Consider Jakarta Mail

Author: atorralba

java/ql/src/semmle/code/java/frameworks/Mail.qll

@@ -3,14 +3,14 @@
 import java
 
 /**
- * The class `javax.mail.Session`
+ * The class `javax.mail.Session` or `jakarta.mail.Session`.
  */
 class MailSession extends Class {
-  MailSession() { this.hasQualifiedName("javax.mail", "Session") }
+  MailSession() { this.hasQualifiedName(["javax.mail", "jakarta.mail"], "Session") }
 }
 
 /**
- * The method `getInstance` of the class `javax.mail.Session`
+ * The method `getInstance` of the classes `javax.mail.Session` or `jakarta.mail.Session`.
  */
 class MailSessionGetInstanceMethod extends Method {
   MailSessionGetInstanceMethod() {
@@ -20,7 +20,7 @@ class MailSessionGetInstanceMethod extends Method {
 }
 
 /**
- * A subtype of the class `org.apache.commons.mail.Email`
+ * A subtype of the class `org.apache.commons.mail.Email`.
  */
 class ApacheEmail extends Class {
   ApacheEmail() { this.getASupertype*().hasQualifiedName("org.apache.commons.mail", "Email") }

java/ql/test/query-tests/security/CWE-297/InsecureJakartaMailTest.java

@@ -0,0 +1,42 @@
+import java.util.Properties;
+
+import jakarta.mail.Authenticator;
+import jakarta.mail.PasswordAuthentication;
+import jakarta.mail.Session;
+
+class InsecureJakartaMailTest {
+	public void testJavaMail() {
+		final Properties properties = new Properties();
+		properties.put("mail.transport.protocol", "protocol");
+		properties.put("mail.smtp.host", "hostname");
+		properties.put("mail.smtp.socketFactory.class", "classname");
+
+		final jakarta.mail.Authenticator authenticator = new jakarta.mail.Authenticator() {
+			protected PasswordAuthentication getPasswordAuthentication() {
+				return new PasswordAuthentication("username", "password");
+			}
+		};
+		if (null != authenticator) {
+			properties.put("mail.smtp.auth", "true");
+		}
+		final Session session = Session.getInstance(properties, authenticator); // $hasInsecureJavaMail
+	}
+
+	public void testSecureJavaMail() {
+		final Properties properties = new Properties();
+		properties.put("mail.transport.protocol", "protocol");
+		properties.put("mail.smtp.host", "hostname");
+		properties.put("mail.smtp.socketFactory.class", "classname");
+
+		final jakarta.mail.Authenticator authenticator = new jakarta.mail.Authenticator() {
+			protected PasswordAuthentication getPasswordAuthentication() {
+				return new PasswordAuthentication("username", "password");
+			}
+		};
+		if (null != authenticator) {
+			properties.put("mail.smtp.auth", "true");
+			properties.put("mail.smtp.ssl.checkserveridentity", "true");
+		}
+		final Session session = Session.getInstance(properties, authenticator); // Safe
+	}
+}

java/ql/test/query-tests/security/CWE-297/options

@@ -1 +1 @@
-// semmle-extractor-options: --javac-args -cp ${testdir}/../../../stubs/apache-commons-email-1.6.0:${testdir}/../../../stubs/javamail-api-1.6.2
+// semmle-extractor-options: --javac-args -cp ${testdir}/../../../stubs/apache-commons-email-1.6.0:${testdir}/../../../stubs/javamail-api-1.6.2:${testdir}/../../../stubs/jakarta-mail-2.0.1