Skip to content

Commit c37ecb7

Browse files
committed
Fix existing JaxRs tests
* Expose getContentTypeString for use by tests * Use it to get constant arguments to @produces annotations * Note that text/html is xss-vulnerable (I have no idea how it ever came to expect exactly text/plain)
1 parent 52471b2 commit c37ecb7

File tree

4 files changed

+9
-5
lines changed

4 files changed

+9
-5
lines changed

java/ql/src/semmle/code/java/frameworks/JaxWS.qll

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -283,7 +283,10 @@ class MessageBodyReaderRead extends Method {
283283
}
284284
}
285285

286-
private string getContentTypeString(Expr e) {
286+
/**
287+
* Gets a constant content-type described by expression `e` (either a string constant or a Jax-RS MediaType field access).
288+
*/
289+
string getContentTypeString(Expr e) {
287290
result = e.(CompileTimeConstantExpr).getStringValue() and
288291
result != ""
289292
or

java/ql/test/library-tests/frameworks/JaxWs/JakartaRs1.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -71,7 +71,7 @@ int Get() { // $ ResourceMethod ResourceMethodOnResourceClass
7171
@Produces("text/html") // $ ProducesAnnotation=text/html
7272
@POST
7373
boolean Post() { // $ ResourceMethod=text/html ResourceMethodOnResourceClass
74-
return false;
74+
return false; // $ XssSink
7575
}
7676

7777
@Produces(MediaType.TEXT_PLAIN) // $ ProducesAnnotation=text/plain

java/ql/test/library-tests/frameworks/JaxWs/JaxRs.ql

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,8 @@ class JaxRsTest extends InlineExpectationsTest {
2525
element = resourceMethod.toString() and
2626
if exists(resourceMethod.getProducesAnnotation())
2727
then
28-
value = resourceMethod.getProducesAnnotation().getADeclaredContentType() and
28+
value =
29+
getContentTypeString(resourceMethod.getProducesAnnotation().getADeclaredContentTypeExpr()) and
2930
value != ""
3031
else
3132
// Filter out empty strings that stem from using stubs.
@@ -143,7 +144,7 @@ class JaxRsTest extends InlineExpectationsTest {
143144
exists(JaxRSProducesAnnotation producesAnnotation |
144145
producesAnnotation.getLocation() = location and
145146
element = producesAnnotation.toString() and
146-
value = producesAnnotation.getADeclaredContentType() and
147+
value = getContentTypeString(producesAnnotation.getADeclaredContentTypeExpr()) and
147148
value != ""
148149
// Filter out empty strings that stem from using stubs.
149150
// If we built the test against the real JAR then the field

java/ql/test/library-tests/frameworks/JaxWs/JaxRs1.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -71,7 +71,7 @@ int Get() { // $ ResourceMethod ResourceMethodOnResourceClass
7171
@Produces("text/html") // $ ProducesAnnotation=text/html
7272
@POST
7373
boolean Post() { // $ ResourceMethod=text/html ResourceMethodOnResourceClass
74-
return false;
74+
return false; // $ XssSink
7575
}
7676

7777
@Produces(MediaType.TEXT_PLAIN) // $ ProducesAnnotation=text/plain

0 commit comments

Comments
 (0)