update tests

Author: Jami Cogswell

java/ql/test/query-tests/security/CWE-730/RegexInjectionTest.java

@@ -27,13 +27,20 @@ public boolean string3(javax.servlet.http.HttpServletRequest request) {
     String pattern = request.getParameter("pattern");
     String input = request.getParameter("input");
 
-    return input.replaceFirst(pattern, "").length() > 0;  // $ hasRegexInjection
+    return input.split(pattern, 0).length > 0;  // $ hasRegexInjection
   }
 
   public boolean string4(javax.servlet.http.HttpServletRequest request) {
     String pattern = request.getParameter("pattern");
     String input = request.getParameter("input");
 
+    return input.replaceFirst(pattern, "").length() > 0;  // $ hasRegexInjection
+  }
+
+  public boolean string5(javax.servlet.http.HttpServletRequest request) {
+    String pattern = request.getParameter("pattern");
+    String input = request.getParameter("input");
+
     return input.replaceAll(pattern, "").length() > 0;  // $ hasRegexInjection
   }
 
@@ -58,13 +65,20 @@ public boolean pattern3(javax.servlet.http.HttpServletRequest request) {
     String pattern = request.getParameter("pattern");
     String input = request.getParameter("input");
 
-    return Pattern.matches(pattern, input);  // $ hasRegexInjection
+    return Pattern.compile(pattern, 0).matcher(input).matches();  // $ hasRegexInjection
   }
 
   public boolean pattern4(javax.servlet.http.HttpServletRequest request) {
     String pattern = request.getParameter("pattern");
     String input = request.getParameter("input");
 
+    return Pattern.matches(pattern, input);  // $ hasRegexInjection
+  }
+
+  public boolean pattern5(javax.servlet.http.HttpServletRequest request) {
+    String pattern = request.getParameter("pattern");
+    String input = request.getParameter("input");
+
     return input.matches("^" + foo(pattern) + "=.*$"); // $ hasRegexInjection
   }
 

java/ql/test/query-tests/security/CWE-730/RegexInjectionTest.ql

@@ -1,6 +1,6 @@
 import java
 import TestUtilities.InlineExpectationsTest
-import semmle.code.java.security.RegexInjectionQuery
+import semmle.code.java.security.regexp.RegexInjectionQuery
 
 //import semmle.code.java.security.regexp.PolynomialReDoSQuery
 class RegexInjectionTest extends InlineExpectationsTest {