Java: Add CodeQL support and tests for Micronaut framework - #21387
Open
nicolaswill wants to merge 11 commits into
Open
Java: Add CodeQL support and tests for Micronaut framework#21387nicolaswill wants to merge 11 commits into
nicolaswill wants to merge 11 commits into
Conversation
Add CodeQL support for Micronaut: add MaD models for HTTP, HTTP client and multipart (sources, sinks and summary propagation), new framework QLL modules (Controller, WebSocket, Config, Data, Security). Add library tests and query tests exercising request inputs, file uploads, HttpClient sinks (SSRF), header sinks (response-splitting) and redirect sinks (open-redirect), plus expected results and extractor options. Include Micronaut 4.x stubs used by the tests.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Contributor
Click to show differences in coveragejavaGenerated file changes for java
- Others,"``actions.osgi``, ``antlr``, ``ch.ethz.ssh2``, ``cn.hutool.core.codec``, ``com.alibaba.com.caucho.hessian.io``, ``com.alibaba.druid.sql``, ``com.alibaba.fastjson2``, ``com.amazonaws.auth``, ``com.auth0.jwt.algorithms``, ``com.azure.identity``, ``com.caucho.burlap.io``, ``com.caucho.hessian.io``, ``com.cedarsoftware.util.io``, ``com.esotericsoftware.kryo.io``, ``com.esotericsoftware.kryo5.io``, ``com.esotericsoftware.yamlbeans``, ``com.hubspot.jinjava``, ``com.jcraft.jsch``, ``com.microsoft.sqlserver.jdbc``, ``com.mitchellbosecke.pebble``, ``com.opensymphony.xwork2``, ``com.sshtools.j2ssh.authentication``, ``com.sun.crypto.provider``, ``com.sun.jndi.ldap``, ``com.sun.net.httpserver``, ``com.sun.net.ssl``, ``com.sun.rowset``, ``com.sun.security.auth.module``, ``com.sun.security.ntlm``, ``com.sun.security.sasl.digest``, ``com.thoughtworks.xstream``, ``com.trilead.ssh2``, ``com.unboundid.ldap.sdk``, ``com.zaxxer.hikari``, ``flexjson``, ``hudson``, ``io.jsonwebtoken``, ``io.undertow.server.handlers.resource``, ``javafx.scene.web``, ``jenkins``, ``jodd.json``, ``liquibase.database.jvm``, ``liquibase.statement.core``, ``net.lingala.zip4j``, ``net.schmizz.sshj``, ``net.sf.json``, ``net.sf.saxon.s9api``, ``ognl``, ``org.acegisecurity``, ``org.antlr.runtime``, ``org.apache.avro``, ``org.apache.commons.codec``, ``org.apache.commons.compress.archivers.tar``, ``org.apache.commons.exec``, ``org.apache.commons.fileupload``, ``org.apache.commons.httpclient.util``, ``org.apache.commons.jelly``, ``org.apache.commons.jexl2``, ``org.apache.commons.jexl3``, ``org.apache.commons.lang``, ``org.apache.commons.logging``, ``org.apache.commons.net``, ``org.apache.commons.ognl``, ``org.apache.cxf.catalog``, ``org.apache.cxf.common.classloader``, ``org.apache.cxf.common.jaxb``, ``org.apache.cxf.common.logging``, ``org.apache.cxf.configuration.jsse``, ``org.apache.cxf.helpers``, ``org.apache.cxf.resource``, ``org.apache.cxf.staxutils``, ``org.apache.cxf.tools.corba.utils``, ``org.apache.cxf.tools.util``, ``org.apache.cxf.transform``, ``org.apache.directory.ldap.client.api``, ``org.apache.hadoop.fs``, ``org.apache.hadoop.hive.metastore``, ``org.apache.hadoop.hive.ql.exec``, ``org.apache.hadoop.hive.ql.metadata``, ``org.apache.hc.client5.http.async.methods``, ``org.apache.hc.client5.http.classic.methods``, ``org.apache.hc.client5.http.fluent``, ``org.apache.hc.client5.http.protocol``, ``org.apache.hc.client5.http.utils``, ``org.apache.hive.hcatalog.templeton``, ``org.apache.ibatis.jdbc``, ``org.apache.ibatis.mapping``, ``org.apache.log4j``, ``org.apache.poi``, ``org.apache.shiro.authc``, ``org.apache.shiro.codec``, ``org.apache.shiro.jndi``, ``org.apache.shiro.mgt``, ``org.apache.sshd.client.session``, ``org.apache.tools.ant``, ``org.apache.tools.zip``, ``org.codehaus.cargo.container.installer``, ``org.dom4j``, ``org.exolab.castor.xml``, ``org.fusesource.leveldbjni``, ``org.geogebra.web.full.main``, ``org.gradle.api.file``, ``org.ho.yaml``, ``org.influxdb``, ``org.jabsorb``, ``org.jboss.vfs``, ``org.jdbi.v3.core``, ``org.jenkins.ui.icon``, ``org.jenkins.ui.symbol``, ``org.keycloak.models.map.storage``, ``org.kohsuke.stapler``, ``org.lastaflute.web``, ``org.mvel2``, ``org.openjdk.jmh.runner.options``, ``org.owasp.esapi``, ``org.pac4j.jwt.config.encryption``, ``org.pac4j.jwt.config.signature``, ``org.scijava.log``, ``org.xml.sax``, ``org.xmlpull.v1``, ``play.libs.ws``, ``play.mvc``, ``ratpack.core.form``, ``ratpack.core.handling``, ``ratpack.core.http``, ``ratpack.exec``, ``ratpack.form``, ``ratpack.func``, ``ratpack.handling``, ``ratpack.http``, ``ratpack.util``, ``software.amazon.awssdk.transfer.s3.model``, ``sun.jvmstat.perfdata.monitor.protocol.local``, ``sun.jvmstat.perfdata.monitor.protocol.rmi``, ``sun.misc``, ``sun.net.ftp``, ``sun.net.www.protocol.http``, ``sun.security.acl``, ``sun.security.jgss.krb5``, ``sun.security.krb5``, ``sun.security.pkcs``, ``sun.security.pkcs11``, ``sun.security.provider``, ``sun.security.ssl``, ``sun.security.x509``, ``sun.tools.jconsole``",151,8258,818,188,6,14,18,,186
+ Others,"``actions.osgi``, ``antlr``, ``ch.ethz.ssh2``, ``cn.hutool.core.codec``, ``com.alibaba.com.caucho.hessian.io``, ``com.alibaba.druid.sql``, ``com.alibaba.fastjson2``, ``com.amazonaws.auth``, ``com.auth0.jwt.algorithms``, ``com.azure.identity``, ``com.caucho.burlap.io``, ``com.caucho.hessian.io``, ``com.cedarsoftware.util.io``, ``com.esotericsoftware.kryo.io``, ``com.esotericsoftware.kryo5.io``, ``com.esotericsoftware.yamlbeans``, ``com.hubspot.jinjava``, ``com.jcraft.jsch``, ``com.microsoft.sqlserver.jdbc``, ``com.mitchellbosecke.pebble``, ``com.opensymphony.xwork2``, ``com.sshtools.j2ssh.authentication``, ``com.sun.crypto.provider``, ``com.sun.jndi.ldap``, ``com.sun.net.httpserver``, ``com.sun.net.ssl``, ``com.sun.rowset``, ``com.sun.security.auth.module``, ``com.sun.security.ntlm``, ``com.sun.security.sasl.digest``, ``com.thoughtworks.xstream``, ``com.trilead.ssh2``, ``com.unboundid.ldap.sdk``, ``com.zaxxer.hikari``, ``flexjson``, ``hudson``, ``io.jsonwebtoken``, ``io.micronaut.context.annotation``, ``io.micronaut.core.convert.value``, ``io.micronaut.http``, ``io.undertow.server.handlers.resource``, ``javafx.scene.web``, ``jenkins``, ``jodd.json``, ``liquibase.database.jvm``, ``liquibase.statement.core``, ``net.lingala.zip4j``, ``net.schmizz.sshj``, ``net.sf.json``, ``net.sf.saxon.s9api``, ``ognl``, ``org.acegisecurity``, ``org.antlr.runtime``, ``org.apache.avro``, ``org.apache.commons.codec``, ``org.apache.commons.compress.archivers.tar``, ``org.apache.commons.exec``, ``org.apache.commons.fileupload``, ``org.apache.commons.httpclient.util``, ``org.apache.commons.jelly``, ``org.apache.commons.jexl2``, ``org.apache.commons.jexl3``, ``org.apache.commons.lang``, ``org.apache.commons.logging``, ``org.apache.commons.net``, ``org.apache.commons.ognl``, ``org.apache.cxf.catalog``, ``org.apache.cxf.common.classloader``, ``org.apache.cxf.common.jaxb``, ``org.apache.cxf.common.logging``, ``org.apache.cxf.configuration.jsse``, ``org.apache.cxf.helpers``, ``org.apache.cxf.resource``, ``org.apache.cxf.staxutils``, ``org.apache.cxf.tools.corba.utils``, ``org.apache.cxf.tools.util``, ``org.apache.cxf.transform``, ``org.apache.directory.ldap.client.api``, ``org.apache.hadoop.fs``, ``org.apache.hadoop.hive.metastore``, ``org.apache.hadoop.hive.ql.exec``, ``org.apache.hadoop.hive.ql.metadata``, ``org.apache.hc.client5.http.async.methods``, ``org.apache.hc.client5.http.classic.methods``, ``org.apache.hc.client5.http.fluent``, ``org.apache.hc.client5.http.protocol``, ``org.apache.hc.client5.http.utils``, ``org.apache.hive.hcatalog.templeton``, ``org.apache.ibatis.jdbc``, ``org.apache.ibatis.mapping``, ``org.apache.log4j``, ``org.apache.poi``, ``org.apache.shiro.authc``, ``org.apache.shiro.codec``, ``org.apache.shiro.jndi``, ``org.apache.shiro.mgt``, ``org.apache.sshd.client.session``, ``org.apache.tools.ant``, ``org.apache.tools.zip``, ``org.codehaus.cargo.container.installer``, ``org.dom4j``, ``org.exolab.castor.xml``, ``org.fusesource.leveldbjni``, ``org.geogebra.web.full.main``, ``org.gradle.api.file``, ``org.ho.yaml``, ``org.influxdb``, ``org.jabsorb``, ``org.jboss.vfs``, ``org.jdbi.v3.core``, ``org.jenkins.ui.icon``, ``org.jenkins.ui.symbol``, ``org.keycloak.models.map.storage``, ``org.kohsuke.stapler``, ``org.lastaflute.web``, ``org.mvel2``, ``org.openjdk.jmh.runner.options``, ``org.owasp.esapi``, ``org.pac4j.jwt.config.encryption``, ``org.pac4j.jwt.config.signature``, ``org.scijava.log``, ``org.xml.sax``, ``org.xmlpull.v1``, ``play.libs.ws``, ``play.mvc``, ``ratpack.core.form``, ``ratpack.core.handling``, ``ratpack.core.http``, ``ratpack.exec``, ``ratpack.form``, ``ratpack.func``, ``ratpack.handling``, ``ratpack.http``, ``ratpack.util``, ``software.amazon.awssdk.transfer.s3.model``, ``sun.jvmstat.perfdata.monitor.protocol.local``, ``sun.jvmstat.perfdata.monitor.protocol.rmi``, ``sun.misc``, ``sun.net.ftp``, ``sun.net.www.protocol.http``, ``sun.security.acl``, ``sun.security.jgss.krb5``, ``sun.security.krb5``, ``sun.security.pkcs``, ``sun.security.pkcs11``, ``sun.security.provider``, ``sun.security.ssl``, ``sun.security.x509``, ``sun.tools.jconsole``",167,8313,849,188,6,14,18,,211
- Totals,,406,28627,2751,461,16,137,33,1,416
+ Totals,,422,28682,2782,461,16,137,33,1,441
+ io.micronaut.context.annotation,,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,
+ io.micronaut.core.convert.value,,,8,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,7,1
+ io.micronaut.http,31,14,47,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,25,2,,,,,,4,,,,,,,,,,14,39,8 |
Contributor
There was a problem hiding this comment.
Pull request overview
Adds Micronaut framework modeling to the Java CodeQL libraries and integrates it into the existing dataflow source/sink architecture, with accompanying stubs and tests to validate taint tracking for common Micronaut HTTP/WebSocket/config patterns.
Changes:
- Add Micronaut-specific CodeQL libraries (controller/websocket/config/data/security overlays) and wire them into
FlowSources. - Add Micronaut MaD
.model.ymlentries for key HTTP/multipart/client APIs (sources, summaries, and sinks such as SSRF, redirect, and header splitting). - Add Micronaut stubs and new/updated tests/options for security and library test suites.
Reviewed changes
Copilot reviewed 72 out of 74 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| java/ql/lib/semmle/code/java/dataflow/FlowSources.qll | Imports Micronaut framework libraries and adds Micronaut source definitions. |
| java/ql/lib/semmle/code/java/frameworks/micronaut/MicronautController.qll | New Micronaut HTTP controller/request mapping identification library. |
| java/ql/lib/semmle/code/java/frameworks/micronaut/MicronautWebSocket.qll | New Micronaut WebSocket endpoint/handler identification library. |
| java/ql/lib/semmle/code/java/frameworks/micronaut/MicronautConfig.qll | New Micronaut configuration injection identification library. |
| java/ql/lib/semmle/code/java/frameworks/micronaut/MicronautData.qll | New Micronaut Data repository/query identification library. |
| java/ql/lib/semmle/code/java/frameworks/micronaut/MicronautSecurity.qll | New Micronaut Security annotation identification library. |
| java/ql/lib/ext/io.micronaut.http.model.yml | Adds Micronaut HTTP request sources + summaries, plus redirect/header sinks. |
| java/ql/lib/ext/io.micronaut.http.multipart.model.yml | Adds Micronaut multipart upload sources (file upload getters). |
| java/ql/lib/ext/io.micronaut.http.client.model.yml | Adds Micronaut HTTP client SSRF sink models + URI/UriBuilder propagation. |
| java/ql/test/library-tests/frameworks/micronaut/options | Adds extractor options for Micronaut library tests (classpath stubs). |
| java/ql/test/library-tests/frameworks/micronaut/flow.ql | New inline taint-flow test driver for Micronaut modeling. |
| java/ql/test/library-tests/frameworks/micronaut/flow.expected | Empty expected output for inline flow test (no mismatches). |
| java/ql/test/library-tests/frameworks/micronaut/MicronautControllerTest.java | Library test cases for Micronaut controller parameter sources and error handler. |
| java/ql/test/library-tests/frameworks/micronaut/MicronautWebSocketTest.java | Library test cases for WebSocket handler parameters as sources. |
| java/ql/test/library-tests/frameworks/micronaut/MicronautHttpRequestTest.java | Library test cases for taint from HttpRequest accessors (headers/params/etc). |
| java/ql/test/library-tests/frameworks/micronaut/MicronautHttpClientTest.java | Library test cases for client sinks and URI/UriBuilder taint propagation. |
| java/ql/test/library-tests/frameworks/micronaut/MicronautFileUploadTest.java | Library test cases for multipart upload taint sources. |
| java/ql/test/library-tests/frameworks/micronaut/MicronautConfigTest.java | Library test cases intended for config injection sources. |
| java/ql/test/query-tests/security/CWE-918/options | Adds Micronaut stubs to classpath for SSRF query tests. |
| java/ql/test/query-tests/security/CWE-918/MicronautSSRF.java | New SSRF query test exercising Micronaut client sinks and controller source. |
| java/ql/test/query-tests/security/CWE-601/semmle/tests/options | Adds Micronaut stubs to classpath for URL redirect query tests. |
| java/ql/test/query-tests/security/CWE-601/semmle/tests/MicronautUrlRedirect.java | New URL redirect query test for HttpResponse.redirect(URI.create(...)). |
| java/ql/test/query-tests/security/CWE-601/semmle/tests/UrlRedirect.expected | Updated expected output for URL redirect query tests (generated). |
| java/ql/test/query-tests/security/CWE-113/semmle/tests/options | Adds Micronaut stubs to classpath for response splitting query tests. |
| java/ql/test/query-tests/security/CWE-113/semmle/tests/MicronautResponseSplitting.java | New response splitting query test for MutableHttpResponse.header(...). |
| java/ql/test/query-tests/security/CWE-113/semmle/tests/ResponseSplitting.expected | Updated expected output for response splitting query tests (generated). |
| java/ql/test/stubs/micronaut-4.x/LICENSE.txt | Adds Micronaut stub licensing file. |
| java/ql/test/stubs/micronaut-4.x/io/micronaut/context/annotation/Property.java | Stub for @Property. |
| java/ql/test/stubs/micronaut-4.x/io/micronaut/context/annotation/Value.java | Stub for @Value. |
| java/ql/test/stubs/micronaut-4.x/io/micronaut/data/annotation/Query.java | Stub for @Query. |
| java/ql/test/stubs/micronaut-4.x/io/micronaut/data/annotation/Repository.java | Stub for @Repository. |
| java/ql/test/stubs/micronaut-4.x/io/micronaut/data/repository/CrudRepository.java | Stub for CrudRepository. |
| java/ql/test/stubs/micronaut-4.x/io/micronaut/data/repository/GenericRepository.java | Stub for GenericRepository. |
| java/ql/test/stubs/micronaut-4.x/io/micronaut/http/HttpHeaders.java | Stub for HttpHeaders. |
| java/ql/test/stubs/micronaut-4.x/io/micronaut/http/HttpMethod.java | Stub for HttpMethod. |
| java/ql/test/stubs/micronaut-4.x/io/micronaut/http/HttpParameters.java | Stub for HttpParameters. |
| java/ql/test/stubs/micronaut-4.x/io/micronaut/http/HttpRequest.java | Stub for HttpRequest (incl. static factories). |
| java/ql/test/stubs/micronaut-4.x/io/micronaut/http/HttpResponse.java | Stub for HttpResponse (incl. redirect). |
| java/ql/test/stubs/micronaut-4.x/io/micronaut/http/HttpStatus.java | Stub for HttpStatus. |
| java/ql/test/stubs/micronaut-4.x/io/micronaut/http/MediaType.java | Stub for MediaType. |
| java/ql/test/stubs/micronaut-4.x/io/micronaut/http/MutableHttpResponse.java | Stub for MutableHttpResponse (incl. header). |
| java/ql/test/stubs/micronaut-4.x/io/micronaut/http/annotation/Body.java | Stub for @Body. |
| java/ql/test/stubs/micronaut-4.x/io/micronaut/http/annotation/Controller.java | Stub for @Controller. |
| java/ql/test/stubs/micronaut-4.x/io/micronaut/http/annotation/CookieValue.java | Stub for @CookieValue. |
| java/ql/test/stubs/micronaut-4.x/io/micronaut/http/annotation/CustomHttpMethod.java | Stub for @CustomHttpMethod. |
| java/ql/test/stubs/micronaut-4.x/io/micronaut/http/annotation/Delete.java | Stub for @Delete. |
| java/ql/test/stubs/micronaut-4.x/io/micronaut/http/annotation/Error.java | Stub for @Error. |
| java/ql/test/stubs/micronaut-4.x/io/micronaut/http/annotation/Get.java | Stub for @Get. |
| java/ql/test/stubs/micronaut-4.x/io/micronaut/http/annotation/Head.java | Stub for @Head. |
| java/ql/test/stubs/micronaut-4.x/io/micronaut/http/annotation/Header.java | Stub for @Header. |
| java/ql/test/stubs/micronaut-4.x/io/micronaut/http/annotation/Options.java | Stub for @Options. |
| java/ql/test/stubs/micronaut-4.x/io/micronaut/http/annotation/Part.java | Stub for @Part. |
| java/ql/test/stubs/micronaut-4.x/io/micronaut/http/annotation/Patch.java | Stub for @Patch. |
| java/ql/test/stubs/micronaut-4.x/io/micronaut/http/annotation/PathVariable.java | Stub for @PathVariable. |
| java/ql/test/stubs/micronaut-4.x/io/micronaut/http/annotation/Post.java | Stub for @Post. |
| java/ql/test/stubs/micronaut-4.x/io/micronaut/http/annotation/Put.java | Stub for @Put. |
| java/ql/test/stubs/micronaut-4.x/io/micronaut/http/annotation/QueryValue.java | Stub for @QueryValue. |
| java/ql/test/stubs/micronaut-4.x/io/micronaut/http/annotation/RequestAttribute.java | Stub for @RequestAttribute. |
| java/ql/test/stubs/micronaut-4.x/io/micronaut/http/annotation/RequestBean.java | Stub for @RequestBean. |
| java/ql/test/stubs/micronaut-4.x/io/micronaut/http/annotation/Trace.java | Stub for @Trace. |
| java/ql/test/stubs/micronaut-4.x/io/micronaut/http/client/BlockingHttpClient.java | Stub for BlockingHttpClient. |
| java/ql/test/stubs/micronaut-4.x/io/micronaut/http/client/HttpClient.java | Stub for HttpClient. |
| java/ql/test/stubs/micronaut-4.x/io/micronaut/http/cookie/Cookie.java | Stub for Cookie. |
| java/ql/test/stubs/micronaut-4.x/io/micronaut/http/cookie/Cookies.java | Stub for Cookies. |
| java/ql/test/stubs/micronaut-4.x/io/micronaut/http/multipart/CompletedFileUpload.java | Stub for CompletedFileUpload. |
| java/ql/test/stubs/micronaut-4.x/io/micronaut/http/uri/UriBuilder.java | Stub for UriBuilder. |
| java/ql/test/stubs/micronaut-4.x/io/micronaut/security/annotation/Secured.java | Stub for @Secured. |
| java/ql/test/stubs/micronaut-4.x/io/micronaut/websocket/WebSocketSession.java | Stub for WebSocketSession. |
| java/ql/test/stubs/micronaut-4.x/io/micronaut/websocket/annotation/OnClose.java | Stub for @OnClose. |
| java/ql/test/stubs/micronaut-4.x/io/micronaut/websocket/annotation/OnMessage.java | Stub for @OnMessage. |
| java/ql/test/stubs/micronaut-4.x/io/micronaut/websocket/annotation/OnOpen.java | Stub for @OnOpen. |
| java/ql/test/stubs/micronaut-4.x/io/micronaut/websocket/annotation/ServerWebSocket.java | Stub for @ServerWebSocket. |
owen-mc
reviewed
Feb 27, 2026
owen-mc
reviewed
Feb 27, 2026
owen-mc
reviewed
Mar 2, 2026
owen-mc
reviewed
Mar 3, 2026
owen-mc
reviewed
Mar 4, 2026
owen-mc
reviewed
Mar 4, 2026
owen-mc
reviewed
Mar 4, 2026
owen-mc
reviewed
Mar 4, 2026
owen-mc
reviewed
Mar 4, 2026
owen-mc
reviewed
Mar 4, 2026
Contributor
|
Note that there should be a space after the |
owen-mc
reviewed
Mar 5, 2026
owen-mc
reviewed
Mar 6, 2026
owen-mc
reviewed
Mar 6, 2026
owen-mc
previously requested changes
Mar 6, 2026
Co-authored-by: Owen Mansel-Chan <62447351+owen-mc@users.noreply.github.com>
…gTest.java Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
…ig.java Co-authored-by: Owen Mansel-Chan <62447351+owen-mc@users.noreply.github.com>
Contributor
Author
|
@owen-mc I've addressed most of your feedback (and more) in the last couple of commits. Should be ready. |
…ronaut-pr # Conflicts: # java/ql/test/query-tests/security/CWE-918/RequestForgery.expected # java/ql/test/query-tests/security/CWE-918/options
jamiewmeldrum
added a commit
to jamiewmeldrum/practiq-api
that referenced
this pull request
Aug 4, 2026
Records why CodeQL is a separate workflow, how findings block merges through the ruleset rather than by failing the run, and the verified limitation that matters most: CodeQL has no Micronaut framework models, so taint tracking on request-bound parameters finds nothing. Proven with a deliberate path injection that produced no alert despite java/path-injection running. Upstream support is open but unmerged (github/codeql#21387), and its model files cannot be vendored usefully because annotation-bound sources need QL library changes a model pack cannot supply.
owen-mc
reviewed
Aug 11, 2026
owen-mc
left a comment
owen-mc
left a comment
Contributor
There was a problem hiding this comment.
Thanks for addressing all of those review comments. My only review comments now are a few minor changes caused by mistakes in my suggestions and a few models that should be in different files.
| data: | ||
| - ["io.micronaut.http.uri", "UriBuilder", True, "build", "()", "", "Argument[this]", "ReturnValue", "taint", "manual"] | ||
| - ["io.micronaut.http.uri", "UriBuilder", True, "expand", "(Map)", "", "Argument[0].MapValue", "ReturnValue", "taint", "manual"] | ||
| - ["io.micronaut.http.uri", "UriBuilder", True, "expand", "(Map)", "", "Argument[this]", "ReturnValue", "taint", "manual"] |
Contributor
There was a problem hiding this comment.
Apologies, there was a mistake in my review suggestion.
Suggested change
| - ["io.micronaut.http.uri", "UriBuilder", True, "expand", "(Map)", "", "Argument[this]", "ReturnValue", "taint", "manual"] | |
| - ["io.micronaut.http.uri", "UriBuilder", True, "expand", "(Map)", "", "Argument[this]", "ReturnValue", "value", "manual"] |
Comment on lines
+19
to
+21
| - ["io.micronaut.core.convert.value", "ConvertibleMultiValues", True, "get", "", "", "Argument[this].Element.MapValue", "ReturnValue", "taint", "manual"] | ||
| - ["io.micronaut.core.convert.value", "ConvertibleMultiValues", True, "getAll", "", "", "Argument[this].Element.MapValue", "ReturnValue", "value", "manual"] | ||
| - ["io.micronaut.core.convert.value", "ConvertibleMultiValues", True, "getFirst", "", "", "Argument[this].Element.MapValue", "ReturnValue", "taint", "manual"] |
Contributor
There was a problem hiding this comment.
Suggested change
| - ["io.micronaut.core.convert.value", "ConvertibleMultiValues", True, "get", "", "", "Argument[this].Element.MapValue", "ReturnValue", "taint", "manual"] | |
| - ["io.micronaut.core.convert.value", "ConvertibleMultiValues", True, "getAll", "", "", "Argument[this].Element.MapValue", "ReturnValue", "value", "manual"] | |
| - ["io.micronaut.core.convert.value", "ConvertibleMultiValues", True, "getFirst", "", "", "Argument[this].Element.MapValue", "ReturnValue", "taint", "manual"] | |
| - ["io.micronaut.core.convert.value", "ConvertibleMultiValues", True, "get", "", "", "Argument[this].MapValue", "ReturnValue", "taint", "manual"] | |
| - ["io.micronaut.core.convert.value", "ConvertibleMultiValues", True, "getAll", "", "", "Argument[this].MapValue", "ReturnValue.Element", "value", "manual"] | |
| - ["io.micronaut.core.convert.value", "ConvertibleMultiValues", True, "getFirst", "", "", "Argument[this].MapValue", "ReturnValue.Element", "taint", "manual"] |
I was wrong before, ConvertibleMultiValues is essentially just a map which can store multiple values for the same key, so the input should have access path .MapValue. getAll returns a list so the output should have access path .Element. getFirst returns Optional and our models for java.util.Optional store the value with the access path .Element (which surprised me), like a list which might have an element, so the output should have access path .Element.
Comment on lines
+22
to
+26
| - ["io.micronaut.core.convert.value", "ConvertibleValues", True, "asMap", "", "", "Argument[this].Element.MapValue", "ReturnValue.MapValue", "taint", "manual"] | ||
| - ["io.micronaut.core.convert.value", "ConvertibleValues", True, "asProperties", "", "", "Argument[this].Element.MapValue", "ReturnValue.MapValue", "taint", "manual"] | ||
| - ["io.micronaut.core.convert.value", "ConvertibleValues", True, "getValue", "", "", "Argument[this].Element.MapValue", "ReturnValue", "taint", "manual"] | ||
| - ["io.micronaut.core.convert.value", "ConvertibleValues", True, "subMap", "", "", "Argument[this].Element.MapValue", "ReturnValue.MapValue", "taint", "manual"] | ||
| - ["io.micronaut.core.convert.value", "ConvertibleValues", True, "values", "", "", "Argument[this].Element.MapValue", "ReturnValue.Element", "taint", "manual"] |
Contributor
There was a problem hiding this comment.
Suggested change
| - ["io.micronaut.core.convert.value", "ConvertibleValues", True, "asMap", "", "", "Argument[this].Element.MapValue", "ReturnValue.MapValue", "taint", "manual"] | |
| - ["io.micronaut.core.convert.value", "ConvertibleValues", True, "asProperties", "", "", "Argument[this].Element.MapValue", "ReturnValue.MapValue", "taint", "manual"] | |
| - ["io.micronaut.core.convert.value", "ConvertibleValues", True, "getValue", "", "", "Argument[this].Element.MapValue", "ReturnValue", "taint", "manual"] | |
| - ["io.micronaut.core.convert.value", "ConvertibleValues", True, "subMap", "", "", "Argument[this].Element.MapValue", "ReturnValue.MapValue", "taint", "manual"] | |
| - ["io.micronaut.core.convert.value", "ConvertibleValues", True, "values", "", "", "Argument[this].Element.MapValue", "ReturnValue.Element", "taint", "manual"] | |
| - ["io.micronaut.core.convert.value", "ConvertibleValues", True, "asMap", "", "", "Argument[this]", "ReturnValue", "taint", "manual"] | |
| - ["io.micronaut.core.convert.value", "ConvertibleValues", True, "asProperties", "", "", "Argument[this]", "ReturnValue", "taint", "manual"] | |
| - ["io.micronaut.core.convert.value", "ConvertibleValues", True, "getValue", "", "", "Argument[this].MapValue", "ReturnValue", "taint", "manual"] | |
| - ["io.micronaut.core.convert.value", "ConvertibleValues", True, "subMap", "", "", "Argument[this].MapValue", "ReturnValue.MapValue", "taint", "manual"] | |
| - ["io.micronaut.core.convert.value", "ConvertibleValues", True, "values", "", "", "Argument[this].MapValue", "ReturnValue.Element", "taint", "manual"] |
I was wrong before: ConvertibleValues is essentially just a map. We are only interested in cases where it's Map<K, List<V>>, but I don't think we need to reflect that in the models - it should just work due to default taint steps.
| pack: codeql/java-all | ||
| extensible: summaryModel | ||
| data: | ||
| - ["io.micronaut.core.convert.value", "ConvertibleMultiValues", True, "get", "", "", "Argument[this].Element.MapValue", "ReturnValue", "taint", "manual"] |
Contributor
There was a problem hiding this comment.
All the models for ConvertibleMultiValues and ConvertibleValues should be in a separate file as they are in a different package.
Comment on lines
43
to
+49
| - ["io.micronaut.http.cookie", "Cookie", True, "getDomain", "", "", "Argument[this]", "ReturnValue", "taint", "manual"] | ||
| - ["io.micronaut.http.cookie", "Cookie", True, "getName", "", "", "Argument[this]", "ReturnValue", "taint", "manual"] | ||
| - ["io.micronaut.http.cookie", "Cookie", True, "getPath", "", "", "Argument[this]", "ReturnValue", "taint", "manual"] | ||
| - ["io.micronaut.http.cookie", "Cookie", True, "getValue", "", "", "Argument[this]", "ReturnValue", "taint", "manual"] | ||
| - ["io.micronaut.http.cookie", "Cookies", True, "findCookie", "", "", "Argument[this]", "ReturnValue", "taint", "manual"] | ||
| - ["io.micronaut.http.cookie", "Cookies", True, "get", "", "", "Argument[this]", "ReturnValue", "taint", "manual"] | ||
| - ["io.micronaut.http.cookie", "Cookies", True, "getAll", "", "", "Argument[this]", "ReturnValue", "taint", "manual"] |
Contributor
There was a problem hiding this comment.
Please move these into a separate file for this package.
owen-mc
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request adds CodeQL modeling for the Micronaut Java framework, covering HTTP controllers, WebSocket endpoints, configuration injection, security annotations, and relevant sources and sinks. The changes integrate Micronaut-specific classes and methods into the CodeQL dataflow architecture, enabling taint tracking and threat modeling for user input, configuration, and HTTP/WebSocket requests. Test cases are included to verify the new models.
Micronaut framework modeling:
MicronautController.qll, enabling detection and classification of user-controlled input sources.MicronautWebSocket.qll.@Valueand@Propertyannotations, modeling fields and parameters as local user input inMicronautConfig.qll.MicronautData.qll.@Securedannotations for classes and methods inMicronautSecurity.qll.Dataflow source and sink integration:
FlowSources.qllto include Micronaut HTTP input parameters, WebSocket parameters, configuration fields/parameters, and error handler parameters as sources, using the new overlays. [1] [2].model.ymlfiles, covering taint propagation and SSRF, response splitting, and URL redirection sinks. [1] [2] [3]Test coverage:
MicronautControllerTest.java.MicronautConfigTest.java.