github / github/codeql

(java,bug)SpringRequestMappingMethod::getValue does not return when a constant in jar is used

Abierto
#10,989 7 comentarios 0 reacciones 0 asignados Ver en GitHub
Lenguaje dominante
CodeQL
Estrellas
10.1k
Forks
2.1k
Merge medio
2 d 15 h
PR fusionados (30 d)
141

Descripción

### Version
CodeQL CLI 2.11.2
### Description
as shown below,the method "putDesignToPackage" will not be matched,the reason is that the annotation PostMapping use a constant which is caculate by third party。
### Example

ql:
```
import java
import semmle.code.java.frameworks.spring.SpringController
import custom.lib_1
from SpringController controller, SpringRequestMappingMethod method
where
method = controller.getAMethod()

select method,controller,method.getValue()
```

java code:
```
@PostMapping(value = OpenDesignPackageApis.DESIGN_PACKAGE_PATH_WITH_ID)
public Result putDesignToPackage(
@PathVariable final String obsPackageId,
@RequestParam(value = "plan_id") final String obsPlanId) throws
BizzException {

return Result.ok();
}
```

constant
```
package com.xxx.design.web.api;

import com.aaa.regex.UrlRegex;

public class OpenDesignPackageApis {

public static final String DESIGN_PACKAGE_PATH = OpenDesignApis.DESIGN + "/package";

public static final String DESIGN_PACKAGE_LIST_PATH = DESIGN_PACKAGE_PATH + "/list";

public static final String DESIGN_PACKAGE_PATH_WITH_ID = DESIGN_PACKAGE_PATH +
"/{obsPackageId:" + UrlRegex.OBSCURED_ID_REGEX + "}";
}
```
the source code which maybe has a bug
SpringController.qll
```
class SpringRequestMappingMethod extends SpringControllerMethod {
...
string getValue() {
result = requestMappingAnnotation.getValue("value").(CompileTimeConstantExpr).getStringValue()
}
....
}
```

https://github.com/github/codeql/issues/10989#tasklist-block-21bc8440-4f27-40d4-9ff5-9c2ab8475f10

Guía de contribución

Abrir la guía de contribución

Evaluación

Este issue todavía no se ha evaluado.

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.