Skip to content

Commit 82ea259

Browse files
committed
Spring HTTP: Fix test mistakes
Classes without RestController and methods without GetMapping or similar were never going to be detected.
1 parent 392e405 commit 82ea259

File tree

1 file changed

+13
-8
lines changed

1 file changed

+13
-8
lines changed

java/ql/test/query-tests/security/CWE-079/semmle/tests/SpringXSS.java

Lines changed: 13 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -99,46 +99,51 @@ public static ResponseEntity<String> methodContentTypeMaybeSafeStringLiterals(St
9999
}
100100
}
101101

102+
@RestController
102103
@RequestMapping(produces = {"application/json"})
103104
private static class ClassContentTypeSafe {
105+
@GetMapping(value = "/abc")
104106
public ResponseEntity<String> test(String userControlled) {
105-
return ResponseEntity.ok(userControlled);
107+
return ResponseEntity.ok(userControlled); // $SPURIOUS: xss
106108
}
107109

108110
@GetMapping(value = "/abc")
109111
public String testDirectReturn(String userControlled) {
110-
return userControlled;
112+
return userControlled; // $SPURIOUS: xss
111113
}
112114

113115
@GetMapping(value = "/xyz", produces = {"text/html"})
114116
public ResponseEntity<String> overridesWithUnsafe(String userControlled) {
115-
return ResponseEntity.ok(userControlled); // $MISSING: xss
117+
return ResponseEntity.ok(userControlled); // $xss
116118
}
117119

118120
@GetMapping(value = "/abc")
119121
public ResponseEntity<String> overridesWithUnsafe2(String userControlled) {
120-
return ResponseEntity.ok().contentType(MediaType.TEXT_HTML).body(userControlled); // $MISSING: xss
122+
return ResponseEntity.ok().contentType(MediaType.TEXT_HTML).body(userControlled); // $xss
121123
}
122124
}
123125

126+
@RestController
124127
@RequestMapping(produces = {"text/html"})
125128
private static class ClassContentTypeUnsafe {
129+
@GetMapping(value = "/abc")
126130
public ResponseEntity<String> test(String userControlled) {
127-
return ResponseEntity.ok(userControlled); // $MISSING: xss
131+
return ResponseEntity.ok(userControlled); // $xss
128132
}
129133

130134
@GetMapping(value = "/abc")
131135
public String testDirectReturn(String userControlled) {
132-
return userControlled; //$MISSING: xss
136+
return userControlled; // $xss
133137
}
134138

135139
@GetMapping(value = "/xyz", produces = {"application/json"})
136140
public ResponseEntity<String> overridesWithSafe(String userControlled) {
137-
return ResponseEntity.ok(userControlled);
141+
return ResponseEntity.ok(userControlled); // $SPURIOUS: xss
138142
}
139143

144+
@GetMapping(value = "/abc")
140145
public ResponseEntity<String> overridesWithSafe2(String userControlled) {
141-
return ResponseEntity.ok().contentType(MediaType.APPLICATION_JSON).body(userControlled);
146+
return ResponseEntity.ok().contentType(MediaType.APPLICATION_JSON).body(userControlled); // $SPURIOUS: xss
142147
}
143148
}
144149

0 commit comments

Comments
 (0)