Merge pull request #16712 from mbaluda/main

Java: Add `FileUtils` sinks to path injection

Author: atorralba

java/ql/lib/ext/org.apache.commons.io.model.yml

@@ -29,4 +29,10 @@ extensions:
       - ["org.apache.commons.io", "FileUtils", True, "copyToFile", "(InputStream,File)", "", "Argument[0]", "file-content-store", "ai-manual"]
       - ["org.apache.commons.io", "FileUtils", True, "copyToFile", "(InputStream,File)", "", "Argument[1]", "path-injection", "manual"]
       - ["org.apache.commons.io", "FileUtils", True, "openInputStream", "(File)", "", "Argument[0]", "path-injection", "ai-manual"]
+      - ["org.apache.commons.io", "FileUtils", True, "delete", "(File)", "", "Argument[0]", "path-injection", "manual"]
+      - ["org.apache.commons.io", "FileUtils", True, "deleteDirectory", "(File)", "", "Argument[0]", "path-injection", "manual"]
+      - ["org.apache.commons.io", "FileUtils", True, "deleteQuietly", "(File)", "", "Argument[0]", "path-injection", "manual"]
+      - ["org.apache.commons.io", "FileUtils", True, "forceDelete", "(File)", "", "Argument[0]", "path-injection", "manual"]
+      - ["org.apache.commons.io", "FileUtils", True, "forceDeleteOnExit", "(File)", "", "Argument[0]", "path-injection", "manual"]
+      - ["org.apache.commons.io", "FileUtils", True, "forceMkdirParent", "(File)", "", "Argument[0]", "path-injection", "manual"]
       - ["org.apache.commons.io", "IOUtils", False, "resourceToString", "(String,Charset)", "", "Argument[0]", "path-injection", "ai-manual"]

java/ql/src/change-notes/2024-06-10-path-injection-fileutils-sinks.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Added more `org.apache.commons.io.FileUtils`-related sinks to the path injection query.