The GitHub Actions job "CI" on grails-core.git/perf/request-path-8.0.x has 
succeeded.
Run started by GitHub user codeconsole (triggered by codeconsole).

Head commit for run:
39e09dab2edb9389c7faba4832e4abff391f74e5 / Scott Murphy Heiberg 
<[email protected]>
refactor: resolve a mapping token through doCall rather than a call override

CodeQL raised eleven java/xss alerts on this branch. Every sink is in
grails-encoder, a module the branch does not touch, and every recorded flow
runs through one edge: RuntimeConstraintEvaluator.call(Object...) is a Java
override of Closure.call, so the analysis admits it as a callee of unrelated
Closure.call sites - GSP tag closures at GroovyPage:514, marshaller closures at
ClosureObjectMarshaller:56 - and carries request parameters from here into the
encoders.

That dispatch cannot happen. Instances exist only in RegexUrlMapping's
controller, action, namespace, view and redirect fields, and the code holding
those fields resolves the token by name instead of calling it:
AbstractUrlMappingInfo.evaluateNameForValue tests for the type ahead of its
Closure branch, and DefaultUrlMappingInfo excludes it from
isNameResolutionRequestDependent. The alerts are new because this branch
promoted an anonymous closure in RegexUrlMapping to a named class with the same
body; the analysis ignores the anonymous one at those call sites and admits the
named one.

doCall is the name Closure.call already resolves through the metaclass, so the
fallback behaves as before while the override leaves the Closure type surface.
Running the CI toolchain over the branch reports eleven alerts for the override
and none for this shape, with the tolerant parameter read unchanged either way.

The evaluator had no test of its own. The spec covers both halves of the class
javadoc: a name captured from the URI is resolved from the match rather than
from whatever request is bound, and calling the evaluator directly reads the
request that is bound at that moment. Renaming doCall fails the second half and
leaves the first passing, which is the split the class documents.

Report URL: https://github.com/apache/grails-core/actions/runs/33357786193

With regards,
GitHub Actions via GitBox

Reply via email to