Java: Allow models-as-data barriers for log injection and improve log injection and path injection sanitizers by owen-mc · Pull Request #22835 · github/codeql

owen-mc · 2026-10-15T21:47:03Z

Adds Java log-injection sanitizers and guards for common JDK, Apache Commons, Guava, OWASP, and Spring APIs.

Allows MaD barriers for log injection, using the "log-injection" kind. Note that these are not barriers for java/sensitive-info-log, even though that query uses the "log-injection" kind for sinks.

Introduces reusable string matching, replacement, and removal concepts, which are also used to improve path-injection sanitization.

…ion"

github-actions · 2026-10-15T21:49:57Z

⚠️ The head of this PR and the base branch were compared for differences in the framework coverage reports. The generated reports are available in the artifacts of this workflow run. The differences will be picked up by the nightly job after the PR gets merged.

Click to show differences in coverage

java

Generated file changes for java

Changes to framework-coverage-java.rst:

-    `Apache Commons Lang <https://commons.apache.org/proper/commons-lang/>`_,``org.apache.commons.lang3``,,425,7,,,,,,
+    `Apache Commons Lang <https://commons.apache.org/proper/commons-lang/>`_,``org.apache.commons.lang3``,,426,7,,,,,,
-    `Apache Commons Text <https://commons.apache.org/proper/commons-text/>`_,``org.apache.commons.text``,,272,,,,,,,
+    `Apache Commons Text <https://commons.apache.org/proper/commons-text/>`_,``org.apache.commons.text``,,273,,,,,,,
-    `Google Guava <https://guava.dev/>`_,``com.google.common.*``,,730,43,9,,,,,
+    `Google Guava <https://guava.dev/>`_,``com.google.common.*``,,735,43,9,,,,,
-    Others,"``actions.osgi``, ``antlr``, ``ch.ethz.ssh2``, ``cn.hutool.core.codec``, ``com.alibaba.com.caucho.hessian.io``, ``com.alibaba.druid.sql``, ``com.alibaba.fastjson2``, ``com.amazonaws.auth``, ``com.auth0.jwt.algorithms``, ``com.azure.identity``, ``com.caucho.burlap.io``, ``com.caucho.hessian.io``, ``com.cedarsoftware.util.io``, ``com.esotericsoftware.kryo.io``, ``com.esotericsoftware.kryo5.io``, ``com.esotericsoftware.yamlbeans``, ``com.hubspot.jinjava``, ``com.jcraft.jsch``, ``com.microsoft.sqlserver.jdbc``, ``com.mitchellbosecke.pebble``, ``com.opensymphony.xwork2``, ``com.sshtools.j2ssh.authentication``, ``com.sun.crypto.provider``, ``com.sun.jndi.ldap``, ``com.sun.net.httpserver``, ``com.sun.net.ssl``, ``com.sun.rowset``, ``com.sun.security.auth.module``, ``com.sun.security.ntlm``, ``com.sun.security.sasl.digest``, ``com.thoughtworks.xstream``, ``com.trilead.ssh2``, ``com.unboundid.ldap.sdk``, ``com.zaxxer.hikari``, ``flexjson``, ``hudson``, ``io.jsonwebtoken``, ``io.micronaut.context.annotation``, ``io.micronaut.core.convert.value``, ``io.micronaut.http``, ``io.r2dbc.spi``, ``io.undertow.server.handlers.resource``, ``javafx.scene.web``, ``jenkins``, ``jodd.json``, ``liquibase.database.jvm``, ``liquibase.statement.core``, ``net.lingala.zip4j``, ``net.schmizz.sshj``, ``net.sf.json``, ``net.sf.saxon.s9api``, ``ognl``, ``org.acegisecurity``, ``org.antlr.runtime``, ``org.apache.avro``, ``org.apache.commons.codec``, ``org.apache.commons.compress.archivers.tar``, ``org.apache.commons.exec``, ``org.apache.commons.fileupload``, ``org.apache.commons.httpclient.util``, ``org.apache.commons.jelly``, ``org.apache.commons.jexl2``, ``org.apache.commons.jexl3``, ``org.apache.commons.lang``, ``org.apache.commons.logging``, ``org.apache.commons.net``, ``org.apache.commons.ognl``, ``org.apache.cxf.catalog``, ``org.apache.cxf.common.classloader``, ``org.apache.cxf.common.jaxb``, ``org.apache.cxf.common.logging``, ``org.apache.cxf.configuration.jsse``, ``org.apache.cxf.helpers``, ``org.apache.cxf.resource``, ``org.apache.cxf.staxutils``, ``org.apache.cxf.tools.corba.utils``, ``org.apache.cxf.tools.util``, ``org.apache.cxf.transform``, ``org.apache.directory.ldap.client.api``, ``org.apache.hadoop.fs``, ``org.apache.hadoop.hive.metastore``, ``org.apache.hadoop.hive.ql.exec``, ``org.apache.hadoop.hive.ql.metadata``, ``org.apache.hc.client5.http.async.methods``, ``org.apache.hc.client5.http.classic.methods``, ``org.apache.hc.client5.http.fluent``, ``org.apache.hc.client5.http.protocol``, ``org.apache.hc.client5.http.utils``, ``org.apache.hive.hcatalog.templeton``, ``org.apache.ibatis.jdbc``, ``org.apache.ibatis.mapping``, ``org.apache.log4j``, ``org.apache.poi``, ``org.apache.shiro.authc``, ``org.apache.shiro.codec``, ``org.apache.shiro.jndi``, ``org.apache.shiro.mgt``, ``org.apache.sshd.client.session``, ``org.apache.tools.ant``, ``org.apache.tools.zip``, ``org.codehaus.cargo.container.installer``, ``org.dom4j``, ``org.exolab.castor.xml``, ``org.fusesource.leveldbjni``, ``org.geogebra.web.full.main``, ``org.gradle.api.file``, ``org.ho.yaml``, ``org.influxdb``, ``org.jabsorb``, ``org.jboss.vfs``, ``org.jdbi.v3.core``, ``org.jenkins.ui.icon``, ``org.jenkins.ui.symbol``, ``org.keycloak.models.map.storage``, ``org.kohsuke.stapler``, ``org.lastaflute.web``, ``org.mvel2``, ``org.openjdk.jmh.runner.options``, ``org.owasp.esapi``, ``org.pac4j.jwt.config.encryption``, ``org.pac4j.jwt.config.signature``, ``org.scijava.log``, ``org.xml.sax``, ``org.xmlpull.v1``, ``play.libs.ws``, ``play.mvc``, ``ratpack.core.form``, ``ratpack.core.handling``, ``ratpack.core.http``, ``ratpack.exec``, ``ratpack.form``, ``ratpack.func``, ``ratpack.handling``, ``ratpack.http``, ``ratpack.util``, ``software.amazon.awssdk.transfer.s3.model``, ``sun.jvmstat.perfdata.monitor.protocol.local``, ``sun.jvmstat.perfdata.monitor.protocol.rmi``, ``sun.misc``, ``sun.net.ftp``, ``sun.net.www.protocol.http``, ``sun.security.acl``, ``sun.security.jgss.krb5``, ``sun.security.krb5``, ``sun.security.pkcs``, ``sun.security.pkcs11``, ``sun.security.provider``, ``sun.security.ssl``, ``sun.security.x509``, ``sun.tools.jconsole``",167,8313,855,188,6,20,18,,211
+    Others,"``actions.osgi``, ``antlr``, ``ch.ethz.ssh2``, ``cn.hutool.core.codec``, ``com.alibaba.com.caucho.hessian.io``, ``com.alibaba.druid.sql``, ``com.alibaba.fastjson2``, ``com.amazonaws.auth``, ``com.auth0.jwt.algorithms``, ``com.azure.identity``, ``com.caucho.burlap.io``, ``com.caucho.hessian.io``, ``com.cedarsoftware.util.io``, ``com.esotericsoftware.kryo.io``, ``com.esotericsoftware.kryo5.io``, ``com.esotericsoftware.yamlbeans``, ``com.hubspot.jinjava``, ``com.jcraft.jsch``, ``com.microsoft.sqlserver.jdbc``, ``com.mitchellbosecke.pebble``, ``com.opensymphony.xwork2``, ``com.sshtools.j2ssh.authentication``, ``com.sun.crypto.provider``, ``com.sun.jndi.ldap``, ``com.sun.net.httpserver``, ``com.sun.net.ssl``, ``com.sun.rowset``, ``com.sun.security.auth.module``, ``com.sun.security.ntlm``, ``com.sun.security.sasl.digest``, ``com.thoughtworks.xstream``, ``com.trilead.ssh2``, ``com.unboundid.ldap.sdk``, ``com.zaxxer.hikari``, ``flexjson``, ``hudson``, ``io.jsonwebtoken``, ``io.micronaut.context.annotation``, ``io.micronaut.core.convert.value``, ``io.micronaut.http``, ``io.r2dbc.spi``, ``io.undertow.server.handlers.resource``, ``javafx.scene.web``, ``jenkins``, ``jodd.json``, ``liquibase.database.jvm``, ``liquibase.statement.core``, ``net.lingala.zip4j``, ``net.schmizz.sshj``, ``net.sf.json``, ``net.sf.saxon.s9api``, ``ognl``, ``org.acegisecurity``, ``org.antlr.runtime``, ``org.apache.avro``, ``org.apache.commons.codec``, ``org.apache.commons.compress.archivers.tar``, ``org.apache.commons.exec``, ``org.apache.commons.fileupload``, ``org.apache.commons.httpclient.util``, ``org.apache.commons.jelly``, ``org.apache.commons.jexl2``, ``org.apache.commons.jexl3``, ``org.apache.commons.lang``, ``org.apache.commons.logging``, ``org.apache.commons.net``, ``org.apache.commons.ognl``, ``org.apache.cxf.catalog``, ``org.apache.cxf.common.classloader``, ``org.apache.cxf.common.jaxb``, ``org.apache.cxf.common.logging``, ``org.apache.cxf.configuration.jsse``, ``org.apache.cxf.helpers``, ``org.apache.cxf.resource``, ``org.apache.cxf.staxutils``, ``org.apache.cxf.tools.corba.utils``, ``org.apache.cxf.tools.util``, ``org.apache.cxf.transform``, ``org.apache.directory.ldap.client.api``, ``org.apache.hadoop.fs``, ``org.apache.hadoop.hive.metastore``, ``org.apache.hadoop.hive.ql.exec``, ``org.apache.hadoop.hive.ql.metadata``, ``org.apache.hc.client5.http.async.methods``, ``org.apache.hc.client5.http.classic.methods``, ``org.apache.hc.client5.http.fluent``, ``org.apache.hc.client5.http.protocol``, ``org.apache.hc.client5.http.utils``, ``org.apache.hive.hcatalog.templeton``, ``org.apache.ibatis.jdbc``, ``org.apache.ibatis.mapping``, ``org.apache.log4j``, ``org.apache.poi``, ``org.apache.shiro.authc``, ``org.apache.shiro.codec``, ``org.apache.shiro.jndi``, ``org.apache.shiro.mgt``, ``org.apache.sshd.client.session``, ``org.apache.tools.ant``, ``org.apache.tools.zip``, ``org.codehaus.cargo.container.installer``, ``org.dom4j``, ``org.exolab.castor.xml``, ``org.fusesource.leveldbjni``, ``org.geogebra.web.full.main``, ``org.gradle.api.file``, ``org.ho.yaml``, ``org.influxdb``, ``org.jabsorb``, ``org.jboss.vfs``, ``org.jdbi.v3.core``, ``org.jenkins.ui.icon``, ``org.jenkins.ui.symbol``, ``org.keycloak.models.map.storage``, ``org.kohsuke.stapler``, ``org.lastaflute.web``, ``org.mvel2``, ``org.openjdk.jmh.runner.options``, ``org.owasp.encoder``, ``org.owasp.esapi``, ``org.pac4j.jwt.config.encryption``, ``org.pac4j.jwt.config.signature``, ``org.scijava.log``, ``org.xml.sax``, ``org.xmlpull.v1``, ``play.libs.ws``, ``play.mvc``, ``ratpack.core.form``, ``ratpack.core.handling``, ``ratpack.core.http``, ``ratpack.exec``, ``ratpack.form``, ``ratpack.func``, ``ratpack.handling``, ``ratpack.http``, ``ratpack.util``, ``software.amazon.awssdk.transfer.s3.model``, ``sun.jvmstat.perfdata.monitor.protocol.local``, ``sun.jvmstat.perfdata.monitor.protocol.rmi``, ``sun.misc``, ``sun.net.ftp``, ``sun.net.www.protocol.http``, ``sun.security.acl``, ``sun.security.jgss.krb5``, ``sun.security.krb5``, ``sun.security.pkcs``, ``sun.security.pkcs11``, ``sun.security.provider``, ``sun.security.ssl``, ``sun.security.x509``, ``sun.tools.jconsole``",167,8314,855,188,6,20,18,,211
-    Totals,,422,28691,2796,461,16,151,33,1,441
+    Totals,,422,28699,2796,461,16,151,33,1,441

Changes to framework-coverage-java.csv:

- com.google.common.base,4,,87,,,,,,,,,,,,,,,,,,,,,,,,,,,,,3,1,,,,,,,,,,,,,,,,,,,,,,63,24
+ com.google.common.base,4,,92,,,,,,,,,,,,,,,,,,,,,,,,,,,,,3,1,,,,,,,,,,,,,,,,,,,,,,68,24
- org.apache.commons.lang3,7,,425,,,,,,,,,,,,,,,,,,,,,,,,,,,6,,,,,,,,,,,,1,,,,,,,,,,,,,294,131
+ org.apache.commons.lang3,7,,426,,,,,,,,,,,,,,,,,,,,,,,,,,,6,,,,,,,,,,,,1,,,,,,,,,,,,,295,131
- org.apache.commons.text,,,272,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,220,52
+ org.apache.commons.text,,,273,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,221,52
+ org.owasp.encoder,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,

Copilot

🟡 Changes recommended

Nonconstant replacements can incorrectly create sanitization barriers and suppress valid log-injection alerts.

1 open finding

Prevent sanitization when replacement is nonconstant or tainted · New

What changed in this PR

Extends Java security analysis with reusable string-operation models and broader log- and path-injection sanitizers.

Changes:

Enable models-as-data log-injection barriers.
Share string matching, replacement, and removal concepts across security checks.
Expand library models, regression fixtures, and change notes.

File	Description
java/ql/test/stubs/owasp-java-encoder/org/owasp/encoder/Encode.java	Add encoder test stub.
java/ql/test/stubs/apache-commons-text-1.9/org/apache/commons/text/StringEscapeUtils.java	Add escaping test stub.
java/ql/test/query-tests/security/CWE-117/options	Include additional library stubs.
java/ql/test/query-tests/security/CWE-117/LogInjectionTest.java	Move replacement sanitizer cases.
java/ql/test/query-tests/security/CWE-117/LogInjectionTest.ext.yml	Register the new test source.
java/ql/test/query-tests/security/CWE-117/LibrarySanitizers.java	Test library sanitizers and guards.
java/ql/test/library-tests/pathsanitizer/Test.java	Extend path-sanitizer cases.
java/ql/test/library-tests/pathsanitizer/options	Include Commons and Guava stubs.
java/ql/lib/semmle/code/java/security/PathSanitizer.qll	Consume shared string-operation concepts.
java/ql/lib/semmle/code/java/security/LogInjection.qll	Extend barriers and sanitizer recognition.
java/ql/lib/semmle/code/java/JDK.qll	Implement JDK string-operation models.
java/ql/lib/semmle/code/java/frameworks/guava/Guava.qll	Model character-matcher operations.
java/ql/lib/semmle/code/java/frameworks/apache/Lang.qll	Model Commons string operations.
java/ql/lib/semmle/code/java/Expr.qll	Unify string and character constant values.
java/ql/lib/semmle/code/java/Concepts.qll	Define reusable string-operation interfaces.
java/ql/lib/ext/org.springframework.util.model.yml	Add whitespace-removal barrier.
java/ql/lib/ext/org.owasp.encoder.model.yml	Add encoder barrier and taint summary.
java/ql/lib/ext/org.apache.commons.text.model.yml	Add Java-escaping models.
java/ql/lib/ext/org.apache.commons.lang3.model.yml	Add escaping and whitespace barriers.
java/ql/lib/ext/com.google.common.base.model.yml	Add character-matcher taint summaries.
java/ql/lib/change-notes/2026-10-15-log-injection-sanitizers.md	Document analysis improvements.

🧠 Review effort: Max

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Co-authored-by: Copilot <[email protected]>

owen-mc · 2026-10-16T14:16:34Z

DCA seems pretty neutral.

jacknojo

Looks good.

I would suggest extending the PR description a bit - it was not obvious to me what goes on here, in particular the

private class ExternalLogInjectionSanitizer extends LogInjectionSanitizer {
  ExternalLogInjectionSanitizer() { barrierNode(this, "log-injection") }
}

"trick" for java/log-injection vs. java/sensitive-log

owen-mc added 2 commits October 15, 2026 11:25

Make java/log-injection use external barriers with kind "log-inject…

942abed

…ion"

Add summary models for common sanitizers

4f593bf

github-advanced-security Bot found potential problems Oct 15, 2026

View reviewed changes

github-actions Bot added documentation Java labels Oct 15, 2026

owen-mc force-pushed the java/mad-barrier-log-injection branch from 811014d to f512ba9 Compare October 15, 2026 22:17

owen-mc changed the title ~~Java/mad barrier log injection~~ Java: Allow models-as-data barriers for log injection and improve log injection and path injection sanitizers Oct 15, 2026

owen-mc marked this pull request as ready for review October 16, 2026 09:17

owen-mc requested a review from a team as a code owner October 16, 2026 09:17

Copilot AI max review requested due to automatic review settings October 16, 2026 09:17

Copilot started reviewing on behalf of owen-mc October 16, 2026 09:18

View session

Copilot AI reviewed Oct 16, 2026

View reviewed changes

Comment thread java/ql/lib/semmle/code/java/security/LogInjection.qll Resolved

owen-mc and others added 7 commits October 16, 2026 11:26

Add tests with SPURIOUS results for sanitization

b23b5ae

Co-authored-by: Copilot <[email protected]>

Add barrier models for sanitizers where possible

5c929a3

Co-authored-by: Copilot <[email protected]>

Add string replacement and removal concepts

b633b8c

Co-authored-by: Copilot <[email protected]>

Model string match sanitizer guards

c720695

Co-authored-by: Copilot <[email protected]>

Model substring match sanitizer guards

54fbda0

Co-authored-by: Copilot <[email protected]>

Use string concepts in path sanitizers

9a2a2c6

Co-authored-by: Copilot <[email protected]>

Add change note for sanitizer improvements

94f4996

Co-authored-by: Copilot <[email protected]>

owen-mc force-pushed the java/mad-barrier-log-injection branch from f512ba9 to 94f4996 Compare October 16, 2026 10:32

jacknojo approved these changes Oct 29, 2026

View reviewed changes

owen-mc merged commit c4d028d into github:main Oct 29, 2026
23 checks passed

owen-mc deleted the java/mad-barrier-log-injection branch October 29, 2026 12:59

Navigation Menu

Repository navigation

Java: Allow models-as-data barriers for log injection and improve log injection and path injection sanitizers - #22835

Java: Allow models-as-data barriers for log injection and improve log injection and path injection sanitizers#22835
owen-mc merged 9 commits into
github:mainfrom
owen-mc:java/mad-barrier-log-injection

owen-mc commented Oct 15, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Oct 15, 2026

java

Generated file changes for java

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

owen-mc commented Oct 16, 2026

Uh oh!

jacknojo left a comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

owen-mc commented Oct 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Oct 15, 2026

java

Generated file changes for java

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

owen-mc commented Oct 16, 2026

Uh oh!

jacknojo left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

owen-mc commented Oct 15, 2026 •

edited

Loading