feat(rules): Add security rules and sanitizers

model/java/config/org.apache.httpcomponents.core5-httpcore5-5.2.4.yaml

@@ -1,5 +1,26 @@
 language: java
 passThrough:
+- function: org.apache.hc.core5.http.HttpHost#<init>
+  signature: (java.lang.String) *
+  copy:
+  - from: arg(0)
+    to:
+    - this
+    - .org.apache.hc.core5.http.HttpHost#hostName#java.lang.String
+- function: org.apache.hc.core5.http.HttpHost#<init>
+  signature: (java.lang.String, int) *
+  copy:
+  - from: arg(0)
+    to:
+    - this
+    - .org.apache.hc.core5.http.HttpHost#hostName#java.lang.String
+- function: org.apache.hc.core5.http.HttpHost#<init>
+  signature: (java.lang.String, java.lang.String, int) *
+  copy:
+  - from: arg(1)
+    to:
+    - this
+    - .org.apache.hc.core5.http.HttpHost#hostName#java.lang.String
 - function: org.apache.hc.core5.http.io.entity.StringEntity#<init>
   signature: (java.lang.String) *
   copy:

rules/ruleset/java/lib/generic/code-injection-sinks.yaml

@@ -10,14 +10,17 @@ rules:
       - java
     patterns:
       - pattern-either:
+          # ── ognl.Ognl core ──
           - pattern: ognl.Ognl.getValue($INPUT,...);
+          # ── Struts2 OgnlReflectionProvider ──
           - pattern: (com.opensymphony.xwork2.ognl.OgnlReflectionProvider $P).getGetMethod($T, $INPUT,...);
           - pattern: (com.opensymphony.xwork2.ognl.OgnlReflectionProvider $P).getSetMethod($T, $INPUT,...);
           - pattern: (com.opensymphony.xwork2.ognl.OgnlReflectionProvider $P).getField($T, $INPUT,...);
           - pattern: (com.opensymphony.xwork2.ognl.OgnlReflectionProvider $P).setProperties($INPUT,...);
           - pattern: (com.opensymphony.xwork2.ognl.OgnlReflectionProvider $P).setProperty($INPUT,...);
           - pattern: (com.opensymphony.xwork2.ognl.OgnlReflectionProvider $P).getValue($INPUT,...);
           - pattern: (com.opensymphony.xwork2.ognl.OgnlReflectionProvider $P).setValue($INPUT,...);
+          # ── Struts2 ReflectionProvider (interface) ──
           - pattern: (com.opensymphony.xwork2.util.reflection.ReflectionProvider $P).getGetMethod($T, $INPUT,...);
           - pattern: (com.opensymphony.xwork2.util.reflection.ReflectionProvider $P).getSetMethod($T, $INPUT,...);
           - pattern: (com.opensymphony.xwork2.util.reflection.ReflectionProvider $P).getField($T, $INPUT,...);
@@ -26,18 +29,20 @@ rules:
           - pattern: (com.opensymphony.xwork2.util.reflection.ReflectionProvider $P).getValue($INPUT,...);
           - pattern: (com.opensymphony.xwork2.util.reflection.ReflectionProvider $P).setValue($INPUT,...);
           - pattern: (com.opensymphony.xwork2.util.reflection.ReflectionProvider $P).translateVariables($INPUT,...);
+          # ── Struts2 TextParseUtil ──
           - pattern: com.opensymphony.xwork2.util.TextParseUtil.translateVariables($INPUT, ...);
           - pattern: com.opensymphony.xwork2.util.TextParseUtil.translateVariablesCollection($INPUT,...);
           - pattern: com.opensymphony.xwork2.util.TextParseUtil.shallBeIncluded($INPUT,...);
-    # TODO: commaDelimitedStringToSet is propagator!
           - pattern: com.opensymphony.xwork2.util.TextParseUtil.commaDelimitedStringToSet($INPUT,...);
+          # ── Struts2 OgnlTextParser / OgnlUtil ──
           - pattern: (com.opensymphony.xwork2.util.OgnlTextParser $P).evaluate($INPUT,...);
           - pattern: (com.opensymphony.xwork2.util.OgnlTextParser $P).setProperties($INPUT,...);
           - pattern: (com.opensymphony.xwork2.ognl.OgnlUtil $P).setProperty($INPUT,...);
           - pattern: (com.opensymphony.xwork2.ognl.OgnlUtil $P).getValue($INPUT,...);
           - pattern: (com.opensymphony.xwork2.ognl.OgnlUtil $P).setValue($INPUT,...);
           - pattern: (com.opensymphony.xwork2.ognl.OgnlUtil $P).callMethod($INPUT,...);
           - pattern: (com.opensymphony.xwork2.ognl.OgnlUtil $P).compile($INPUT,...);
+          # ── Struts2 StrutsUtil / VelocityStrutsUtil / OgnlTool ──
           - pattern: (org.apache.struts2.util.VelocityStrutsUtil $P).evaluate($INPUT,...);
           - pattern: (org.apache.struts2.util.StrutsUtil $P).isTrue($INPUT,...);
           - pattern: (org.apache.struts2.util.StrutsUtil $P).findString($INPUT,...);
@@ -46,10 +51,106 @@ rules:
           - pattern: (org.apache.struts2.util.StrutsUtil $P).translateVariables($INPUT,...);
           - pattern: (org.apache.struts2.util.StrutsUtil $P).makeSelectList($INPUT,...);
           - pattern: (org.apache.struts2.views.jsp.ui.OgnlTool $P).findValue($INPUT,...);
+          # ── Struts2 ValueStack ──
           - pattern: (com.opensymphony.xwork2.util.ValueStack $P).findString($INPUT,...);
           - pattern: (com.opensymphony.xwork2.util.ValueStack $P).findValue($INPUT,...);
           - pattern: (com.opensymphony.xwork2.util.ValueStack $P).setValue($INPUT,...);
           - pattern: (com.opensymphony.xwork2.util.ValueStack $P).setParameter($INPUT,...);
+          # ognl.Node.getValue/setValue (Argument[this] - tainted compiled expression)
+          - patterns:
+              - pattern: (ognl.Node $INPUT).$METHOD(...);
+              - metavariable-regex:
+                  metavariable: $METHOD
+                  regex: (getValue|setValue)
+          # ognl.enhance.ExpressionAccessor.get/set (Argument[this])
+          - patterns:
+              - pattern: (ognl.enhance.ExpressionAccessor $INPUT).$METHOD(...);
+              - metavariable-regex:
+                  metavariable: $METHOD
+                  regex: (get|set)
+          # org.apache.commons.ognl.Ognl.getValue/setValue (Argument[0])
+          - pattern: org.apache.commons.ognl.Ognl.getValue($INPUT,...);
+          - pattern: org.apache.commons.ognl.Ognl.setValue($INPUT,...);
+          # org.apache.commons.ognl.Node.getValue/setValue (Argument[this])
+          - patterns:
+              - pattern: (org.apache.commons.ognl.Node $INPUT).$METHOD(...);
+              - metavariable-regex:
+                  metavariable: $METHOD
+                  regex: (getValue|setValue)
+          # org.apache.commons.ognl.enhance.ExpressionAccessor.get/set (Argument[this])
+          - patterns:
+              - pattern: (org.apache.commons.ognl.enhance.ExpressionAccessor $INPUT).$METHOD(...);
+              - metavariable-regex:
+                  metavariable: $METHOD
+                  regex: (get|set)
+          # OgnlValueStack methods (Argument[0])
+          - patterns:
+              - pattern: (com.opensymphony.xwork2.ognl.OgnlValueStack $P).$METHOD($INPUT,...);
+              - metavariable-regex:
+                  metavariable: $METHOD
+                  regex: (findString|findValue|getValue|getValueUsingOgnl|setParameter|setValue|tryFindValue|tryFindValueWhenExpressionIsNotNull|trySetValue)
+          # ActionSupport.getFormatted (Argument[0] and Argument[1])
+          - pattern: (com.opensymphony.xwork2.ActionSupport $P).getFormatted($INPUT,...);
+          - pattern: (com.opensymphony.xwork2.ActionSupport $P).getFormatted(...,$INPUT);
+          # TextProvider.getText (Argument[0])
+          - pattern: (com.opensymphony.xwork2.TextProvider $P).getText($INPUT,...);
+          # TextProvider.getText (Argument[1] - default value in some overloads)
+          - pattern: (com.opensymphony.xwork2.TextProvider $P).getText($A, $INPUT,...);
+          # TextProvider.hasKey (Argument[0])
+          - pattern: (com.opensymphony.xwork2.TextProvider $P).hasKey($INPUT);
+          # DEPENDENCY LIMITATION: LocalizedTextUtil removed in Struts 2.5.x (no test dependency available)
+          # LocalizedTextUtil.findText (Argument[1])
+          # - pattern: com.opensymphony.xwork2.util.LocalizedTextUtil.findText($A, $INPUT,...);
+          # LocalizedTextUtil.findText (Argument[3])
+          # - pattern: com.opensymphony.xwork2.util.LocalizedTextUtil.findText($A, $B, $C, $INPUT,...);
+          # ValidatorSupport.parse/getFieldValue (Argument[0])
+          - patterns:
+              - pattern: (com.opensymphony.xwork2.validator.validators.ValidatorSupport $P).$METHOD($INPUT,...);
+              - metavariable-regex:
+                  metavariable: $METHOD
+                  regex: (parse|getFieldValue)
+          # StrutsBodyTagSupport.findPattern/findString (Argument[1])
+          - patterns:
+              - pattern: (org.apache.struts2.views.jsp.StrutsBodyTagSupport $P).$METHOD($A, $INPUT,...);
+              - metavariable-regex:
+                  metavariable: $METHOD
+                  regex: (findPattern|findString)
+          # Inlined Map.of(...) flow into setProperties — OpenTaint's Map.of
+          # propagator stores taint on the MapValue accessor, not on the Map
+          # reference itself, so the bare $INPUT pattern misses the case where
+          # the caller wraps a tainted string in a Map first. Match the Map
+          # construction explicitly so $INPUT binds to the value, and pin the
+          # receiver type with a per-provider pattern-inside declaration (the
+          # dangerous-groovy-shell idiom below) instead of repeating each shape
+          # — OpenTaint does not support a typed `metavariable-pattern` on $P.
+          - patterns:
+              - pattern-either:
+                  - pattern: |
+                      $M = java.util.Map.of($K1, $INPUT);
+                      ...
+                      $P.setProperties($M, ...);
+                  - pattern: |
+                      $M = java.util.Map.of($K1, $V1, $K2, $INPUT);
+                      ...
+                      $P.setProperties($M, ...);
+                  - pattern: |
+                      $M = java.util.Map.of($K1, $INPUT, $K2, $V2);
+                      ...
+                      $P.setProperties($M, ...);
+                  - pattern: |
+                      $P.setProperties(java.util.Map.of($K1, $INPUT), ...);
+                  - pattern: |
+                      $P.setProperties(java.util.Map.of($K1, $V1, $K2, $INPUT), ...);
+                  - pattern: |
+                      $P.setProperties(java.util.Map.of($K1, $INPUT, $K2, $V2), ...);
+              - pattern-either:
+                  - pattern-inside: |
+                      com.opensymphony.xwork2.ognl.OgnlReflectionProvider $P = ...;
+                      ...
+                  - pattern-inside: |
+                      com.opensymphony.xwork2.util.reflection.ReflectionProvider $P = ...;
+                      ...
+              - focus-metavariable: $INPUT
 
   - id: dangerous-groovy-shell
     options:
@@ -80,6 +181,22 @@ rules:
       - pattern: groovy.util.Eval.x($X, $UNTRUSTED)
       - pattern: groovy.util.Eval.xy($X, $Y, $UNTRUSTED)
       - pattern: groovy.util.Eval.xyz($X, $Y, $Z, $UNTRUSTED)
+      # groovy.text.TemplateEngine.createTemplate (Argument[0])
+      - pattern: (groovy.text.TemplateEngine $T).createTemplate($UNTRUSTED)
+      # CompilationUnit.compile (Argument[this] - tainted compilation unit)
+      - pattern: |
+          (org.codehaus.groovy.control.CompilationUnit $UNTRUSTED).compile(...);
+      # Untrusted source added to a CompilationUnit then compiled. The unit stores
+      # the source in a virtual field, so the tainted-unit sink above can't observe
+      # it on the whole unit — match the source entering addSource and require a
+      # later compile() (cf. List.add(..) -> new ProcessBuilder($ARGS) in
+      # command-injection-sinks).
+      - patterns:
+          - pattern: |
+              (org.codehaus.groovy.control.CompilationUnit $CU).addSource(..., $UNTRUSTED, ...);
+              ...
+              (org.codehaus.groovy.control.CompilationUnit $CU).compile(...);
+          - focus-metavariable: $UNTRUSTED
 
   - id: dangerous-script-engine-eval
     options:
@@ -94,3 +211,45 @@ rules:
       - pattern: (javax.script.ScriptEngine $SE).eval($UNTRUSTED)
       - pattern: (javax.script.Invocable $INVC).invokeFunction(..., $UNTRUSTED)
       - pattern: (javax.script.Invocable $INVC).invokeMethod(..., $UNTRUSTED)
+
+  - id: mvel-injection-sinks
+    options:
+      lib: true
+    severity: NOTE
+    message: MVEL expression injection with user-controlled input
+    metadata:
+      provenance: https://github.com/github/codeql/tree/cdd8aa49e16650a96b8993e8745c7672600fe930/java/ql/lib/ext
+    languages:
+      - java
+    pattern-either:
+      # MVEL.eval/evalToBoolean/evalToString/executeAllExpression/executeExpression/executeSetExpression (Argument[0])
+      - patterns:
+          - pattern: org.mvel2.MVEL.$METHOD($EXPR, ...)
+          - metavariable-regex:
+              metavariable: $METHOD
+              regex: (eval|evalToBoolean|evalToString|executeAllExpression|executeExpression|executeSetExpression)
+      # MVELRuntime.execute (Argument[1])
+      - pattern: org.mvel2.MVELRuntime.execute($H, $EXPR, ...)
+      # MvelScriptEngine.eval/evaluate (Argument[0])
+      - patterns:
+          - pattern: (org.mvel2.jsr223.MvelScriptEngine $E).$METHOD($EXPR, ...)
+          - metavariable-regex:
+              metavariable: $METHOD
+              regex: (eval|evaluate)
+      # TemplateRuntime.eval/execute (Argument[0])
+      - patterns:
+          - pattern: org.mvel2.templates.TemplateRuntime.$METHOD($EXPR, ...)
+          - metavariable-regex:
+              metavariable: $METHOD
+              regex: (eval|execute)
+      # MvelCompiledScript.eval (Argument[this] - tainted compiled script)
+      - pattern: (org.mvel2.jsr223.MvelCompiledScript $EXPR).eval(...)
+      # Accessor/CompiledAccExpression/CompiledExpression/ExecutableStatement getValue/getDirectValue (Argument[this])
+      - patterns:
+          - pattern: (org.mvel2.compiler.$TYPE $EXPR).$METHOD(...)
+          - metavariable-regex:
+              metavariable: $TYPE
+              regex: (Accessor|CompiledAccExpression|CompiledExpression|ExecutableStatement)
+          - metavariable-regex:
+              metavariable: $METHOD
+              regex: (getValue|getDirectValue)