Java: File constructor path sanitizer

[jcogs33]

Description

Adds a path injection sanitizer for the child argument of a java.io.File constructor when that argument is normalized or checked for the absence of "..".

Consideration

Note that sanitizing the second argument of the File constructor also sanitizes other uses of that variable after the constructor call (see the MISSING cases in the tests). Let me know if there is some way to adjust the QL to avoid also sanitizing these other uses. I can sanitize the File constructor call instead of the second argument, but then the first argument needs to be checked for taint.

Pull Request checklist

All query authors

• A change note is added if necessary. See the documentation in this repository.
• QL tests are added if necessary. See Testing custom queries in the GitHub documentation.

Internal query authors only

• Changes are validated at scale (internal access required).

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

Comments suppressed due to low confidence (1)

java/ql/test/library-tests/pathsanitizer/Test.java:482

• Several consecutive blocks (lines 480–610) repeat similar path validation logic. Consider extracting this shared logic into a utility method or parameterized test to simplify and reduce duplication.

File f1 = new File("safe/file.txt");

Tip: Copilot code review supports C#, Go, Java, JavaScript, Markdown, Python, Ruby and TypeScript, with more languages coming soon. Learn more

[owen-mc]

I think it would be better to sanitize the constructor call instead, with checks on the first argument.

[github-actions]

⚠️ The head of this PR and the base branch were compared for differences in the framework coverage reports. The generated reports are available in the artifacts of this workflow run. The differences will be picked up by the nightly job after the PR gets merged.

Click to show differences in coverage

java

Generated file changes for java

• Changes to framework-coverage-java.rst:

-    Java Standard Library,``java.*``,10,4622,259,99,,9,,,26
+    Java Standard Library,``java.*``,10,4621,259,99,,9,,,26
-    Totals,,312,26329,2635,404,16,128,33,1,409
+    Totals,,312,26328,2635,404,16,128,33,1,409

• Changes to framework-coverage-java.csv:

- java.io,66,1,226,,,,,,,,,22,,,,,,,,,,,,,,,44,,,,,,,,,,,,,,,,,,,,,,1,,203,23
+ java.io,66,1,225,,,,,,,,,22,,,,,,,,,,,,,,,44,,,,,,,,,,,,,,,,,,,,,,1,,202,23

[jcogs33]

The new DCA run looks good.

[owen-mc]

Looks great. Only trivial comments. It's great that we found a way of expressing exactly what we want with good performance.

[owen-mc]

I love the thorough tests.