Fix RequestResponseFlowConfig.isSink error

Author: haby0

java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.ql

@@ -52,7 +52,7 @@ class RequestResponseFlowConfig extends TaintTracking::Configuration {
 
   override predicate isSink(DataFlow::Node sink) {
     sink instanceof XssSink and
-    any(RequestGetMethod m).polyCalls*(source.getEnclosingCallable())
+    any(RequestGetMethod m).polyCalls*(sink.getEnclosingCallable())
   }
 
   override predicate isAdditionalTaintStep(DataFlow::Node pred, DataFlow::Node succ) {

java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll

@@ -77,10 +77,13 @@ class SpringControllerRequestMappingGetMethod extends SpringControllerGetMethod
     this.getAnAnnotation()
         .getType()
         .hasQualifiedName("org.springframework.web.bind.annotation", "RequestMapping") and
-    this.getAnAnnotation().getValue("method").toString().regexpMatch("RequestMethod.GET|\\{...\\}") and
+    (
+      this.getAnAnnotation().getValue("method").(VarAccess).getVariable().getName() = "GET" or
+      this.getAnAnnotation().getValue("method").(ArrayInit).getSize() = 0 //Java code example: @RequestMapping(value = "test")
+    ) and
     not exists(MethodAccess ma |
       ma.getMethod() instanceof ServletRequestGetBodyMethod and
-      this = getACallingCallableOrSelf(ma.getEnclosingCallable())
+      any(this).polyCalls*(ma.getEnclosingCallable())
     ) and
     not this.getAParamType().getName() = "MultipartFile"
   }