Skip to content

Commit 746f022

Browse files
Jami CogswellJami Cogswell
Jami Cogswell
authored and
Jami Cogswell
committed
Java: add 'Spring' prefix to public class names
1 parent c2e859c commit 746f022

File tree

4 files changed

+50
-50
lines changed

4 files changed

+50
-50
lines changed

‎java/ql/lib/semmle/code/java/frameworks/spring/SpringBoot.qll‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -8,17 +8,17 @@ import java
88
/**
99
* The class `org.springframework.boot.actuate.autoconfigure.security.servlet.EndpointRequest`.
1010
*/
11-
class TypeEndpointRequest extends Class {
12-
TypeEndpointRequest() {
11+
class SpringEndpointRequest extends Class {
12+
SpringEndpointRequest() {
1313
this.hasQualifiedName("org.springframework.boot.actuate.autoconfigure.security.servlet",
1414
"EndpointRequest")
1515
}
1616
}
1717

1818
/** A call to `EndpointRequest.toAnyEndpoint` method. */
19-
class ToAnyEndpointCall extends MethodCall {
20-
ToAnyEndpointCall() {
19+
class SpringToAnyEndpointCall extends MethodCall {
20+
SpringToAnyEndpointCall() {
2121
this.getMethod().hasName("toAnyEndpoint") and
22-
this.getMethod().getDeclaringType() instanceof TypeEndpointRequest
22+
this.getMethod().getDeclaringType() instanceof SpringEndpointRequest
2323
}
2424
}

‎java/ql/lib/semmle/code/java/frameworks/spring/SpringSecurity.qll‎

Lines changed: 30 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,8 @@
66
import java
77

88
/** The class `org.springframework.security.config.annotation.web.builders.HttpSecurity`. */
9-
class TypeHttpSecurity extends Class {
10-
TypeHttpSecurity() {
9+
class SpringHttpSecurity extends Class {
10+
SpringHttpSecurity() {
1111
this.hasQualifiedName("org.springframework.security.config.annotation.web.builders",
1212
"HttpSecurity")
1313
}
@@ -19,8 +19,8 @@ class TypeHttpSecurity extends Class {
1919
* or the class
2020
* `org.springframework.security.config.annotation.web.configurers.AuthorizeHttpRequestsConfigurer$AuthorizedUrl`.
2121
*/
22-
class TypeAuthorizedUrl extends Class {
23-
TypeAuthorizedUrl() {
22+
class SpringAuthorizedUrl extends Class {
23+
SpringAuthorizedUrl() {
2424
this.hasQualifiedName("org.springframework.security.config.annotation.web.configurers",
2525
[
2626
"ExpressionUrlAuthorizationConfigurer<HttpSecurity>$AuthorizedUrl<>",
@@ -32,8 +32,8 @@ class TypeAuthorizedUrl extends Class {
3232
/**
3333
* The class `org.springframework.security.config.annotation.web.AbstractRequestMatcherRegistry`.
3434
*/
35-
class TypeAbstractRequestMatcherRegistry extends Class {
36-
TypeAbstractRequestMatcherRegistry() {
35+
class SpringAbstractRequestMatcherRegistry extends Class {
36+
SpringAbstractRequestMatcherRegistry() {
3737
this.hasQualifiedName("org.springframework.security.config.annotation.web",
3838
"AbstractRequestMatcherRegistry<AuthorizedUrl<>>")
3939
}
@@ -45,10 +45,10 @@ class TypeAbstractRequestMatcherRegistry extends Class {
4545
* Note: this method is deprecated and scheduled for removal
4646
* in Spring Security 7.0.
4747
*/
48-
class AuthorizeRequestsCall extends MethodCall {
49-
AuthorizeRequestsCall() {
48+
class SpringAuthorizeRequestsCall extends MethodCall {
49+
SpringAuthorizeRequestsCall() {
5050
this.getMethod().hasName("authorizeRequests") and
51-
this.getMethod().getDeclaringType() instanceof TypeHttpSecurity
51+
this.getMethod().getDeclaringType() instanceof SpringHttpSecurity
5252
}
5353
}
5454

@@ -58,10 +58,10 @@ class AuthorizeRequestsCall extends MethodCall {
5858
* Note: the no-argument version of this method is deprecated
5959
* and scheduled for removal in Spring Security 7.0.
6060
*/
61-
class AuthorizeHttpRequestsCall extends MethodCall {
62-
AuthorizeHttpRequestsCall() {
61+
class SpringAuthorizeHttpRequestsCall extends MethodCall {
62+
SpringAuthorizeHttpRequestsCall() {
6363
this.getMethod().hasName("authorizeHttpRequests") and
64-
this.getMethod().getDeclaringType() instanceof TypeHttpSecurity
64+
this.getMethod().getDeclaringType() instanceof SpringHttpSecurity
6565
}
6666
}
6767

@@ -71,10 +71,10 @@ class AuthorizeHttpRequestsCall extends MethodCall {
7171
* Note: this method was removed in Spring Security 6.0.
7272
* It was replaced by `securityMatcher`.
7373
*/
74-
class RequestMatcherCall extends MethodCall {
75-
RequestMatcherCall() {
74+
class SpringRequestMatcherCall extends MethodCall {
75+
SpringRequestMatcherCall() {
7676
this.getMethod().hasName("requestMatcher") and
77-
this.getMethod().getDeclaringType() instanceof TypeHttpSecurity
77+
this.getMethod().getDeclaringType() instanceof SpringHttpSecurity
7878
}
7979
}
8080

@@ -84,41 +84,41 @@ class RequestMatcherCall extends MethodCall {
8484
* Note: this method was removed in Spring Security 6.0.
8585
* It was replaced by `securityMatchers`.
8686
*/
87-
class RequestMatchersCall extends MethodCall {
88-
RequestMatchersCall() {
87+
class SpringRequestMatchersCall extends MethodCall {
88+
SpringRequestMatchersCall() {
8989
this.getMethod().hasName("requestMatchers") and
90-
this.getMethod().getDeclaringType() instanceof TypeHttpSecurity
90+
this.getMethod().getDeclaringType() instanceof SpringHttpSecurity
9191
}
9292
}
9393

9494
/** A call to the `HttpSecurity.securityMatcher` method. */
95-
class SecurityMatcherCall extends MethodCall {
96-
SecurityMatcherCall() {
95+
class SpringSecurityMatcherCall extends MethodCall {
96+
SpringSecurityMatcherCall() {
9797
this.getMethod().hasName("securityMatcher") and
98-
this.getMethod().getDeclaringType() instanceof TypeHttpSecurity
98+
this.getMethod().getDeclaringType() instanceof SpringHttpSecurity
9999
}
100100
}
101101

102102
/** A call to the `HttpSecurity.securityMatchers` method. */
103-
class SecurityMatchersCall extends MethodCall {
104-
SecurityMatchersCall() {
103+
class SpringSecurityMatchersCall extends MethodCall {
104+
SpringSecurityMatchersCall() {
105105
this.getMethod().hasName("securityMatchers") and
106-
this.getMethod().getDeclaringType() instanceof TypeHttpSecurity
106+
this.getMethod().getDeclaringType() instanceof SpringHttpSecurity
107107
}
108108
}
109109

110110
/** A call to the `AuthorizedUrl.permitAll` method. */
111-
class PermitAllCall extends MethodCall {
112-
PermitAllCall() {
111+
class SpringPermitAllCall extends MethodCall {
112+
SpringPermitAllCall() {
113113
this.getMethod().hasName("permitAll") and
114-
this.getMethod().getDeclaringType() instanceof TypeAuthorizedUrl
114+
this.getMethod().getDeclaringType() instanceof SpringAuthorizedUrl
115115
}
116116
}
117117

118118
/** A call to the `AbstractRequestMatcherRegistry.anyRequest` method. */
119-
class AnyRequestCall extends MethodCall {
120-
AnyRequestCall() {
119+
class SpringAnyRequestCall extends MethodCall {
120+
SpringAnyRequestCall() {
121121
this.getMethod().hasName("anyRequest") and
122-
this.getMethod().getDeclaringType() instanceof TypeAbstractRequestMatcherRegistry
122+
this.getMethod().getDeclaringType() instanceof SpringAbstractRequestMatcherRegistry
123123
}
124124
}

‎java/ql/lib/semmle/code/java/security/SpringBootActuatorsQuery.qll‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -11,10 +11,10 @@ private import semmle.code.java.frameworks.spring.SpringBoot
1111
private class HttpSecurityMatcherCall extends MethodCall {
1212
HttpSecurityMatcherCall() {
1313
(
14-
this instanceof RequestMatcherCall or
15-
this instanceof SecurityMatcherCall
14+
this instanceof SpringRequestMatcherCall or
15+
this instanceof SpringSecurityMatcherCall
1616
) and
17-
this.getArgument(0) instanceof ToAnyEndpointCall
17+
this.getArgument(0) instanceof SpringToAnyEndpointCall
1818
}
1919
}
2020

@@ -25,10 +25,10 @@ private class HttpSecurityMatcherCall extends MethodCall {
2525
private class HttpSecurityMatchersCall extends MethodCall {
2626
HttpSecurityMatchersCall() {
2727
(
28-
this instanceof RequestMatchersCall or
29-
this instanceof SecurityMatchersCall
28+
this instanceof SpringRequestMatchersCall or
29+
this instanceof SpringSecurityMatchersCall
3030
) and
31-
this.getArgument(0).(LambdaExpr).getExprBody() instanceof ToAnyEndpointCall
31+
this.getArgument(0).(LambdaExpr).getExprBody() instanceof SpringToAnyEndpointCall
3232
}
3333
}
3434

@@ -39,21 +39,21 @@ private class HttpSecurityMatchersCall extends MethodCall {
3939
private class RegistryRequestMatchersCall extends MethodCall {
4040
RegistryRequestMatchersCall() {
4141
this.getMethod().hasName("requestMatchers") and
42-
this.getMethod().getDeclaringType() instanceof TypeAbstractRequestMatcherRegistry and
43-
this.getAnArgument() instanceof ToAnyEndpointCall
42+
this.getMethod().getDeclaringType() instanceof SpringAbstractRequestMatcherRegistry and
43+
this.getAnArgument() instanceof SpringToAnyEndpointCall
4444
}
4545
}
4646

4747
/** A call to an `HttpSecurity` method that authorizes requests. */
4848
private class AuthorizeCall extends MethodCall {
4949
AuthorizeCall() {
50-
this instanceof AuthorizeRequestsCall or
51-
this instanceof AuthorizeHttpRequestsCall
50+
this instanceof SpringAuthorizeRequestsCall or
51+
this instanceof SpringAuthorizeHttpRequestsCall
5252
}
5353
}
5454

5555
/** Holds if `permitAllCall` is called on request(s) mapped to actuator endpoint(s). */
56-
predicate permitsSpringBootActuators(PermitAllCall permitAllCall) {
56+
predicate permitsSpringBootActuators(SpringPermitAllCall permitAllCall) {
5757
exists(AuthorizeCall authorizeCall |
5858
// .requestMatcher(EndpointRequest).authorizeRequests([...]).[...]
5959
authorizeCall.getQualifier() instanceof HttpSecurityMatcherCall
@@ -65,7 +65,7 @@ predicate permitsSpringBootActuators(PermitAllCall permitAllCall) {
6565
// [...].authorizeRequests(r -> r.requestMatchers(EndpointRequest).permitAll())
6666
authorizeCall.getArgument(0).(LambdaExpr).getExprBody() = permitAllCall and
6767
(
68-
permitAllCall.getQualifier() instanceof AnyRequestCall or
68+
permitAllCall.getQualifier() instanceof SpringAnyRequestCall or
6969
permitAllCall.getQualifier() instanceof RegistryRequestMatchersCall
7070
)
7171
or
@@ -77,7 +77,7 @@ predicate permitsSpringBootActuators(PermitAllCall permitAllCall) {
7777
permitAllCall.getQualifier() = registryRequestMatchersCall
7878
)
7979
or
80-
exists(AnyRequestCall anyRequestCall |
80+
exists(SpringAnyRequestCall anyRequestCall |
8181
anyRequestCall.getQualifier() = authorizeCall and
8282
permitAllCall.getQualifier() = anyRequestCall
8383
)
@@ -104,7 +104,7 @@ predicate permitsSpringBootActuators(PermitAllCall permitAllCall) {
104104
v.getAnAccess() = authorizeCall.getQualifier() and
105105
v.getAnAccess() = matcherCall.getQualifier() and
106106
authorizeCall.getArgument(0).(LambdaExpr).getExprBody() = permitAllCall and
107-
permitAllCall.getQualifier() instanceof AnyRequestCall
107+
permitAllCall.getQualifier() instanceof SpringAnyRequestCall
108108
)
109109
)
110110
}

‎java/ql/src/Security/CWE/CWE-200/SpringBootActuators.ql‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,6 @@ import java
1515
import semmle.code.java.frameworks.spring.SpringSecurity
1616
import semmle.code.java.security.SpringBootActuatorsQuery
1717

18-
from PermitAllCall permitAllCall
18+
from SpringPermitAllCall permitAllCall
1919
where permitsSpringBootActuators(permitAllCall)
2020
select permitAllCall, "Unauthenticated access to Spring Boot actuator is allowed."

0 commit comments

Comments
 (0)