Ratpack improve support for parsing types

Author: JLLeitschuh

java/ql/src/semmle/code/java/frameworks/ratpack/Ratpack.qll

@@ -24,13 +24,22 @@ private class RatpackHttpSource extends SourceModelCsv {
           "Request;true;getRawUri;;;ReturnValue;remote", "Request;true;getUri;;;ReturnValue;remote",
           "Request;true;getBody;;;ReturnValue;remote"
         ]
+    or
+    // All Context#parse methods that return a Promise are remote flow sources.
+    row =
+      ["ratpack.handling;", "ratpack.core.handling;"] + "Context;true;parse;" +
+        [
+          "(java.lang.Class);", "(com.google.common.reflect.TypeToken);", "(java.lang.Class,O);",
+          "(com.google.common.reflect.TypeToken,O);", "(ratpack.core.parse.Parse);",
+          "(ratpack.parse.Parse);"
+        ] + ";ReturnValue;remote"
   }
 }
 
 /**
  * Ratpack methods that propagate user-supplied request data as tainted.
  */
-private class RatpackHttpModel extends SummaryModelCsv {
+private class RatpackModel extends SummaryModelCsv {
   override predicate row(string row) {
     row =
       ["ratpack.http;", "ratpack.core.http;"] +
@@ -49,6 +58,24 @@ private class RatpackHttpModel extends SummaryModelCsv {
     or
     row =
       ["ratpack.form;", "ratpack.core.form;"] +
-        ["UploadedFile;true;getFileName;;;Argument[-1];ReturnValue;taint"]
+        [
+          "UploadedFile;true;getFileName;;;Argument[-1];ReturnValue;taint",
+          "Form;true;file;;;Argument[-1];ReturnValue;taint",
+          "Form;true;files;;;Argument[-1];ReturnValue;taint"
+        ]
+    or
+    row =
+      ["ratpack.handling;", "ratpack.core.handling;"] +
+        [
+          "Context;true;parse;(ratpack.http.TypedData,ratpack.parse.Parse);;Argument[0];ReturnValue;taint",
+          "Context;true;parse;(ratpack.core.http.TypedData,ratpack.core.parse.Parse);;Argument[0];ReturnValue;taint"
+        ]
+    or
+    row =
+      ["ratpack.util;", "ratpack.func;"] +
+        [
+          "MultiValueMap;true;getAll;;;Argument[-1];ReturnValue;taint",
+          "MultiValueMap;true;asMultimap;;;Argument[-1];ReturnValue;taint"
+        ]
   }
 }

java/ql/test/library-tests/frameworks/ratpack/resources/Resource.java

@@ -1,6 +1,8 @@
 import ratpack.core.handling.Context;
 import ratpack.core.http.TypedData;
+import ratpack.core.form.Form;
 import ratpack.core.form.UploadedFile;
+import ratpack.core.parse.Parse;
 import ratpack.exec.Promise;
 import java.io.OutputStream;
 
@@ -67,4 +69,36 @@ void test4() {
             .flatMap(a -> Promise.value(a))
             .then(this::sink); //$hasTaintFlow
     }
+
+    void test5(Context ctx) {
+        ctx
+            .getRequest()
+            .getBody()
+            .map(data -> {
+                Form form = ctx.parse(data, Form.form());
+                sink(form); //$hasTaintFlow
+                return form;
+            })
+            .then(form -> {
+                sink(form.file("questionable_file")); //$hasTaintFlow
+                sink(form.file("questionable_file").getFileName()); //$hasTaintFlow
+                sink(form.files("questionable_files")); //$hasTaintFlow
+                sink(form.files()); //$hasTaintFlow
+                sink(form.asMultimap()); //$hasTaintFlow
+                sink(form.asMultimap().asMap()); //$hasTaintFlow
+            });
+    }
+
+    void test6(Context ctx) {
+        ctx
+            .parse(Parse.of(Form.class))
+            .then(form -> {
+                sink(form); //$hasTaintFlow
+            });
+        ctx
+            .parse(Form.class)
+            .then(form -> {
+                sink(form); //$hasTaintFlow
+            });
+    }
 }