(java,bug)SpringRequestMappingMethod::getValue does not return when a constant in jar is used
- Lingua principale
- CodeQL
- Stelle
- 10.1k
- Fork
- 2.1k
- Merge medio
- 2g 15h
- PR unite (30g)
- 141
Descrizione
### Version
CodeQL CLI 2.11.2
### Description
as shown below,the method "putDesignToPackage" will not be matched,the reason is that the annotation PostMapping use a constant which is caculate by third party。
### Example
ql:
```
import java
import semmle.code.java.frameworks.spring.SpringController
import custom.lib_1
from SpringController controller, SpringRequestMappingMethod method
where
method = controller.getAMethod()
select method,controller,method.getValue()
```
java code:
```
@PostMapping(value = OpenDesignPackageApis.DESIGN_PACKAGE_PATH_WITH_ID)
public Result putDesignToPackage(
@PathVariable final String obsPackageId,
@RequestParam(value = "plan_id") final String obsPlanId) throws
BizzException {
return Result.ok();
}
```
constant
```
package com.xxx.design.web.api;
import com.aaa.regex.UrlRegex;
public class OpenDesignPackageApis {
public static final String DESIGN_PACKAGE_PATH = OpenDesignApis.DESIGN + "/package";
public static final String DESIGN_PACKAGE_LIST_PATH = DESIGN_PACKAGE_PATH + "/list";
public static final String DESIGN_PACKAGE_PATH_WITH_ID = DESIGN_PACKAGE_PATH +
"/{obsPackageId:" + UrlRegex.OBSCURED_ID_REGEX + "}";
}
```
the source code which maybe has a bug
SpringController.qll
```
class SpringRequestMappingMethod extends SpringControllerMethod {
...
string getValue() {
result = requestMappingAnnotation.getValue("value").(CompileTimeConstantExpr).getStringValue()
}
....
}
```
https://github.com/github/codeql/issues/10989#tasklist-block-21bc8440-4f27-40d4-9ff5-9c2ab8475f10
Guida per i contributori
Apri la guida per i contributori
Valutazione
Questa issue non è ancora stata valutata.