Skip to content

Commit 2a23f87

Browse files
Jami CogswellJami Cogswell
Jami Cogswell
authored and
Jami Cogswell
committed
Java: add tests for org.apache.hc.client5.http.async.methods.model.yml; resolve conflicts
1 parent e89df25 commit 2a23f87

File tree

2 files changed

+150
-2
lines changed

2 files changed

+150
-2
lines changed

‎java/ql/test/query-tests/security/CWE-918/ApacheHttpSSRF.java

Lines changed: 149 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,9 +18,18 @@
1818
import javax.servlet.http.HttpServletRequest;
1919
import javax.servlet.http.HttpServletResponse;
2020

21+
// version 5-related imports
22+
import org.apache.hc.core5.http.HttpHost;
23+
import org.apache.hc.core5.http.Method;
24+
import org.apache.hc.client5.http.async.methods.BasicHttpRequests;
25+
import org.apache.hc.client5.http.async.methods.ConfigurableHttpRequest;
26+
import org.apache.hc.client5.http.async.methods.SimpleHttpRequest;
27+
import org.apache.hc.client5.http.async.methods.SimpleHttpRequests;
28+
import org.apache.hc.client5.http.async.methods.SimpleRequestBuilder;
29+
2130
public class ApacheHttpSSRF extends HttpServlet {
2231

23-
protected void doGet(HttpServletRequest request, HttpServletResponse response)
32+
protected void doGet0(HttpServletRequest request, HttpServletResponse response)
2433
throws ServletException, IOException {
2534
try {
2635

@@ -61,4 +70,143 @@ protected void doGet(HttpServletRequest request, HttpServletResponse response)
6170
// TODO: handle exception
6271
}
6372
}
73+
74+
// org.apache.hc.client5.http.async.methods
75+
protected void doGet1(HttpServletRequest request, HttpServletResponse response)
76+
throws ServletException, IOException {
77+
try {
78+
79+
String uriSink = request.getParameter("uri");
80+
URI uri = new URI(uriSink);
81+
82+
String hostSink = request.getParameter("host");
83+
HttpHost host = new HttpHost(hostSink);
84+
85+
// org.apache.hc.client5.http.async.methods.BasicHttpRequests
86+
BasicHttpRequests.create(Method.CONNECT, host, "path"); // $ SSRF
87+
BasicHttpRequests.create(Method.CONNECT, uri.toString()); // $ SSRF
88+
BasicHttpRequests.create(Method.CONNECT, uri); // $ SSRF
89+
BasicHttpRequests.create("method", uri.toString()); // $ SSRF
90+
BasicHttpRequests.create("method", uri); // $ SSRF
91+
92+
BasicHttpRequests.delete(host, "path"); // $ SSRF
93+
BasicHttpRequests.delete(uri.toString()); // $ SSRF
94+
BasicHttpRequests.delete(uri); // $ SSRF
95+
96+
BasicHttpRequests.get(host, "path"); // $ SSRF
97+
BasicHttpRequests.get(uri.toString()); // $ SSRF
98+
BasicHttpRequests.get(uri); // $ SSRF
99+
100+
BasicHttpRequests.head(host, "path"); // $ SSRF
101+
BasicHttpRequests.head(uri.toString()); // $ SSRF
102+
BasicHttpRequests.head(uri); // $ SSRF
103+
104+
BasicHttpRequests.options(host, "path"); // $ SSRF
105+
BasicHttpRequests.options(uri.toString()); // $ SSRF
106+
BasicHttpRequests.options(uri); // $ SSRF
107+
108+
BasicHttpRequests.patch(host, "path"); // $ SSRF
109+
BasicHttpRequests.patch(uri.toString()); // $ SSRF
110+
BasicHttpRequests.patch(uri); // $ SSRF
111+
112+
BasicHttpRequests.post(host, "path"); // $ SSRF
113+
BasicHttpRequests.post(uri.toString()); // $ SSRF
114+
BasicHttpRequests.post(uri); // $ SSRF
115+
116+
BasicHttpRequests.put(host, "path"); // $ SSRF
117+
BasicHttpRequests.put(uri.toString()); // $ SSRF
118+
BasicHttpRequests.put(uri); // $ SSRF
119+
120+
BasicHttpRequests.trace(host, "path"); // $ SSRF
121+
BasicHttpRequests.trace(uri.toString()); // $ SSRF
122+
BasicHttpRequests.trace(uri); // $ SSRF
123+
124+
// org.apache.hc.client5.http.async.methods.ConfigurableHttpRequest
125+
new ConfigurableHttpRequest("method", host, "path"); // $ SSRF
126+
new ConfigurableHttpRequest("method", uri); // $ SSRF
127+
128+
// org.apache.hc.client5.http.async.methods.SimpleHttpRequest
129+
new SimpleHttpRequest(Method.CONNECT, host, "path"); // $ SSRF
130+
new SimpleHttpRequest(Method.CONNECT, uri); // $ SSRF
131+
new SimpleHttpRequest("method", host, "path"); // $ SSRF
132+
new SimpleHttpRequest("method", uri); // $ SSRF
133+
134+
SimpleHttpRequest.create(Method.CONNECT, host, "path"); // $ SSRF
135+
SimpleHttpRequest.create(Method.CONNECT, uri); // $ SSRF
136+
SimpleHttpRequest.create("method", uri.toString()); // $ SSRF
137+
SimpleHttpRequest.create("method", uri); // $ SSRF
138+
139+
// org.apache.hc.client5.http.async.methods.SimpleHttpRequests
140+
SimpleHttpRequests.create(Method.CONNECT, host, "path"); // $ SSRF
141+
SimpleHttpRequests.create(Method.CONNECT, uri.toString()); // $ SSRF
142+
SimpleHttpRequests.create(Method.CONNECT, uri); // $ SSRF
143+
SimpleHttpRequests.create("method", uri.toString()); // $ SSRF
144+
SimpleHttpRequests.create("method", uri); // $ SSRF
145+
146+
SimpleHttpRequests.delete(host, "path"); // $ SSRF
147+
SimpleHttpRequests.delete(uri.toString()); // $ SSRF
148+
SimpleHttpRequests.delete(uri); // $ SSRF
149+
150+
SimpleHttpRequests.get(host, "path"); // $ SSRF
151+
SimpleHttpRequests.get(uri.toString()); // $ SSRF
152+
SimpleHttpRequests.get(uri); // $ SSRF
153+
154+
SimpleHttpRequests.head(host, "path"); // $ SSRF
155+
SimpleHttpRequests.head(uri.toString()); // $ SSRF
156+
SimpleHttpRequests.head(uri); // $ SSRF
157+
158+
SimpleHttpRequests.options(host, "path"); // $ SSRF
159+
SimpleHttpRequests.options(uri.toString()); // $ SSRF
160+
SimpleHttpRequests.options(uri); // $ SSRF
161+
162+
SimpleHttpRequests.patch(host, "path"); // $ SSRF
163+
SimpleHttpRequests.patch(uri.toString()); // $ SSRF
164+
SimpleHttpRequests.patch(uri); // $ SSRF
165+
166+
SimpleHttpRequests.post(host, "path"); // $ SSRF
167+
SimpleHttpRequests.post(uri.toString()); // $ SSRF
168+
SimpleHttpRequests.post(uri); // $ SSRF
169+
170+
SimpleHttpRequests.put(host, "path"); // $ SSRF
171+
SimpleHttpRequests.put(uri.toString()); // $ SSRF
172+
SimpleHttpRequests.put(uri); // $ SSRF
173+
174+
SimpleHttpRequests.trace(host, "path"); // $ SSRF
175+
SimpleHttpRequests.trace(uri.toString()); // $ SSRF
176+
SimpleHttpRequests.trace(uri); // $ SSRF
177+
178+
// org.apache.hc.client5.http.async.methods.SimpleRequestBuilder
179+
SimpleRequestBuilder.delete(uri.toString()); // $ SSRF
180+
SimpleRequestBuilder.delete(uri); // $ SSRF
181+
182+
SimpleRequestBuilder.get(uri.toString()); // $ SSRF
183+
SimpleRequestBuilder.get(uri); // $ SSRF
184+
185+
SimpleRequestBuilder.head(uri.toString()); // $ SSRF
186+
SimpleRequestBuilder.head(uri); // $ SSRF
187+
188+
SimpleRequestBuilder.options(uri.toString()); // $ SSRF
189+
SimpleRequestBuilder.options(uri); // $ SSRF
190+
191+
SimpleRequestBuilder.patch(uri.toString()); // $ SSRF
192+
SimpleRequestBuilder.patch(uri); // $ SSRF
193+
194+
SimpleRequestBuilder.post(uri.toString()); // $ SSRF
195+
SimpleRequestBuilder.post(uri); // $ SSRF
196+
197+
SimpleRequestBuilder.put(uri.toString()); // $ SSRF
198+
SimpleRequestBuilder.put(uri); // $ SSRF
199+
200+
SimpleRequestBuilder.get().setHttpHost(host); // $ SSRF
201+
202+
SimpleRequestBuilder.get().setUri(uri.toString()); // $ SSRF
203+
SimpleRequestBuilder.get().setUri(uri); // $ SSRF
204+
205+
SimpleRequestBuilder.trace(uri.toString()); // $ SSRF
206+
SimpleRequestBuilder.trace(uri); // $ SSRF
207+
208+
} catch (Exception e) {
209+
// TODO: handle exception
210+
}
211+
}
64212
}

‎java/ql/test/query-tests/security/CWE-918/options

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
//semmle-extractor-options: --javac-args -source 11 -target 11 -cp ${testdir}/../../../stubs/springframework-5.3.8:${testdir}/../../../stubs/javax-ws-rs-api-2.1.1:${testdir}/../../../stubs/javax-ws-rs-api-3.0.0:${testdir}/../../../stubs/apache-http-4.4.13/:${testdir}/../../../stubs/projectreactor-3.4.3/:${testdir}/../../../stubs/postgresql-42.3.3/:${testdir}/../../../stubs/HikariCP-3.4.5/:${testdir}/../../../stubs/spring-jdbc-5.3.8/:${testdir}/../../../stubs/jdbi3-core-3.27.2/:${testdir}/../../../stubs/cargo:${testdir}/../../../stubs/javafx-web:${testdir}/../../../stubs/apache-commons-jelly-1.0.1:${testdir}/../../../stubs/dom4j-2.1.1:${testdir}/../../../stubs/jaxen-1.2.0:${testdir}/../../../stubs/stapler-1.263:${testdir}/../../../stubs/javax-servlet-2.5:${testdir}/../../../stubs/apache-commons-fileupload-1.4:${testdir}/../../../stubs/saxon-xqj-9.x:${testdir}/../../../stubs/apache-commons-beanutils:${testdir}/../../../stubs/apache-commons-lang
1+
//semmle-extractor-options: --javac-args -source 11 -target 11 -cp ${testdir}/../../../stubs/springframework-5.3.8:${testdir}/../../../stubs/javax-ws-rs-api-2.1.1:${testdir}/../../../stubs/javax-ws-rs-api-3.0.0:${testdir}/../../../stubs/apache-http-4.4.13/:${testdir}/../../../stubs/projectreactor-3.4.3/:${testdir}/../../../stubs/postgresql-42.3.3/:${testdir}/../../../stubs/HikariCP-3.4.5/:${testdir}/../../../stubs/spring-jdbc-5.3.8/:${testdir}/../../../stubs/jdbi3-core-3.27.2/:${testdir}/../../../stubs/cargo:${testdir}/../../../stubs/javafx-web:${testdir}/../../../stubs/apache-commons-jelly-1.0.1:${testdir}/../../../stubs/dom4j-2.1.1:${testdir}/../../../stubs/jaxen-1.2.0:${testdir}/../../../stubs/stapler-1.263:${testdir}/../../../stubs/javax-servlet-2.5:${testdir}/../../../stubs/apache-commons-fileupload-1.4:${testdir}/../../../stubs/saxon-xqj-9.x:${testdir}/../../../stubs/apache-commons-beanutils:${testdir}/../../../stubs/apache-commons-lang:${testdir}/../../../stubs/apache-http-5-TEMP/

0 commit comments

Comments
 (0)