Skip to content

Java: add RegexpCheckBarrier to trust-boundary-violation sanitizers #21656

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
owen-mc merged 6 commits into from
Apr 29, 2026
Merged

Java: add RegexpCheckBarrier to trust-boundary-violation sanitizers #21656

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
345b842
Java: add RegexpCheckBarrier to trust-boundary-violation sanitizers
MarkLee131 Apr 4, 2026
258a53e
Update java/ql/test/query-tests/security/CWE-501/TrustBoundaryViolati…
MarkLee131 Apr 4, 2026
b49c6dc
Add @Pattern annotation test case and javax-validation-constraints stub
MarkLee131 Apr 4, 2026
af794ed
Merge branch 'main' into fix/trust-boundary-regexp-barrier
MarkLee131 Apr 21, 2026
d27ee86
Java: refactor trust-boundary sanitizers into TrustBoundaryValidation…
MarkLee131 Apr 29, 2026
49d014c
Merge branch 'main' into fix/trust-boundary-regexp-barrier
MarkLee131 Apr 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions java/ql/lib/change-notes/2026-04-04-trust-boundary-regexp-barrier.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
---
category: minorAnalysis
---
* The `java/trust-boundary-violation` query now recognizes regular expression checks (including `String.matches()` guards and `@javax.validation.constraints.Pattern` annotations) as sanitizers, consistent with the existing treatment of ESAPI validators. This reduces false positives when input is validated against a pattern before being stored in a session.
3 changes: 2 additions & 1 deletion java/ql/lib/semmle/code/java/security/TrustBoundaryViolationQuery.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,8 @@ module TrustBoundaryConfig implements DataFlow::ConfigSig {
predicate isBarrier(DataFlow::Node node) {
node instanceof TrustBoundaryValidationSanitizer or
node.getType() instanceof HttpServletSession or
node instanceof SimpleTypeSanitizer
node instanceof SimpleTypeSanitizer or
node instanceof RegexpCheckBarrier
Copy link
Copy Markdown
Contributor

@owen-mc owen-mc Apr 29, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
node instanceof TrustBoundaryValidationSanitizer or
node.getType() instanceof HttpServletSession or
node instanceof SimpleTypeSanitizer
node instanceof SimpleTypeSanitizer or
node instanceof RegexpCheckBarrier
node instanceof TrustBoundaryValidationSanitizer

It is slightly preferable to define these sanitizers by introducing classes which extend TrustBoundaryValidationSanitizer. It wasn't done this way before, but if you could tidy it up that would be great. So you'll need to add

class SimpleTypeTrustBoundaryValidationSanitizer extends TrustBoundaryValidationSanitizer instanceof SimpleTypeSanitizer
{ }

class RegexpCheckTrustBoundaryValidationSanitizer extends TrustBoundaryValidationSanitizer instanceof RegexpCheckBarrier
{ }

class HttpServletSessionTypeTrustBoundaryValidationSanitizer extends TrustBoundaryValidationSanitizer
{
  HttpServletSessionTypeTrustBoundaryValidationSanitizer() {
    this.getType() instanceof HttpServletSession
  }
}

Copy link
Copy Markdown
Contributor Author

@MarkLee131 MarkLee131 Apr 29, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry, GitHub didn't let me apply the suggestion directly from the web UI, so I redid it locally and pushed in d27ee86. Pulled the three sanitizers out into their own classes as you suggested.

}

predicate isSink(DataFlow::Node sink) { sink instanceof TrustBoundaryViolationSink }
Expand Down
14 changes: 14 additions & 0 deletions java/ql/test/query-tests/security/CWE-501/TrustBoundaryViolations.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,5 +31,19 @@ public void doGet(HttpServletRequest request, HttpServletResponse response) {
}
} catch (Exception e) {
}

// GOOD: A direct String.matches(...) regex check constrains the input before it is written to the session.
String input4 = request.getParameter("input4");
if (input4.matches("[a-zA-Z0-9]+")) {
request.getSession().setAttribute("input4", input4);
}
}

@javax.validation.constraints.Pattern(regexp = "^[a-zA-Z0-9]+$")
String validatedField;

public void doPost(HttpServletRequest request, HttpServletResponse response) {
// GOOD: The field is constrained by a @Pattern annotation.
request.getSession().setAttribute("validated", validatedField);
}
}
2 changes: 1 addition & 1 deletion java/ql/test/query-tests/security/CWE-501/options
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1 @@
//semmle-extractor-options: --javac-args -cp ${testdir}/../../../stubs/esapi-2.0.1:${testdir}/../../../stubs/javax-servlet-2.5
//semmle-extractor-options: --javac-args -cp ${testdir}/../../../stubs/esapi-2.0.1:${testdir}/../../../stubs/javax-servlet-2.5:${testdir}/../../../stubs/javax-validation-constraints
Loading