codeql icon indicating copy to clipboard operation
codeql copied to clipboard

Java: add more Spring RestTemplate request forgery sinks

Open owen-mc opened this issue 1 month ago • 0 comments

This is an extension of https://github.com/github/codeql/pull/18153 to include all the other methods on the class RestTemplate which have a parameter named uriVariables. They should all be request forgery sinks, but the original PR only did it for getForObject.

It is hard to do performance analysis or evaluate precision because they are very few uses of these APIs in public repos. (We know from customer feedback that they are used in enterprise code.) I looked at the tuple counts from running the query on the test and didn't see any sign of bad join orders.

owen-mc avatar Nov 28 '25 00:11 owen-mc