Java: add test for qhelp good example

github · jcogs33 · Mar 11, 2025 · Feb 16, 2025 · Feb 16, 2025 · Feb 16, 2025
commit f65a5b9a6625c43c9cc4ce8fd9e1982455627325
diff --git a/java/ql/test/query-tests/security/CWE-016/SpringBootActuatorsTest.java b/java/ql/test/query-tests/security/CWE-016/SpringBootActuatorsTest.java
@@ -271,4 +271,11 @@ public void securityFilterChain(HttpSecurity http) throws Exception {
 		http.securityMatcher(EndpointRequest.toAnyEndpoint());
 		http.authorizeHttpRequests((requests) -> requests.anyRequest().permitAll()); // $ hasExposedSpringBootActuator
 	}
+
+  // QHelp Good example
+  protected void configureQhelpGood(HttpSecurity http) throws Exception {
+    // GOOD: only users with ENDPOINT_ADMIN role are allowed to access the actuator endpoints
+    http.requestMatcher(EndpointRequest.toAnyEndpoint()).authorizeRequests((requests) ->
+        requests.anyRequest().hasRole("ENDPOINT_ADMIN"));
+  }
 }