Reduce false positive for Path traversal

[h3xstream]

Path traversal is one of the detector that can cause a large number of false positive.

Here is a list of API that are safe value to construct a path or filename from.

• System.getProperty()
• Calendar.getInstance().get(Calendar.YEAR); / Calendar.getInstance().get(Calendar.MONTH); / ...
• UUID.randomUUID().toString()
• File.createTempFile()
• Files.createTempDirectory()
• System.currentTimeMillis()
• System.nanoTime()

TODO :

• Add the signature to configurations
• Create test cases to make sure the configurations are effective.

[h3xstream]

Transfer the state of the parameter to the return value..

• org/springframework/core/io/support/ResourcePatternResolver.getResources(Ljava/lang/String;)[Lorg/springframework/core/io/Resource;:0
• java/lang/Class.getResource(Ljava/lang/String;)Ljava/net/URL;:0

Safe:
(Fetching the directory first might be susceptible to path traversal but the files list are ok if the initial folder is ok.)

• java/io/File.list()[Ljava/lang/String;:
• java/io/File.list(Ljava/io/FilenameFilter;)[Ljava/lang/String;:
• java/io/File.listFiles()[Ljava/io/File;:
• java/io/File.listFiles(Ljava/io/FilenameFilter;)[Ljava/io/File;:
• java/io/File.listFiles(Ljava/io/FileFilter;)[Ljava/io/File;:
• java/io/File.getName()Ljava/lang/String;:
• java/io/File.getParent()Ljava/lang/String;:
• java/io/File.getParentFile()Ljava/io/File;:
• java/io/File.getPath()Ljava/lang/String;:

Annotation properties could be considered safe.
This will remove a couple of FP that occurs while scanning framework that evaluate expression in annotations.

[h3xstream]

Closing this issue as all of the signature where implemented except the Spring Environment.getProperty()..