From e78e6b6a8c5861e2b1a0c73e0114fd389d7435ff Mon Sep 17 00:00:00 2001 From: Owen Mansel-Chan Date: Wed, 14 Oct 2026 11:21:00 +0100 Subject: [PATCH 1/4] Add string equality to ListOfConstantsSanitizer --- .../2026-10-14-constant-value-guards.md | 4 + .../security/ListOfConstantsSanitizer.qll | 43 ++- .../code/java/security/RequestForgery.qll | 15 +- .../test/library-tests/listofconstants/A.java | 24 ++ .../listofconstants/test.expected | 2 + .../semmle/tests/HostComparisonRedirect.java | 25 ++ .../CWE-601/semmle/tests/UrlRedirect.expected | 274 ++++++++-------- .../security/CWE-918/HostComparison.java | 25 ++ .../security/CWE-918/RequestForgery.expected | 307 +++++++++--------- 9 files changed, 416 insertions(+), 303 deletions(-) create mode 100644 java/ql/lib/change-notes/2026-10-14-constant-value-guards.md diff --git a/java/ql/lib/change-notes/2026-10-14-constant-value-guards.md b/java/ql/lib/change-notes/2026-10-14-constant-value-guards.md new file mode 100644 index 000000000000..ee8e09960064 --- /dev/null +++ b/java/ql/lib/change-notes/2026-10-14-constant-value-guards.md @@ -0,0 +1,4 @@ +--- +category: minorAnalysis +--- +* Java taint-tracking queries now recognize equality and case-insensitive equality checks against fixed string constants as sanitizers. The queries `java/ssrf` and `java/unvalidated-url-redirection` also recognize checks of `URI.getHost()` against fixed collections of strings, including when the host is normalized to upper or lower case. diff --git a/java/ql/lib/semmle/code/java/security/ListOfConstantsSanitizer.qll b/java/ql/lib/semmle/code/java/security/ListOfConstantsSanitizer.qll index b00c5c99405a..480191c1e412 100644 --- a/java/ql/lib/semmle/code/java/security/ListOfConstantsSanitizer.qll +++ b/java/ql/lib/semmle/code/java/security/ListOfConstantsSanitizer.qll @@ -1,7 +1,4 @@ -/** - * Provides a default taint sanitizer identifying comparisons against lists of - * compile-time constants. - */ +/** Provides a default taint sanitizer identifying checks against compile-time constants. */ overlay[local?] module; @@ -257,11 +254,39 @@ private predicate constantCollectionContainsCheck(Guard g, Expr e, boolean branc } /** - * A comparison against a list of compile-time constants, sanitizing taint by - * restricting to a set of known values. + * Holds if the guard `g` ensures that the string expression `e` equals a compile-time constant + * upon evaluating to `branch`. + */ +private predicate constantStringEqualityCheck(Guard g, Expr e, boolean branch) { + exists(MethodCall comparison, Expr constant | + g = comparison and + comparison.getMethod().getDeclaringType() instanceof TypeString and + comparison.getMethod().hasName(["equals", "equalsIgnoreCase"]) and + branch = true and + ( + e = comparison.getQualifier() and constant = comparison.getArgument(0) + or + e = comparison.getArgument(0) and constant = comparison.getQualifier() + ) and + exists(constant.(CompileTimeConstantExpr).getStringValue()) + ) +} + +/** + * Holds if the guard `g` ensures that the expression `e` is one of a set of compile-time constants + * upon evaluating to `branch`. + */ +predicate constantValueGuardChecks(Guard g, Expr e, boolean branch) { + constantStringEqualityCheck(g, e, branch) + or + constantCollectionContainsCheck(g, e, branch) +} + +/** + * A check against compile-time constants, sanitizing taint by restricting a value to a known set. */ -private class ListOfConstantsComparisonSanitizerGuard extends TaintTracking::DefaultTaintSanitizer { - ListOfConstantsComparisonSanitizerGuard() { - this = DataFlow::BarrierGuard::getABarrierNode() +private class ConstantValueSanitizerGuard extends TaintTracking::DefaultTaintSanitizer { + ConstantValueSanitizerGuard() { + this = DataFlow::BarrierGuard::getABarrierNode() } } diff --git a/java/ql/lib/semmle/code/java/security/RequestForgery.qll b/java/ql/lib/semmle/code/java/security/RequestForgery.qll index e1c77a721535..d280d270c7c3 100644 --- a/java/ql/lib/semmle/code/java/security/RequestForgery.qll +++ b/java/ql/lib/semmle/code/java/security/RequestForgery.qll @@ -14,6 +14,7 @@ private import semmle.code.java.controlflow.Guards private import semmle.code.java.dataflow.StringPrefixes private import semmle.code.java.dataflow.ExternalFlow private import semmle.code.java.dataflow.SSA +private import semmle.code.java.security.ListOfConstantsSanitizer private import semmle.code.java.security.Sanitizers /** @@ -149,18 +150,8 @@ private predicate isHostComparisonSanitizer(Guard guard, Expr e, boolean branch) ) ) or - exists(MethodCall comparison, Expr checked, Expr allowed | - guard = comparison and - comparison.getMethod().getDeclaringType() instanceof TypeString and - comparison.getMethod().hasName(["equals", "equalsIgnoreCase"]) and - branch = true and - ( - checked = comparison.getQualifier() and allowed = comparison.getArgument(0) - or - checked = comparison.getArgument(0) and allowed = comparison.getQualifier() - ) and - // New cases require a fixed allowlist entry, not another untrusted value. - exists(allowed.(CompileTimeConstantExpr).getStringValue()) and + exists(Expr checked | + constantValueGuardChecks(guard, checked, branch) and e = getCheckedHost(checked).getQualifier() ) } diff --git a/java/ql/test/library-tests/listofconstants/A.java b/java/ql/test/library-tests/listofconstants/A.java index 74129692d71d..3aea4a2495c9 100644 --- a/java/ql/test/library-tests/listofconstants/A.java +++ b/java/ql/test/library-tests/listofconstants/A.java @@ -32,4 +32,28 @@ private void testAdd(String inp) { sink(inp); } } + + private void checkEquals(String input) { + if ("AA".equals(input)) { + sink(input); + } + } + + private void checkEqualsIgnoreCase(String input) { + if (input.equalsIgnoreCase("AA")) { + sink(input); + } + } + + private void checkWrongBranch(String input) { + if (!"AA".equals(input)) { + sink(input); + } + } + + private void checkUntrustedValue(String input, String allowed) { + if (allowed.equals(input)) { + sink(input); + } + } } diff --git a/java/ql/test/library-tests/listofconstants/test.expected b/java/ql/test/library-tests/listofconstants/test.expected index 203d64cd46dd..89b555b41179 100644 --- a/java/ql/test/library-tests/listofconstants/test.expected +++ b/java/ql/test/library-tests/listofconstants/test.expected @@ -1,3 +1,5 @@ | A.java:12:12:12:20 | separator | | A.java:23:12:23:17 | schema | | A.java:32:12:32:14 | inp | +| A.java:38:12:38:16 | input | +| A.java:44:12:44:16 | input | diff --git a/java/ql/test/query-tests/security/CWE-601/semmle/tests/HostComparisonRedirect.java b/java/ql/test/query-tests/security/CWE-601/semmle/tests/HostComparisonRedirect.java index edc5638bec26..09575c19098c 100644 --- a/java/ql/test/query-tests/security/CWE-601/semmle/tests/HostComparisonRedirect.java +++ b/java/ql/test/query-tests/security/CWE-601/semmle/tests/HostComparisonRedirect.java @@ -1,5 +1,6 @@ import java.net.URI; import java.util.Arrays; +import java.util.Set; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; @@ -203,6 +204,30 @@ public void constantAllowlistField(HttpServletRequest request, HttpServletRespon } } + public void constantCollection(HttpServletRequest request, HttpServletResponse response) throws Exception { + URI uri = new URI(request.getParameter("url")); + String host = uri.getHost(); + if (Set.of("example.com", "example.org").contains(host)) { + response.sendRedirect(uri.toString()); + } + } + + public void normalizedConstantCollection(HttpServletRequest request, HttpServletResponse response) throws Exception { + URI uri = new URI(request.getParameter("url")); + String host = uri.getHost(); + if (Set.of("EXAMPLE.COM", "EXAMPLE.ORG").contains(host.toUpperCase())) { + response.sendRedirect(uri.toString()); + } + } + + public void untrustedCollection(HttpServletRequest request, HttpServletResponse response) throws Exception { + URI uri = new URI(request.getParameter("url")); // $ Source + String host = uri.getHost(); + if (Set.of(request.getParameter("allowed")).contains(host)) { + response.sendRedirect(uri.toString()); // $ Alert + } + } + public void orBypass(HttpServletRequest request, HttpServletResponse response, boolean skip) throws Exception { URI uri = new URI(request.getParameter("url")); // $ Source String host = uri.getHost(); diff --git a/java/ql/test/query-tests/security/CWE-601/semmle/tests/UrlRedirect.expected b/java/ql/test/query-tests/security/CWE-601/semmle/tests/UrlRedirect.expected index 7a16ee15c617..b7863b009357 100644 --- a/java/ql/test/query-tests/security/CWE-601/semmle/tests/UrlRedirect.expected +++ b/java/ql/test/query-tests/security/CWE-601/semmle/tests/UrlRedirect.expected @@ -1,21 +1,22 @@ #select -| HostComparisonRedirect.java:9:31:9:44 | toString(...) | HostComparisonRedirect.java:8:27:8:53 | getParameter(...) : String | HostComparisonRedirect.java:9:31:9:44 | toString(...) | Untrusted URL redirection depends on a $@. | HostComparisonRedirect.java:8:27:8:53 | getParameter(...) | user-provided value | -| HostComparisonRedirect.java:52:35:52:48 | toString(...) | HostComparisonRedirect.java:50:27:50:53 | getParameter(...) : String | HostComparisonRedirect.java:52:35:52:48 | toString(...) | Untrusted URL redirection depends on a $@. | HostComparisonRedirect.java:50:27:50:53 | getParameter(...) | user-provided value | -| HostComparisonRedirect.java:59:35:59:48 | toString(...) | HostComparisonRedirect.java:57:27:57:53 | getParameter(...) : String | HostComparisonRedirect.java:59:35:59:48 | toString(...) | Untrusted URL redirection depends on a $@. | HostComparisonRedirect.java:57:27:57:53 | getParameter(...) | user-provided value | -| HostComparisonRedirect.java:70:35:70:48 | toString(...) | HostComparisonRedirect.java:68:27:68:53 | getParameter(...) : String | HostComparisonRedirect.java:70:35:70:48 | toString(...) | Untrusted URL redirection depends on a $@. | HostComparisonRedirect.java:68:27:68:53 | getParameter(...) | user-provided value | -| HostComparisonRedirect.java:86:35:86:48 | toString(...) | HostComparisonRedirect.java:84:27:84:53 | getParameter(...) : String | HostComparisonRedirect.java:86:35:86:48 | toString(...) | Untrusted URL redirection depends on a $@. | HostComparisonRedirect.java:84:27:84:53 | getParameter(...) | user-provided value | -| HostComparisonRedirect.java:94:35:94:49 | toString(...) | HostComparisonRedirect.java:92:28:92:54 | getParameter(...) : String | HostComparisonRedirect.java:94:35:94:49 | toString(...) | Untrusted URL redirection depends on a $@. | HostComparisonRedirect.java:92:28:92:54 | getParameter(...) | user-provided value | -| HostComparisonRedirect.java:105:35:105:48 | toString(...) | HostComparisonRedirect.java:103:27:103:53 | getParameter(...) : String | HostComparisonRedirect.java:105:35:105:48 | toString(...) | Untrusted URL redirection depends on a $@. | HostComparisonRedirect.java:103:27:103:53 | getParameter(...) | user-provided value | -| HostComparisonRedirect.java:113:35:113:49 | toString(...) | HostComparisonRedirect.java:111:28:111:54 | getParameter(...) : String | HostComparisonRedirect.java:113:35:113:49 | toString(...) | Untrusted URL redirection depends on a $@. | HostComparisonRedirect.java:111:28:111:54 | getParameter(...) | user-provided value | -| HostComparisonRedirect.java:122:35:122:48 | toString(...) | HostComparisonRedirect.java:118:27:118:53 | getParameter(...) : String | HostComparisonRedirect.java:122:35:122:48 | toString(...) | Untrusted URL redirection depends on a $@. | HostComparisonRedirect.java:118:27:118:53 | getParameter(...) | user-provided value | -| HostComparisonRedirect.java:133:35:133:48 | toString(...) | HostComparisonRedirect.java:127:27:127:53 | getParameter(...) : String | HostComparisonRedirect.java:133:35:133:48 | toString(...) | Untrusted URL redirection depends on a $@. | HostComparisonRedirect.java:127:27:127:53 | getParameter(...) | user-provided value | -| HostComparisonRedirect.java:142:35:142:48 | toString(...) | HostComparisonRedirect.java:140:23:140:49 | getParameter(...) : String | HostComparisonRedirect.java:142:35:142:48 | toString(...) | Untrusted URL redirection depends on a $@. | HostComparisonRedirect.java:140:23:140:49 | getParameter(...) | user-provided value | -| HostComparisonRedirect.java:149:35:149:48 | toString(...) | HostComparisonRedirect.java:147:27:147:53 | getParameter(...) : String | HostComparisonRedirect.java:149:35:149:48 | toString(...) | Untrusted URL redirection depends on a $@. | HostComparisonRedirect.java:147:27:147:53 | getParameter(...) | user-provided value | -| HostComparisonRedirect.java:156:35:156:48 | toString(...) | HostComparisonRedirect.java:154:27:154:53 | getParameter(...) : String | HostComparisonRedirect.java:156:35:156:48 | toString(...) | Untrusted URL redirection depends on a $@. | HostComparisonRedirect.java:154:27:154:53 | getParameter(...) | user-provided value | -| HostComparisonRedirect.java:184:39:184:52 | toString(...) | HostComparisonRedirect.java:177:27:177:53 | getParameter(...) : String | HostComparisonRedirect.java:184:39:184:52 | toString(...) | Untrusted URL redirection depends on a $@. | HostComparisonRedirect.java:177:27:177:53 | getParameter(...) | user-provided value | -| HostComparisonRedirect.java:210:35:210:48 | toString(...) | HostComparisonRedirect.java:207:27:207:53 | getParameter(...) : String | HostComparisonRedirect.java:210:35:210:48 | toString(...) | Untrusted URL redirection depends on a $@. | HostComparisonRedirect.java:207:27:207:53 | getParameter(...) | user-provided value | -| HostComparisonRedirect.java:236:35:236:48 | toString(...) | HostComparisonRedirect.java:232:27:232:53 | getParameter(...) : String | HostComparisonRedirect.java:236:35:236:48 | toString(...) | Untrusted URL redirection depends on a $@. | HostComparisonRedirect.java:232:27:232:53 | getParameter(...) | user-provided value | -| HostComparisonRedirect.java:245:35:245:48 | toString(...) | HostComparisonRedirect.java:241:27:241:53 | getParameter(...) : String | HostComparisonRedirect.java:245:35:245:48 | toString(...) | Untrusted URL redirection depends on a $@. | HostComparisonRedirect.java:241:27:241:53 | getParameter(...) | user-provided value | +| HostComparisonRedirect.java:10:31:10:44 | toString(...) | HostComparisonRedirect.java:9:27:9:53 | getParameter(...) : String | HostComparisonRedirect.java:10:31:10:44 | toString(...) | Untrusted URL redirection depends on a $@. | HostComparisonRedirect.java:9:27:9:53 | getParameter(...) | user-provided value | +| HostComparisonRedirect.java:53:35:53:48 | toString(...) | HostComparisonRedirect.java:51:27:51:53 | getParameter(...) : String | HostComparisonRedirect.java:53:35:53:48 | toString(...) | Untrusted URL redirection depends on a $@. | HostComparisonRedirect.java:51:27:51:53 | getParameter(...) | user-provided value | +| HostComparisonRedirect.java:60:35:60:48 | toString(...) | HostComparisonRedirect.java:58:27:58:53 | getParameter(...) : String | HostComparisonRedirect.java:60:35:60:48 | toString(...) | Untrusted URL redirection depends on a $@. | HostComparisonRedirect.java:58:27:58:53 | getParameter(...) | user-provided value | +| HostComparisonRedirect.java:71:35:71:48 | toString(...) | HostComparisonRedirect.java:69:27:69:53 | getParameter(...) : String | HostComparisonRedirect.java:71:35:71:48 | toString(...) | Untrusted URL redirection depends on a $@. | HostComparisonRedirect.java:69:27:69:53 | getParameter(...) | user-provided value | +| HostComparisonRedirect.java:87:35:87:48 | toString(...) | HostComparisonRedirect.java:85:27:85:53 | getParameter(...) : String | HostComparisonRedirect.java:87:35:87:48 | toString(...) | Untrusted URL redirection depends on a $@. | HostComparisonRedirect.java:85:27:85:53 | getParameter(...) | user-provided value | +| HostComparisonRedirect.java:95:35:95:49 | toString(...) | HostComparisonRedirect.java:93:28:93:54 | getParameter(...) : String | HostComparisonRedirect.java:95:35:95:49 | toString(...) | Untrusted URL redirection depends on a $@. | HostComparisonRedirect.java:93:28:93:54 | getParameter(...) | user-provided value | +| HostComparisonRedirect.java:106:35:106:48 | toString(...) | HostComparisonRedirect.java:104:27:104:53 | getParameter(...) : String | HostComparisonRedirect.java:106:35:106:48 | toString(...) | Untrusted URL redirection depends on a $@. | HostComparisonRedirect.java:104:27:104:53 | getParameter(...) | user-provided value | +| HostComparisonRedirect.java:114:35:114:49 | toString(...) | HostComparisonRedirect.java:112:28:112:54 | getParameter(...) : String | HostComparisonRedirect.java:114:35:114:49 | toString(...) | Untrusted URL redirection depends on a $@. | HostComparisonRedirect.java:112:28:112:54 | getParameter(...) | user-provided value | +| HostComparisonRedirect.java:123:35:123:48 | toString(...) | HostComparisonRedirect.java:119:27:119:53 | getParameter(...) : String | HostComparisonRedirect.java:123:35:123:48 | toString(...) | Untrusted URL redirection depends on a $@. | HostComparisonRedirect.java:119:27:119:53 | getParameter(...) | user-provided value | +| HostComparisonRedirect.java:134:35:134:48 | toString(...) | HostComparisonRedirect.java:128:27:128:53 | getParameter(...) : String | HostComparisonRedirect.java:134:35:134:48 | toString(...) | Untrusted URL redirection depends on a $@. | HostComparisonRedirect.java:128:27:128:53 | getParameter(...) | user-provided value | +| HostComparisonRedirect.java:143:35:143:48 | toString(...) | HostComparisonRedirect.java:141:23:141:49 | getParameter(...) : String | HostComparisonRedirect.java:143:35:143:48 | toString(...) | Untrusted URL redirection depends on a $@. | HostComparisonRedirect.java:141:23:141:49 | getParameter(...) | user-provided value | +| HostComparisonRedirect.java:150:35:150:48 | toString(...) | HostComparisonRedirect.java:148:27:148:53 | getParameter(...) : String | HostComparisonRedirect.java:150:35:150:48 | toString(...) | Untrusted URL redirection depends on a $@. | HostComparisonRedirect.java:148:27:148:53 | getParameter(...) | user-provided value | +| HostComparisonRedirect.java:157:35:157:48 | toString(...) | HostComparisonRedirect.java:155:27:155:53 | getParameter(...) : String | HostComparisonRedirect.java:157:35:157:48 | toString(...) | Untrusted URL redirection depends on a $@. | HostComparisonRedirect.java:155:27:155:53 | getParameter(...) | user-provided value | +| HostComparisonRedirect.java:185:39:185:52 | toString(...) | HostComparisonRedirect.java:178:27:178:53 | getParameter(...) : String | HostComparisonRedirect.java:185:39:185:52 | toString(...) | Untrusted URL redirection depends on a $@. | HostComparisonRedirect.java:178:27:178:53 | getParameter(...) | user-provided value | +| HostComparisonRedirect.java:227:35:227:48 | toString(...) | HostComparisonRedirect.java:224:27:224:53 | getParameter(...) : String | HostComparisonRedirect.java:227:35:227:48 | toString(...) | Untrusted URL redirection depends on a $@. | HostComparisonRedirect.java:224:27:224:53 | getParameter(...) | user-provided value | +| HostComparisonRedirect.java:235:35:235:48 | toString(...) | HostComparisonRedirect.java:232:27:232:53 | getParameter(...) : String | HostComparisonRedirect.java:235:35:235:48 | toString(...) | Untrusted URL redirection depends on a $@. | HostComparisonRedirect.java:232:27:232:53 | getParameter(...) | user-provided value | +| HostComparisonRedirect.java:261:35:261:48 | toString(...) | HostComparisonRedirect.java:257:27:257:53 | getParameter(...) : String | HostComparisonRedirect.java:261:35:261:48 | toString(...) | Untrusted URL redirection depends on a $@. | HostComparisonRedirect.java:257:27:257:53 | getParameter(...) | user-provided value | +| HostComparisonRedirect.java:270:35:270:48 | toString(...) | HostComparisonRedirect.java:266:27:266:53 | getParameter(...) : String | HostComparisonRedirect.java:270:35:270:48 | toString(...) | Untrusted URL redirection depends on a $@. | HostComparisonRedirect.java:266:27:266:53 | getParameter(...) | user-provided value | | MicronautUrlRedirect.java:14:38:14:55 | create(...) | MicronautUrlRedirect.java:12:39:12:63 | target : String | MicronautUrlRedirect.java:14:38:14:55 | create(...) | Untrusted URL redirection depends on a $@. | MicronautUrlRedirect.java:12:39:12:63 | target | user-provided value | | MicronautUrlRedirect.java:28:47:28:64 | create(...) | MicronautUrlRedirect.java:27:45:27:69 | target : String | MicronautUrlRedirect.java:28:47:28:64 | create(...) | Untrusted URL redirection depends on a $@. | MicronautUrlRedirect.java:27:45:27:69 | target | user-provided value | | MicronautUrlRedirect.java:33:38:33:55 | create(...) | MicronautUrlRedirect.java:32:44:32:68 | target : String | MicronautUrlRedirect.java:33:38:33:55 | create(...) | Untrusted URL redirection depends on a $@. | MicronautUrlRedirect.java:32:44:32:68 | target | user-provided value | @@ -27,57 +28,60 @@ | UrlRedirect.java:42:43:42:72 | getParameter(...) | UrlRedirect.java:42:43:42:72 | getParameter(...) | UrlRedirect.java:42:43:42:72 | getParameter(...) | Untrusted URL redirection depends on a $@. | UrlRedirect.java:42:43:42:72 | getParameter(...) | user-provided value | | mad/Test.java:14:22:14:38 | (...)... | mad/Test.java:9:16:9:41 | getParameter(...) : String | mad/Test.java:14:22:14:38 | (...)... | Untrusted URL redirection depends on a $@. | mad/Test.java:9:16:9:41 | getParameter(...) | user-provided value | edges -| HostComparisonRedirect.java:8:19:8:54 | new URI(...) : URI | HostComparisonRedirect.java:9:31:9:33 | uri : URI | provenance | | -| HostComparisonRedirect.java:8:27:8:53 | getParameter(...) : String | HostComparisonRedirect.java:8:19:8:54 | new URI(...) : URI | provenance | Src:MaD:6 MaD:8 | -| HostComparisonRedirect.java:9:31:9:33 | uri : URI | HostComparisonRedirect.java:9:31:9:44 | toString(...) | provenance | MaD:10 | -| HostComparisonRedirect.java:50:19:50:54 | new URI(...) : URI | HostComparisonRedirect.java:52:35:52:37 | uri : URI | provenance | | -| HostComparisonRedirect.java:50:27:50:53 | getParameter(...) : String | HostComparisonRedirect.java:50:19:50:54 | new URI(...) : URI | provenance | Src:MaD:6 MaD:8 | -| HostComparisonRedirect.java:52:35:52:37 | uri : URI | HostComparisonRedirect.java:52:35:52:48 | toString(...) | provenance | MaD:10 | -| HostComparisonRedirect.java:57:19:57:54 | new URI(...) : URI | HostComparisonRedirect.java:59:35:59:37 | uri : URI | provenance | | -| HostComparisonRedirect.java:57:27:57:53 | getParameter(...) : String | HostComparisonRedirect.java:57:19:57:54 | new URI(...) : URI | provenance | Src:MaD:6 MaD:8 | -| HostComparisonRedirect.java:59:35:59:37 | uri : URI | HostComparisonRedirect.java:59:35:59:48 | toString(...) | provenance | MaD:10 | -| HostComparisonRedirect.java:68:19:68:54 | new URI(...) : URI | HostComparisonRedirect.java:70:35:70:37 | uri : URI | provenance | | -| HostComparisonRedirect.java:68:27:68:53 | getParameter(...) : String | HostComparisonRedirect.java:68:19:68:54 | new URI(...) : URI | provenance | Src:MaD:6 MaD:8 | -| HostComparisonRedirect.java:70:35:70:37 | uri : URI | HostComparisonRedirect.java:70:35:70:48 | toString(...) | provenance | MaD:10 | -| HostComparisonRedirect.java:84:19:84:54 | new URI(...) : URI | HostComparisonRedirect.java:86:35:86:37 | uri : URI | provenance | | -| HostComparisonRedirect.java:84:27:84:53 | getParameter(...) : String | HostComparisonRedirect.java:84:19:84:54 | new URI(...) : URI | provenance | Src:MaD:6 MaD:8 | -| HostComparisonRedirect.java:86:35:86:37 | uri : URI | HostComparisonRedirect.java:86:35:86:48 | toString(...) | provenance | MaD:10 | -| HostComparisonRedirect.java:92:20:92:55 | new URI(...) : URI | HostComparisonRedirect.java:94:35:94:38 | used : URI | provenance | | -| HostComparisonRedirect.java:92:28:92:54 | getParameter(...) : String | HostComparisonRedirect.java:92:20:92:55 | new URI(...) : URI | provenance | Src:MaD:6 MaD:8 | -| HostComparisonRedirect.java:94:35:94:38 | used : URI | HostComparisonRedirect.java:94:35:94:49 | toString(...) | provenance | MaD:10 | -| HostComparisonRedirect.java:103:19:103:54 | new URI(...) : URI | HostComparisonRedirect.java:105:35:105:37 | uri : URI | provenance | | -| HostComparisonRedirect.java:103:27:103:53 | getParameter(...) : String | HostComparisonRedirect.java:103:19:103:54 | new URI(...) : URI | provenance | Src:MaD:6 MaD:8 | -| HostComparisonRedirect.java:105:35:105:37 | uri : URI | HostComparisonRedirect.java:105:35:105:48 | toString(...) | provenance | MaD:10 | -| HostComparisonRedirect.java:111:20:111:55 | new URI(...) : URI | HostComparisonRedirect.java:113:35:113:38 | used : URI | provenance | | -| HostComparisonRedirect.java:111:28:111:54 | getParameter(...) : String | HostComparisonRedirect.java:111:20:111:55 | new URI(...) : URI | provenance | Src:MaD:6 MaD:8 | -| HostComparisonRedirect.java:113:35:113:38 | used : URI | HostComparisonRedirect.java:113:35:113:49 | toString(...) | provenance | MaD:10 | -| HostComparisonRedirect.java:118:19:118:54 | new URI(...) : URI | HostComparisonRedirect.java:122:35:122:37 | uri : URI | provenance | | -| HostComparisonRedirect.java:118:27:118:53 | getParameter(...) : String | HostComparisonRedirect.java:118:19:118:54 | new URI(...) : URI | provenance | Src:MaD:6 MaD:8 | -| HostComparisonRedirect.java:122:35:122:37 | uri : URI | HostComparisonRedirect.java:122:35:122:48 | toString(...) | provenance | MaD:10 | -| HostComparisonRedirect.java:127:19:127:54 | new URI(...) : URI | HostComparisonRedirect.java:133:35:133:37 | uri : URI | provenance | | -| HostComparisonRedirect.java:127:27:127:53 | getParameter(...) : String | HostComparisonRedirect.java:127:19:127:54 | new URI(...) : URI | provenance | Src:MaD:6 MaD:8 | -| HostComparisonRedirect.java:133:35:133:37 | uri : URI | HostComparisonRedirect.java:133:35:133:48 | toString(...) | provenance | MaD:10 | -| HostComparisonRedirect.java:140:15:140:50 | new URI(...) : URI | HostComparisonRedirect.java:142:35:142:37 | uri : URI | provenance | | -| HostComparisonRedirect.java:140:23:140:49 | getParameter(...) : String | HostComparisonRedirect.java:140:15:140:50 | new URI(...) : URI | provenance | Src:MaD:6 MaD:8 | -| HostComparisonRedirect.java:142:35:142:37 | uri : URI | HostComparisonRedirect.java:142:35:142:48 | toString(...) | provenance | MaD:10 | -| HostComparisonRedirect.java:147:19:147:54 | new URI(...) : URI | HostComparisonRedirect.java:149:35:149:37 | uri : URI | provenance | | -| HostComparisonRedirect.java:147:27:147:53 | getParameter(...) : String | HostComparisonRedirect.java:147:19:147:54 | new URI(...) : URI | provenance | Src:MaD:6 MaD:8 | -| HostComparisonRedirect.java:149:35:149:37 | uri : URI | HostComparisonRedirect.java:149:35:149:48 | toString(...) | provenance | MaD:10 | -| HostComparisonRedirect.java:154:19:154:54 | new URI(...) : URI | HostComparisonRedirect.java:156:35:156:37 | uri : URI | provenance | | -| HostComparisonRedirect.java:154:27:154:53 | getParameter(...) : String | HostComparisonRedirect.java:154:19:154:54 | new URI(...) : URI | provenance | Src:MaD:6 MaD:8 | -| HostComparisonRedirect.java:156:35:156:37 | uri : URI | HostComparisonRedirect.java:156:35:156:48 | toString(...) | provenance | MaD:10 | -| HostComparisonRedirect.java:177:19:177:54 | new URI(...) : URI | HostComparisonRedirect.java:184:39:184:41 | uri : URI | provenance | | -| HostComparisonRedirect.java:177:27:177:53 | getParameter(...) : String | HostComparisonRedirect.java:177:19:177:54 | new URI(...) : URI | provenance | Src:MaD:6 MaD:8 | -| HostComparisonRedirect.java:184:39:184:41 | uri : URI | HostComparisonRedirect.java:184:39:184:52 | toString(...) | provenance | MaD:10 | -| HostComparisonRedirect.java:207:19:207:54 | new URI(...) : URI | HostComparisonRedirect.java:210:35:210:37 | uri : URI | provenance | | -| HostComparisonRedirect.java:207:27:207:53 | getParameter(...) : String | HostComparisonRedirect.java:207:19:207:54 | new URI(...) : URI | provenance | Src:MaD:6 MaD:8 | -| HostComparisonRedirect.java:210:35:210:37 | uri : URI | HostComparisonRedirect.java:210:35:210:48 | toString(...) | provenance | MaD:10 | -| HostComparisonRedirect.java:232:19:232:54 | new URI(...) : URI | HostComparisonRedirect.java:236:35:236:37 | uri : URI | provenance | | +| HostComparisonRedirect.java:9:19:9:54 | new URI(...) : URI | HostComparisonRedirect.java:10:31:10:33 | uri : URI | provenance | | +| HostComparisonRedirect.java:9:27:9:53 | getParameter(...) : String | HostComparisonRedirect.java:9:19:9:54 | new URI(...) : URI | provenance | Src:MaD:6 MaD:8 | +| HostComparisonRedirect.java:10:31:10:33 | uri : URI | HostComparisonRedirect.java:10:31:10:44 | toString(...) | provenance | MaD:10 | +| HostComparisonRedirect.java:51:19:51:54 | new URI(...) : URI | HostComparisonRedirect.java:53:35:53:37 | uri : URI | provenance | | +| HostComparisonRedirect.java:51:27:51:53 | getParameter(...) : String | HostComparisonRedirect.java:51:19:51:54 | new URI(...) : URI | provenance | Src:MaD:6 MaD:8 | +| HostComparisonRedirect.java:53:35:53:37 | uri : URI | HostComparisonRedirect.java:53:35:53:48 | toString(...) | provenance | MaD:10 | +| HostComparisonRedirect.java:58:19:58:54 | new URI(...) : URI | HostComparisonRedirect.java:60:35:60:37 | uri : URI | provenance | | +| HostComparisonRedirect.java:58:27:58:53 | getParameter(...) : String | HostComparisonRedirect.java:58:19:58:54 | new URI(...) : URI | provenance | Src:MaD:6 MaD:8 | +| HostComparisonRedirect.java:60:35:60:37 | uri : URI | HostComparisonRedirect.java:60:35:60:48 | toString(...) | provenance | MaD:10 | +| HostComparisonRedirect.java:69:19:69:54 | new URI(...) : URI | HostComparisonRedirect.java:71:35:71:37 | uri : URI | provenance | | +| HostComparisonRedirect.java:69:27:69:53 | getParameter(...) : String | HostComparisonRedirect.java:69:19:69:54 | new URI(...) : URI | provenance | Src:MaD:6 MaD:8 | +| HostComparisonRedirect.java:71:35:71:37 | uri : URI | HostComparisonRedirect.java:71:35:71:48 | toString(...) | provenance | MaD:10 | +| HostComparisonRedirect.java:85:19:85:54 | new URI(...) : URI | HostComparisonRedirect.java:87:35:87:37 | uri : URI | provenance | | +| HostComparisonRedirect.java:85:27:85:53 | getParameter(...) : String | HostComparisonRedirect.java:85:19:85:54 | new URI(...) : URI | provenance | Src:MaD:6 MaD:8 | +| HostComparisonRedirect.java:87:35:87:37 | uri : URI | HostComparisonRedirect.java:87:35:87:48 | toString(...) | provenance | MaD:10 | +| HostComparisonRedirect.java:93:20:93:55 | new URI(...) : URI | HostComparisonRedirect.java:95:35:95:38 | used : URI | provenance | | +| HostComparisonRedirect.java:93:28:93:54 | getParameter(...) : String | HostComparisonRedirect.java:93:20:93:55 | new URI(...) : URI | provenance | Src:MaD:6 MaD:8 | +| HostComparisonRedirect.java:95:35:95:38 | used : URI | HostComparisonRedirect.java:95:35:95:49 | toString(...) | provenance | MaD:10 | +| HostComparisonRedirect.java:104:19:104:54 | new URI(...) : URI | HostComparisonRedirect.java:106:35:106:37 | uri : URI | provenance | | +| HostComparisonRedirect.java:104:27:104:53 | getParameter(...) : String | HostComparisonRedirect.java:104:19:104:54 | new URI(...) : URI | provenance | Src:MaD:6 MaD:8 | +| HostComparisonRedirect.java:106:35:106:37 | uri : URI | HostComparisonRedirect.java:106:35:106:48 | toString(...) | provenance | MaD:10 | +| HostComparisonRedirect.java:112:20:112:55 | new URI(...) : URI | HostComparisonRedirect.java:114:35:114:38 | used : URI | provenance | | +| HostComparisonRedirect.java:112:28:112:54 | getParameter(...) : String | HostComparisonRedirect.java:112:20:112:55 | new URI(...) : URI | provenance | Src:MaD:6 MaD:8 | +| HostComparisonRedirect.java:114:35:114:38 | used : URI | HostComparisonRedirect.java:114:35:114:49 | toString(...) | provenance | MaD:10 | +| HostComparisonRedirect.java:119:19:119:54 | new URI(...) : URI | HostComparisonRedirect.java:123:35:123:37 | uri : URI | provenance | | +| HostComparisonRedirect.java:119:27:119:53 | getParameter(...) : String | HostComparisonRedirect.java:119:19:119:54 | new URI(...) : URI | provenance | Src:MaD:6 MaD:8 | +| HostComparisonRedirect.java:123:35:123:37 | uri : URI | HostComparisonRedirect.java:123:35:123:48 | toString(...) | provenance | MaD:10 | +| HostComparisonRedirect.java:128:19:128:54 | new URI(...) : URI | HostComparisonRedirect.java:134:35:134:37 | uri : URI | provenance | | +| HostComparisonRedirect.java:128:27:128:53 | getParameter(...) : String | HostComparisonRedirect.java:128:19:128:54 | new URI(...) : URI | provenance | Src:MaD:6 MaD:8 | +| HostComparisonRedirect.java:134:35:134:37 | uri : URI | HostComparisonRedirect.java:134:35:134:48 | toString(...) | provenance | MaD:10 | +| HostComparisonRedirect.java:141:15:141:50 | new URI(...) : URI | HostComparisonRedirect.java:143:35:143:37 | uri : URI | provenance | | +| HostComparisonRedirect.java:141:23:141:49 | getParameter(...) : String | HostComparisonRedirect.java:141:15:141:50 | new URI(...) : URI | provenance | Src:MaD:6 MaD:8 | +| HostComparisonRedirect.java:143:35:143:37 | uri : URI | HostComparisonRedirect.java:143:35:143:48 | toString(...) | provenance | MaD:10 | +| HostComparisonRedirect.java:148:19:148:54 | new URI(...) : URI | HostComparisonRedirect.java:150:35:150:37 | uri : URI | provenance | | +| HostComparisonRedirect.java:148:27:148:53 | getParameter(...) : String | HostComparisonRedirect.java:148:19:148:54 | new URI(...) : URI | provenance | Src:MaD:6 MaD:8 | +| HostComparisonRedirect.java:150:35:150:37 | uri : URI | HostComparisonRedirect.java:150:35:150:48 | toString(...) | provenance | MaD:10 | +| HostComparisonRedirect.java:155:19:155:54 | new URI(...) : URI | HostComparisonRedirect.java:157:35:157:37 | uri : URI | provenance | | +| HostComparisonRedirect.java:155:27:155:53 | getParameter(...) : String | HostComparisonRedirect.java:155:19:155:54 | new URI(...) : URI | provenance | Src:MaD:6 MaD:8 | +| HostComparisonRedirect.java:157:35:157:37 | uri : URI | HostComparisonRedirect.java:157:35:157:48 | toString(...) | provenance | MaD:10 | +| HostComparisonRedirect.java:178:19:178:54 | new URI(...) : URI | HostComparisonRedirect.java:185:39:185:41 | uri : URI | provenance | | +| HostComparisonRedirect.java:178:27:178:53 | getParameter(...) : String | HostComparisonRedirect.java:178:19:178:54 | new URI(...) : URI | provenance | Src:MaD:6 MaD:8 | +| HostComparisonRedirect.java:185:39:185:41 | uri : URI | HostComparisonRedirect.java:185:39:185:52 | toString(...) | provenance | MaD:10 | +| HostComparisonRedirect.java:224:19:224:54 | new URI(...) : URI | HostComparisonRedirect.java:227:35:227:37 | uri : URI | provenance | | +| HostComparisonRedirect.java:224:27:224:53 | getParameter(...) : String | HostComparisonRedirect.java:224:19:224:54 | new URI(...) : URI | provenance | Src:MaD:6 MaD:8 | +| HostComparisonRedirect.java:227:35:227:37 | uri : URI | HostComparisonRedirect.java:227:35:227:48 | toString(...) | provenance | MaD:10 | +| HostComparisonRedirect.java:232:19:232:54 | new URI(...) : URI | HostComparisonRedirect.java:235:35:235:37 | uri : URI | provenance | | | HostComparisonRedirect.java:232:27:232:53 | getParameter(...) : String | HostComparisonRedirect.java:232:19:232:54 | new URI(...) : URI | provenance | Src:MaD:6 MaD:8 | -| HostComparisonRedirect.java:236:35:236:37 | uri : URI | HostComparisonRedirect.java:236:35:236:48 | toString(...) | provenance | MaD:10 | -| HostComparisonRedirect.java:241:19:241:54 | new URI(...) : URI | HostComparisonRedirect.java:245:35:245:37 | uri : URI | provenance | | -| HostComparisonRedirect.java:241:27:241:53 | getParameter(...) : String | HostComparisonRedirect.java:241:19:241:54 | new URI(...) : URI | provenance | Src:MaD:6 MaD:8 | -| HostComparisonRedirect.java:245:35:245:37 | uri : URI | HostComparisonRedirect.java:245:35:245:48 | toString(...) | provenance | MaD:10 | +| HostComparisonRedirect.java:235:35:235:37 | uri : URI | HostComparisonRedirect.java:235:35:235:48 | toString(...) | provenance | MaD:10 | +| HostComparisonRedirect.java:257:19:257:54 | new URI(...) : URI | HostComparisonRedirect.java:261:35:261:37 | uri : URI | provenance | | +| HostComparisonRedirect.java:257:27:257:53 | getParameter(...) : String | HostComparisonRedirect.java:257:19:257:54 | new URI(...) : URI | provenance | Src:MaD:6 MaD:8 | +| HostComparisonRedirect.java:261:35:261:37 | uri : URI | HostComparisonRedirect.java:261:35:261:48 | toString(...) | provenance | MaD:10 | +| HostComparisonRedirect.java:266:19:266:54 | new URI(...) : URI | HostComparisonRedirect.java:270:35:270:37 | uri : URI | provenance | | +| HostComparisonRedirect.java:266:27:266:53 | getParameter(...) : String | HostComparisonRedirect.java:266:19:266:54 | new URI(...) : URI | provenance | Src:MaD:6 MaD:8 | +| HostComparisonRedirect.java:270:35:270:37 | uri : URI | HostComparisonRedirect.java:270:35:270:48 | toString(...) | provenance | MaD:10 | | MicronautUrlRedirect.java:12:39:12:63 | target : String | MicronautUrlRedirect.java:14:49:14:54 | target : String | provenance | | | MicronautUrlRedirect.java:14:49:14:54 | target : String | MicronautUrlRedirect.java:14:38:14:55 | create(...) | provenance | MaD:9 Sink:MaD:2 | | MicronautUrlRedirect.java:27:45:27:69 | target : String | MicronautUrlRedirect.java:28:58:28:63 | target : String | provenance | | @@ -104,74 +108,78 @@ models | 9 | Summary: java.net; URI; false; create; ; ; Argument[0]; ReturnValue; taint; manual | | 10 | Summary: java.net; URI; false; toString; ; ; Argument[this]; ReturnValue; taint; manual | nodes -| HostComparisonRedirect.java:8:19:8:54 | new URI(...) : URI | semmle.label | new URI(...) : URI | -| HostComparisonRedirect.java:8:27:8:53 | getParameter(...) : String | semmle.label | getParameter(...) : String | -| HostComparisonRedirect.java:9:31:9:33 | uri : URI | semmle.label | uri : URI | -| HostComparisonRedirect.java:9:31:9:44 | toString(...) | semmle.label | toString(...) | -| HostComparisonRedirect.java:50:19:50:54 | new URI(...) : URI | semmle.label | new URI(...) : URI | -| HostComparisonRedirect.java:50:27:50:53 | getParameter(...) : String | semmle.label | getParameter(...) : String | -| HostComparisonRedirect.java:52:35:52:37 | uri : URI | semmle.label | uri : URI | -| HostComparisonRedirect.java:52:35:52:48 | toString(...) | semmle.label | toString(...) | -| HostComparisonRedirect.java:57:19:57:54 | new URI(...) : URI | semmle.label | new URI(...) : URI | -| HostComparisonRedirect.java:57:27:57:53 | getParameter(...) : String | semmle.label | getParameter(...) : String | -| HostComparisonRedirect.java:59:35:59:37 | uri : URI | semmle.label | uri : URI | -| HostComparisonRedirect.java:59:35:59:48 | toString(...) | semmle.label | toString(...) | -| HostComparisonRedirect.java:68:19:68:54 | new URI(...) : URI | semmle.label | new URI(...) : URI | -| HostComparisonRedirect.java:68:27:68:53 | getParameter(...) : String | semmle.label | getParameter(...) : String | -| HostComparisonRedirect.java:70:35:70:37 | uri : URI | semmle.label | uri : URI | -| HostComparisonRedirect.java:70:35:70:48 | toString(...) | semmle.label | toString(...) | -| HostComparisonRedirect.java:84:19:84:54 | new URI(...) : URI | semmle.label | new URI(...) : URI | -| HostComparisonRedirect.java:84:27:84:53 | getParameter(...) : String | semmle.label | getParameter(...) : String | -| HostComparisonRedirect.java:86:35:86:37 | uri : URI | semmle.label | uri : URI | -| HostComparisonRedirect.java:86:35:86:48 | toString(...) | semmle.label | toString(...) | -| HostComparisonRedirect.java:92:20:92:55 | new URI(...) : URI | semmle.label | new URI(...) : URI | -| HostComparisonRedirect.java:92:28:92:54 | getParameter(...) : String | semmle.label | getParameter(...) : String | -| HostComparisonRedirect.java:94:35:94:38 | used : URI | semmle.label | used : URI | -| HostComparisonRedirect.java:94:35:94:49 | toString(...) | semmle.label | toString(...) | -| HostComparisonRedirect.java:103:19:103:54 | new URI(...) : URI | semmle.label | new URI(...) : URI | -| HostComparisonRedirect.java:103:27:103:53 | getParameter(...) : String | semmle.label | getParameter(...) : String | -| HostComparisonRedirect.java:105:35:105:37 | uri : URI | semmle.label | uri : URI | -| HostComparisonRedirect.java:105:35:105:48 | toString(...) | semmle.label | toString(...) | -| HostComparisonRedirect.java:111:20:111:55 | new URI(...) : URI | semmle.label | new URI(...) : URI | -| HostComparisonRedirect.java:111:28:111:54 | getParameter(...) : String | semmle.label | getParameter(...) : String | -| HostComparisonRedirect.java:113:35:113:38 | used : URI | semmle.label | used : URI | -| HostComparisonRedirect.java:113:35:113:49 | toString(...) | semmle.label | toString(...) | -| HostComparisonRedirect.java:118:19:118:54 | new URI(...) : URI | semmle.label | new URI(...) : URI | -| HostComparisonRedirect.java:118:27:118:53 | getParameter(...) : String | semmle.label | getParameter(...) : String | -| HostComparisonRedirect.java:122:35:122:37 | uri : URI | semmle.label | uri : URI | -| HostComparisonRedirect.java:122:35:122:48 | toString(...) | semmle.label | toString(...) | -| HostComparisonRedirect.java:127:19:127:54 | new URI(...) : URI | semmle.label | new URI(...) : URI | -| HostComparisonRedirect.java:127:27:127:53 | getParameter(...) : String | semmle.label | getParameter(...) : String | -| HostComparisonRedirect.java:133:35:133:37 | uri : URI | semmle.label | uri : URI | -| HostComparisonRedirect.java:133:35:133:48 | toString(...) | semmle.label | toString(...) | -| HostComparisonRedirect.java:140:15:140:50 | new URI(...) : URI | semmle.label | new URI(...) : URI | -| HostComparisonRedirect.java:140:23:140:49 | getParameter(...) : String | semmle.label | getParameter(...) : String | -| HostComparisonRedirect.java:142:35:142:37 | uri : URI | semmle.label | uri : URI | -| HostComparisonRedirect.java:142:35:142:48 | toString(...) | semmle.label | toString(...) | -| HostComparisonRedirect.java:147:19:147:54 | new URI(...) : URI | semmle.label | new URI(...) : URI | -| HostComparisonRedirect.java:147:27:147:53 | getParameter(...) : String | semmle.label | getParameter(...) : String | -| HostComparisonRedirect.java:149:35:149:37 | uri : URI | semmle.label | uri : URI | -| HostComparisonRedirect.java:149:35:149:48 | toString(...) | semmle.label | toString(...) | -| HostComparisonRedirect.java:154:19:154:54 | new URI(...) : URI | semmle.label | new URI(...) : URI | -| HostComparisonRedirect.java:154:27:154:53 | getParameter(...) : String | semmle.label | getParameter(...) : String | -| HostComparisonRedirect.java:156:35:156:37 | uri : URI | semmle.label | uri : URI | -| HostComparisonRedirect.java:156:35:156:48 | toString(...) | semmle.label | toString(...) | -| HostComparisonRedirect.java:177:19:177:54 | new URI(...) : URI | semmle.label | new URI(...) : URI | -| HostComparisonRedirect.java:177:27:177:53 | getParameter(...) : String | semmle.label | getParameter(...) : String | -| HostComparisonRedirect.java:184:39:184:41 | uri : URI | semmle.label | uri : URI | -| HostComparisonRedirect.java:184:39:184:52 | toString(...) | semmle.label | toString(...) | -| HostComparisonRedirect.java:207:19:207:54 | new URI(...) : URI | semmle.label | new URI(...) : URI | -| HostComparisonRedirect.java:207:27:207:53 | getParameter(...) : String | semmle.label | getParameter(...) : String | -| HostComparisonRedirect.java:210:35:210:37 | uri : URI | semmle.label | uri : URI | -| HostComparisonRedirect.java:210:35:210:48 | toString(...) | semmle.label | toString(...) | +| HostComparisonRedirect.java:9:19:9:54 | new URI(...) : URI | semmle.label | new URI(...) : URI | +| HostComparisonRedirect.java:9:27:9:53 | getParameter(...) : String | semmle.label | getParameter(...) : String | +| HostComparisonRedirect.java:10:31:10:33 | uri : URI | semmle.label | uri : URI | +| HostComparisonRedirect.java:10:31:10:44 | toString(...) | semmle.label | toString(...) | +| HostComparisonRedirect.java:51:19:51:54 | new URI(...) : URI | semmle.label | new URI(...) : URI | +| HostComparisonRedirect.java:51:27:51:53 | getParameter(...) : String | semmle.label | getParameter(...) : String | +| HostComparisonRedirect.java:53:35:53:37 | uri : URI | semmle.label | uri : URI | +| HostComparisonRedirect.java:53:35:53:48 | toString(...) | semmle.label | toString(...) | +| HostComparisonRedirect.java:58:19:58:54 | new URI(...) : URI | semmle.label | new URI(...) : URI | +| HostComparisonRedirect.java:58:27:58:53 | getParameter(...) : String | semmle.label | getParameter(...) : String | +| HostComparisonRedirect.java:60:35:60:37 | uri : URI | semmle.label | uri : URI | +| HostComparisonRedirect.java:60:35:60:48 | toString(...) | semmle.label | toString(...) | +| HostComparisonRedirect.java:69:19:69:54 | new URI(...) : URI | semmle.label | new URI(...) : URI | +| HostComparisonRedirect.java:69:27:69:53 | getParameter(...) : String | semmle.label | getParameter(...) : String | +| HostComparisonRedirect.java:71:35:71:37 | uri : URI | semmle.label | uri : URI | +| HostComparisonRedirect.java:71:35:71:48 | toString(...) | semmle.label | toString(...) | +| HostComparisonRedirect.java:85:19:85:54 | new URI(...) : URI | semmle.label | new URI(...) : URI | +| HostComparisonRedirect.java:85:27:85:53 | getParameter(...) : String | semmle.label | getParameter(...) : String | +| HostComparisonRedirect.java:87:35:87:37 | uri : URI | semmle.label | uri : URI | +| HostComparisonRedirect.java:87:35:87:48 | toString(...) | semmle.label | toString(...) | +| HostComparisonRedirect.java:93:20:93:55 | new URI(...) : URI | semmle.label | new URI(...) : URI | +| HostComparisonRedirect.java:93:28:93:54 | getParameter(...) : String | semmle.label | getParameter(...) : String | +| HostComparisonRedirect.java:95:35:95:38 | used : URI | semmle.label | used : URI | +| HostComparisonRedirect.java:95:35:95:49 | toString(...) | semmle.label | toString(...) | +| HostComparisonRedirect.java:104:19:104:54 | new URI(...) : URI | semmle.label | new URI(...) : URI | +| HostComparisonRedirect.java:104:27:104:53 | getParameter(...) : String | semmle.label | getParameter(...) : String | +| HostComparisonRedirect.java:106:35:106:37 | uri : URI | semmle.label | uri : URI | +| HostComparisonRedirect.java:106:35:106:48 | toString(...) | semmle.label | toString(...) | +| HostComparisonRedirect.java:112:20:112:55 | new URI(...) : URI | semmle.label | new URI(...) : URI | +| HostComparisonRedirect.java:112:28:112:54 | getParameter(...) : String | semmle.label | getParameter(...) : String | +| HostComparisonRedirect.java:114:35:114:38 | used : URI | semmle.label | used : URI | +| HostComparisonRedirect.java:114:35:114:49 | toString(...) | semmle.label | toString(...) | +| HostComparisonRedirect.java:119:19:119:54 | new URI(...) : URI | semmle.label | new URI(...) : URI | +| HostComparisonRedirect.java:119:27:119:53 | getParameter(...) : String | semmle.label | getParameter(...) : String | +| HostComparisonRedirect.java:123:35:123:37 | uri : URI | semmle.label | uri : URI | +| HostComparisonRedirect.java:123:35:123:48 | toString(...) | semmle.label | toString(...) | +| HostComparisonRedirect.java:128:19:128:54 | new URI(...) : URI | semmle.label | new URI(...) : URI | +| HostComparisonRedirect.java:128:27:128:53 | getParameter(...) : String | semmle.label | getParameter(...) : String | +| HostComparisonRedirect.java:134:35:134:37 | uri : URI | semmle.label | uri : URI | +| HostComparisonRedirect.java:134:35:134:48 | toString(...) | semmle.label | toString(...) | +| HostComparisonRedirect.java:141:15:141:50 | new URI(...) : URI | semmle.label | new URI(...) : URI | +| HostComparisonRedirect.java:141:23:141:49 | getParameter(...) : String | semmle.label | getParameter(...) : String | +| HostComparisonRedirect.java:143:35:143:37 | uri : URI | semmle.label | uri : URI | +| HostComparisonRedirect.java:143:35:143:48 | toString(...) | semmle.label | toString(...) | +| HostComparisonRedirect.java:148:19:148:54 | new URI(...) : URI | semmle.label | new URI(...) : URI | +| HostComparisonRedirect.java:148:27:148:53 | getParameter(...) : String | semmle.label | getParameter(...) : String | +| HostComparisonRedirect.java:150:35:150:37 | uri : URI | semmle.label | uri : URI | +| HostComparisonRedirect.java:150:35:150:48 | toString(...) | semmle.label | toString(...) | +| HostComparisonRedirect.java:155:19:155:54 | new URI(...) : URI | semmle.label | new URI(...) : URI | +| HostComparisonRedirect.java:155:27:155:53 | getParameter(...) : String | semmle.label | getParameter(...) : String | +| HostComparisonRedirect.java:157:35:157:37 | uri : URI | semmle.label | uri : URI | +| HostComparisonRedirect.java:157:35:157:48 | toString(...) | semmle.label | toString(...) | +| HostComparisonRedirect.java:178:19:178:54 | new URI(...) : URI | semmle.label | new URI(...) : URI | +| HostComparisonRedirect.java:178:27:178:53 | getParameter(...) : String | semmle.label | getParameter(...) : String | +| HostComparisonRedirect.java:185:39:185:41 | uri : URI | semmle.label | uri : URI | +| HostComparisonRedirect.java:185:39:185:52 | toString(...) | semmle.label | toString(...) | +| HostComparisonRedirect.java:224:19:224:54 | new URI(...) : URI | semmle.label | new URI(...) : URI | +| HostComparisonRedirect.java:224:27:224:53 | getParameter(...) : String | semmle.label | getParameter(...) : String | +| HostComparisonRedirect.java:227:35:227:37 | uri : URI | semmle.label | uri : URI | +| HostComparisonRedirect.java:227:35:227:48 | toString(...) | semmle.label | toString(...) | | HostComparisonRedirect.java:232:19:232:54 | new URI(...) : URI | semmle.label | new URI(...) : URI | | HostComparisonRedirect.java:232:27:232:53 | getParameter(...) : String | semmle.label | getParameter(...) : String | -| HostComparisonRedirect.java:236:35:236:37 | uri : URI | semmle.label | uri : URI | -| HostComparisonRedirect.java:236:35:236:48 | toString(...) | semmle.label | toString(...) | -| HostComparisonRedirect.java:241:19:241:54 | new URI(...) : URI | semmle.label | new URI(...) : URI | -| HostComparisonRedirect.java:241:27:241:53 | getParameter(...) : String | semmle.label | getParameter(...) : String | -| HostComparisonRedirect.java:245:35:245:37 | uri : URI | semmle.label | uri : URI | -| HostComparisonRedirect.java:245:35:245:48 | toString(...) | semmle.label | toString(...) | +| HostComparisonRedirect.java:235:35:235:37 | uri : URI | semmle.label | uri : URI | +| HostComparisonRedirect.java:235:35:235:48 | toString(...) | semmle.label | toString(...) | +| HostComparisonRedirect.java:257:19:257:54 | new URI(...) : URI | semmle.label | new URI(...) : URI | +| HostComparisonRedirect.java:257:27:257:53 | getParameter(...) : String | semmle.label | getParameter(...) : String | +| HostComparisonRedirect.java:261:35:261:37 | uri : URI | semmle.label | uri : URI | +| HostComparisonRedirect.java:261:35:261:48 | toString(...) | semmle.label | toString(...) | +| HostComparisonRedirect.java:266:19:266:54 | new URI(...) : URI | semmle.label | new URI(...) : URI | +| HostComparisonRedirect.java:266:27:266:53 | getParameter(...) : String | semmle.label | getParameter(...) : String | +| HostComparisonRedirect.java:270:35:270:37 | uri : URI | semmle.label | uri : URI | +| HostComparisonRedirect.java:270:35:270:48 | toString(...) | semmle.label | toString(...) | | MicronautUrlRedirect.java:12:39:12:63 | target : String | semmle.label | target : String | | MicronautUrlRedirect.java:14:38:14:55 | create(...) | semmle.label | create(...) | | MicronautUrlRedirect.java:14:49:14:54 | target : String | semmle.label | target : String | diff --git a/java/ql/test/query-tests/security/CWE-918/HostComparison.java b/java/ql/test/query-tests/security/CWE-918/HostComparison.java index 163a74d1d8ae..daecaa4557c7 100644 --- a/java/ql/test/query-tests/security/CWE-918/HostComparison.java +++ b/java/ql/test/query-tests/security/CWE-918/HostComparison.java @@ -1,5 +1,6 @@ import java.net.URI; import java.util.Arrays; +import java.util.Set; import javax.servlet.http.HttpServletRequest; public class HostComparison { @@ -202,6 +203,30 @@ public void constantAllowlistField(HttpServletRequest request) throws Exception } } + public void constantCollection(HttpServletRequest request) throws Exception { + URI uri = new URI(request.getParameter("url")); + String host = uri.getHost(); + if (Set.of("example.com", "example.org").contains(host)) { + uri.toURL().openConnection(); + } + } + + public void normalizedConstantCollection(HttpServletRequest request) throws Exception { + URI uri = new URI(request.getParameter("url")); + String host = uri.getHost(); + if (Set.of("EXAMPLE.COM", "EXAMPLE.ORG").contains(host.toUpperCase())) { + uri.toURL().openConnection(); + } + } + + public void untrustedCollection(HttpServletRequest request) throws Exception { + URI uri = new URI(request.getParameter("url")); // $ Source + String host = uri.getHost(); + if (Set.of(request.getParameter("allowed")).contains(host)) { + uri.toURL().openConnection(); // $ Alert + } + } + public void orBypass(HttpServletRequest request, boolean skip) throws Exception { URI uri = new URI(request.getParameter("url")); // $ Source String host = uri.getHost(); diff --git a/java/ql/test/query-tests/security/CWE-918/RequestForgery.expected b/java/ql/test/query-tests/security/CWE-918/RequestForgery.expected index 3aaa32970e6d..106827a84070 100644 --- a/java/ql/test/query-tests/security/CWE-918/RequestForgery.expected +++ b/java/ql/test/query-tests/security/CWE-918/RequestForgery.expected @@ -210,23 +210,24 @@ | ApacheHttpSSRFVersion5.java:388:44:388:46 | uri | ApacheHttpSSRFVersion5.java:372:30:372:56 | getParameter(...) : String | ApacheHttpSSRFVersion5.java:388:44:388:46 | uri | Potential server-side request forgery due to a $@. | ApacheHttpSSRFVersion5.java:372:30:372:56 | getParameter(...) | user-provided value | | ApacheHttpSSRFVersion5.java:390:24:390:26 | uri | ApacheHttpSSRFVersion5.java:372:30:372:56 | getParameter(...) : String | ApacheHttpSSRFVersion5.java:390:24:390:26 | uri | Potential server-side request forgery due to a $@. | ApacheHttpSSRFVersion5.java:372:30:372:56 | getParameter(...) | user-provided value | | ApacheHttpSSRFVersion5.java:394:24:394:26 | uri | ApacheHttpSSRFVersion5.java:372:30:372:56 | getParameter(...) : String | ApacheHttpSSRFVersion5.java:394:24:394:26 | uri | Potential server-side request forgery due to a $@. | ApacheHttpSSRFVersion5.java:372:30:372:56 | getParameter(...) | user-provided value | -| HostComparison.java:8:9:8:19 | toURL(...) | HostComparison.java:7:27:7:53 | getParameter(...) : String | HostComparison.java:8:9:8:19 | toURL(...) | Potential server-side request forgery due to a $@. | HostComparison.java:7:27:7:53 | getParameter(...) | user-provided value | -| HostComparison.java:51:13:51:23 | toURL(...) | HostComparison.java:49:27:49:53 | getParameter(...) : String | HostComparison.java:51:13:51:23 | toURL(...) | Potential server-side request forgery due to a $@. | HostComparison.java:49:27:49:53 | getParameter(...) | user-provided value | -| HostComparison.java:58:13:58:23 | toURL(...) | HostComparison.java:56:27:56:53 | getParameter(...) : String | HostComparison.java:58:13:58:23 | toURL(...) | Potential server-side request forgery due to a $@. | HostComparison.java:56:27:56:53 | getParameter(...) | user-provided value | -| HostComparison.java:69:13:69:23 | toURL(...) | HostComparison.java:67:27:67:53 | getParameter(...) : String | HostComparison.java:69:13:69:23 | toURL(...) | Potential server-side request forgery due to a $@. | HostComparison.java:67:27:67:53 | getParameter(...) | user-provided value | -| HostComparison.java:85:13:85:23 | toURL(...) | HostComparison.java:83:27:83:53 | getParameter(...) : String | HostComparison.java:85:13:85:23 | toURL(...) | Potential server-side request forgery due to a $@. | HostComparison.java:83:27:83:53 | getParameter(...) | user-provided value | -| HostComparison.java:93:13:93:24 | toURL(...) | HostComparison.java:91:28:91:54 | getParameter(...) : String | HostComparison.java:93:13:93:24 | toURL(...) | Potential server-side request forgery due to a $@. | HostComparison.java:91:28:91:54 | getParameter(...) | user-provided value | -| HostComparison.java:104:13:104:23 | toURL(...) | HostComparison.java:102:27:102:53 | getParameter(...) : String | HostComparison.java:104:13:104:23 | toURL(...) | Potential server-side request forgery due to a $@. | HostComparison.java:102:27:102:53 | getParameter(...) | user-provided value | -| HostComparison.java:112:13:112:24 | toURL(...) | HostComparison.java:110:28:110:54 | getParameter(...) : String | HostComparison.java:112:13:112:24 | toURL(...) | Potential server-side request forgery due to a $@. | HostComparison.java:110:28:110:54 | getParameter(...) | user-provided value | -| HostComparison.java:121:13:121:23 | toURL(...) | HostComparison.java:117:27:117:53 | getParameter(...) : String | HostComparison.java:121:13:121:23 | toURL(...) | Potential server-side request forgery due to a $@. | HostComparison.java:117:27:117:53 | getParameter(...) | user-provided value | -| HostComparison.java:132:13:132:23 | toURL(...) | HostComparison.java:126:27:126:53 | getParameter(...) : String | HostComparison.java:132:13:132:23 | toURL(...) | Potential server-side request forgery due to a $@. | HostComparison.java:126:27:126:53 | getParameter(...) | user-provided value | -| HostComparison.java:141:13:141:23 | toURL(...) | HostComparison.java:139:23:139:49 | getParameter(...) : String | HostComparison.java:141:13:141:23 | toURL(...) | Potential server-side request forgery due to a $@. | HostComparison.java:139:23:139:49 | getParameter(...) | user-provided value | -| HostComparison.java:148:13:148:23 | toURL(...) | HostComparison.java:146:27:146:53 | getParameter(...) : String | HostComparison.java:148:13:148:23 | toURL(...) | Potential server-side request forgery due to a $@. | HostComparison.java:146:27:146:53 | getParameter(...) | user-provided value | -| HostComparison.java:155:13:155:23 | toURL(...) | HostComparison.java:153:27:153:53 | getParameter(...) : String | HostComparison.java:155:13:155:23 | toURL(...) | Potential server-side request forgery due to a $@. | HostComparison.java:153:27:153:53 | getParameter(...) | user-provided value | -| HostComparison.java:183:17:183:27 | toURL(...) | HostComparison.java:176:27:176:53 | getParameter(...) : String | HostComparison.java:183:17:183:27 | toURL(...) | Potential server-side request forgery due to a $@. | HostComparison.java:176:27:176:53 | getParameter(...) | user-provided value | -| HostComparison.java:209:13:209:23 | toURL(...) | HostComparison.java:206:27:206:53 | getParameter(...) : String | HostComparison.java:209:13:209:23 | toURL(...) | Potential server-side request forgery due to a $@. | HostComparison.java:206:27:206:53 | getParameter(...) | user-provided value | -| HostComparison.java:235:13:235:23 | toURL(...) | HostComparison.java:231:27:231:53 | getParameter(...) : String | HostComparison.java:235:13:235:23 | toURL(...) | Potential server-side request forgery due to a $@. | HostComparison.java:231:27:231:53 | getParameter(...) | user-provided value | -| HostComparison.java:244:13:244:23 | toURL(...) | HostComparison.java:240:27:240:53 | getParameter(...) : String | HostComparison.java:244:13:244:23 | toURL(...) | Potential server-side request forgery due to a $@. | HostComparison.java:240:27:240:53 | getParameter(...) | user-provided value | +| HostComparison.java:9:9:9:19 | toURL(...) | HostComparison.java:8:27:8:53 | getParameter(...) : String | HostComparison.java:9:9:9:19 | toURL(...) | Potential server-side request forgery due to a $@. | HostComparison.java:8:27:8:53 | getParameter(...) | user-provided value | +| HostComparison.java:52:13:52:23 | toURL(...) | HostComparison.java:50:27:50:53 | getParameter(...) : String | HostComparison.java:52:13:52:23 | toURL(...) | Potential server-side request forgery due to a $@. | HostComparison.java:50:27:50:53 | getParameter(...) | user-provided value | +| HostComparison.java:59:13:59:23 | toURL(...) | HostComparison.java:57:27:57:53 | getParameter(...) : String | HostComparison.java:59:13:59:23 | toURL(...) | Potential server-side request forgery due to a $@. | HostComparison.java:57:27:57:53 | getParameter(...) | user-provided value | +| HostComparison.java:70:13:70:23 | toURL(...) | HostComparison.java:68:27:68:53 | getParameter(...) : String | HostComparison.java:70:13:70:23 | toURL(...) | Potential server-side request forgery due to a $@. | HostComparison.java:68:27:68:53 | getParameter(...) | user-provided value | +| HostComparison.java:86:13:86:23 | toURL(...) | HostComparison.java:84:27:84:53 | getParameter(...) : String | HostComparison.java:86:13:86:23 | toURL(...) | Potential server-side request forgery due to a $@. | HostComparison.java:84:27:84:53 | getParameter(...) | user-provided value | +| HostComparison.java:94:13:94:24 | toURL(...) | HostComparison.java:92:28:92:54 | getParameter(...) : String | HostComparison.java:94:13:94:24 | toURL(...) | Potential server-side request forgery due to a $@. | HostComparison.java:92:28:92:54 | getParameter(...) | user-provided value | +| HostComparison.java:105:13:105:23 | toURL(...) | HostComparison.java:103:27:103:53 | getParameter(...) : String | HostComparison.java:105:13:105:23 | toURL(...) | Potential server-side request forgery due to a $@. | HostComparison.java:103:27:103:53 | getParameter(...) | user-provided value | +| HostComparison.java:113:13:113:24 | toURL(...) | HostComparison.java:111:28:111:54 | getParameter(...) : String | HostComparison.java:113:13:113:24 | toURL(...) | Potential server-side request forgery due to a $@. | HostComparison.java:111:28:111:54 | getParameter(...) | user-provided value | +| HostComparison.java:122:13:122:23 | toURL(...) | HostComparison.java:118:27:118:53 | getParameter(...) : String | HostComparison.java:122:13:122:23 | toURL(...) | Potential server-side request forgery due to a $@. | HostComparison.java:118:27:118:53 | getParameter(...) | user-provided value | +| HostComparison.java:133:13:133:23 | toURL(...) | HostComparison.java:127:27:127:53 | getParameter(...) : String | HostComparison.java:133:13:133:23 | toURL(...) | Potential server-side request forgery due to a $@. | HostComparison.java:127:27:127:53 | getParameter(...) | user-provided value | +| HostComparison.java:142:13:142:23 | toURL(...) | HostComparison.java:140:23:140:49 | getParameter(...) : String | HostComparison.java:142:13:142:23 | toURL(...) | Potential server-side request forgery due to a $@. | HostComparison.java:140:23:140:49 | getParameter(...) | user-provided value | +| HostComparison.java:149:13:149:23 | toURL(...) | HostComparison.java:147:27:147:53 | getParameter(...) : String | HostComparison.java:149:13:149:23 | toURL(...) | Potential server-side request forgery due to a $@. | HostComparison.java:147:27:147:53 | getParameter(...) | user-provided value | +| HostComparison.java:156:13:156:23 | toURL(...) | HostComparison.java:154:27:154:53 | getParameter(...) : String | HostComparison.java:156:13:156:23 | toURL(...) | Potential server-side request forgery due to a $@. | HostComparison.java:154:27:154:53 | getParameter(...) | user-provided value | +| HostComparison.java:184:17:184:27 | toURL(...) | HostComparison.java:177:27:177:53 | getParameter(...) : String | HostComparison.java:184:17:184:27 | toURL(...) | Potential server-side request forgery due to a $@. | HostComparison.java:177:27:177:53 | getParameter(...) | user-provided value | +| HostComparison.java:226:13:226:23 | toURL(...) | HostComparison.java:223:27:223:53 | getParameter(...) : String | HostComparison.java:226:13:226:23 | toURL(...) | Potential server-side request forgery due to a $@. | HostComparison.java:223:27:223:53 | getParameter(...) | user-provided value | +| HostComparison.java:234:13:234:23 | toURL(...) | HostComparison.java:231:27:231:53 | getParameter(...) : String | HostComparison.java:234:13:234:23 | toURL(...) | Potential server-side request forgery due to a $@. | HostComparison.java:231:27:231:53 | getParameter(...) | user-provided value | +| HostComparison.java:260:13:260:23 | toURL(...) | HostComparison.java:256:27:256:53 | getParameter(...) : String | HostComparison.java:260:13:260:23 | toURL(...) | Potential server-side request forgery due to a $@. | HostComparison.java:256:27:256:53 | getParameter(...) | user-provided value | +| HostComparison.java:269:13:269:23 | toURL(...) | HostComparison.java:265:27:265:53 | getParameter(...) : String | HostComparison.java:269:13:269:23 | toURL(...) | Potential server-side request forgery due to a $@. | HostComparison.java:265:27:265:53 | getParameter(...) | user-provided value | | JakartaWsSSRF.java:15:23:15:25 | url | JakartaWsSSRF.java:14:22:14:48 | getParameter(...) : String | JakartaWsSSRF.java:15:23:15:25 | url | Potential server-side request forgery due to a $@. | JakartaWsSSRF.java:14:22:14:48 | getParameter(...) | user-provided value | | JavaNetHttpSSRF.java:30:32:30:35 | url1 | JavaNetHttpSSRF.java:25:27:25:53 | getParameter(...) : String | JavaNetHttpSSRF.java:30:32:30:35 | url1 | Potential server-side request forgery due to a $@. | JavaNetHttpSSRF.java:25:27:25:53 | getParameter(...) | user-provided value | | JavaNetHttpSSRF.java:33:32:33:35 | url1 | JavaNetHttpSSRF.java:25:27:25:53 | getParameter(...) : String | JavaNetHttpSSRF.java:33:32:33:35 | url1 | Potential server-side request forgery due to a $@. | JavaNetHttpSSRF.java:25:27:25:53 | getParameter(...) | user-provided value | @@ -733,74 +734,78 @@ edges | ApacheHttpSSRFVersion5.java:376:29:376:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:385:50:385:53 | host | provenance | Sink:MaD:206 | | ApacheHttpSSRFVersion5.java:376:29:376:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:387:44:387:47 | host | provenance | Sink:MaD:208 | | ApacheHttpSSRFVersion5.java:376:42:376:49 | hostSink : String | ApacheHttpSSRFVersion5.java:376:29:376:50 | new HttpHost(...) : HttpHost | provenance | MaD:315 | -| HostComparison.java:7:19:7:54 | new URI(...) : URI | HostComparison.java:8:9:8:11 | uri : URI | provenance | | -| HostComparison.java:7:27:7:53 | getParameter(...) : String | HostComparison.java:7:19:7:54 | new URI(...) : URI | provenance | Src:MaD:292 Config | -| HostComparison.java:7:27:7:53 | getParameter(...) : String | HostComparison.java:7:19:7:54 | new URI(...) : URI | provenance | Src:MaD:292 MaD:304 | -| HostComparison.java:8:9:8:11 | uri : URI | HostComparison.java:8:9:8:19 | toURL(...) | provenance | MaD:308 Sink:MaD:15 | -| HostComparison.java:49:19:49:54 | new URI(...) : URI | HostComparison.java:51:13:51:15 | uri : URI | provenance | | -| HostComparison.java:49:27:49:53 | getParameter(...) : String | HostComparison.java:49:19:49:54 | new URI(...) : URI | provenance | Src:MaD:292 Config | -| HostComparison.java:49:27:49:53 | getParameter(...) : String | HostComparison.java:49:19:49:54 | new URI(...) : URI | provenance | Src:MaD:292 MaD:304 | -| HostComparison.java:51:13:51:15 | uri : URI | HostComparison.java:51:13:51:23 | toURL(...) | provenance | MaD:308 Sink:MaD:15 | -| HostComparison.java:56:19:56:54 | new URI(...) : URI | HostComparison.java:58:13:58:15 | uri : URI | provenance | | -| HostComparison.java:56:27:56:53 | getParameter(...) : String | HostComparison.java:56:19:56:54 | new URI(...) : URI | provenance | Src:MaD:292 Config | -| HostComparison.java:56:27:56:53 | getParameter(...) : String | HostComparison.java:56:19:56:54 | new URI(...) : URI | provenance | Src:MaD:292 MaD:304 | -| HostComparison.java:58:13:58:15 | uri : URI | HostComparison.java:58:13:58:23 | toURL(...) | provenance | MaD:308 Sink:MaD:15 | -| HostComparison.java:67:19:67:54 | new URI(...) : URI | HostComparison.java:69:13:69:15 | uri : URI | provenance | | -| HostComparison.java:67:27:67:53 | getParameter(...) : String | HostComparison.java:67:19:67:54 | new URI(...) : URI | provenance | Src:MaD:292 Config | -| HostComparison.java:67:27:67:53 | getParameter(...) : String | HostComparison.java:67:19:67:54 | new URI(...) : URI | provenance | Src:MaD:292 MaD:304 | -| HostComparison.java:69:13:69:15 | uri : URI | HostComparison.java:69:13:69:23 | toURL(...) | provenance | MaD:308 Sink:MaD:15 | -| HostComparison.java:83:19:83:54 | new URI(...) : URI | HostComparison.java:85:13:85:15 | uri : URI | provenance | | -| HostComparison.java:83:27:83:53 | getParameter(...) : String | HostComparison.java:83:19:83:54 | new URI(...) : URI | provenance | Src:MaD:292 Config | -| HostComparison.java:83:27:83:53 | getParameter(...) : String | HostComparison.java:83:19:83:54 | new URI(...) : URI | provenance | Src:MaD:292 MaD:304 | -| HostComparison.java:85:13:85:15 | uri : URI | HostComparison.java:85:13:85:23 | toURL(...) | provenance | MaD:308 Sink:MaD:15 | -| HostComparison.java:91:20:91:55 | new URI(...) : URI | HostComparison.java:93:13:93:16 | used : URI | provenance | | -| HostComparison.java:91:28:91:54 | getParameter(...) : String | HostComparison.java:91:20:91:55 | new URI(...) : URI | provenance | Src:MaD:292 Config | -| HostComparison.java:91:28:91:54 | getParameter(...) : String | HostComparison.java:91:20:91:55 | new URI(...) : URI | provenance | Src:MaD:292 MaD:304 | -| HostComparison.java:93:13:93:16 | used : URI | HostComparison.java:93:13:93:24 | toURL(...) | provenance | MaD:308 Sink:MaD:15 | -| HostComparison.java:102:19:102:54 | new URI(...) : URI | HostComparison.java:104:13:104:15 | uri : URI | provenance | | -| HostComparison.java:102:27:102:53 | getParameter(...) : String | HostComparison.java:102:19:102:54 | new URI(...) : URI | provenance | Src:MaD:292 Config | -| HostComparison.java:102:27:102:53 | getParameter(...) : String | HostComparison.java:102:19:102:54 | new URI(...) : URI | provenance | Src:MaD:292 MaD:304 | -| HostComparison.java:104:13:104:15 | uri : URI | HostComparison.java:104:13:104:23 | toURL(...) | provenance | MaD:308 Sink:MaD:15 | -| HostComparison.java:110:20:110:55 | new URI(...) : URI | HostComparison.java:112:13:112:16 | used : URI | provenance | | -| HostComparison.java:110:28:110:54 | getParameter(...) : String | HostComparison.java:110:20:110:55 | new URI(...) : URI | provenance | Src:MaD:292 Config | -| HostComparison.java:110:28:110:54 | getParameter(...) : String | HostComparison.java:110:20:110:55 | new URI(...) : URI | provenance | Src:MaD:292 MaD:304 | -| HostComparison.java:112:13:112:16 | used : URI | HostComparison.java:112:13:112:24 | toURL(...) | provenance | MaD:308 Sink:MaD:15 | -| HostComparison.java:117:19:117:54 | new URI(...) : URI | HostComparison.java:121:13:121:15 | uri : URI | provenance | | -| HostComparison.java:117:27:117:53 | getParameter(...) : String | HostComparison.java:117:19:117:54 | new URI(...) : URI | provenance | Src:MaD:292 Config | -| HostComparison.java:117:27:117:53 | getParameter(...) : String | HostComparison.java:117:19:117:54 | new URI(...) : URI | provenance | Src:MaD:292 MaD:304 | -| HostComparison.java:121:13:121:15 | uri : URI | HostComparison.java:121:13:121:23 | toURL(...) | provenance | MaD:308 Sink:MaD:15 | -| HostComparison.java:126:19:126:54 | new URI(...) : URI | HostComparison.java:132:13:132:15 | uri : URI | provenance | | -| HostComparison.java:126:27:126:53 | getParameter(...) : String | HostComparison.java:126:19:126:54 | new URI(...) : URI | provenance | Src:MaD:292 Config | -| HostComparison.java:126:27:126:53 | getParameter(...) : String | HostComparison.java:126:19:126:54 | new URI(...) : URI | provenance | Src:MaD:292 MaD:304 | -| HostComparison.java:132:13:132:15 | uri : URI | HostComparison.java:132:13:132:23 | toURL(...) | provenance | MaD:308 Sink:MaD:15 | -| HostComparison.java:139:15:139:50 | new URI(...) : URI | HostComparison.java:141:13:141:15 | uri : URI | provenance | | -| HostComparison.java:139:23:139:49 | getParameter(...) : String | HostComparison.java:139:15:139:50 | new URI(...) : URI | provenance | Src:MaD:292 Config | -| HostComparison.java:139:23:139:49 | getParameter(...) : String | HostComparison.java:139:15:139:50 | new URI(...) : URI | provenance | Src:MaD:292 MaD:304 | -| HostComparison.java:141:13:141:15 | uri : URI | HostComparison.java:141:13:141:23 | toURL(...) | provenance | MaD:308 Sink:MaD:15 | -| HostComparison.java:146:19:146:54 | new URI(...) : URI | HostComparison.java:148:13:148:15 | uri : URI | provenance | | -| HostComparison.java:146:27:146:53 | getParameter(...) : String | HostComparison.java:146:19:146:54 | new URI(...) : URI | provenance | Src:MaD:292 Config | -| HostComparison.java:146:27:146:53 | getParameter(...) : String | HostComparison.java:146:19:146:54 | new URI(...) : URI | provenance | Src:MaD:292 MaD:304 | -| HostComparison.java:148:13:148:15 | uri : URI | HostComparison.java:148:13:148:23 | toURL(...) | provenance | MaD:308 Sink:MaD:15 | -| HostComparison.java:153:19:153:54 | new URI(...) : URI | HostComparison.java:155:13:155:15 | uri : URI | provenance | | -| HostComparison.java:153:27:153:53 | getParameter(...) : String | HostComparison.java:153:19:153:54 | new URI(...) : URI | provenance | Src:MaD:292 Config | -| HostComparison.java:153:27:153:53 | getParameter(...) : String | HostComparison.java:153:19:153:54 | new URI(...) : URI | provenance | Src:MaD:292 MaD:304 | -| HostComparison.java:155:13:155:15 | uri : URI | HostComparison.java:155:13:155:23 | toURL(...) | provenance | MaD:308 Sink:MaD:15 | -| HostComparison.java:176:19:176:54 | new URI(...) : URI | HostComparison.java:183:17:183:19 | uri : URI | provenance | | -| HostComparison.java:176:27:176:53 | getParameter(...) : String | HostComparison.java:176:19:176:54 | new URI(...) : URI | provenance | Src:MaD:292 Config | -| HostComparison.java:176:27:176:53 | getParameter(...) : String | HostComparison.java:176:19:176:54 | new URI(...) : URI | provenance | Src:MaD:292 MaD:304 | -| HostComparison.java:183:17:183:19 | uri : URI | HostComparison.java:183:17:183:27 | toURL(...) | provenance | MaD:308 Sink:MaD:15 | -| HostComparison.java:206:19:206:54 | new URI(...) : URI | HostComparison.java:209:13:209:15 | uri : URI | provenance | | -| HostComparison.java:206:27:206:53 | getParameter(...) : String | HostComparison.java:206:19:206:54 | new URI(...) : URI | provenance | Src:MaD:292 Config | -| HostComparison.java:206:27:206:53 | getParameter(...) : String | HostComparison.java:206:19:206:54 | new URI(...) : URI | provenance | Src:MaD:292 MaD:304 | -| HostComparison.java:209:13:209:15 | uri : URI | HostComparison.java:209:13:209:23 | toURL(...) | provenance | MaD:308 Sink:MaD:15 | -| HostComparison.java:231:19:231:54 | new URI(...) : URI | HostComparison.java:235:13:235:15 | uri : URI | provenance | | +| HostComparison.java:8:19:8:54 | new URI(...) : URI | HostComparison.java:9:9:9:11 | uri : URI | provenance | | +| HostComparison.java:8:27:8:53 | getParameter(...) : String | HostComparison.java:8:19:8:54 | new URI(...) : URI | provenance | Src:MaD:292 Config | +| HostComparison.java:8:27:8:53 | getParameter(...) : String | HostComparison.java:8:19:8:54 | new URI(...) : URI | provenance | Src:MaD:292 MaD:304 | +| HostComparison.java:9:9:9:11 | uri : URI | HostComparison.java:9:9:9:19 | toURL(...) | provenance | MaD:308 Sink:MaD:15 | +| HostComparison.java:50:19:50:54 | new URI(...) : URI | HostComparison.java:52:13:52:15 | uri : URI | provenance | | +| HostComparison.java:50:27:50:53 | getParameter(...) : String | HostComparison.java:50:19:50:54 | new URI(...) : URI | provenance | Src:MaD:292 Config | +| HostComparison.java:50:27:50:53 | getParameter(...) : String | HostComparison.java:50:19:50:54 | new URI(...) : URI | provenance | Src:MaD:292 MaD:304 | +| HostComparison.java:52:13:52:15 | uri : URI | HostComparison.java:52:13:52:23 | toURL(...) | provenance | MaD:308 Sink:MaD:15 | +| HostComparison.java:57:19:57:54 | new URI(...) : URI | HostComparison.java:59:13:59:15 | uri : URI | provenance | | +| HostComparison.java:57:27:57:53 | getParameter(...) : String | HostComparison.java:57:19:57:54 | new URI(...) : URI | provenance | Src:MaD:292 Config | +| HostComparison.java:57:27:57:53 | getParameter(...) : String | HostComparison.java:57:19:57:54 | new URI(...) : URI | provenance | Src:MaD:292 MaD:304 | +| HostComparison.java:59:13:59:15 | uri : URI | HostComparison.java:59:13:59:23 | toURL(...) | provenance | MaD:308 Sink:MaD:15 | +| HostComparison.java:68:19:68:54 | new URI(...) : URI | HostComparison.java:70:13:70:15 | uri : URI | provenance | | +| HostComparison.java:68:27:68:53 | getParameter(...) : String | HostComparison.java:68:19:68:54 | new URI(...) : URI | provenance | Src:MaD:292 Config | +| HostComparison.java:68:27:68:53 | getParameter(...) : String | HostComparison.java:68:19:68:54 | new URI(...) : URI | provenance | Src:MaD:292 MaD:304 | +| HostComparison.java:70:13:70:15 | uri : URI | HostComparison.java:70:13:70:23 | toURL(...) | provenance | MaD:308 Sink:MaD:15 | +| HostComparison.java:84:19:84:54 | new URI(...) : URI | HostComparison.java:86:13:86:15 | uri : URI | provenance | | +| HostComparison.java:84:27:84:53 | getParameter(...) : String | HostComparison.java:84:19:84:54 | new URI(...) : URI | provenance | Src:MaD:292 Config | +| HostComparison.java:84:27:84:53 | getParameter(...) : String | HostComparison.java:84:19:84:54 | new URI(...) : URI | provenance | Src:MaD:292 MaD:304 | +| HostComparison.java:86:13:86:15 | uri : URI | HostComparison.java:86:13:86:23 | toURL(...) | provenance | MaD:308 Sink:MaD:15 | +| HostComparison.java:92:20:92:55 | new URI(...) : URI | HostComparison.java:94:13:94:16 | used : URI | provenance | | +| HostComparison.java:92:28:92:54 | getParameter(...) : String | HostComparison.java:92:20:92:55 | new URI(...) : URI | provenance | Src:MaD:292 Config | +| HostComparison.java:92:28:92:54 | getParameter(...) : String | HostComparison.java:92:20:92:55 | new URI(...) : URI | provenance | Src:MaD:292 MaD:304 | +| HostComparison.java:94:13:94:16 | used : URI | HostComparison.java:94:13:94:24 | toURL(...) | provenance | MaD:308 Sink:MaD:15 | +| HostComparison.java:103:19:103:54 | new URI(...) : URI | HostComparison.java:105:13:105:15 | uri : URI | provenance | | +| HostComparison.java:103:27:103:53 | getParameter(...) : String | HostComparison.java:103:19:103:54 | new URI(...) : URI | provenance | Src:MaD:292 Config | +| HostComparison.java:103:27:103:53 | getParameter(...) : String | HostComparison.java:103:19:103:54 | new URI(...) : URI | provenance | Src:MaD:292 MaD:304 | +| HostComparison.java:105:13:105:15 | uri : URI | HostComparison.java:105:13:105:23 | toURL(...) | provenance | MaD:308 Sink:MaD:15 | +| HostComparison.java:111:20:111:55 | new URI(...) : URI | HostComparison.java:113:13:113:16 | used : URI | provenance | | +| HostComparison.java:111:28:111:54 | getParameter(...) : String | HostComparison.java:111:20:111:55 | new URI(...) : URI | provenance | Src:MaD:292 Config | +| HostComparison.java:111:28:111:54 | getParameter(...) : String | HostComparison.java:111:20:111:55 | new URI(...) : URI | provenance | Src:MaD:292 MaD:304 | +| HostComparison.java:113:13:113:16 | used : URI | HostComparison.java:113:13:113:24 | toURL(...) | provenance | MaD:308 Sink:MaD:15 | +| HostComparison.java:118:19:118:54 | new URI(...) : URI | HostComparison.java:122:13:122:15 | uri : URI | provenance | | +| HostComparison.java:118:27:118:53 | getParameter(...) : String | HostComparison.java:118:19:118:54 | new URI(...) : URI | provenance | Src:MaD:292 Config | +| HostComparison.java:118:27:118:53 | getParameter(...) : String | HostComparison.java:118:19:118:54 | new URI(...) : URI | provenance | Src:MaD:292 MaD:304 | +| HostComparison.java:122:13:122:15 | uri : URI | HostComparison.java:122:13:122:23 | toURL(...) | provenance | MaD:308 Sink:MaD:15 | +| HostComparison.java:127:19:127:54 | new URI(...) : URI | HostComparison.java:133:13:133:15 | uri : URI | provenance | | +| HostComparison.java:127:27:127:53 | getParameter(...) : String | HostComparison.java:127:19:127:54 | new URI(...) : URI | provenance | Src:MaD:292 Config | +| HostComparison.java:127:27:127:53 | getParameter(...) : String | HostComparison.java:127:19:127:54 | new URI(...) : URI | provenance | Src:MaD:292 MaD:304 | +| HostComparison.java:133:13:133:15 | uri : URI | HostComparison.java:133:13:133:23 | toURL(...) | provenance | MaD:308 Sink:MaD:15 | +| HostComparison.java:140:15:140:50 | new URI(...) : URI | HostComparison.java:142:13:142:15 | uri : URI | provenance | | +| HostComparison.java:140:23:140:49 | getParameter(...) : String | HostComparison.java:140:15:140:50 | new URI(...) : URI | provenance | Src:MaD:292 Config | +| HostComparison.java:140:23:140:49 | getParameter(...) : String | HostComparison.java:140:15:140:50 | new URI(...) : URI | provenance | Src:MaD:292 MaD:304 | +| HostComparison.java:142:13:142:15 | uri : URI | HostComparison.java:142:13:142:23 | toURL(...) | provenance | MaD:308 Sink:MaD:15 | +| HostComparison.java:147:19:147:54 | new URI(...) : URI | HostComparison.java:149:13:149:15 | uri : URI | provenance | | +| HostComparison.java:147:27:147:53 | getParameter(...) : String | HostComparison.java:147:19:147:54 | new URI(...) : URI | provenance | Src:MaD:292 Config | +| HostComparison.java:147:27:147:53 | getParameter(...) : String | HostComparison.java:147:19:147:54 | new URI(...) : URI | provenance | Src:MaD:292 MaD:304 | +| HostComparison.java:149:13:149:15 | uri : URI | HostComparison.java:149:13:149:23 | toURL(...) | provenance | MaD:308 Sink:MaD:15 | +| HostComparison.java:154:19:154:54 | new URI(...) : URI | HostComparison.java:156:13:156:15 | uri : URI | provenance | | +| HostComparison.java:154:27:154:53 | getParameter(...) : String | HostComparison.java:154:19:154:54 | new URI(...) : URI | provenance | Src:MaD:292 Config | +| HostComparison.java:154:27:154:53 | getParameter(...) : String | HostComparison.java:154:19:154:54 | new URI(...) : URI | provenance | Src:MaD:292 MaD:304 | +| HostComparison.java:156:13:156:15 | uri : URI | HostComparison.java:156:13:156:23 | toURL(...) | provenance | MaD:308 Sink:MaD:15 | +| HostComparison.java:177:19:177:54 | new URI(...) : URI | HostComparison.java:184:17:184:19 | uri : URI | provenance | | +| HostComparison.java:177:27:177:53 | getParameter(...) : String | HostComparison.java:177:19:177:54 | new URI(...) : URI | provenance | Src:MaD:292 Config | +| HostComparison.java:177:27:177:53 | getParameter(...) : String | HostComparison.java:177:19:177:54 | new URI(...) : URI | provenance | Src:MaD:292 MaD:304 | +| HostComparison.java:184:17:184:19 | uri : URI | HostComparison.java:184:17:184:27 | toURL(...) | provenance | MaD:308 Sink:MaD:15 | +| HostComparison.java:223:19:223:54 | new URI(...) : URI | HostComparison.java:226:13:226:15 | uri : URI | provenance | | +| HostComparison.java:223:27:223:53 | getParameter(...) : String | HostComparison.java:223:19:223:54 | new URI(...) : URI | provenance | Src:MaD:292 Config | +| HostComparison.java:223:27:223:53 | getParameter(...) : String | HostComparison.java:223:19:223:54 | new URI(...) : URI | provenance | Src:MaD:292 MaD:304 | +| HostComparison.java:226:13:226:15 | uri : URI | HostComparison.java:226:13:226:23 | toURL(...) | provenance | MaD:308 Sink:MaD:15 | +| HostComparison.java:231:19:231:54 | new URI(...) : URI | HostComparison.java:234:13:234:15 | uri : URI | provenance | | | HostComparison.java:231:27:231:53 | getParameter(...) : String | HostComparison.java:231:19:231:54 | new URI(...) : URI | provenance | Src:MaD:292 Config | | HostComparison.java:231:27:231:53 | getParameter(...) : String | HostComparison.java:231:19:231:54 | new URI(...) : URI | provenance | Src:MaD:292 MaD:304 | -| HostComparison.java:235:13:235:15 | uri : URI | HostComparison.java:235:13:235:23 | toURL(...) | provenance | MaD:308 Sink:MaD:15 | -| HostComparison.java:240:19:240:54 | new URI(...) : URI | HostComparison.java:244:13:244:15 | uri : URI | provenance | | -| HostComparison.java:240:27:240:53 | getParameter(...) : String | HostComparison.java:240:19:240:54 | new URI(...) : URI | provenance | Src:MaD:292 Config | -| HostComparison.java:240:27:240:53 | getParameter(...) : String | HostComparison.java:240:19:240:54 | new URI(...) : URI | provenance | Src:MaD:292 MaD:304 | -| HostComparison.java:244:13:244:15 | uri : URI | HostComparison.java:244:13:244:23 | toURL(...) | provenance | MaD:308 Sink:MaD:15 | +| HostComparison.java:234:13:234:15 | uri : URI | HostComparison.java:234:13:234:23 | toURL(...) | provenance | MaD:308 Sink:MaD:15 | +| HostComparison.java:256:19:256:54 | new URI(...) : URI | HostComparison.java:260:13:260:15 | uri : URI | provenance | | +| HostComparison.java:256:27:256:53 | getParameter(...) : String | HostComparison.java:256:19:256:54 | new URI(...) : URI | provenance | Src:MaD:292 Config | +| HostComparison.java:256:27:256:53 | getParameter(...) : String | HostComparison.java:256:19:256:54 | new URI(...) : URI | provenance | Src:MaD:292 MaD:304 | +| HostComparison.java:260:13:260:15 | uri : URI | HostComparison.java:260:13:260:23 | toURL(...) | provenance | MaD:308 Sink:MaD:15 | +| HostComparison.java:265:19:265:54 | new URI(...) : URI | HostComparison.java:269:13:269:15 | uri : URI | provenance | | +| HostComparison.java:265:27:265:53 | getParameter(...) : String | HostComparison.java:265:19:265:54 | new URI(...) : URI | provenance | Src:MaD:292 Config | +| HostComparison.java:265:27:265:53 | getParameter(...) : String | HostComparison.java:265:19:265:54 | new URI(...) : URI | provenance | Src:MaD:292 MaD:304 | +| HostComparison.java:269:13:269:15 | uri : URI | HostComparison.java:269:13:269:23 | toURL(...) | provenance | MaD:308 Sink:MaD:15 | | JakartaWsSSRF.java:14:22:14:48 | getParameter(...) : String | JakartaWsSSRF.java:15:23:15:25 | url | provenance | Src:MaD:292 Sink:MaD:9 | | JavaNetHttpSSRF.java:25:27:25:53 | getParameter(...) : String | JavaNetHttpSSRF.java:26:31:26:34 | sink : String | provenance | Src:MaD:292 | | JavaNetHttpSSRF.java:26:23:26:35 | new URI(...) : URI | JavaNetHttpSSRF.java:39:59:39:61 | uri | provenance | Sink:MaD:12 | @@ -1859,74 +1864,78 @@ nodes | ApacheHttpSSRFVersion5.java:388:44:388:46 | uri | semmle.label | uri | | ApacheHttpSSRFVersion5.java:390:24:390:26 | uri | semmle.label | uri | | ApacheHttpSSRFVersion5.java:394:24:394:26 | uri | semmle.label | uri | -| HostComparison.java:7:19:7:54 | new URI(...) : URI | semmle.label | new URI(...) : URI | -| HostComparison.java:7:27:7:53 | getParameter(...) : String | semmle.label | getParameter(...) : String | -| HostComparison.java:8:9:8:11 | uri : URI | semmle.label | uri : URI | -| HostComparison.java:8:9:8:19 | toURL(...) | semmle.label | toURL(...) | -| HostComparison.java:49:19:49:54 | new URI(...) : URI | semmle.label | new URI(...) : URI | -| HostComparison.java:49:27:49:53 | getParameter(...) : String | semmle.label | getParameter(...) : String | -| HostComparison.java:51:13:51:15 | uri : URI | semmle.label | uri : URI | -| HostComparison.java:51:13:51:23 | toURL(...) | semmle.label | toURL(...) | -| HostComparison.java:56:19:56:54 | new URI(...) : URI | semmle.label | new URI(...) : URI | -| HostComparison.java:56:27:56:53 | getParameter(...) : String | semmle.label | getParameter(...) : String | -| HostComparison.java:58:13:58:15 | uri : URI | semmle.label | uri : URI | -| HostComparison.java:58:13:58:23 | toURL(...) | semmle.label | toURL(...) | -| HostComparison.java:67:19:67:54 | new URI(...) : URI | semmle.label | new URI(...) : URI | -| HostComparison.java:67:27:67:53 | getParameter(...) : String | semmle.label | getParameter(...) : String | -| HostComparison.java:69:13:69:15 | uri : URI | semmle.label | uri : URI | -| HostComparison.java:69:13:69:23 | toURL(...) | semmle.label | toURL(...) | -| HostComparison.java:83:19:83:54 | new URI(...) : URI | semmle.label | new URI(...) : URI | -| HostComparison.java:83:27:83:53 | getParameter(...) : String | semmle.label | getParameter(...) : String | -| HostComparison.java:85:13:85:15 | uri : URI | semmle.label | uri : URI | -| HostComparison.java:85:13:85:23 | toURL(...) | semmle.label | toURL(...) | -| HostComparison.java:91:20:91:55 | new URI(...) : URI | semmle.label | new URI(...) : URI | -| HostComparison.java:91:28:91:54 | getParameter(...) : String | semmle.label | getParameter(...) : String | -| HostComparison.java:93:13:93:16 | used : URI | semmle.label | used : URI | -| HostComparison.java:93:13:93:24 | toURL(...) | semmle.label | toURL(...) | -| HostComparison.java:102:19:102:54 | new URI(...) : URI | semmle.label | new URI(...) : URI | -| HostComparison.java:102:27:102:53 | getParameter(...) : String | semmle.label | getParameter(...) : String | -| HostComparison.java:104:13:104:15 | uri : URI | semmle.label | uri : URI | -| HostComparison.java:104:13:104:23 | toURL(...) | semmle.label | toURL(...) | -| HostComparison.java:110:20:110:55 | new URI(...) : URI | semmle.label | new URI(...) : URI | -| HostComparison.java:110:28:110:54 | getParameter(...) : String | semmle.label | getParameter(...) : String | -| HostComparison.java:112:13:112:16 | used : URI | semmle.label | used : URI | -| HostComparison.java:112:13:112:24 | toURL(...) | semmle.label | toURL(...) | -| HostComparison.java:117:19:117:54 | new URI(...) : URI | semmle.label | new URI(...) : URI | -| HostComparison.java:117:27:117:53 | getParameter(...) : String | semmle.label | getParameter(...) : String | -| HostComparison.java:121:13:121:15 | uri : URI | semmle.label | uri : URI | -| HostComparison.java:121:13:121:23 | toURL(...) | semmle.label | toURL(...) | -| HostComparison.java:126:19:126:54 | new URI(...) : URI | semmle.label | new URI(...) : URI | -| HostComparison.java:126:27:126:53 | getParameter(...) : String | semmle.label | getParameter(...) : String | -| HostComparison.java:132:13:132:15 | uri : URI | semmle.label | uri : URI | -| HostComparison.java:132:13:132:23 | toURL(...) | semmle.label | toURL(...) | -| HostComparison.java:139:15:139:50 | new URI(...) : URI | semmle.label | new URI(...) : URI | -| HostComparison.java:139:23:139:49 | getParameter(...) : String | semmle.label | getParameter(...) : String | -| HostComparison.java:141:13:141:15 | uri : URI | semmle.label | uri : URI | -| HostComparison.java:141:13:141:23 | toURL(...) | semmle.label | toURL(...) | -| HostComparison.java:146:19:146:54 | new URI(...) : URI | semmle.label | new URI(...) : URI | -| HostComparison.java:146:27:146:53 | getParameter(...) : String | semmle.label | getParameter(...) : String | -| HostComparison.java:148:13:148:15 | uri : URI | semmle.label | uri : URI | -| HostComparison.java:148:13:148:23 | toURL(...) | semmle.label | toURL(...) | -| HostComparison.java:153:19:153:54 | new URI(...) : URI | semmle.label | new URI(...) : URI | -| HostComparison.java:153:27:153:53 | getParameter(...) : String | semmle.label | getParameter(...) : String | -| HostComparison.java:155:13:155:15 | uri : URI | semmle.label | uri : URI | -| HostComparison.java:155:13:155:23 | toURL(...) | semmle.label | toURL(...) | -| HostComparison.java:176:19:176:54 | new URI(...) : URI | semmle.label | new URI(...) : URI | -| HostComparison.java:176:27:176:53 | getParameter(...) : String | semmle.label | getParameter(...) : String | -| HostComparison.java:183:17:183:19 | uri : URI | semmle.label | uri : URI | -| HostComparison.java:183:17:183:27 | toURL(...) | semmle.label | toURL(...) | -| HostComparison.java:206:19:206:54 | new URI(...) : URI | semmle.label | new URI(...) : URI | -| HostComparison.java:206:27:206:53 | getParameter(...) : String | semmle.label | getParameter(...) : String | -| HostComparison.java:209:13:209:15 | uri : URI | semmle.label | uri : URI | -| HostComparison.java:209:13:209:23 | toURL(...) | semmle.label | toURL(...) | +| HostComparison.java:8:19:8:54 | new URI(...) : URI | semmle.label | new URI(...) : URI | +| HostComparison.java:8:27:8:53 | getParameter(...) : String | semmle.label | getParameter(...) : String | +| HostComparison.java:9:9:9:11 | uri : URI | semmle.label | uri : URI | +| HostComparison.java:9:9:9:19 | toURL(...) | semmle.label | toURL(...) | +| HostComparison.java:50:19:50:54 | new URI(...) : URI | semmle.label | new URI(...) : URI | +| HostComparison.java:50:27:50:53 | getParameter(...) : String | semmle.label | getParameter(...) : String | +| HostComparison.java:52:13:52:15 | uri : URI | semmle.label | uri : URI | +| HostComparison.java:52:13:52:23 | toURL(...) | semmle.label | toURL(...) | +| HostComparison.java:57:19:57:54 | new URI(...) : URI | semmle.label | new URI(...) : URI | +| HostComparison.java:57:27:57:53 | getParameter(...) : String | semmle.label | getParameter(...) : String | +| HostComparison.java:59:13:59:15 | uri : URI | semmle.label | uri : URI | +| HostComparison.java:59:13:59:23 | toURL(...) | semmle.label | toURL(...) | +| HostComparison.java:68:19:68:54 | new URI(...) : URI | semmle.label | new URI(...) : URI | +| HostComparison.java:68:27:68:53 | getParameter(...) : String | semmle.label | getParameter(...) : String | +| HostComparison.java:70:13:70:15 | uri : URI | semmle.label | uri : URI | +| HostComparison.java:70:13:70:23 | toURL(...) | semmle.label | toURL(...) | +| HostComparison.java:84:19:84:54 | new URI(...) : URI | semmle.label | new URI(...) : URI | +| HostComparison.java:84:27:84:53 | getParameter(...) : String | semmle.label | getParameter(...) : String | +| HostComparison.java:86:13:86:15 | uri : URI | semmle.label | uri : URI | +| HostComparison.java:86:13:86:23 | toURL(...) | semmle.label | toURL(...) | +| HostComparison.java:92:20:92:55 | new URI(...) : URI | semmle.label | new URI(...) : URI | +| HostComparison.java:92:28:92:54 | getParameter(...) : String | semmle.label | getParameter(...) : String | +| HostComparison.java:94:13:94:16 | used : URI | semmle.label | used : URI | +| HostComparison.java:94:13:94:24 | toURL(...) | semmle.label | toURL(...) | +| HostComparison.java:103:19:103:54 | new URI(...) : URI | semmle.label | new URI(...) : URI | +| HostComparison.java:103:27:103:53 | getParameter(...) : String | semmle.label | getParameter(...) : String | +| HostComparison.java:105:13:105:15 | uri : URI | semmle.label | uri : URI | +| HostComparison.java:105:13:105:23 | toURL(...) | semmle.label | toURL(...) | +| HostComparison.java:111:20:111:55 | new URI(...) : URI | semmle.label | new URI(...) : URI | +| HostComparison.java:111:28:111:54 | getParameter(...) : String | semmle.label | getParameter(...) : String | +| HostComparison.java:113:13:113:16 | used : URI | semmle.label | used : URI | +| HostComparison.java:113:13:113:24 | toURL(...) | semmle.label | toURL(...) | +| HostComparison.java:118:19:118:54 | new URI(...) : URI | semmle.label | new URI(...) : URI | +| HostComparison.java:118:27:118:53 | getParameter(...) : String | semmle.label | getParameter(...) : String | +| HostComparison.java:122:13:122:15 | uri : URI | semmle.label | uri : URI | +| HostComparison.java:122:13:122:23 | toURL(...) | semmle.label | toURL(...) | +| HostComparison.java:127:19:127:54 | new URI(...) : URI | semmle.label | new URI(...) : URI | +| HostComparison.java:127:27:127:53 | getParameter(...) : String | semmle.label | getParameter(...) : String | +| HostComparison.java:133:13:133:15 | uri : URI | semmle.label | uri : URI | +| HostComparison.java:133:13:133:23 | toURL(...) | semmle.label | toURL(...) | +| HostComparison.java:140:15:140:50 | new URI(...) : URI | semmle.label | new URI(...) : URI | +| HostComparison.java:140:23:140:49 | getParameter(...) : String | semmle.label | getParameter(...) : String | +| HostComparison.java:142:13:142:15 | uri : URI | semmle.label | uri : URI | +| HostComparison.java:142:13:142:23 | toURL(...) | semmle.label | toURL(...) | +| HostComparison.java:147:19:147:54 | new URI(...) : URI | semmle.label | new URI(...) : URI | +| HostComparison.java:147:27:147:53 | getParameter(...) : String | semmle.label | getParameter(...) : String | +| HostComparison.java:149:13:149:15 | uri : URI | semmle.label | uri : URI | +| HostComparison.java:149:13:149:23 | toURL(...) | semmle.label | toURL(...) | +| HostComparison.java:154:19:154:54 | new URI(...) : URI | semmle.label | new URI(...) : URI | +| HostComparison.java:154:27:154:53 | getParameter(...) : String | semmle.label | getParameter(...) : String | +| HostComparison.java:156:13:156:15 | uri : URI | semmle.label | uri : URI | +| HostComparison.java:156:13:156:23 | toURL(...) | semmle.label | toURL(...) | +| HostComparison.java:177:19:177:54 | new URI(...) : URI | semmle.label | new URI(...) : URI | +| HostComparison.java:177:27:177:53 | getParameter(...) : String | semmle.label | getParameter(...) : String | +| HostComparison.java:184:17:184:19 | uri : URI | semmle.label | uri : URI | +| HostComparison.java:184:17:184:27 | toURL(...) | semmle.label | toURL(...) | +| HostComparison.java:223:19:223:54 | new URI(...) : URI | semmle.label | new URI(...) : URI | +| HostComparison.java:223:27:223:53 | getParameter(...) : String | semmle.label | getParameter(...) : String | +| HostComparison.java:226:13:226:15 | uri : URI | semmle.label | uri : URI | +| HostComparison.java:226:13:226:23 | toURL(...) | semmle.label | toURL(...) | | HostComparison.java:231:19:231:54 | new URI(...) : URI | semmle.label | new URI(...) : URI | | HostComparison.java:231:27:231:53 | getParameter(...) : String | semmle.label | getParameter(...) : String | -| HostComparison.java:235:13:235:15 | uri : URI | semmle.label | uri : URI | -| HostComparison.java:235:13:235:23 | toURL(...) | semmle.label | toURL(...) | -| HostComparison.java:240:19:240:54 | new URI(...) : URI | semmle.label | new URI(...) : URI | -| HostComparison.java:240:27:240:53 | getParameter(...) : String | semmle.label | getParameter(...) : String | -| HostComparison.java:244:13:244:15 | uri : URI | semmle.label | uri : URI | -| HostComparison.java:244:13:244:23 | toURL(...) | semmle.label | toURL(...) | +| HostComparison.java:234:13:234:15 | uri : URI | semmle.label | uri : URI | +| HostComparison.java:234:13:234:23 | toURL(...) | semmle.label | toURL(...) | +| HostComparison.java:256:19:256:54 | new URI(...) : URI | semmle.label | new URI(...) : URI | +| HostComparison.java:256:27:256:53 | getParameter(...) : String | semmle.label | getParameter(...) : String | +| HostComparison.java:260:13:260:15 | uri : URI | semmle.label | uri : URI | +| HostComparison.java:260:13:260:23 | toURL(...) | semmle.label | toURL(...) | +| HostComparison.java:265:19:265:54 | new URI(...) : URI | semmle.label | new URI(...) : URI | +| HostComparison.java:265:27:265:53 | getParameter(...) : String | semmle.label | getParameter(...) : String | +| HostComparison.java:269:13:269:15 | uri : URI | semmle.label | uri : URI | +| HostComparison.java:269:13:269:23 | toURL(...) | semmle.label | toURL(...) | | JakartaWsSSRF.java:14:22:14:48 | getParameter(...) : String | semmle.label | getParameter(...) : String | | JakartaWsSSRF.java:15:23:15:25 | url | semmle.label | url | | JavaNetHttpSSRF.java:25:27:25:53 | getParameter(...) : String | semmle.label | getParameter(...) : String | From 4dd6cece86e6d89782ac0e946989370ba239f9a0 Mon Sep 17 00:00:00 2001 From: Owen Mansel-Chan Date: Wed, 14 Oct 2026 19:44:48 +0100 Subject: [PATCH 2/4] Rename file ConstantValueSanitizer.qll --- java/ql/lib/semmle/code/java/dataflow/FlowSteps.qll | 2 +- ...{ListOfConstantsSanitizer.qll => ConstantValueSanitizer.qll} | 0 java/ql/lib/semmle/code/java/security/RequestForgery.qll | 2 +- 3 files changed, 2 insertions(+), 2 deletions(-) rename java/ql/lib/semmle/code/java/security/{ListOfConstantsSanitizer.qll => ConstantValueSanitizer.qll} (100%) diff --git a/java/ql/lib/semmle/code/java/dataflow/FlowSteps.qll b/java/ql/lib/semmle/code/java/dataflow/FlowSteps.qll index 6dd8de89e213..615a9640bf07 100644 --- a/java/ql/lib/semmle/code/java/dataflow/FlowSteps.qll +++ b/java/ql/lib/semmle/code/java/dataflow/FlowSteps.qll @@ -30,7 +30,7 @@ private module Frameworks { private import semmle.code.java.frameworks.ThreadLocal private import semmle.code.java.frameworks.ratpack.RatpackExec private import semmle.code.java.frameworks.stapler.Stapler - private import semmle.code.java.security.ListOfConstantsSanitizer + private import semmle.code.java.security.ConstantValueSanitizer private import semmle.code.java.security.PathSanitizer } diff --git a/java/ql/lib/semmle/code/java/security/ListOfConstantsSanitizer.qll b/java/ql/lib/semmle/code/java/security/ConstantValueSanitizer.qll similarity index 100% rename from java/ql/lib/semmle/code/java/security/ListOfConstantsSanitizer.qll rename to java/ql/lib/semmle/code/java/security/ConstantValueSanitizer.qll diff --git a/java/ql/lib/semmle/code/java/security/RequestForgery.qll b/java/ql/lib/semmle/code/java/security/RequestForgery.qll index d280d270c7c3..5681bfa9f074 100644 --- a/java/ql/lib/semmle/code/java/security/RequestForgery.qll +++ b/java/ql/lib/semmle/code/java/security/RequestForgery.qll @@ -14,7 +14,7 @@ private import semmle.code.java.controlflow.Guards private import semmle.code.java.dataflow.StringPrefixes private import semmle.code.java.dataflow.ExternalFlow private import semmle.code.java.dataflow.SSA -private import semmle.code.java.security.ListOfConstantsSanitizer +private import semmle.code.java.security.ConstantValueSanitizer private import semmle.code.java.security.Sanitizers /** From 6f5965b05d48e439f87af81a4d96829eab95a478 Mon Sep 17 00:00:00 2001 From: Owen Mansel-Chan Date: Thu, 15 Oct 2026 09:55:11 +0100 Subject: [PATCH 3/4] Rename test class --- .../CONSISTENCY/typeParametersInScope.expected | 2 +- .../listofconstants/{A.java => ConstantValue.java} | 2 +- .../test/library-tests/listofconstants/test.expected | 10 +++++----- 3 files changed, 7 insertions(+), 7 deletions(-) rename java/ql/test/library-tests/listofconstants/{A.java => ConstantValue.java} (97%) diff --git a/java/ql/test/library-tests/listofconstants/CONSISTENCY/typeParametersInScope.expected b/java/ql/test/library-tests/listofconstants/CONSISTENCY/typeParametersInScope.expected index 1ea902154a6e..355fb350542e 100644 --- a/java/ql/test/library-tests/listofconstants/CONSISTENCY/typeParametersInScope.expected +++ b/java/ql/test/library-tests/listofconstants/CONSISTENCY/typeParametersInScope.expected @@ -1 +1 @@ -| Type A uses out-of-scope type variable E. Note the Java extractor is known to sometimes do this; the Kotlin extractor should not. | +| Type ConstantValue uses out-of-scope type variable E. Note the Java extractor is known to sometimes do this; the Kotlin extractor should not. | diff --git a/java/ql/test/library-tests/listofconstants/A.java b/java/ql/test/library-tests/listofconstants/ConstantValue.java similarity index 97% rename from java/ql/test/library-tests/listofconstants/A.java rename to java/ql/test/library-tests/listofconstants/ConstantValue.java index 3aea4a2495c9..a9c422e64c52 100644 --- a/java/ql/test/library-tests/listofconstants/A.java +++ b/java/ql/test/library-tests/listofconstants/ConstantValue.java @@ -1,6 +1,6 @@ import java.util.*; -public class A { +public class ConstantValue { private static final Set SEPARATORS = Collections.unmodifiableSet( new HashSet<>(Arrays.asList("\t", "\n", ";"))); diff --git a/java/ql/test/library-tests/listofconstants/test.expected b/java/ql/test/library-tests/listofconstants/test.expected index 89b555b41179..f275a0b13b27 100644 --- a/java/ql/test/library-tests/listofconstants/test.expected +++ b/java/ql/test/library-tests/listofconstants/test.expected @@ -1,5 +1,5 @@ -| A.java:12:12:12:20 | separator | -| A.java:23:12:23:17 | schema | -| A.java:32:12:32:14 | inp | -| A.java:38:12:38:16 | input | -| A.java:44:12:44:16 | input | +| ConstantValue.java:12:12:12:20 | separator | +| ConstantValue.java:23:12:23:17 | schema | +| ConstantValue.java:32:12:32:14 | inp | +| ConstantValue.java:38:12:38:16 | input | +| ConstantValue.java:44:12:44:16 | input | From eba0abb767b95c36e48f830b6445be290722dc5f Mon Sep 17 00:00:00 2001 From: Owen Mansel-Chan Date: Thu, 15 Oct 2026 09:55:37 +0100 Subject: [PATCH 4/4] Rename test folder --- .../CONSISTENCY/typeParametersInScope.expected | 0 .../ConstantValue.java | 0 .../{listofconstants => default-taint-sanitizer}/test.expected | 0 .../{listofconstants => default-taint-sanitizer}/test.ql | 0 4 files changed, 0 insertions(+), 0 deletions(-) rename java/ql/test/library-tests/{listofconstants => default-taint-sanitizer}/CONSISTENCY/typeParametersInScope.expected (100%) rename java/ql/test/library-tests/{listofconstants => default-taint-sanitizer}/ConstantValue.java (100%) rename java/ql/test/library-tests/{listofconstants => default-taint-sanitizer}/test.expected (100%) rename java/ql/test/library-tests/{listofconstants => default-taint-sanitizer}/test.ql (100%) diff --git a/java/ql/test/library-tests/listofconstants/CONSISTENCY/typeParametersInScope.expected b/java/ql/test/library-tests/default-taint-sanitizer/CONSISTENCY/typeParametersInScope.expected similarity index 100% rename from java/ql/test/library-tests/listofconstants/CONSISTENCY/typeParametersInScope.expected rename to java/ql/test/library-tests/default-taint-sanitizer/CONSISTENCY/typeParametersInScope.expected diff --git a/java/ql/test/library-tests/listofconstants/ConstantValue.java b/java/ql/test/library-tests/default-taint-sanitizer/ConstantValue.java similarity index 100% rename from java/ql/test/library-tests/listofconstants/ConstantValue.java rename to java/ql/test/library-tests/default-taint-sanitizer/ConstantValue.java diff --git a/java/ql/test/library-tests/listofconstants/test.expected b/java/ql/test/library-tests/default-taint-sanitizer/test.expected similarity index 100% rename from java/ql/test/library-tests/listofconstants/test.expected rename to java/ql/test/library-tests/default-taint-sanitizer/test.expected diff --git a/java/ql/test/library-tests/listofconstants/test.ql b/java/ql/test/library-tests/default-taint-sanitizer/test.ql similarity index 100% rename from java/ql/test/library-tests/listofconstants/test.ql rename to java/ql/test/library-tests/default-taint-sanitizer/test.ql