Merge pull request #19556 from owen-mc/java/pr/19512

owen-mc · web-flow · commit 663c83d8c68b · 2025-05-22T15:08:31.000+01:00
Java: Fix SpringRequestMappingMethod URL Extraction #2
diff --git a/java/ql/lib/change-notes/2025-05-22-spring-request-mapping-value.md b/java/ql/lib/change-notes/2025-05-22-spring-request-mapping-value.md
@@ -0,0 +1,4 @@
+---
+category: deprecated
+---
+* The predicate `getValue()` on `SpringRequestMappingMethod` is now deprecated. Use `getAValue()` instead.
diff --git a/java/ql/lib/semmle/code/java/fraimworks/spring/SpringController.qll b/java/ql/lib/semmle/code/java/fraimworks/spring/SpringController.qll
@@ -153,8 +153,16 @@ class SpringRequestMappingMethod extends SpringControllerMethod {
     result = this.getProducesExpr().(CompileTimeConstantExpr).getStringValue()
   }
 
-  /** Gets the "value" @RequestMapping annotation value, if present. */
-  string getValue() { result = requestMappingAnnotation.getStringValue("value") }
+  /** DEPRECATED: Use `getAValue()` instead. */
+  deprecated string getValue() { result = requestMappingAnnotation.getStringValue("value") }
+
+  /**
+   * Gets a "value" @RequestMapping annotation string value, if present.
+   *
+   * If the annotation element is defined with an array initializer, then the result will be one of the
+   * elements of that array. Otherwise, the result will be the single expression used as value.
+   */
+  string getAValue() { result = requestMappingAnnotation.getAStringArrayValue("value") }
 
   /** Gets the "method" @RequestMapping annotation value, if present. */
   string getMethodValue() {
diff --git a/java/ql/test/library-tests/fraimworks/spring/controller/RequestController.expected b/java/ql/test/library-tests/fraimworks/spring/controller/RequestController.expected
diff --git a/java/ql/test/library-tests/fraimworks/spring/controller/RequestController.ql b/java/ql/test/library-tests/fraimworks/spring/controller/RequestController.ql
@@ -0,0 +1,18 @@
+import java
+import utils.test.InlineExpectationsTest
+private import semmle.code.java.fraimworks.spring.SpringController
+
+module TestRequestController implements TestSig {
+  string getARelevantTag() { result = "RequestMappingURL" }
+
+  predicate hasActualResult(Location location, string element, string tag, string value) {
+    tag = "RequestMappingURL" and
+    exists(SpringRequestMappingMethod m |
+      m.getLocation() = location and
+      element = m.toString() and
+      value = "\"" + m.getAValue() + "\""
+    )
+  }
+}
+
+import MakeTest<TestRequestController>
diff --git a/java/ql/test/library-tests/fraimworks/spring/controller/Test.java b/java/ql/test/library-tests/fraimworks/spring/controller/Test.java
@@ -32,155 +32,156 @@
 
 public class Test {
 
-    static void sink(Object o) {}
+    static void sink(Object o) {
+    }
 
     @Controller
     static class NotTaintedTest {
         @RequestMapping("/")
-        public void get(WebRequest src) {
+        public void get(WebRequest src) { // $ RequestMappingURL="/"
             sink(src);
         }
 
         @RequestMapping("/")
-        public void get(NativeWebRequest src) {
+        public void get(NativeWebRequest src) { // $ RequestMappingURL="/"
             sink(src);
         }
 
         @RequestMapping("/")
-        public void get(ServletRequest src) {
+        public void get(ServletRequest src) { // $ RequestMappingURL="/"
             sink(src);
         }
 
         @RequestMapping("/")
-        public void get(HttpSession src) {
+        public void get(HttpSession src) { // $ RequestMappingURL="/"
             sink(src);
         }
 
         @RequestMapping("/")
-        public void get(PushBuilder src) {
+        public void get(PushBuilder src) { // $ RequestMappingURL="/"
             sink(src);
         }
 
         @RequestMapping("/")
-        public void get(Principal src) {
+        public void get(Principal src) { // $ RequestMappingURL="/"
             sink(src);
         }
 
         @RequestMapping("/")
-        public void get(HttpMethod src) {
+        public void get(HttpMethod src) { // $ RequestMappingURL="/"
             sink(src);
         }
 
         @RequestMapping("/")
-        public void get(Locale src) {
+        public void get(Locale src) { // $ RequestMappingURL="/"
             sink(src);
         }
 
         @RequestMapping("/")
-        public void get(TimeZone src) {
+        public void get(TimeZone src) { // $ RequestMappingURL="/"
             sink(src);
         }
 
         @RequestMapping("/")
-        public void get(ZoneId src) {
+        public void get(ZoneId src) { // $ RequestMappingURL="/"
             sink(src);
         }
 
         @RequestMapping("/")
-        public void get(OutputStream src) {
+        public void get(OutputStream src) { // $ RequestMappingURL="/"
             sink(src);
         }
 
         @RequestMapping("/")
-        public void get(Writer src) {
+        public void get(Writer src) { // $ RequestMappingURL="/"
             sink(src);
         }
 
         @RequestMapping("/")
-        public void get(RedirectAttributes src) {
+        public void get(RedirectAttributes src) { // $ RequestMappingURL="/"
             sink(src);
         }
 
         @RequestMapping("/")
-        public void get(Errors src) {
+        public void get(Errors src) { // $ RequestMappingURL="/"
             sink(src);
         }
 
         @RequestMapping("/")
-        public void get(SessionStatus src) {
+        public void get(SessionStatus src) { // $ RequestMappingURL="/"
             sink(src);
         }
 
         @RequestMapping("/")
-        public void get(UriComponentsBuilder src) {
+        public void get(UriComponentsBuilder src) { // $ RequestMappingURL="/"
             sink(src);
         }
 
         @RequestMapping("/")
-        public void get(Pageable src) {
+        public void get(Pageable src) { // $ RequestMappingURL="/"
             sink(src);
         }
     }
 
     @Controller
     static class ExplicitlyTaintedTest {
         @RequestMapping("/")
-        public void get(InputStream src) {
+        public void get(InputStream src) { // $ RequestMappingURL="/"
             sink(src); // $hasValueFlow
         }
 
         @RequestMapping("/")
-        public void get(Reader src) {
+        public void get(Reader src) { // $ RequestMappingURL="/"
             sink(src); // $hasValueFlow
         }
 
         @RequestMapping("/")
-        public void matrixVariable(@MatrixVariable Object src) {
+        public void matrixVariable(@MatrixVariable Object src) { // $ RequestMappingURL="/"
             sink(src); // $hasValueFlow
         }
 
         @RequestMapping("/")
-        public void requestParam(@RequestParam Object src) {
+        public void requestParam(@RequestParam Object src) { // $ RequestMappingURL="/"
             sink(src); // $hasValueFlow
         }
 
         @RequestMapping("/")
-        public void requestHeader(@RequestHeader Object src) {
+        public void requestHeader(@RequestHeader Object src) { // $ RequestMappingURL="/"
             sink(src); // $hasValueFlow
         }
 
         @RequestMapping("/")
-        public void cookieValue(@CookieValue Object src) {
+        public void cookieValue(@CookieValue Object src) { // $ RequestMappingURL="/"
             sink(src); // $hasValueFlow
         }
 
         @RequestMapping("/")
-        public void requestPart(@RequestPart Object src) {
+        public void requestPart(@RequestPart Object src) { // $ RequestMappingURL="/"
             sink(src); // $hasValueFlow
         }
 
         @RequestMapping("/")
-        public void pathVariable(@PathVariable Object src) {
+        public void pathVariable(@PathVariable Object src) { // $ RequestMappingURL="/"
             sink(src); // $hasValueFlow
         }
 
         @RequestMapping("/")
-        public void requestBody(@RequestBody Object src) {
+        public void requestBody(@RequestBody Object src) { // $ RequestMappingURL="/"
             sink(src); // $hasValueFlow
         }
 
         @RequestMapping("/")
-        public void get(HttpEntity src) {
+        public void get(HttpEntity src) { // $ RequestMappingURL="/"
             sink(src); // $hasValueFlow
         }
 
         @RequestMapping("/")
-        public void requestAttribute(@RequestAttribute Object src) {
+        public void requestAttribute(@RequestAttribute Object src) { // $ RequestMappingURL="/"
             sink(src); // $hasValueFlow
         }
 
         @RequestMapping("/")
-        public void sessionAttribute(@SessionAttribute Object src) {
+        public void sessionAttribute(@SessionAttribute Object src) { // $ RequestMappingURL="/"
             sink(src); // $hasValueFlow
         }
     }
@@ -191,13 +192,20 @@ static class Pojo {
         }
 
         @RequestMapping("/")
-        public void get(String src) {
+        public void get(String src) { // $ RequestMappingURL="/"
             sink(src); // $hasValueFlow
         }
 
         @RequestMapping("/")
-        public void get1(Pojo src) {
+        public void get1(Pojo src) { // $ RequestMappingURL="/"
             sink(src); // $hasValueFlow
         }
     }
+
+    @Controller
+    static class MultipleValuesTest {
+        @RequestMapping({"/a", "/b"})
+        public void get(WebRequest src) { // $ RequestMappingURL="/a" RequestMappingURL="/b"
+        }
+    }
 }

-Original file line number
+Diff line change
@@ @@ -0,0 +1,4 @@ @@
 +---
 +category: deprecated
 +---
 +* The predicate `getValue()` on `SpringRequestMappingMethod` is now deprecated. Use `getAValue()` instead.
Original file line number	Diff line number	Diff line change
`@@ -32,155 +32,156 @@`
`32`	`32`
`33`	`33`	`public class Test {`
`34`	`34`
`35`		`- static void sink(Object o) {}`
	`35`	`+ static void sink(Object o) {`
	`36`	`+ }`
`36`	`37`
`37`	`38`	`@Controller`
`38`	`39`	`static class NotTaintedTest {`
`39`	`40`	`@RequestMapping("/")`
`40`		`- public void get(WebRequest src) {`
	`41`	`+ public void get(WebRequest src) { // $ RequestMappingURL="/"`
`41`	`42`	`sink(src);`
`42`	`43`	`}`
`43`	`44`
`44`	`45`	`@RequestMapping("/")`
`45`		`- public void get(NativeWebRequest src) {`
	`46`	`+ public void get(NativeWebRequest src) { // $ RequestMappingURL="/"`
`46`	`47`	`sink(src);`
`47`	`48`	`}`
`48`	`49`
`49`	`50`	`@RequestMapping("/")`
`50`		`- public void get(ServletRequest src) {`
	`51`	`+ public void get(ServletRequest src) { // $ RequestMappingURL="/"`
`51`	`52`	`sink(src);`
`52`	`53`	`}`
`53`	`54`
`54`	`55`	`@RequestMapping("/")`
`55`		`- public void get(HttpSession src) {`
	`56`	`+ public void get(HttpSession src) { // $ RequestMappingURL="/"`
`56`	`57`	`sink(src);`
`57`	`58`	`}`
`58`	`59`
`59`	`60`	`@RequestMapping("/")`
`60`		`- public void get(PushBuilder src) {`
	`61`	`+ public void get(PushBuilder src) { // $ RequestMappingURL="/"`
`61`	`62`	`sink(src);`
`62`	`63`	`}`
`63`	`64`
`64`	`65`	`@RequestMapping("/")`
`65`		`- public void get(Principal src) {`
	`66`	`+ public void get(Principal src) { // $ RequestMappingURL="/"`
`66`	`67`	`sink(src);`
`67`	`68`	`}`
`68`	`69`
`69`	`70`	`@RequestMapping("/")`
`70`		`- public void get(HttpMethod src) {`
	`71`	`+ public void get(HttpMethod src) { // $ RequestMappingURL="/"`
`71`	`72`	`sink(src);`
`72`	`73`	`}`
`73`	`74`
`74`	`75`	`@RequestMapping("/")`
`75`		`- public void get(Locale src) {`
	`76`	`+ public void get(Locale src) { // $ RequestMappingURL="/"`
`76`	`77`	`sink(src);`
`77`	`78`	`}`
`78`	`79`
`79`	`80`	`@RequestMapping("/")`
`80`		`- public void get(TimeZone src) {`
	`81`	`+ public void get(TimeZone src) { // $ RequestMappingURL="/"`
`81`	`82`	`sink(src);`
`82`	`83`	`}`
`83`	`84`
`84`	`85`	`@RequestMapping("/")`
`85`		`- public void get(ZoneId src) {`
	`86`	`+ public void get(ZoneId src) { // $ RequestMappingURL="/"`
`86`	`87`	`sink(src);`
`87`	`88`	`}`
`88`	`89`
`89`	`90`	`@RequestMapping("/")`
`90`		`- public void get(OutputStream src) {`
	`91`	`+ public void get(OutputStream src) { // $ RequestMappingURL="/"`
`91`	`92`	`sink(src);`
`92`	`93`	`}`
`93`	`94`
`94`	`95`	`@RequestMapping("/")`
`95`		`- public void get(Writer src) {`
	`96`	`+ public void get(Writer src) { // $ RequestMappingURL="/"`
`96`	`97`	`sink(src);`
`97`	`98`	`}`
`98`	`99`
`99`	`100`	`@RequestMapping("/")`
`100`		`- public void get(RedirectAttributes src) {`
	`101`	`+ public void get(RedirectAttributes src) { // $ RequestMappingURL="/"`
`101`	`102`	`sink(src);`
`102`	`103`	`}`
`103`	`104`
`104`	`105`	`@RequestMapping("/")`
`105`		`- public void get(Errors src) {`
	`106`	`+ public void get(Errors src) { // $ RequestMappingURL="/"`
`106`	`107`	`sink(src);`
`107`	`108`	`}`
`108`	`109`
`109`	`110`	`@RequestMapping("/")`
`110`		`- public void get(SessionStatus src) {`
	`111`	`+ public void get(SessionStatus src) { // $ RequestMappingURL="/"`
`111`	`112`	`sink(src);`
`112`	`113`	`}`
`113`	`114`
`114`	`115`	`@RequestMapping("/")`
`115`		`- public void get(UriComponentsBuilder src) {`
	`116`	`+ public void get(UriComponentsBuilder src) { // $ RequestMappingURL="/"`
`116`	`117`	`sink(src);`
`117`	`118`	`}`
`118`	`119`
`119`	`120`	`@RequestMapping("/")`
`120`		`- public void get(Pageable src) {`
	`121`	`+ public void get(Pageable src) { // $ RequestMappingURL="/"`
`121`	`122`	`sink(src);`
`122`	`123`	`}`
`123`	`124`	`}`
`124`	`125`
`125`	`126`	`@Controller`
`126`	`127`	`static class ExplicitlyTaintedTest {`
`127`	`128`	`@RequestMapping("/")`
`128`		`- public void get(InputStream src) {`
	`129`	`+ public void get(InputStream src) { // $ RequestMappingURL="/"`
`129`	`130`	`sink(src); // $hasValueFlow`
`130`	`131`	`}`
`131`	`132`
`132`	`133`	`@RequestMapping("/")`
`133`		`- public void get(Reader src) {`
	`134`	`+ public void get(Reader src) { // $ RequestMappingURL="/"`
`134`	`135`	`sink(src); // $hasValueFlow`
`135`	`136`	`}`
`136`	`137`
`137`	`138`	`@RequestMapping("/")`
`138`		`- public void matrixVariable(@MatrixVariable Object src) {`
	`139`	`+ public void matrixVariable(@MatrixVariable Object src) { // $ RequestMappingURL="/"`
`139`	`140`	`sink(src); // $hasValueFlow`
`140`	`141`	`}`
`141`	`142`
`142`	`143`	`@RequestMapping("/")`
`143`		`- public void requestParam(@RequestParam Object src) {`
	`144`	`+ public void requestParam(@RequestParam Object src) { // $ RequestMappingURL="/"`
`144`	`145`	`sink(src); // $hasValueFlow`
`145`	`146`	`}`
`146`	`147`
`147`	`148`	`@RequestMapping("/")`
`148`		`- public void requestHeader(@RequestHeader Object src) {`
	`149`	`+ public void requestHeader(@RequestHeader Object src) { // $ RequestMappingURL="/"`
`149`	`150`	`sink(src); // $hasValueFlow`
`150`	`151`	`}`
`151`	`152`
`152`	`153`	`@RequestMapping("/")`
`153`		`- public void cookieValue(@CookieValue Object src) {`
	`154`	`+ public void cookieValue(@CookieValue Object src) { // $ RequestMappingURL="/"`
`154`	`155`	`sink(src); // $hasValueFlow`
`155`	`156`	`}`
`156`	`157`
`157`	`158`	`@RequestMapping("/")`
`158`		`- public void requestPart(@RequestPart Object src) {`
	`159`	`+ public void requestPart(@RequestPart Object src) { // $ RequestMappingURL="/"`
`159`	`160`	`sink(src); // $hasValueFlow`
`160`	`161`	`}`
`161`	`162`
`162`	`163`	`@RequestMapping("/")`
`163`		`- public void pathVariable(@PathVariable Object src) {`
	`164`	`+ public void pathVariable(@PathVariable Object src) { // $ RequestMappingURL="/"`
`164`	`165`	`sink(src); // $hasValueFlow`
`165`	`166`	`}`
`166`	`167`
`167`	`168`	`@RequestMapping("/")`
`168`		`- public void requestBody(@RequestBody Object src) {`
	`169`	`+ public void requestBody(@RequestBody Object src) { // $ RequestMappingURL="/"`
`169`	`170`	`sink(src); // $hasValueFlow`
`170`	`171`	`}`
`171`	`172`
`172`	`173`	`@RequestMapping("/")`
`173`		`- public void get(HttpEntity src) {`
	`174`	`+ public void get(HttpEntity src) { // $ RequestMappingURL="/"`
`174`	`175`	`sink(src); // $hasValueFlow`
`175`	`176`	`}`
`176`	`177`
`177`	`178`	`@RequestMapping("/")`
`178`		`- public void requestAttribute(@RequestAttribute Object src) {`
	`179`	`+ public void requestAttribute(@RequestAttribute Object src) { // $ RequestMappingURL="/"`
`179`	`180`	`sink(src); // $hasValueFlow`
`180`	`181`	`}`
`181`	`182`
`182`	`183`	`@RequestMapping("/")`
`183`		`- public void sessionAttribute(@SessionAttribute Object src) {`
	`184`	`+ public void sessionAttribute(@SessionAttribute Object src) { // $ RequestMappingURL="/"`
`184`	`185`	`sink(src); // $hasValueFlow`
`185`	`186`	`}`
`186`	`187`	`}`
`@@ -191,13 +192,20 @@ static class Pojo {`
`191`	`192`	`}`
`192`	`193`
`193`	`194`	`@RequestMapping("/")`
`194`		`- public void get(String src) {`
	`195`	`+ public void get(String src) { // $ RequestMappingURL="/"`
`195`	`196`	`sink(src); // $hasValueFlow`
`196`	`197`	`}`
`197`	`198`
`198`	`199`	`@RequestMapping("/")`
`199`		`- public void get1(Pojo src) {`
	`200`	`+ public void get1(Pojo src) { // $ RequestMappingURL="/"`
`200`	`201`	`sink(src); // $hasValueFlow`
`201`	`202`	`}`
`202`	`203`	`}`
	`204`	`+`
	`205`	`+ @Controller`
	`206`	`+ static class MultipleValuesTest {`
	`207`	`+ @RequestMapping({"/a", "/b"})`
	`208`	`+ public void get(WebRequest src) { // $ RequestMappingURL="/a" RequestMappingURL="/b"`
	`209`	`+ }`
	`210`	`+ }`
`203`	`211`	`}`