Java: convert tests to inline expectations

Author: Jami Cogswell

java/ql/src/Security/CWE/CWE-016/SpringBootActuators.qll renamed to java/ql/lib/semmle/code/java/security/SpringBootActuatorsQuery.qll

@@ -1,3 +1,5 @@
+/** Provides classes and predicates to reason about exposed actuators in Spring Boot. */
+
 import java
 
 /** The class `org.springframework.security.config.annotation.web.builders.HttpSecurity`. */

java/ql/src/Security/CWE/CWE-016/SpringBootActuators.ql

@@ -12,7 +12,7 @@
  */
 
 import java
-import SpringBootActuators
+import semmle.code.java.security.SpringBootActuatorsQuery
 
 from PermitAllCall permitAllCall
 where permitAllCall.permitsSpringBootActuators()

java/ql/test/query-tests/security/CWE-016/SpringBootActuators.expected

@@ -1,33 +1,33 @@
 import org.springframework.boot.actuate.autoconfigure.security.servlet.EndpointRequest;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 
-public class SpringBootActuators {
+public class SpringBootActuatorsTest {
   protected void configure(HttpSecurity http) throws Exception {
-    http.requestMatcher(EndpointRequest.toAnyEndpoint()).authorizeRequests(requests -> requests.anyRequest().permitAll());
+    http.requestMatcher(EndpointRequest.toAnyEndpoint()).authorizeRequests(requests -> requests.anyRequest().permitAll()); // $ hasExposedSpringBootActuator
   }
 
   protected void configure2(HttpSecurity http) throws Exception {
-    http.requestMatcher(EndpointRequest.toAnyEndpoint()).authorizeRequests().requestMatchers(EndpointRequest.toAnyEndpoint()).permitAll();
+    http.requestMatcher(EndpointRequest.toAnyEndpoint()).authorizeRequests().requestMatchers(EndpointRequest.toAnyEndpoint()).permitAll(); // $ hasExposedSpringBootActuator
   }
 
   protected void configure3(HttpSecurity http) throws Exception {
-    http.requestMatchers(matcher -> EndpointRequest.toAnyEndpoint()).authorizeRequests().requestMatchers(EndpointRequest.toAnyEndpoint()).permitAll();
+    http.requestMatchers(matcher -> EndpointRequest.toAnyEndpoint()).authorizeRequests().requestMatchers(EndpointRequest.toAnyEndpoint()).permitAll(); // $ hasExposedSpringBootActuator
   }
 
   protected void configure4(HttpSecurity http) throws Exception {
-    http.requestMatcher(EndpointRequest.toAnyEndpoint()).authorizeRequests().anyRequest().permitAll();
+    http.requestMatcher(EndpointRequest.toAnyEndpoint()).authorizeRequests().anyRequest().permitAll(); // $ hasExposedSpringBootActuator
   }
 
   protected void configure5(HttpSecurity http) throws Exception {
-    http.authorizeRequests().requestMatchers(EndpointRequest.toAnyEndpoint()).permitAll();
+    http.authorizeRequests().requestMatchers(EndpointRequest.toAnyEndpoint()).permitAll(); // $ hasExposedSpringBootActuator
   }
 
   protected void configure6(HttpSecurity http) throws Exception {
-    http.authorizeRequests(requests -> requests.requestMatchers(EndpointRequest.toAnyEndpoint()).permitAll());
+    http.authorizeRequests(requests -> requests.requestMatchers(EndpointRequest.toAnyEndpoint()).permitAll()); // $ hasExposedSpringBootActuator
   }
 
   protected void configure7(HttpSecurity http) throws Exception {
-    http.requestMatchers(matcher -> EndpointRequest.toAnyEndpoint()).authorizeRequests().anyRequest().permitAll();
+    http.requestMatchers(matcher -> EndpointRequest.toAnyEndpoint()).authorizeRequests().anyRequest().permitAll(); // $ hasExposedSpringBootActuator
   }
 
   protected void configureOk1(HttpSecurity http) throws Exception {

java/ql/test/query-tests/security/CWE-016/SpringBootActuators.qlref

@@ -0,0 +1,18 @@
+import java
+import semmle.code.java.security.SpringBootActuatorsQuery
+import utils.test.InlineExpectationsTest
+
+module SpringBootActuatorsTest implements TestSig {
+  string getARelevantTag() { result = "hasExposedSpringBootActuator" }
+
+  predicate hasActualResult(Location location, string element, string tag, string value) {
+    tag = "hasExposedSpringBootActuator" and
+    exists(PermitAllCall permitAllCall | permitAllCall.permitsSpringBootActuators() |
+      permitAllCall.getLocation() = location and
+      element = permitAllCall.toString() and
+      value = ""
+    )
+  }
+}
+
+import MakeTest<SpringBootActuatorsTest>