Java: CWE-079 Query to detect XSS with JavaServer Faces (JSF)

[luchua-bc]

JavaServer Faces (JSF) is a Java-based MVC web application framework intended to simplify development integration of web-based user interfaces. JavaServer Faces is a standardized display technology for component-based UI development, which was formalized through the Java Community Process and is a part of the Java EE platform.

JSF UI components are rendered as markup languages such as HTML and XML through a JSF renderer. User inputs that don't have proper sanitization and are directly written to a JSF renderer make the website vulnerable to cross-site scripting.

The query detects unsafe usage of JSF renderer that are vulnerable to XSS attacks. Please consider to merge the PR. Thanks.

[github-actions]

⚠️ The head of this PR and the base branch were compared for differences in the framework coverage reports. The generated reports are available in the artifacts of this workflow run. The differences will be picked up by the nightly job after the PR gets merged. The following differences were found:

java

Generated file changes for java

• Changes to framework-coverage-java.rst:

-    Java extensions,"``javax.*``, ``jakarta.*``",22,540,18,,,,,1,1,2
+    Java extensions,"``javax.*``, ``jakarta.*``",42,540,22,,,4,,1,1,2
-    Totals,,84,2465,296,13,6,6,107,33,1,66
+    Totals,,104,2465,300,13,6,10,107,33,1,66

• Changes to framework-coverage-java.csv:

+ jakarta.faces.context,2,10,,,,,,,,,,,,,,2,10,,
+ javax.faces.context,2,10,,,,,,,,,,,,,,2,10,,

[smowton]

@luchua-bc I've polished this up to what I'd consider main query-pack standard -- you might want to take a look at the new commits to see what's changed which would be welcome in future for any query targeting the main (non-experimental) suite.

[luchua-bc]

Thanks @smowton a lot for refactoring the query into the main (non-experimental) suite. Those separate commits are crystal clear. I will make sure future queries follow the best practices:

• Only include stub methods and constants being used by the query
• Merge with configuration and test cases of the same kind, e.g. servlet and JSF
• Put qll libraries in java/ql/lib instead of java/ql/src
• Add reverse import from the external flow library
• Create a change note

[aschackmull]

LGTM.

[github-actions]

⚠️ The head of this PR and the base branch were compared for differences in the framework coverage reports. The generated reports are available in the artifacts of this workflow run. The differences will be picked up by the nightly job after the PR gets merged. The following differences were found:

java

Generated file changes for java

• Changes to framework-coverage-java.rst:

-    Java extensions,"``javax.*``, ``jakarta.*``",40,552,27,,,,,1,1,2
+    Java extensions,"``javax.*``, ``jakarta.*``",54,552,31,,,4,,1,1,2
-    Totals,,102,3554,398,13,6,6,107,33,1,66
+    Totals,,116,3554,402,13,6,10,107,33,1,66

• Changes to framework-coverage-java.csv:

+ jakarta.faces.context,2,7,,,,,,,,,,,,,,,,,,2,7,,
+ javax.faces.context,2,7,,,,,,,,,,,,,,,,,,2,7,,

[smowton]

Proxying @aschackmull's approval