Merge pull request #20688 from hvitved/java/request-forgery-matches-sanitizer

Java: Treat `x.matches(regexp)` as a sanitizer for request forgery

Author: hvitved

java/ql/lib/semmle/code/java/security/RequestForgery.qll

@@ -164,3 +164,24 @@ private class HostComparisonSanitizer extends RequestForgerySanitizer {
     this = DataFlow::BarrierGuard<isHostComparisonSanitizer/3>::getABarrierNode()
   }
 }
+
+/**
+ * A qualifier in a call to a `.matches()` method that is a sanitizer for URL redirects.
+ *
+ * Matches any method call where the method is named `matches`.
+ */
+private predicate isMatchesSanitizer(Guard guard, Expr e, boolean branch) {
+  guard =
+    any(MethodCall method |
+      method.getMethod().getName() = "matches" and
+      e = method.getQualifier() and
+      branch = true
+    )
+}
+
+/**
+ * A qualifier in a call to `.matches()` that is a sanitizer for URL redirects.
+ */
+private class MatchesSanitizer extends RequestForgerySanitizer {
+  MatchesSanitizer() { this = DataFlow::BarrierGuard<isMatchesSanitizer/3>::getABarrierNode() }
+}

java/ql/src/change-notes/2025-10-24-request-forgery-matches-sanitizer.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Calls to `String.matches` are now treated as sanitizers for the `java/ssrf` query.

java/ql/test/query-tests/security/CWE-918/SanitizationTests.java

@@ -119,8 +119,26 @@ protected void doGet(HttpServletRequest request, HttpServletResponse response)
             String unsafeUri10 = String.format("%s://%s:%s%s", "http", "myserver.com", "80", request.getParameter("baduri10")); // $ Source
             HttpRequest unsafer10 = HttpRequest.newBuilder(new URI(unsafeUri10)).build(); // $ Alert
             client.send(unsafer10, null); // $ Alert
+
+            // GOOD: sanitisation by regexp validation
+            String param10 = request.getParameter("uri10");
+            if (param10.matches("[a-zA-Z0-9_-]+")) {
+                HttpRequest r10 = HttpRequest.newBuilder(new URI(param10)).build();
+                client.send(r10, null);
+            }
+            
+            String param11 = request.getParameter("uri11");
+            validate(param11);
+            HttpRequest r11 = HttpRequest.newBuilder(new URI(param11)).build();
+            client.send(r11, null);
         } catch (Exception e) {
             // TODO: handle exception
         }
     }
+
+    private void validate(String s) {
+        if (!s.matches("[a-zA-Z0-9_-]+")) {
+            throw new IllegalArgumentException("Invalid ID");
+        }
+    }
 }

misc/scripts/create-change-note.py

@@ -7,7 +7,7 @@
 # - What language the change note is for
 # - Whether it's a query or library change (the string `src` or `lib`)
 # - The name of the change note (in kebab-case)
-# - The category of the change.
+# - The category of the change (see https://github.com/github/codeql/blob/main/docs/change-notes.md#change-categories).
 
 # The change note will be created in the `{language}/ql/{subdir}/change-notes` directory, where `subdir` is either `src` or `lib`.