Make the test runnable via codeql test run

ggolawski · ggolawski · commit 1d8da905ac02 · 2020-04-03T21:44:13.000+02:00
diff --git a/java/ql/src/experimental/qlpack.yml b/java/ql/src/experimental/qlpack.yml
@@ -0,0 +1,3 @@
+name: codeql-java-experimental
+version: 0.0.0
+libraryPathDependencies: codeql-java
diff --git a/java/ql/test/experimental/qlpack.yml b/java/ql/test/experimental/qlpack.yml
@@ -0,0 +1,4 @@
+name: codeql-java-experimental-tests
+version: 0.0.0
+libraryPathDependencies: codeql-java-experimental
+extractor: java
diff --git a/java/ql/test/experimental/query-tests/security/CWE-016/SpringBootActuators.expected b/java/ql/test/experimental/query-tests/security/CWE-016/SpringBootActuators.expected
@@ -0,0 +1,7 @@
+| SpringBootActuators.java:6:88:6:120 | permitAll(...) | Unauthenticated access to Spring Boot actuator is allowed. |
+| SpringBootActuators.java:10:5:10:137 | permitAll(...) | Unauthenticated access to Spring Boot actuator is allowed. |
+| SpringBootActuators.java:14:5:14:149 | permitAll(...) | Unauthenticated access to Spring Boot actuator is allowed. |
+| SpringBootActuators.java:18:5:18:101 | permitAll(...) | Unauthenticated access to Spring Boot actuator is allowed. |
+| SpringBootActuators.java:22:5:22:89 | permitAll(...) | Unauthenticated access to Spring Boot actuator is allowed. |
+| SpringBootActuators.java:26:40:26:108 | permitAll(...) | Unauthenticated access to Spring Boot actuator is allowed. |
+| SpringBootActuators.java:30:5:30:113 | permitAll(...) | Unauthenticated access to Spring Boot actuator is allowed. |
diff --git a/java/ql/test/experimental/query-tests/security/CWE-016/options b/java/ql/test/experimental/query-tests/security/CWE-016/options
@@ -0,0 +1 @@
+//semmle-extractor-options: --javac-args -cp ${testdir}/../../../stubs/springframework-5.2.3
diff --git a/java/ql/test/experimental/stubs/springframework-5.2.3/org/springframework/beans/factory/BeanFactory.java b/java/ql/test/experimental/stubs/springframework-5.2.3/org/springframework/beans/factory/BeanFactory.java
@@ -0,0 +1,3 @@
+package org.springframework.beans.factory;
+
+public interface BeanFactory {}
diff --git a/java/ql/test/experimental/stubs/springframework-5.2.3/org/springframework/beans/factory/HierarchicalBeanFactory.java b/java/ql/test/experimental/stubs/springframework-5.2.3/org/springframework/beans/factory/HierarchicalBeanFactory.java
@@ -0,0 +1,3 @@
+package org.springframework.beans.factory;
+
+public interface HierarchicalBeanFactory extends BeanFactory {}
diff --git a/java/ql/test/experimental/stubs/springframework-5.2.3/org/springframework/beans/factory/ListableBeanFactory.java b/java/ql/test/experimental/stubs/springframework-5.2.3/org/springframework/beans/factory/ListableBeanFactory.java
@@ -0,0 +1,3 @@
+package org.springframework.beans.factory;
+
+public interface ListableBeanFactory extends BeanFactory {}
diff --git a/java/ql/test/experimental/stubs/springframework-5.2.3/org/springframework/boot/actuate/autoconfigure/security/servlet/EndpointRequest.java b/java/ql/test/experimental/stubs/springframework-5.2.3/org/springframework/boot/actuate/autoconfigure/security/servlet/EndpointRequest.java
@@ -0,0 +1,15 @@
+package org.springframework.boot.actuate.autoconfigure.security.servlet;
+
+import org.springframework.boot.security.servlet.ApplicationContextRequestMatcher;
+import org.springframework.web.context.WebApplicationContext;
+
+public final class EndpointRequest {
+	public static EndpointRequestMatcher toAnyEndpoint() {
+		return null;
+  }
+  
+  public static final class EndpointRequestMatcher extends AbstractRequestMatcher {}
+
+  private abstract static class AbstractRequestMatcher
+			extends ApplicationContextRequestMatcher<WebApplicationContext> {}
+}
diff --git a/java/ql/test/experimental/stubs/springframework-5.2.3/org/springframework/boot/security/servlet/ApplicationContextRequestMatcher.java b/java/ql/test/experimental/stubs/springframework-5.2.3/org/springframework/boot/security/servlet/ApplicationContextRequestMatcher.java
@@ -0,0 +1,5 @@
+package org.springframework.boot.security.servlet;
+
+import org.springframework.security.web.util.matcher.RequestMatcher;
+
+public abstract class ApplicationContextRequestMatcher<C> implements RequestMatcher {}
diff --git a/java/ql/test/experimental/stubs/springframework-5.2.3/org/springframework/context/ApplicationContext.java b/java/ql/test/experimental/stubs/springframework-5.2.3/org/springframework/context/ApplicationContext.java
@@ -0,0 +1,9 @@
+package org.springframework.context;
+
+import org.springframework.beans.factory.HierarchicalBeanFactory;
+import org.springframework.beans.factory.ListableBeanFactory;
+import org.springframework.core.env.EnvironmentCapable;
+import org.springframework.core.io.support.ResourcePatternResolver;
+
+public interface ApplicationContext extends EnvironmentCapable, ListableBeanFactory, HierarchicalBeanFactory,
+		MessageSource, ApplicationEventPublisher, ResourcePatternResolver {}
diff --git a/java/ql/test/experimental/stubs/springframework-5.2.3/org/springframework/context/ApplicationEventPublisher.java b/java/ql/test/experimental/stubs/springframework-5.2.3/org/springframework/context/ApplicationEventPublisher.java
@@ -0,0 +1,6 @@
+package org.springframework.context;
+
+@FunctionalInterface
+public interface ApplicationEventPublisher {
+  void publishEvent(Object event);
+}
diff --git a/java/ql/test/experimental/stubs/springframework-5.2.3/org/springframework/context/MessageSource.java b/java/ql/test/experimental/stubs/springframework-5.2.3/org/springframework/context/MessageSource.java
@@ -0,0 +1,3 @@
+package org.springframework.context;
+
+public interface MessageSource {}
diff --git a/java/ql/test/experimental/stubs/springframework-5.2.3/org/springframework/core/env/EnvironmentCapable.java b/java/ql/test/experimental/stubs/springframework-5.2.3/org/springframework/core/env/EnvironmentCapable.java
@@ -0,0 +1,3 @@
+package org.springframework.core.env;
+
+public interface EnvironmentCapable {}
diff --git a/java/ql/test/experimental/stubs/springframework-5.2.3/org/springframework/core/io/ResourceLoader.java b/java/ql/test/experimental/stubs/springframework-5.2.3/org/springframework/core/io/ResourceLoader.java
@@ -0,0 +1,3 @@
+package org.springframework.core.io;
+
+public interface ResourceLoader {}
diff --git a/java/ql/test/experimental/stubs/springframework-5.2.3/org/springframework/core/io/support/ResourcePatternResolver.java b/java/ql/test/experimental/stubs/springframework-5.2.3/org/springframework/core/io/support/ResourcePatternResolver.java
@@ -0,0 +1,5 @@
+package org.springframework.core.io.support;
+
+import org.springframework.core.io.ResourceLoader;
+
+public interface ResourcePatternResolver extends ResourceLoader {}
diff --git a/java/ql/test/experimental/stubs/springframework-5.2.3/org/springframework/security/config/Customizer.java b/java/ql/test/experimental/stubs/springframework-5.2.3/org/springframework/security/config/Customizer.java
@@ -0,0 +1,6 @@
+package org.springframework.security.config;
+
+@FunctionalInterface
+public interface Customizer<T> {
+  void customize(T t);
+}
diff --git a/java/ql/test/experimental/stubs/springframework-5.2.3/org/springframework/security/config/annotation/AbstractConfiguredSecurityBuilder.java b/java/ql/test/experimental/stubs/springframework-5.2.3/org/springframework/security/config/annotation/AbstractConfiguredSecurityBuilder.java
@@ -0,0 +1,4 @@
+package org.springframework.security.config.annotation;
+
+public abstract class AbstractConfiguredSecurityBuilder<O, B extends SecurityBuilder<O>>
+		extends AbstractSecurityBuilder<O> {}
diff --git a/java/ql/test/experimental/stubs/springframework-5.2.3/org/springframework/security/config/annotation/AbstractSecurityBuilder.java b/java/ql/test/experimental/stubs/springframework-5.2.3/org/springframework/security/config/annotation/AbstractSecurityBuilder.java
@@ -0,0 +1,3 @@
+package org.springframework.security.config.annotation;
+
+public abstract class AbstractSecurityBuilder<O> implements SecurityBuilder<O> {}
diff --git a/java/ql/test/experimental/stubs/springframework-5.2.3/org/springframework/security/config/annotation/SecurityBuilder.java b/java/ql/test/experimental/stubs/springframework-5.2.3/org/springframework/security/config/annotation/SecurityBuilder.java
@@ -0,0 +1,3 @@
+package org.springframework.security.config.annotation;
+
+public interface SecurityBuilder<O> {}
diff --git a/java/ql/test/experimental/stubs/springframework-5.2.3/org/springframework/security/config/annotation/SecurityConfigurer.java b/java/ql/test/experimental/stubs/springframework-5.2.3/org/springframework/security/config/annotation/SecurityConfigurer.java
@@ -0,0 +1,3 @@
+package org.springframework.security.config.annotation;
+
+public interface SecurityConfigurer<O, B extends SecurityBuilder<O>> {}
diff --git a/java/ql/test/experimental/stubs/springframework-5.2.3/org/springframework/security/config/annotation/SecurityConfigurerAdapter.java b/java/ql/test/experimental/stubs/springframework-5.2.3/org/springframework/security/config/annotation/SecurityConfigurerAdapter.java
@@ -0,0 +1,4 @@
+package org.springframework.security.config.annotation;
+
+public abstract class SecurityConfigurerAdapter<O, B extends SecurityBuilder<O>>
+		implements SecurityConfigurer<O, B> {}
diff --git a/java/ql/test/experimental/stubs/springframework-5.2.3/org/springframework/security/config/annotation/web/AbstractRequestMatcherRegistry.java b/java/ql/test/experimental/stubs/springframework-5.2.3/org/springframework/security/config/annotation/web/AbstractRequestMatcherRegistry.java
@@ -0,0 +1,13 @@
+package org.springframework.security.config.annotation.web;
+
+import org.springframework.security.web.util.matcher.RequestMatcher;
+
+public abstract class AbstractRequestMatcherRegistry<C> {
+  public C anyRequest() {
+    return null;
+  }
+  
+  public C requestMatchers(RequestMatcher... requestMatchers) {
+		return null;
+	}
+}
diff --git a/java/ql/test/experimental/stubs/springframework-5.2.3/org/springframework/security/config/annotation/web/HttpSecurityBuilder.java b/java/ql/test/experimental/stubs/springframework-5.2.3/org/springframework/security/config/annotation/web/HttpSecurityBuilder.java
@@ -0,0 +1,7 @@
+package org.springframework.security.config.annotation.web;
+
+import org.springframework.security.config.annotation.SecurityBuilder;
+import org.springframework.security.web.DefaultSecurityFilterChain;
+
+public interface HttpSecurityBuilder<H extends HttpSecurityBuilder<H>> extends
+		SecurityBuilder<DefaultSecurityFilterChain> {}
diff --git a/java/ql/test/experimental/stubs/springframework-5.2.3/org/springframework/security/config/annotation/web/builders/HttpSecurity.java b/java/ql/test/experimental/stubs/springframework-5.2.3/org/springframework/security/config/annotation/web/builders/HttpSecurity.java
@@ -0,0 +1,43 @@
+package org.springframework.security.config.annotation.web.builders;
+
+import org.springframework.security.config.annotation.AbstractConfiguredSecurityBuilder;
+import org.springframework.security.config.annotation.SecurityBuilder;
+import org.springframework.security.config.annotation.web.HttpSecurityBuilder;
+import org.springframework.security.web.DefaultSecurityFilterChain;
+import org.springframework.security.web.util.matcher.RequestMatcher;
+import org.springframework.security.config.Customizer;
+import org.springframework.security.config.annotation.web.configurers.ExpressionUrlAuthorizationConfigurer;
+import org.springframework.security.config.annotation.web.AbstractRequestMatcherRegistry;
+
+public final class HttpSecurity extends AbstractConfiguredSecurityBuilder<DefaultSecurityFilterChain, HttpSecurity>
+		implements SecurityBuilder<DefaultSecurityFilterChain>, HttpSecurityBuilder<HttpSecurity> {
+
+	public HttpSecurity requestMatcher(RequestMatcher requestMatcher) {
+		return this;
+	}
+
+	public HttpSecurity authorizeRequests(
+			Customizer<ExpressionUrlAuthorizationConfigurer<HttpSecurity>.ExpressionInterceptUrlRegistry> authorizeRequestsCustomizer)
+			throws Exception {
+		return this;
+	}
+
+	public ExpressionUrlAuthorizationConfigurer<HttpSecurity>.ExpressionInterceptUrlRegistry authorizeRequests()
+			throws Exception {
+		return null;
+	}
+
+	public HttpSecurity requestMatchers(Customizer<RequestMatcherConfigurer> requestMatcherCustomizer) {
+		return this;
+	}
+
+	public RequestMatcherConfigurer requestMatchers() {
+		return null;
+	}
+
+	public final class MvcMatchersRequestMatcherConfigurer extends RequestMatcherConfigurer {
+	}
+
+	public class RequestMatcherConfigurer extends AbstractRequestMatcherRegistry<RequestMatcherConfigurer> {
+	}
+}
diff --git a/java/ql/test/experimental/stubs/springframework-5.2.3/org/springframework/security/config/annotation/web/configurers/AbstractConfigAttributeRequestMatcherRegistry.java b/java/ql/test/experimental/stubs/springframework-5.2.3/org/springframework/security/config/annotation/web/configurers/AbstractConfigAttributeRequestMatcherRegistry.java
@@ -0,0 +1,6 @@
+package org.springframework.security.config.annotation.web.configurers;
+
+import org.springframework.security.config.annotation.web.AbstractRequestMatcherRegistry;
+
+public abstract class AbstractConfigAttributeRequestMatcherRegistry<C> extends
+		AbstractRequestMatcherRegistry<C> {}
diff --git a/java/ql/test/experimental/stubs/springframework-5.2.3/org/springframework/security/config/annotation/web/configurers/AbstractHttpConfigurer.java b/java/ql/test/experimental/stubs/springframework-5.2.3/org/springframework/security/config/annotation/web/configurers/AbstractHttpConfigurer.java
@@ -0,0 +1,8 @@
+package org.springframework.security.config.annotation.web.configurers;
+
+import org.springframework.security.config.annotation.SecurityConfigurerAdapter;
+import org.springframework.security.config.annotation.web.HttpSecurityBuilder;
+import org.springframework.security.web.DefaultSecurityFilterChain;
+
+public abstract class AbstractHttpConfigurer<T extends AbstractHttpConfigurer<T, B>, B extends HttpSecurityBuilder<B>>
+		extends SecurityConfigurerAdapter<DefaultSecurityFilterChain, B> {}
diff --git a/java/ql/test/experimental/stubs/springframework-5.2.3/org/springframework/security/config/annotation/web/configurers/AbstractInterceptUrlConfigurer.java b/java/ql/test/experimental/stubs/springframework-5.2.3/org/springframework/security/config/annotation/web/configurers/AbstractInterceptUrlConfigurer.java
@@ -0,0 +1,10 @@
+package org.springframework.security.config.annotation.web.configurers;
+
+import org.springframework.security.config.annotation.web.HttpSecurityBuilder;
+
+abstract class AbstractInterceptUrlConfigurer<C extends AbstractInterceptUrlConfigurer<C, H>, H extends HttpSecurityBuilder<H>>
+		extends AbstractHttpConfigurer<C, H> {
+	abstract class AbstractInterceptUrlRegistry<R extends AbstractInterceptUrlRegistry<R, T>, T>
+			extends AbstractConfigAttributeRequestMatcherRegistry<T> {
+	}
+}
diff --git a/java/ql/test/experimental/stubs/springframework-5.2.3/org/springframework/security/config/annotation/web/configurers/ExpressionUrlAuthorizationConfigurer.java b/java/ql/test/experimental/stubs/springframework-5.2.3/org/springframework/security/config/annotation/web/configurers/ExpressionUrlAuthorizationConfigurer.java
@@ -0,0 +1,16 @@
+package org.springframework.security.config.annotation.web.configurers;
+
+import org.springframework.security.config.annotation.web.HttpSecurityBuilder;
+
+public final class ExpressionUrlAuthorizationConfigurer<H extends HttpSecurityBuilder<H>>
+		extends AbstractInterceptUrlConfigurer<ExpressionUrlAuthorizationConfigurer<H>, H> {
+	public class ExpressionInterceptUrlRegistry extends
+			ExpressionUrlAuthorizationConfigurer<H>.AbstractInterceptUrlRegistry<ExpressionInterceptUrlRegistry, AuthorizedUrl> {
+	}
+
+	public class AuthorizedUrl {
+		public ExpressionInterceptUrlRegistry permitAll() {
+			return null;
+		}
+	}
+}
diff --git a/java/ql/test/experimental/stubs/springframework-5.2.3/org/springframework/security/web/DefaultSecurityFilterChain.java b/java/ql/test/experimental/stubs/springframework-5.2.3/org/springframework/security/web/DefaultSecurityFilterChain.java
@@ -0,0 +1,3 @@
+package org.springframework.security.web;
+
+public final class DefaultSecurityFilterChain implements SecurityFilterChain {}
diff --git a/java/ql/test/experimental/stubs/springframework-5.2.3/org/springframework/security/web/SecurityFilterChain.java b/java/ql/test/experimental/stubs/springframework-5.2.3/org/springframework/security/web/SecurityFilterChain.java
@@ -0,0 +1,3 @@
+package org.springframework.security.web;
+
+public interface SecurityFilterChain {}
diff --git a/java/ql/test/experimental/stubs/springframework-5.2.3/org/springframework/security/web/util/matcher/RequestMatcher.java b/java/ql/test/experimental/stubs/springframework-5.2.3/org/springframework/security/web/util/matcher/RequestMatcher.java
@@ -0,0 +1,3 @@
+package org.springframework.security.web.util.matcher;
+
+public interface RequestMatcher {}
diff --git a/java/ql/test/experimental/stubs/springframework-5.2.3/org/springframework/web/context/WebApplicationContext.java b/java/ql/test/experimental/stubs/springframework-5.2.3/org/springframework/web/context/WebApplicationContext.java
@@ -0,0 +1,5 @@
+package org.springframework.web.context;
+
+import org.springframework.context.ApplicationContext;
+
+public interface WebApplicationContext extends ApplicationContext {}

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+name: codeql-java-experimental`
	`2`	`+version: 0.0.0`
	`3`	`+libraryPathDependencies: codeql-java`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1 @@`
	`1`	`+//semmle-extractor-options: --javac-args -cp ${testdir}/../../../stubs/springframework-5.2.3`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+package org.springframework.beans.factory;`
	`2`	`+`
	`3`	`+public interface BeanFactory {}`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+package org.springframework.beans.factory;`
	`2`	`+`
	`3`	`+public interface HierarchicalBeanFactory extends BeanFactory {}`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+package org.springframework.beans.factory;`
	`2`	`+`
	`3`	`+public interface ListableBeanFactory extends BeanFactory {}`