Merge pull request #8874 from smowton/smowton/fix/insecure-cookies-look-through-named-constants

Java insecure cookies query: look through named constants

Author: aschackmull

java/ql/src/Security/CWE/CWE-614/InsecureCookie.ql

@@ -20,7 +20,7 @@ where
   not exists(Variable cookie, MethodAccess m |
     add.getArgument(0) = cookie.getAnAccess() and
     m.getMethod().getName() = "setSecure" and
-    m.getArgument(0).(BooleanLiteral).getBooleanValue() = true and
+    m.getArgument(0).(CompileTimeConstantExpr).getBooleanValue() = true and
     m.getQualifier() = cookie.getAnAccess()
   )
 select add, "Cookie is added to response without the 'secure' flag being set."

java/ql/src/change-notes/2022-04-26-insecure-cookie-named-constants.md

@@ -0,0 +1,6 @@
+---
+category: minorAnalysis
+---
+* Query `java/insecure-cookie` no longer produces a false positive if 
+`cookie.setSecure(...)` is called passing a constant that always equals 
+`true`.