Java: Add Spring XSS tests

[smowton]

Based on #6042

These cover the cases currently exercised in https://github.com/github/codeql-securitylab/blob/main/java/ql/src/pwntester/security/RestXSS.ql particularly for Spring.

Auxiliary changes:

• Minor fix to inline-expectations tests
• Converted existing XSS tests to inline expectations

[MathiasVP]

Doesn't this check belong in getEndOfColumnPosition? That predicate already does a very similar thing that checks the start position.

[smowton]

It seems to me that getEndOfColumnPosition is doing the right thing -- it's identifying that the next column is the next column keyword or the end of the string.

The problem is that MISSING: abc could previously match both this disjunct (column = TDefaultColumn(), end = EOS, expectation = abc) and the other disjunct (column = TNamedColumn("MISSING"), start = len("MISSING: "), end = EOS, expectation = abc)

[smowton]

I suppose alternatively we could replace regexpFind with a regexpMatch consuming only whitespace up front, so MISSING: abc would fail to match due to the : character

[MathiasVP]

Ah, right. I see what you mean. I think replacing regexpFind with regexpMatch would be the more "right" thing to do, but I don't dislike this solution enough to argue against your fix. 👍

[smowton]

I tried using regexpMatch, but it's awkward because it's using regexpFind in order to bind more than one chunk that matches expectationRegexp() -- for example, in // $ a=b c=d that regexpFind is supposed to match twice, once starting at a and again starting at c.

[RasmusWL]

I haven't looked too far into the machinery of InlineExpectationsTest.qll, but did this turn out to be a problem for your test? I couldn't see anything with MISSING: in it 😕 so if you have a motivating example, that would be great 👍

[smowton]

Sure, here's an example that produces spurious missing-value warnings at every use of // $ MISSING::

public class Test {

  public static void main1() {} // $MISSING: abc
  public static void main2() {} //$MISSING:abc
  public static void main3() {} //$MISSING: abc
  public static void main4() {} // $MISSING:abc

} // $MISSING: abc

[RasmusWL]

Oh, I see this has been fixed by #6096 now 👍 I'm not sure if you still want this change to go in for the inline-tests? (this is more in the category of nitpicks I guess)

[aschackmull]

This line is now superfluous and the fix commit on this PR can be removed.

[smowton]

👍 rebased and dropped

[RasmusWL]

awesome, thanks ❤️