Java: Simple support for Ratpack HTTP Framework

Author: JLLeitschuh

java/ql/src/semmle/code/java/dataflow/FlowSources.qll

@@ -18,6 +18,7 @@ import semmle.code.java.frameworks.JaxWS
 import semmle.code.java.frameworks.javase.WebSocket
 import semmle.code.java.frameworks.android.Android
 import semmle.code.java.frameworks.android.Intent
+import semmle.code.java.frameworks.ratpack.RatpackHttp
 import semmle.code.java.frameworks.spring.SpringWeb
 import semmle.code.java.frameworks.spring.SpringController
 import semmle.code.java.frameworks.spring.SpringWebClient
@@ -267,6 +268,9 @@ private class RemoteTaintedMethod extends Method {
     this instanceof SocketGetInputStreamMethod or
     this instanceof ApacheHttpGetParams or
     this instanceof ApacheHttpEntityGetContent or
+    this instanceof RatpackHttpRequestGetMethod or
+    this instanceof RatpackHttpTypedDataGetMethod or
+    this instanceof RatpackUploadFileGetMethod or
     // In the setting of Android we assume that XML has been transmitted over
     // the network, so may be tainted.
     this instanceof XmlPullGetMethod or

java/ql/src/semmle/code/java/frameworks/ratpack/RatpackHttp.qll

@@ -0,0 +1,59 @@
+/**
+ * Provides classes and predicates related to `ratpack.http.*`.
+ */
+
+import java
+
+/**
+ * The interface `ratpack.http.Request`.
+ * https://ratpack.io/manual/current/api/ratpack/http/Request.html
+ */
+library class RatpackRequest extends RefType {
+  RatpackRequest() { hasQualifiedName("ratpack.http", "Request") }
+}
+
+/**
+ * Methods on `ratpack.http.Request` that return user tainted data.
+ */
+library class RatpackHttpRequestGetMethod extends Method {
+  RatpackHttpRequestGetMethod() {
+    getDeclaringType() instanceof RatpackRequest and
+    hasName([
+        "getContentLength", "getCookies", "getHeaders", "getPath", "getQuery", "getQueryParams",
+        "getRawUri", "getUri"
+      ])
+  }
+}
+
+/**
+ * The interface `ratpack.http.TypedData`.
+ * https://ratpack.io/manual/current/api/ratpack/http/TypedData.html
+ */
+library class RatpackTypedData extends RefType {
+  RatpackTypedData() { hasQualifiedName("ratpack.http", "TypedData") }
+}
+
+/**
+ * Methods on `ratpack.http.TypedData` that return user tainted data.
+ */
+library class RatpackHttpTypedDataGetMethod extends Method {
+  RatpackHttpTypedDataGetMethod() {
+    getDeclaringType() instanceof RatpackTypedData and
+    hasName(["getBuffer", "getBytes", "getContentType", "getInputStream", "getText"])
+  }
+}
+
+/**
+ * The interface `ratpack.form.UploadedFile`.
+ * https://ratpack.io/manual/current/api/ratpack/form/UploadedFile.html
+ */
+library class RatpackUploadFile extends RefType {
+  RatpackUploadFile() { hasQualifiedName("ratpack.form", "UploadedFile") }
+}
+
+library class RatpackUploadFileGetMethod extends Method {
+  RatpackUploadFileGetMethod() {
+    getDeclaringType() instanceof RatpackUploadFile and
+    hasName("getFileName")
+  }
+}