github / github/codeql

(java,bug)SpringRequestMappingMethod::getValue does not return when a constant in jar is used

Aperta
#10,989 7 commenti 0 reazioni 0 assegnatari Vedi su GitHub
Lingua principale
CodeQL
Stelle
10.1k
Fork
2.1k
Merge medio
2g 15h
PR unite (30g)
141

Descrizione

### Version
CodeQL CLI 2.11.2
### Description
as shown below,the method "putDesignToPackage" will not be matched,the reason is that the annotation PostMapping use a constant which is caculate by third party。
### Example

ql:
```
import java
import semmle.code.java.frameworks.spring.SpringController
import custom.lib_1
from SpringController controller, SpringRequestMappingMethod method
where
method = controller.getAMethod()

select method,controller,method.getValue()
```

java code:
```
@PostMapping(value = OpenDesignPackageApis.DESIGN_PACKAGE_PATH_WITH_ID)
public Result putDesignToPackage(
@PathVariable final String obsPackageId,
@RequestParam(value = "plan_id") final String obsPlanId) throws
BizzException {

return Result.ok();
}
```

constant
```
package com.xxx.design.web.api;

import com.aaa.regex.UrlRegex;

public class OpenDesignPackageApis {

public static final String DESIGN_PACKAGE_PATH = OpenDesignApis.DESIGN + "/package";

public static final String DESIGN_PACKAGE_LIST_PATH = DESIGN_PACKAGE_PATH + "/list";

public static final String DESIGN_PACKAGE_PATH_WITH_ID = DESIGN_PACKAGE_PATH +
"/{obsPackageId:" + UrlRegex.OBSCURED_ID_REGEX + "}";
}
```
the source code which maybe has a bug
SpringController.qll
```
class SpringRequestMappingMethod extends SpringControllerMethod {
...
string getValue() {
result = requestMappingAnnotation.getValue("value").(CompileTimeConstantExpr).getStringValue()
}
....
}
```

https://github.com/github/codeql/issues/10989#tasklist-block-21bc8440-4f27-40d4-9ff5-9c2ab8475f10

Guida per i contributori

Apri la guida per i contributori

Valutazione

Questa issue non è ancora stata valutata.

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.