Convert model to QL

Author: owen-mc

java/ql/lib/ext/org.springframework.web.client.model.yml

@@ -16,9 +16,6 @@ extensions:
       - ["org.springframework.web.client", "RestTemplate", False, "execute", "", "", "Argument[0]", "request-forgery", "manual"]
       - ["org.springframework.web.client", "RestTemplate", False, "getForEntity", "", "", "Argument[0]", "request-forgery", "manual"]
       - ["org.springframework.web.client", "RestTemplate", False, "getForObject", "", "", "Argument[0]", "request-forgery", "manual"]
-      - ["org.springframework.web.client", "RestTemplate", False, "getForObject", "", "", "Argument[2]", "request-forgery", "manual"] # This is a workaround for the fact that sink model can't currently have access paths
-      # - ["org.springframework.web.client", "RestTemplate", False, "getForObject", "", "", "Argument[2].ArrayElement", "request-forgery", "manual"]
-      # - ["org.springframework.web.client", "RestTemplate", False, "getForObject", "", "", "Argument[2].MapValue", "request-forgery", "manual"]
       - ["org.springframework.web.client", "RestTemplate", False, "headForHeaders", "", "", "Argument[0]", "request-forgery", "manual"]
       - ["org.springframework.web.client", "RestTemplate", False, "optionsForAllow", "", "", "Argument[0]", "request-forgery", "manual"]
       - ["org.springframework.web.client", "RestTemplate", False, "patchForObject", "", "", "Argument[0]", "request-forgery", "manual"]

java/ql/lib/semmle/code/java/frameworks/spring/SpringWebClient.qll

@@ -27,3 +27,21 @@ class SpringWebClient extends Interface {
     this.hasQualifiedName("org.springframework.web.reactive.function.client", "WebClient")
   }
 }
+
+private import semmle.code.java.security.RequestForgery
+
+private class SpringWebClientRestTemplateGetForObject extends RequestForgerySink {
+  SpringWebClientRestTemplateGetForObject() {
+    exists(Method m, MethodCall mc, int i |
+      m.getDeclaringType() instanceof SpringRestTemplate and
+      m.hasName("getForObject") and
+      mc.getMethod() = m
+    |
+      // Deal with two overloads, with third parameter type `Object...` and
+      // `Map<String, ?>`. We cannot deal with mapvalue content easily but
+      // there is a default implicit taint read at sinks that will catch it.
+      this.asExpr() = mc.getArgument(i) and
+      i >= 2
+    )
+  }
+}