Java: Add Spring flow out of HttpEntity and HttpHeader

Author: lcartey

java/ql/src/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll

@@ -393,6 +393,19 @@ private predicate taintPreservingQualifierToMethod(Method m) {
   exists(SpringUntrustedDataType dt |
     m.(GetterMethod) = dt.getAMethod()
   )
+  or
+  exists(SpringHttpEntity sre |
+    m = sre.getAMethod() and
+    m.getName().regexpMatch("getBody|getHeaders")
+  )
+  or
+  exists(SpringHttpHeaders headers |
+    m = headers.getAMethod() |
+    m.getReturnType() instanceof TypeString
+    or
+    m.getReturnType().(RefType).getSourceDeclaration().getASourceSupertype*().hasQualifiedName("java.util", "List") and
+    m.getReturnType().(ParameterizedType).getTypeArgument(0) instanceof TypeString
+  )
 }
 
 private class StringReplaceMethod extends Method {

java/ql/src/semmle/code/java/frameworks/spring/SpringHttp.qll

@@ -32,4 +32,8 @@ class SpringResponseEntityBodyBuilder extends Interface {
     getSourceDeclaration().getEnclosingType() = any(SpringResponseEntity sre) and
     hasName("BodyBuilder")
   }
+}
+
+class SpringHttpHeaders extends Class {
+  SpringHttpHeaders() { hasQualifiedName("org.springframework.http", "HttpHeaders") }
 }