Add Micronaut framework support for Java QL

Add CodeQL support for Micronaut: add MaD models for HTTP, HTTP client and multipart (sources, sinks and summary propagation), new framework QLL modules (Controller, WebSocket, Config, Data, Security). Add library tests and query tests exercising request inputs, file uploads, HttpClient sinks (SSRF), header sinks (response-splitting) and redirect sinks (open-redirect), plus expected results and extractor options. Include Micronaut 4.x stubs used by the tests.

Author: nicolaswill

java/ql/lib/ext/io.micronaut.http.client.model.yml

@@ -0,0 +1,33 @@
+extensions:
+  - addsTo:
+      pack: codeql/java-all
+      extensible: sinkModel
+    data:
+      # HttpClient.toBlocking() returns BlockingHttpClient; retrieve/exchange with String URL are SSRF sinks
+      - ["io.micronaut.http.client", "BlockingHttpClient", True, "retrieve", "(String)", "", "Argument[0]", "request-forgery", "manual"]
+      - ["io.micronaut.http.client", "BlockingHttpClient", True, "retrieve", "(String,Class)", "", "Argument[0]", "request-forgery", "manual"]
+      - ["io.micronaut.http.client", "BlockingHttpClient", True, "exchange", "(String)", "", "Argument[0]", "request-forgery", "manual"]
+      - ["io.micronaut.http.client", "BlockingHttpClient", True, "exchange", "(String,Class)", "", "Argument[0]", "request-forgery", "manual"]
+  - addsTo:
+      pack: codeql/java-all
+      extensible: summaryModel
+    data:
+      # HttpClient.toBlocking() taint propagation
+      - ["io.micronaut.http.client", "HttpClient", True, "toBlocking", "()", "", "Argument[this]", "ReturnValue", "taint", "manual"]
+      # HttpRequest.GET/POST/PUT/DELETE/PATCH factory methods propagate URI taint
+      - ["io.micronaut.http", "HttpRequest", True, "GET", "(String)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
+      - ["io.micronaut.http", "HttpRequest", True, "POST", "(String,Object)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
+      - ["io.micronaut.http", "HttpRequest", True, "PUT", "(String,Object)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
+      - ["io.micronaut.http", "HttpRequest", True, "DELETE", "(String)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
+      - ["io.micronaut.http", "HttpRequest", True, "PATCH", "(String,Object)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
+      - ["io.micronaut.http", "HttpRequest", True, "HEAD", "(String)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
+      - ["io.micronaut.http", "HttpRequest", True, "OPTIONS", "(String)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
+      # UriBuilder taint propagation
+      - ["io.micronaut.http.uri", "UriBuilder", True, "of", "(CharSequence)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
+      - ["io.micronaut.http.uri", "UriBuilder", True, "of", "(URI)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
+      - ["io.micronaut.http.uri", "UriBuilder", True, "host", "(String)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
+      - ["io.micronaut.http.uri", "UriBuilder", True, "path", "(String)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
+      - ["io.micronaut.http.uri", "UriBuilder", True, "queryParam", "(String,Object[])", "", "Argument[0]", "ReturnValue", "taint", "manual"]
+      - ["io.micronaut.http.uri", "UriBuilder", True, "queryParam", "(String,Object[])", "", "Argument[1].ArrayElement", "ReturnValue", "taint", "manual"]
+      - ["io.micronaut.http.uri", "UriBuilder", True, "fragment", "(String)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
+      - ["io.micronaut.http.uri", "UriBuilder", True, "build", "()", "", "Argument[this]", "ReturnValue", "taint", "manual"]

java/ql/lib/ext/io.micronaut.http.model.yml

@@ -0,0 +1,38 @@
+extensions:
+  - addsTo:
+      pack: codeql/java-all
+      extensible: sourceModel
+    data:
+      - ["io.micronaut.http", "HttpRequest", True, "getBody", "", "", "ReturnValue", "remote", "manual"]
+      - ["io.micronaut.http", "HttpRequest", True, "getHeaders", "", "", "ReturnValue", "remote", "manual"]
+      - ["io.micronaut.http", "HttpRequest", True, "getParameters", "", "", "ReturnValue", "remote", "manual"]
+      - ["io.micronaut.http", "HttpRequest", True, "getCookies", "", "", "ReturnValue", "remote", "manual"]
+      - ["io.micronaut.http", "HttpRequest", True, "getUri", "", "", "ReturnValue", "remote", "manual"]
+      - ["io.micronaut.http", "HttpRequest", True, "getPath", "", "", "ReturnValue", "remote", "manual"]
+      - ["io.micronaut.http", "HttpRequest", True, "getContentType", "", "", "ReturnValue", "remote", "manual"]
+      - ["io.micronaut.http", "HttpRequest", True, "getContentLength", "", "", "ReturnValue", "remote", "manual"]
+      - ["io.micronaut.http", "HttpRequest", True, "getMethodName", "", "", "ReturnValue", "remote", "manual"]
+  - addsTo:
+      pack: codeql/java-all
+      extensible: summaryModel
+    data:
+      - ["io.micronaut.http", "HttpHeaders", True, "get", "", "", "Argument[this]", "ReturnValue", "taint", "manual"]
+      - ["io.micronaut.http", "HttpHeaders", True, "getAll", "", "", "Argument[this]", "ReturnValue", "taint", "manual"]
+      - ["io.micronaut.http", "HttpHeaders", True, "getFirst", "", "", "Argument[this]", "ReturnValue", "taint", "manual"]
+      - ["io.micronaut.http", "HttpHeaders", True, "values", "", "", "Argument[this]", "ReturnValue", "taint", "manual"]
+      - ["io.micronaut.http", "HttpParameters", True, "get", "", "", "Argument[this]", "ReturnValue", "taint", "manual"]
+      - ["io.micronaut.http", "HttpParameters", True, "getAll", "", "", "Argument[this]", "ReturnValue", "taint", "manual"]
+      - ["io.micronaut.http", "HttpParameters", True, "getFirst", "", "", "Argument[this]", "ReturnValue", "taint", "manual"]
+      - ["io.micronaut.http.cookie", "Cookies", True, "get", "", "", "Argument[this]", "ReturnValue", "taint", "manual"]
+      - ["io.micronaut.http.cookie", "Cookies", True, "getAll", "", "", "Argument[this]", "ReturnValue", "taint", "manual"]
+      - ["io.micronaut.http.cookie", "Cookies", True, "findCookie", "", "", "Argument[this]", "ReturnValue", "taint", "manual"]
+      - ["io.micronaut.http.cookie", "Cookie", True, "getValue", "", "", "Argument[this]", "ReturnValue", "taint", "manual"]
+      - ["io.micronaut.http.cookie", "Cookie", True, "getName", "", "", "Argument[this]", "ReturnValue", "taint", "manual"]
+      - ["io.micronaut.http.cookie", "Cookie", True, "getDomain", "", "", "Argument[this]", "ReturnValue", "taint", "manual"]
+      - ["io.micronaut.http.cookie", "Cookie", True, "getPath", "", "", "Argument[this]", "ReturnValue", "taint", "manual"]
+  - addsTo:
+      pack: codeql/java-all
+      extensible: sinkModel
+    data:
+      - ["io.micronaut.http", "MutableHttpResponse", True, "header", "(CharSequence,CharSequence)", "", "Argument[1]", "response-splitting", "manual"]
+      - ["io.micronaut.http", "HttpResponse", True, "redirect", "(URI)", "", "Argument[0]", "url-redirection", "manual"]

java/ql/lib/ext/io.micronaut.http.multipart.model.yml

@@ -0,0 +1,10 @@
+extensions:
+  - addsTo:
+      pack: codeql/java-all
+      extensible: sourceModel
+    data:
+      - ["io.micronaut.http.multipart", "CompletedFileUpload", True, "getBytes", "", "", "ReturnValue", "remote", "manual"]
+      - ["io.micronaut.http.multipart", "CompletedFileUpload", True, "getInputStream", "", "", "ReturnValue", "remote", "manual"]
+      - ["io.micronaut.http.multipart", "CompletedFileUpload", True, "getFilename", "", "", "ReturnValue", "remote", "manual"]
+      - ["io.micronaut.http.multipart", "CompletedFileUpload", True, "getContentType", "", "", "ReturnValue", "remote", "manual"]
+      - ["io.micronaut.http.multipart", "CompletedFileUpload", True, "getSize", "", "", "ReturnValue", "remote", "manual"]

java/ql/lib/semmle/code/java/dataflow/FlowSources.qll

@@ -30,6 +30,9 @@ import semmle.code.java.frameworks.Guice
 import semmle.code.java.frameworks.struts.StrutsActions
 import semmle.code.java.frameworks.Thrift
 import semmle.code.java.frameworks.javaee.jsf.JSFRenderer
+import semmle.code.java.frameworks.micronaut.MicronautController
+import semmle.code.java.frameworks.micronaut.MicronautWebSocket
+import semmle.code.java.frameworks.micronaut.MicronautConfig
 private import semmle.code.java.dataflow.ExternalFlow
 private import codeql.threatmodels.ThreatModels
 
@@ -187,6 +190,38 @@ private class AndroidExternalStorageSource extends RemoteFlowSource {
   override string getSourceType() { result = "Android external storage" }
 }
 
+private class MicronautHttpInputParameterSource extends RemoteFlowSource {
+  MicronautHttpInputParameterSource() {
+    this.asParameter() = any(MicronautRequestMappingParameter mrmp | mrmp.isTaintedInput())
+  }
+
+  override string getSourceType() { result = "Micronaut HTTP input parameter" }
+}
+
+private class MicronautWebSocketParameterSource extends RemoteFlowSource {
+  MicronautWebSocketParameterSource() { this.asParameter() instanceof MicronautWebSocketParameter }
+
+  override string getSourceType() { result = "Micronaut WebSocket parameter" }
+}
+
+private class MicronautConfigSource extends LocalUserInput {
+  MicronautConfigSource() {
+    this.asExpr() = any(MicronautConfigField f).getAnAccess()
+    or
+    this.asParameter() instanceof MicronautConfigParameter
+  }
+
+  override string getThreatModel() { result = "environment" }
+}
+
+private class MicronautErrorHandlerSource extends RemoteFlowSource {
+  MicronautErrorHandlerSource() {
+    this.asParameter() = any(MicronautErrorHandler h).getARemoteParameter()
+  }
+
+  override string getSourceType() { result = "Micronaut error handler parameter" }
+}
+
 /** Class for `tainted` user input. */
 abstract class UserInput extends SourceNode { }
 

java/ql/lib/semmle/code/java/frameworks/micronaut/MicronautConfig.qll

@@ -0,0 +1,41 @@
+/** Provides classes for identifying Micronaut configuration injection sources. */
+overlay[local?]
+module;
+
+import java
+
+/** The annotation type `@Value` from `io.micronaut.context.annotation`. */
+class MicronautValueAnnotation extends AnnotationType {
+  MicronautValueAnnotation() { this.hasQualifiedName("io.micronaut.context.annotation", "Value") }
+}
+
+/** The annotation type `@Property` from `io.micronaut.context.annotation`. */
+class MicronautPropertyAnnotation extends AnnotationType {
+  MicronautPropertyAnnotation() {
+    this.hasQualifiedName("io.micronaut.context.annotation", "Property")
+  }
+}
+
+/**
+ * A field annotated with Micronaut's `@Value` or `@Property` annotation,
+ * representing an injected configuration value.
+ */
+class MicronautConfigField extends Field {
+  MicronautConfigField() {
+    this.getAnAnnotation().getType() instanceof MicronautValueAnnotation
+    or
+    this.getAnAnnotation().getType() instanceof MicronautPropertyAnnotation
+  }
+}
+
+/**
+ * A parameter annotated with Micronaut's `@Value` or `@Property` annotation,
+ * representing an injected configuration value.
+ */
+class MicronautConfigParameter extends Parameter {
+  MicronautConfigParameter() {
+    this.getAnAnnotation().getType() instanceof MicronautValueAnnotation
+    or
+    this.getAnAnnotation().getType() instanceof MicronautPropertyAnnotation
+  }
+}

java/ql/lib/semmle/code/java/frameworks/micronaut/MicronautController.qll

@@ -0,0 +1,142 @@
+/**
+ * Provides classes for identifying Micronaut HTTP controllers and their request handling methods.
+ */
+overlay[local?]
+module;
+
+import java
+
+/** An annotation type that identifies Micronaut controllers. */
+class MicronautControllerAnnotation extends AnnotationType {
+  MicronautControllerAnnotation() {
+    this.hasQualifiedName("io.micronaut.http.annotation", "Controller")
+  }
+}
+
+/**
+ * A class annotated as a Micronaut `@Controller`.
+ */
+class MicronautController extends Class {
+  MicronautController() {
+    this.getAnAnnotation().getType() instanceof MicronautControllerAnnotation
+  }
+}
+
+/** An annotation type that identifies Micronaut HTTP method mappings. */
+class MicronautHttpMethodAnnotation extends AnnotationType {
+  MicronautHttpMethodAnnotation() {
+    this.getPackage().hasName("io.micronaut.http.annotation") and
+    this.hasName([
+        "Get", "Post", "Put", "Delete", "Patch", "Head", "Options", "Trace", "CustomHttpMethod"
+      ])
+  }
+}
+
+/**
+ * A method on a Micronaut controller that is executed in response to an HTTP request.
+ */
+class MicronautRequestMappingMethod extends Method {
+  MicronautRequestMappingMethod() {
+    this.getDeclaringType() instanceof MicronautController and
+    this.getAnAnnotation().getType() instanceof MicronautHttpMethodAnnotation
+  }
+
+  /** Gets a request mapping parameter. */
+  MicronautRequestMappingParameter getARequestParameter() { result = this.getAParameter() }
+}
+
+/** A Micronaut annotation indicating remote user input from HTTP requests. */
+class MicronautHttpInputAnnotation extends Annotation {
+  MicronautHttpInputAnnotation() {
+    exists(AnnotationType a |
+      a = this.getType() and
+      a.getPackage().hasName("io.micronaut.http.annotation")
+    |
+      a.hasName([
+          "PathVariable", "QueryValue", "Body", "Header", "CookieValue", "Part", "RequestAttribute"
+        ])
+    )
+  }
+}
+
+/** A parameter of a `MicronautRequestMappingMethod`. */
+class MicronautRequestMappingParameter extends Parameter {
+  MicronautRequestMappingParameter() { this.getCallable() instanceof MicronautRequestMappingMethod }
+
+  /** Holds if the parameter should not be considered a direct source of taint. */
+  predicate isNotDirectlyTaintedInput() {
+    this.getType().(RefType).getAnAncestor().hasQualifiedName("io.micronaut.http", "HttpResponse")
+    or
+    this.getType()
+        .(RefType)
+        .getAnAncestor()
+        .hasQualifiedName("io.micronaut.http", "MutableHttpResponse")
+    or
+    this.getType().(RefType).getAnAncestor().hasQualifiedName("java.security", "Principal")
+    or
+    this.getType().(RefType).getAnAncestor().hasQualifiedName("java.util", "Locale")
+    or
+    this.getType().(RefType).getAnAncestor().hasQualifiedName("java.util", "TimeZone")
+    or
+    this.getType().(RefType).getAnAncestor().hasQualifiedName("java.time", "ZoneId")
+    or
+    // @Value/@Property parameters are configuration injection, not HTTP input
+    this.getAnAnnotation()
+        .getType()
+        .hasQualifiedName("io.micronaut.context.annotation", ["Value", "Property"])
+  }
+
+  private predicate isExplicitlyTaintedInput() {
+    // The MicronautHttpInputAnnotations allow access to the URI path,
+    // request parameters, cookie values, headers, and the body of the request.
+    this.getAnAnnotation() instanceof MicronautHttpInputAnnotation
+    or
+    // A @RequestBean parameter binds multiple request attributes into a POJO
+    this.getAnAnnotation().getType() instanceof MicronautRequestBeanAnnotation
+    or
+    // An HttpRequest parameter provides access to request data
+    this.getType()
+        .(RefType)
+        .getASourceSupertype*()
+        .hasQualifiedName("io.micronaut.http", "HttpRequest")
+    or
+    // InputStream or Reader parameters allow access to the body of a request
+    this.getType().(RefType).getAnAncestor() instanceof TypeInputStream
+    or
+    this.getType().(RefType).getAnAncestor().hasQualifiedName("java.io", "Reader")
+  }
+
+  /** Holds if the input is tainted (i.e. comes from user-controlled input). */
+  predicate isTaintedInput() {
+    this.isExplicitlyTaintedInput()
+    or
+    not this.isNotDirectlyTaintedInput()
+  }
+}
+
+/** An annotation type that identifies Micronaut error handler methods. */
+class MicronautErrorAnnotation extends AnnotationType {
+  MicronautErrorAnnotation() { this.hasQualifiedName("io.micronaut.http.annotation", "Error") }
+}
+
+/** A method annotated with Micronaut's `@Error` that handles exceptions. */
+class MicronautErrorHandler extends Method {
+  MicronautErrorHandler() { this.getAnAnnotation().getType() instanceof MicronautErrorAnnotation }
+
+  /** Gets a parameter that carries user-controlled request data. */
+  Parameter getARemoteParameter() {
+    result = this.getAParameter() and
+    result
+        .getType()
+        .(RefType)
+        .getASourceSupertype*()
+        .hasQualifiedName("io.micronaut.http", "HttpRequest")
+  }
+}
+
+/** An annotation type that identifies Micronaut request bean parameters. */
+class MicronautRequestBeanAnnotation extends AnnotationType {
+  MicronautRequestBeanAnnotation() {
+    this.hasQualifiedName("io.micronaut.http.annotation", "RequestBean")
+  }
+}

java/ql/lib/semmle/code/java/frameworks/micronaut/MicronautData.qll

@@ -0,0 +1,32 @@
+/** Provides classes for identifying Micronaut Data repositories and query annotations. */
+overlay[local?]
+module;
+
+import java
+
+/**
+ * The annotation type `@Query` from `io.micronaut.data.annotation`.
+ */
+class MicronautQueryAnnotation extends AnnotationType {
+  MicronautQueryAnnotation() { this.hasQualifiedName("io.micronaut.data.annotation", "Query") }
+}
+
+/**
+ * The annotation type `@Repository` from `io.micronaut.data.annotation`.
+ */
+class MicronautRepositoryAnnotation extends AnnotationType {
+  MicronautRepositoryAnnotation() {
+    this.hasQualifiedName("io.micronaut.data.annotation", "Repository")
+  }
+}
+
+/**
+ * A class annotated with Micronaut's `@Repository` annotation.
+ */
+class MicronautRepositoryClass extends RefType {
+  MicronautRepositoryClass() {
+    this.getAnAnnotation().getType() instanceof MicronautRepositoryAnnotation
+    or
+    this.getAnAncestor().hasQualifiedName("io.micronaut.data.repository", "GenericRepository")
+  }
+}

java/ql/lib/semmle/code/java/frameworks/micronaut/MicronautSecurity.qll

@@ -0,0 +1,38 @@
+/**
+ * Provides classes for identifying Micronaut Security annotations.
+ *
+ * Micronaut Security provides the `@Secured` annotation and integrates
+ * with standard `@RolesAllowed` for method-level access control.
+ */
+overlay[local?]
+module;
+
+import java
+
+/**
+ * The annotation type `@Secured` from `io.micronaut.security.annotation`.
+ */
+class MicronautSecuredAnnotation extends AnnotationType {
+  MicronautSecuredAnnotation() {
+    this.hasQualifiedName("io.micronaut.security.annotation", "Secured")
+  }
+}
+
+/**
+ * A callable (method or constructor) that is annotated with Micronaut's `@Secured`
+ * annotation, either directly or via its declaring type.
+ */
+class MicronautSecuredCallable extends Callable {
+  MicronautSecuredCallable() {
+    this.getAnAnnotation().getType() instanceof MicronautSecuredAnnotation
+    or
+    this.getDeclaringType().getAnAnnotation().getType() instanceof MicronautSecuredAnnotation
+  }
+}
+
+/**
+ * A class annotated with Micronaut's `@Secured` annotation.
+ */
+class MicronautSecuredClass extends Class {
+  MicronautSecuredClass() { this.getAnAnnotation().getType() instanceof MicronautSecuredAnnotation }
+}