java-spring-sink-source.yaml

rules:
- id: java-spring-sink-source
  mode: taint
  pattern-sinks:
    - pattern: |
        $SINK(...)
  pattern-sources:
    - patterns:
      - pattern: $VAR
      - pattern-either:
        - pattern-inside: |
            $TYPE $FUNC(..., @RequestParam(...) $T $VAR, ...) {
              ...
            }
        - pattern-inside: |
            $TYPE $FUNC(..., @RequestHeader(...) $T $VAR, ...) {
              ...
            }
        - pattern-inside: |
            $TYPE $FUNC(..., @CookieValue(...) $T $VAR, ...) {
              ...
            }
        - pattern-inside: |
            $TYPE $FUNC(..., @RequestAttribute(...) $T $VAR, ...) {
              ...
            }
        - pattern-inside: |
            $TYPE $FUNC(..., @RequestBody(...) $T $VAR, ...) {
              ...
            }
  message: |
      sink found
  languages: [java]
  severity: ERROR