Java: some refactoring

Author: Jami Cogswell

java/ql/lib/semmle/code/java/frameworks/spring/SpringSecurity.qll

@@ -40,7 +40,7 @@ class TypeAbstractRequestMatcherRegistry extends Class {
 }
 
 /**
- * A call to `HttpSecurity.authorizeRequests` method.
+ * A call to the `HttpSecurity.authorizeRequests` method.
  *
  * Note: this API is deprecated and scheduled for removal
  * in Spring Security 7.0.
@@ -53,7 +53,7 @@ class AuthorizeRequestsCall extends MethodCall {
 }
 
 /**
- * A call to `HttpSecurity.authorizeHttpRequests` method.
+ * A call to the `HttpSecurity.authorizeHttpRequests` method.
  *
  * Note: the no-argument version of this API is deprecated
  * and scheduled for removal in Spring Security 7.0.
@@ -65,15 +65,47 @@ class AuthorizeHttpRequestsCall extends MethodCall {
   }
 }
 
-/** A call to `AuthorizedUrl.permitAll` method. */
+/** A call to the `HttpSecurity.requestMatcher` method. */
+class RequestMatcherCall extends MethodCall {
+  RequestMatcherCall() {
+    this.getMethod().hasName("requestMatcher") and
+    this.getMethod().getDeclaringType() instanceof TypeHttpSecurity
+  }
+}
+
+/** A call to the `HttpSecurity.requestMatchers` method. */
+class RequestMatchersCall extends MethodCall {
+  RequestMatchersCall() {
+    this.getMethod().hasName("requestMatchers") and
+    this.getMethod().getDeclaringType() instanceof TypeHttpSecurity
+  }
+}
+
+/** A call to the `HttpSecurity.securityMatcher` method. */
+class SecurityMatcherCall extends MethodCall {
+  SecurityMatcherCall() {
+    this.getMethod().hasName("securityMatcher") and
+    this.getMethod().getDeclaringType() instanceof TypeHttpSecurity
+  }
+}
+
+/** A call to the `HttpSecurity.securityMatchers` method. */
+class SecurityMatchersCall extends MethodCall {
+  SecurityMatchersCall() {
+    this.getMethod().hasName("securityMatchers") and
+    this.getMethod().getDeclaringType() instanceof TypeHttpSecurity
+  }
+}
+
+/** A call to the `AuthorizedUrl.permitAll` method. */
 class PermitAllCall extends MethodCall {
   PermitAllCall() {
     this.getMethod().hasName("permitAll") and
     this.getMethod().getDeclaringType() instanceof TypeAuthorizedUrl
   }
 }
 
-/** A call to `AbstractRequestMatcherRegistry.anyRequest` method. */
+/** A call to the `AbstractRequestMatcherRegistry.anyRequest` method. */
 class AnyRequestCall extends MethodCall {
   AnyRequestCall() {
     this.getMethod().hasName("anyRequest") and

java/ql/lib/semmle/code/java/security/SpringBootActuatorsQuery.qll

@@ -5,32 +5,36 @@ private import semmle.code.java.frameworks.spring.SpringSecurity
 private import semmle.code.java.frameworks.spring.SpringBoot
 
 /**
- * A call to `HttpSecurity.requestMatcher` method with argument
+ * A call to an `HttpSecurity` matcher method with argument
  * `EndpointRequest.toAnyEndpoint()`.
  */
-private class RequestMatcherCall extends MethodCall {
-  RequestMatcherCall() {
-    this.getMethod().hasName("requestMatcher") and
-    this.getMethod().getDeclaringType() instanceof TypeHttpSecurity and
+private class MatcherCall extends MethodCall {
+  MatcherCall() {
+    (
+      this instanceof RequestMatcherCall or
+      this instanceof SecurityMatcherCall
+    ) and
     this.getArgument(0) instanceof ToAnyEndpointCall
   }
 }
 
 /**
- * A call to `HttpSecurity.requestMatchers` method with lambda argument
- * `EndpointRequest.toAnyEndpoint()`.
+ * A call to an `HttpSecurity` matchers method with lambda
+ * argument `EndpointRequest.toAnyEndpoint()`.
  */
-private class RequestMatchersCall extends MethodCall {
-  RequestMatchersCall() {
-    this.getMethod().hasName("requestMatchers") and
-    this.getMethod().getDeclaringType() instanceof TypeHttpSecurity and
+private class MatchersCall extends MethodCall {
+  MatchersCall() {
+    (
+      this instanceof RequestMatchersCall or
+      this instanceof SecurityMatchersCall
+    ) and
     this.getArgument(0).(LambdaExpr).getExprBody() instanceof ToAnyEndpointCall
   }
 }
 
 /**
- * A call to `AbstractRequestMatcherRegistry.requestMatchers` method with an argument
- * `RequestMatcher.toAnyEndpoint()`.
+ * A call to an `AbstractRequestMatcherRegistry.requestMatchers` method with
+ * argument `EndpointRequest.toAnyEndpoint()`.
  */
 private class RegistryRequestMatchersCall extends MethodCall {
   RegistryRequestMatchersCall() {
@@ -40,63 +44,14 @@ private class RegistryRequestMatchersCall extends MethodCall {
   }
 }
 
-/**
- * A call to `HttpSecurity.securityMatcher` method with argument
- * `EndpointRequest.toAnyEndpoint()`.
- */
-private class SecurityMatcherCall extends MethodCall {
-  SecurityMatcherCall() {
-    this.getMethod().hasName("securityMatcher") and
-    this.getMethod().getDeclaringType() instanceof TypeHttpSecurity and
-    this.getArgument(0) instanceof ToAnyEndpointCall
-  }
-}
-
-/**
- * A call to `HttpSecurity.securityMatchers` method with lambda argument
- * `EndpointRequest.toAnyEndpoint()`.
- */
-private class SecurityMatchersCall extends MethodCall {
-  SecurityMatchersCall() {
-    this.getMethod().hasName("securityMatchers") and
-    this.getMethod().getDeclaringType() instanceof TypeHttpSecurity and
-    this.getArgument(0).(LambdaExpr).getExprBody() instanceof ToAnyEndpointCall
-  }
-}
-
-/**
- * A call to a method that authorizes requests, e.g. `authorizeRequests` or
- * `authorizeHttpRequests`.
- */
+/** A call to an `HttpSecurity` method that authorizes requests. */
 private class AuthorizeCall extends MethodCall {
   AuthorizeCall() {
     this instanceof AuthorizeRequestsCall or
     this instanceof AuthorizeHttpRequestsCall
   }
 }
 
-/**
- * A call to a matcher method with argument
- * `EndpointRequest.toAnyEndpoint()`.
- */
-private class MatcherCall extends MethodCall {
-  MatcherCall() {
-    this instanceof RequestMatcherCall or
-    this instanceof SecurityMatcherCall
-  }
-}
-
-/**
- * A call to a matchers method with argument
- * `EndpointRequest.toAnyEndpoint()`.
- */
-private class MatchersCall extends MethodCall {
-  MatchersCall() {
-    this instanceof RequestMatchersCall or
-    this instanceof SecurityMatchersCall
-  }
-}
-
 /** Holds if `permitAllCall` is called on request(s) mapped to actuator endpoint(s). */
 predicate permitsSpringBootActuators(PermitAllCall permitAllCall) {
   exists(AuthorizeCall authorizeCall |