"] + - ["jakarta.servlet", "ServletRequest", False, "getReader", "()", "", "ReturnValue", "remote", "manual"] - addsTo: pack: codeql/java-all extensible: sinkModel From d84e5319c31c203d2b03b0ca96a57f72d863b532 Mon Sep 17 00:00:00 2001 From: Sid Gawri Date: Fri, 15 Aug 2025 15:59:05 -0400 Subject: [PATCH 2/2] changenote --- .../ql/lib/change-notes/2025-08-15-lib-models-remotesource.md | 4 ++++ 1 file changed, 4 insertions(+) create mode 100644 java/ql/lib/change-notes/2025-08-15-lib-models-remotesource.md diff --git a/java/ql/lib/change-notes/2025-08-15-lib-models-remotesource.md b/java/ql/lib/change-notes/2025-08-15-lib-models-remotesource.md new file mode 100644 index 000000000000..3cb81f840197 --- /dev/null +++ b/java/ql/lib/change-notes/2025-08-15-lib-models-remotesource.md @@ -0,0 +1,4 @@ +--- +category: majorAnalysis +--- +* Added library models for the relevant method calls under `jakarta.servlet.ServletRequest` and `jakarta.servlet.http.HttpServletRequest` as remote flow sources.