Add isSanitizerGuard, verify file path

Author: haby0

java/ql/src/experimental/Security/CWE/CWE-089/MyBatisMapperXmlSqlInjection.ql

@@ -14,6 +14,7 @@
 import java
 import DataFlow::PathGraph
 import MyBatisMapperXmlSqlInjectionLib
+import semmle.code.java.security.SanitizerGuard
 import semmle.code.java.dataflow.FlowSources
 
 private class MyBatisMapperXmlSqlInjectionConfiguration extends TaintTracking::Configuration {
@@ -30,6 +31,10 @@ private class MyBatisMapperXmlSqlInjectionConfiguration extends TaintTracking::C
     node.getType() instanceof BoxedType or
     node.getType() instanceof NumberType
   }
+
+  override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) {
+    guard instanceof ContainsSanitizer or guard instanceof EqualsSanitizer
+  }
 }
 
 from

java/ql/src/semmle/code/java/security/SanitizerGuard.qll

@@ -0,0 +1,33 @@
+/**
+ * Provide universal sanitizer guards.
+ */
+
+import java
+import semmle.code.java.dataflow.DataFlow
+
+/**
+ * An contains method sanitizer guard.
+ * 
+ * e.g. `if(test.contains("test")) {...`
+ */
+class ContainsSanitizer extends DataFlow::BarrierGuard {
+  ContainsSanitizer() { this.(MethodAccess).getMethod().hasName("contains") }
+
+  override predicate checks(Expr e, boolean branch) {
+    e = this.(MethodAccess).getArgument(0) and branch = true
+  }
+}
+
+/**
+ * An equals method sanitizer guard.
+ * 
+ * e.g. `if("test".equals(test)) {...`
+ */
+class EqualsSanitizer extends DataFlow::BarrierGuard {
+  EqualsSanitizer() { this.(MethodAccess).getMethod().hasName("equals") }
+
+  override predicate checks(Expr e, boolean branch) {
+    e = [this.(MethodAccess).getArgument(0), this.(MethodAccess).getQualifier()] and
+    branch = true
+  }
+}

java/ql/src/semmle/code/xml/MyBatisMapperXML.qll

@@ -6,7 +6,8 @@ import java
 class MyBatisMapperXMLFile extends XMLFile {
   MyBatisMapperXMLFile() {
     count(XMLElement e | e = this.getAChild()) = 1 and
-    this.getAChild().getName() = "mapper"
+    this.getAChild().getName() = "mapper" and
+    this.getFile().getAbsolutePath().indexOf("/src/main") > 0
   }
 }