Java: SpringController - handle non-string literal produces values.

lcartey · lcartey · commit 8bd5f748b468 · 2020-06-16T09:50:36.000+01:00
diff --git a/java/ql/src/semmle/code/java/frameworks/spring/SpringController.qll b/java/ql/src/semmle/code/java/frameworks/spring/SpringController.qll
@@ -124,7 +124,7 @@ class SpringRequestMappingMethod extends SpringControllerMethod {
 
   /** Gets the "produces" @RequestMapping annotation value, if present. */
   string getProduces() {
-    result = requestMappingAnnotation.getValue("produces").(StringLiteral).getValue()
+    result = requestMappingAnnotation.getValue("produces").(CompileTimeConstantExpr).getStringValue()
   }
 
   /** Holds if this is considered an @ResponseBody method. */

Original file line number	Diff line number	Diff line change
`@@ -124,7 +124,7 @@ class SpringRequestMappingMethod extends SpringControllerMethod {`
`124`	`124`
`125`	`125`	`/** Gets the "produces" @RequestMapping annotation value, if present. */`
`126`	`126`	`string getProduces() {`
`127`		`- result = requestMappingAnnotation.getValue("produces").(StringLiteral).getValue()`
	`127`	`+ result = requestMappingAnnotation.getValue("produces").(CompileTimeConstantExpr).getStringValue()`
`128`	`128`	`}`
`129`	`129`
`130`	`130`	`/** Holds if this is considered an @ResponseBody method. */`