github / github/codeql

(java,bug)SpringRequestMappingMethod::getValue does not return when a constant in jar is used

Ouverte
#10,989 7 commentaires 0 réactions 0 personnes assignées Voir sur GitHub
Langage dominant
CodeQL
Étoiles
10.1k
Forks
2.1k
Merge moyen
2 j 15 h
PR mergées (30 j)
141

Description

### Version
CodeQL CLI 2.11.2
### Description
as shown below,the method "putDesignToPackage" will not be matched,the reason is that the annotation PostMapping use a constant which is caculate by third party。
### Example

ql:
```
import java
import semmle.code.java.frameworks.spring.SpringController
import custom.lib_1
from SpringController controller, SpringRequestMappingMethod method
where
method = controller.getAMethod()

select method,controller,method.getValue()
```

java code:
```
@PostMapping(value = OpenDesignPackageApis.DESIGN_PACKAGE_PATH_WITH_ID)
public Result putDesignToPackage(
@PathVariable final String obsPackageId,
@RequestParam(value = "plan_id") final String obsPlanId) throws
BizzException {

return Result.ok();
}
```

constant
```
package com.xxx.design.web.api;

import com.aaa.regex.UrlRegex;

public class OpenDesignPackageApis {

public static final String DESIGN_PACKAGE_PATH = OpenDesignApis.DESIGN + "/package";

public static final String DESIGN_PACKAGE_LIST_PATH = DESIGN_PACKAGE_PATH + "/list";

public static final String DESIGN_PACKAGE_PATH_WITH_ID = DESIGN_PACKAGE_PATH +
"/{obsPackageId:" + UrlRegex.OBSCURED_ID_REGEX + "}";
}
```
the source code which maybe has a bug
SpringController.qll
```
class SpringRequestMappingMethod extends SpringControllerMethod {
...
string getValue() {
result = requestMappingAnnotation.getValue("value").(CompileTimeConstantExpr).getStringValue()
}
....
}
```

https://github.com/github/codeql/issues/10989#tasklist-block-21bc8440-4f27-40d4-9ff5-9c2ab8475f10

Guide de contribution

Ouvrir le guide de contribution

Évaluation

Cette issue n'a pas encore été évaluée.

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.