Java: add RegexpCheckBarrier to trust-boundary-violation sanitizers

[MarkLee131]

This is an experimental fix for #21655:

The trust-boundary-violation query only recognized OWASP ESAPI validators as sanitizers. ESAPI is rarely used in modern Java projects, while regex validation via String.matches() and @javax.validation.constraints.Pattern is the standard approach in Spring/Jakarta applications.

RegexpCheckBarrier already exists in Sanitizers.qll and is used by other queries (e.g., RequestForgery). This wires it into TrustBoundaryConfig, so patterns like input.matches("[a-zA-Z0-9]+") and @pattern annotations are recognized as sanitizers, consistent with the existing ESAPI treatment.

[Copilot]

Pull request overview

Updates the Java trust-boundary-violation query to treat regex-based validation as a sanitizer/barrier, aligning it with common Spring/Jakarta validation patterns and reducing false positives compared to ESAPI-only recognition.

Changes:

• Wire RegexpCheckBarrier into TrustBoundaryConfig.isBarrier(...) for java/trust-boundary-violation.
• Add a query-test scenario intended to demonstrate regex guard sanitization.
• Add a change-note documenting the expanded sanitizer recognition.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
java/ql/lib/semmle/code/java/security/TrustBoundaryViolationQuery.qll	Extends the trust-boundary barrier set to include RegexpCheckBarrier.
java/ql/test/query-tests/security/CWE-501/TrustBoundaryViolations.java	Adds a “GOOD” case using a String.matches(...) guard for session writes.
java/ql/lib/change-notes/2026-04-04-trust-boundary-regexp-barrier.md	Documents the query behavior change as a minor analysis improvement.

[owen-mc]

Thanks for this contribution. One small stylistic point, which doesn't block the PR.

[owen-mc]

Suggested change

	node instanceof TrustBoundaryValidationSanitizer or
	node.getType() instanceof HttpServletSession or
	node instanceof SimpleTypeSanitizer
	node instanceof SimpleTypeSanitizer or
	node instanceof RegexpCheckBarrier
	node instanceof TrustBoundaryValidationSanitizer

It is slightly preferable to define these sanitizers by introducing classes which extend TrustBoundaryValidationSanitizer. It wasn't done this way before, but if you could tidy it up that would be great. So you'll need to add

class SimpleTypeTrustBoundaryValidationSanitizer extends TrustBoundaryValidationSanitizer instanceof SimpleTypeSanitizer
{ }

class RegexpCheckTrustBoundaryValidationSanitizer extends TrustBoundaryValidationSanitizer instanceof RegexpCheckBarrier
{ }

class HttpServletSessionTypeTrustBoundaryValidationSanitizer extends TrustBoundaryValidationSanitizer
{
  HttpServletSessionTypeTrustBoundaryValidationSanitizer() {
    this.getType() instanceof HttpServletSession
  }
}

[MarkLee131]

Sorry, GitHub didn't let me apply the suggestion directly from the web UI, so I redid it locally and pushed in d27ee86. Pulled the three sanitizers out into their own classes as you suggested.