Exclude loopback address from reverse DNS source

Author: owen-mc

java/ql/lib/semmle/code/java/dataflow/FlowSources.qll

@@ -126,7 +126,7 @@ private class ReverseDnsSource extends RemoteFlowSource {
       m.getMethod() instanceof ReverseDnsMethod and
       not exists(MethodCall l |
         (variableStep(l, m.getQualifier()) or l = m.getQualifier()) and
-        l.getMethod().getName() = "getLocalHost"
+        (l.getMethod().getName() = "getLocalHost" or l.getMethod().getName() = "getLoopbackAddress")
       )
     )
   }

java/ql/test/query-tests/security/CWE-807/semmle/tests/ConditionalBypassTest.java

@@ -53,10 +53,10 @@ public static void main(HttpServletRequest request) throws Exception {
 		InetAddress loopback = InetAddress.getLoopbackAddress();
 		// GOOD: reverse DNS on loopback address is fine
 		if (loopback.getCanonicalHostName().equals("localhost")) {
-			login(user, password); // $ SPURIOUS: hasConditionalBypassTest
+			login(user, password); // $ hasConditionalBypassTest
 		}
 		if (Inet4Address.getLoopbackAddress().getCanonicalHostName().equals("localhost")) {
-			login(user, password); // $ SPURIOUS: hasConditionalBypassTest
+			login(user, password); // $ hasConditionalBypassTest
 		}
 	}