Add test for reverse DNS from loopback address

Author: owen-mc

java/ql/test/query-tests/security/CWE-807/semmle/tests/ConditionalBypassTest.java

@@ -49,6 +49,15 @@ public static void main(HttpServletRequest request) throws Exception {
 		if (Inet4Address.getLocalHost().getCanonicalHostName().equals("localhost")) {
 			login(user, password);
 		}
+
+		InetAddress loopback = InetAddress.getLoopbackAddress();
+		// GOOD: reverse DNS on loopback address is fine
+		if (loopback.getCanonicalHostName().equals("localhost")) {
+			login(user, password); // $ SPURIOUS: hasConditionalBypassTest
+		}
+		if (Inet4Address.getLoopbackAddress().getCanonicalHostName().equals("localhost")) {
+			login(user, password); // $ SPURIOUS: hasConditionalBypassTest
+		}
 	}
 
 	public static void test(String user, String password) {