Java: Update CWE-918 model coverage for Apache HttpClient `execute` sinks by Copilot · Pull Request #21804 · github/codeql

Copilot · 2026-05-06T16:02:10Z

Replaces the earlier fluent-Request focused changes with targeted SSRF model updates and regression tests for org.apache.http.client.HttpClient#execute sinks.

What this addresses
- Updates java/ql/lib/ext/org.apache.http.client.model.yml to cover all requested request-forgery sink overloads for HttpClient.execute(...).
- Follows the existing SSRF test style in this suite (inline // $ Source and // $ Alert expectations).
Model updates
- HttpClient.execute(HttpHost, HttpRequest)
- HttpClient.execute(HttpHost, HttpRequest, HttpContext)
- HttpClient.execute(HttpHost, HttpRequest, ResponseHandler)
- HttpClient.execute(HttpHost, HttpRequest, ResponseHandler, HttpContext)
- HttpClient.execute(HttpUriRequest)
- HttpClient.execute(HttpUriRequest, HttpContext)
- HttpClient.execute(HttpUriRequest, ResponseHandler)
- HttpClient.execute(HttpUriRequest, ResponseHandler, HttpContext)
Test coverage added
- New test file: java/ql/test/query-tests/security/CWE-918/ApacheHttpClientExecuteSSRF.java
- Covers all modeled HttpClient.execute overloads listed above.
Stub + test configuration updates
- Added stubs:
  - java/ql/test/stubs/apache-http-client-4.4.13/org/apache/http/client/HttpClient.java
  - java/ql/test/stubs/apache-http-client-4.4.13/org/apache/http/client/ResponseHandler.java
- Updated java/ql/test/query-tests/security/CWE-918/options to include ${testdir}/../../../stubs/apache-http-client-4.4.13.
Replaced previous branch content
- Removed prior fluent test/stub changes:
  - java/ql/test/query-tests/security/CWE-918/ApacheHttpFluentSSRF.java
  - java/ql/test/stubs/apache-http-fluent-4.5.14/org/apache/http/client/fluent/Request.java

Example from new test

String sink = request.getParameter("host"); // $ Source
HttpHost host = new HttpHost(sink);

client.execute(host, req); // $ Alert
client.execute(host, req, context); // $ Alert
client.execute(host, req, handler); // $ Alert
client.execute(host, req, handler, context); // $ Alert

Original prompt

Please add tests for the models for this class. Look at the other SSRF tests in java/ql/test/query-tests/security/CWE-918/CWE-918.testproj/src/Users/owen-mc/workspace/code/ql/java/ql/test/query-tests/security/CWE-918/ApacheHttpSSRF.java to an example to follow. You will have to add stubs and add the path to them in the file java/ql/test/query-tests/security/CWE-918/options . Look at that file to see where the stubs should be located. You can look at existing stubs to see what they should be like.

Created from VS Code.

Agent-Logs-Url: https://github.com/github/codeql/sessions/bd4fa112-dbc3-47e8-9cef-9b1b13c7e549 Co-authored-by: owen-mc <[email protected]>

owen-mc · 2026-05-06T20:26:43Z

@copilot

(1) Please delete your current changes on this branch.

(2) Please update java/ql/lib/ext/org.apache.http.client.model.yml to:

extensions:
  - addsTo:
      pack: codeql/java-all
      extensible: sinkModel
    data:
      - ["org.apache.http.client", "HttpClient", True, "execute", "(HttpHost,HttpRequest)", "", "Argument[0]", "request-forgery", "ai-manual"]
      - ["org.apache.http.client", "HttpClient", True, "execute", "(HttpHost,HttpRequest,HttpContext)", "", "Argument[0]", "request-forgery", "ai-manual"]
      - ["org.apache.http.client", "HttpClient", True, "execute", "(HttpHost,HttpRequest,ResponseHandler)", "", "Argument[0]", "request-forgery", "ai-manual"]
      - ["org.apache.http.client", "HttpClient", True, "execute", "(HttpHost,HttpRequest,ResponseHandler,HttpContext)", "", "Argument[0]", "request-forgery", "ai-manual"]
      - ["org.apache.http.client", "HttpClient", True, "execute", "(HttpUriRequest)", "", "Argument[0]", "request-forgery", "ai-manual"]
      - ["org.apache.http.client", "HttpClient", True, "execute", "(HttpUriRequest,HttpContext)", "", "Argument[0]", "request-forgery", "ai-manual"]
      - ["org.apache.http.client", "HttpClient", True, "execute", "(HttpUriRequest,ResponseHandler)", "", "Argument[0]", "request-forgery", "ai-manual"]
      - ["org.apache.http.client", "HttpClient", True, "execute", "(HttpUriRequest,ResponseHandler,HttpContext)", "", "Argument[0]", "request-forgery", "ai-manual"]

(3) Please add tests for the models in that file. Look at the other SSRF tests in java/ql/test/query-tests/security/CWE-918/ApacheHttpSSRF.java for an example to follow. You will have to add stubs and add the path to them in the file java/ql/test/query-tests/security/CWE-918/options . Look at that file to see where the stubs should be located. You can look at existing stubs to see what they should be like.

Agent-Logs-Url: https://github.com/github/codeql/sessions/3db201db-a1b5-4353-a94a-14a8d156dd3b Co-authored-by: owen-mc <[email protected]>

Copilot · 2026-05-06T20:32:20Z

@copilot

(1) Please delete your current changes on this branch.
...

Done in 043ec85. I removed the previous fluent-only test/stub changes, updated java/ql/lib/ext/org.apache.http.client.model.yml with the exact 8 HttpClient.execute sink rows you requested, added CWE-918 tests in ApacheHttpClientExecuteSSRF.java, added stubs for HttpClient and ResponseHandler, and updated CWE-918/options to include the new stub path.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

releases.bazel.build
- Triggering command: /usr/local/lib/node_modules/@bazel/bazelisk/bazelisk-linux_amd64 /usr/local/lib/node_modules/@bazel/bazelisk/bazelisk-linux_amd64 query kind('.*test', //java/ql/test/query-tests/security/CWE-918/...) (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

owen-mc

Adds some missing sinks.

Copilot

Pull request overview

This PR expands CodeQL’s Java SSRF (CWE-918) coverage by modeling additional Apache HttpClient 4.x HttpClient#execute(...) overloads as request-forgery sinks, and adds a dedicated regression test plus stubs to exercise those overloads.

Changes:

Added sink models for the full set of org.apache.http.client.HttpClient#execute(...) overloads taking HttpHost / HttpUriRequest.
Added a new CWE-918 regression test and minimal stubs for HttpClient and ResponseHandler, wiring the stub directory into the test classpath.
Updated the RequestForgery.expected baseline and added a Java pack change note describing the analysis impact.

Show a summary per file

File	Description
java/ql/lib/ext/org.apache.http.client.model.yml	Adds `request-forgery` sink models for `HttpClient.execute(...)` overloads.
java/ql/test/query-tests/security/CWE-918/ApacheHttpClientExecuteSSRF.java	New regression test covering each newly modeled overload.
java/ql/test/stubs/apache-http-client-4.4.13/org/apache/http/client/HttpClient.java	Adds an `HttpClient` stub exposing the modeled `execute(...)` overloads.
java/ql/test/stubs/apache-http-client-4.4.13/org/apache/http/client/ResponseHandler.java	Adds a `ResponseHandler` stub required by `HttpClient.execute(...)` overloads.
java/ql/test/query-tests/security/CWE-918/options	Extends the test classpath to include the new Apache HttpClient stub directory.
java/ql/test/query-tests/security/CWE-918/RequestForgery.expected	Updates expected results/baseline to include new alerts and model listing changes.
java/ql/lib/change-notes/2026-05-07-apache-httpclient-ssrf-sinks.md	Documents the user-visible analysis improvement for Java SSRF queries.

Copilot's findings

Files reviewed: 6/7 changed files
Comments generated: 1

aschackmull · 2026-05-22T10:56:13Z

+            HttpHost host = new HttpHost(sink);
+            HttpRequest req = new BasicHttpRequest("GET", "/");
+            HttpUriRequest uriReq = (HttpUriRequest) (Object) sink;
+            HttpContext context = null;
+            HttpClient client = null;
+            ResponseHandler<Object> handler = null;


I agree that this is confusing. Also, the source is named sink, which is confusing as well.

aschackmull · 2026-05-22T10:58:37Z

      pack: codeql/java-all
      extensible: sinkModel
    data:
+      - ["org.apache.http.client", "HttpClient", True, "execute", "(HttpHost,HttpRequest)", "", "Argument[0]", "request-forgery", "ai-manual"]


Is this right? Based on the type names and the models below, which target the HttpUriRequest argument, I'd expect the sink to be the HttpRequest argument (possibly in addition to HttpHost).

BazookaMusic · 2026-05-22T11:03:48Z

      pack: codeql/java-all
      extensible: sinkModel
    data:
+      - ["org.apache.http.client", "HttpClient", True, "execute", "(HttpHost,HttpRequest)", "", "Argument[0]", "request-forgery", "ai-manual"]


The models look good, but I'm not sure if maybe Argument[1] is also a sink here.

https://codeql.github.com/codeql-query-help/javascript/js-host-header-forgery-in-email-generation/

The request here will have the headers of the outgoing request so if they are user controlled, they could for example cause a malicious redirect or something like that depending on the server that reads it.

I will approve it, but do check this out too

BazookaMusic

Actually I checked it and Anders is correct, HttpHost is the base url and then httprequest contains the relative url.

It's still request forgery if tainted data goes into the relative url

owen-mc · 2026-05-22T12:44:35Z

@BazookaMusic Our request forgery queries only alert for being able to change the host, so actually it sounds like that model is correct.

Initial plan

26dca55

Copilot AI assigned Copilot and owen-mc May 6, 2026

Copilot started work on behalf of owen-mc May 6, 2026 16:02 View session

Add SSRF tests and stubs for Apache Http fluent Request models

f5b17b0

Agent-Logs-Url: https://github.com/github/codeql/sessions/bd4fa112-dbc3-47e8-9cef-9b1b13c7e549 Co-authored-by: owen-mc <[email protected]>

Copilot AI changed the title ~~[WIP] Add tests for the models following SSRF examples~~ Add CWE-918 model regression coverage for Apache Http Fluent Request sinks May 6, 2026

Copilot AI requested a review from owen-mc May 6, 2026 16:09

Copilot finished work on behalf of owen-mc May 6, 2026 16:09

owen-mc closed this May 6, 2026

owen-mc reopened this May 6, 2026

github-actions Bot added the Java label May 6, 2026

Copilot started work on behalf of owen-mc May 6, 2026 20:26 View session

Replace fluent SSRF changes with Apache HttpClient execute model tests

043ec85

Agent-Logs-Url: https://github.com/github/codeql/sessions/3db201db-a1b5-4353-a94a-14a8d156dd3b Co-authored-by: owen-mc <[email protected]>

Copilot AI changed the title ~~Add CWE-918 model regression coverage for Apache Http Fluent Request sinks~~ Update CWE-918 model coverage for Apache HttpClient execute sinks May 6, 2026

Copilot finished work on behalf of owen-mc May 6, 2026 20:33

owen-mc added 2 commits May 7, 2026 10:17

Update test output

dd35bc0

Add change note

dc86476

owen-mc marked this pull request as ready for review May 7, 2026 09:24

owen-mc requested a review from a team as a code owner May 7, 2026 09:24

Copilot AI review requested due to automatic review settings May 7, 2026 09:24

github-actions Bot added the documentation label May 7, 2026

owen-mc approved these changes May 7, 2026

View reviewed changes

Copilot started reviewing on behalf of owen-mc May 7, 2026 09:25 View session

Copilot AI reviewed May 7, 2026

View reviewed changes

owen-mc requested a review from aschackmull May 8, 2026 13:28

owen-mc requested a review from BazookaMusic May 20, 2026 10:38

owen-mc changed the title ~~Update CWE-918 model coverage for Apache HttpClient execute sinks~~ Java: Update CWE-918 model coverage for Apache HttpClient execute sinks May 21, 2026

aschackmull reviewed May 22, 2026

View reviewed changes

BazookaMusic approved these changes May 22, 2026

View reviewed changes

BazookaMusic requested changes May 22, 2026

View reviewed changes

Copilot started work on behalf of owen-mc May 22, 2026 12:43 View session

Make ApacheHttpClientExecuteSSRF setup runtime-valid

d7659a0

BazookaMusic approved these changes May 22, 2026

View reviewed changes

Copilot finished work on behalf of owen-mc May 22, 2026 12:49

Copilot AI requested a review from owen-mc May 22, 2026 12:49

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Java: Update CWE-918 model coverage for Apache HttpClient `execute` sinks#21804

Java: Update CWE-918 model coverage for Apache HttpClient `execute` sinks#21804
Copilot wants to merge 6 commits into
mainfrom
copilot/add-tests-for-models

Copilot AI commented May 6, 2026 •

edited

Loading

Uh oh!

owen-mc commented May 6, 2026

Uh oh!

Copilot AI commented May 6, 2026 •

edited

Loading

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

owen-mc left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

aschackmull May 22, 2026

Uh oh!

aschackmull May 22, 2026

Uh oh!

BazookaMusic May 22, 2026

Uh oh!

BazookaMusic left a comment

Uh oh!

owen-mc commented May 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

Copilot AI commented May 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

owen-mc commented May 6, 2026

Uh oh!

Copilot AI commented May 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

owen-mc left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

aschackmull May 22, 2026

Choose a reason for hiding this comment

Uh oh!

aschackmull May 22, 2026

Choose a reason for hiding this comment

Uh oh!

BazookaMusic May 22, 2026

Choose a reason for hiding this comment

Uh oh!

BazookaMusic left a comment

Choose a reason for hiding this comment

Uh oh!

owen-mc commented May 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Copilot AI commented May 6, 2026 •

edited

Loading

Copilot AI commented May 6, 2026 •

edited

Loading