Java: handle example in Spring docs

Author: Jami Cogswell

java/ql/lib/semmle/code/java/security/SpringBootActuatorsQuery.qll

@@ -142,5 +142,14 @@ predicate permitsSpringBootActuators(PermitAllCall permitAllCall) {
       registryRequestMatchersCall.getQualifier() = authorizeCall and
       permitAllCall.getQualifier() = registryRequestMatchersCall
     )
+    or
+    exists(Variable v, MatcherCall matcherCall |
+      // http.securityMatcher(EndpointRequest.toAnyEndpoint());
+      // http.authorizeRequests([...].permitAll())
+      v.getAnAccess() = authorizeCall.getQualifier() and
+      v.getAnAccess() = matcherCall.getQualifier() and
+      authorizeCall.getArgument(0).(LambdaExpr).getExprBody() = permitAllCall and
+      permitAllCall.getQualifier() instanceof AnyRequestCall
+    )
   )
 }

java/ql/test/query-tests/security/CWE-016/SpringBootActuatorsTest.java

@@ -264,4 +264,11 @@ protected void configureOkNoPermitAll4_securityMatchers(HttpSecurity http) throw
   protected void configureOkNoPermitAll7_securityMatchers(HttpSecurity http) throws Exception {
     http.securityMatchers(matcher -> EndpointRequest.toAnyEndpoint()).authorizeHttpRequests().anyRequest();
   }
+
+  // Spring doc example
+  // https://docs.spring.io/spring-boot/reference/actuator/endpoints.html#actuator.endpoints.security
+  public void securityFilterChain(HttpSecurity http) throws Exception {
+		http.securityMatcher(EndpointRequest.toAnyEndpoint());
+		http.authorizeHttpRequests((requests) -> requests.anyRequest().permitAll()); // $ hasExposedSpringBootActuator
+	}
 }