Java: Convert Cookie.get* methods to CSV based flow source

Author: tamasvajk

java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll

@@ -132,7 +132,11 @@ private predicate sourceModelCsv(string row) {
       // TODO consider org.springframework.web.context.request.WebRequest.getRemoteUser
       // ServletRequestGetBodyMethod
       "javax.servlet;ServletRequest;false;getInputStream;();;ReturnValue;remote",
-      "javax.servlet;ServletRequest;false;getReader;();;ReturnValue;remote"
+      "javax.servlet;ServletRequest;false;getReader;();;ReturnValue;remote",
+      // CookieGet*
+      "javax.servlet.http;Cookie;false;getValue;();;ReturnValue;remote",
+      "javax.servlet.http;Cookie;false;getName;();;ReturnValue;remote",
+      "javax.servlet.http;Cookie;false;getComment;();;ReturnValue;remote"
     ]
 }
 

java/ql/src/semmle/code/java/dataflow/FlowSources.qll

@@ -216,9 +216,6 @@ private class RemoteTaintedMethod extends Method {
   RemoteTaintedMethod() {
     this instanceof PlayRequestGetMethod or
     this instanceof SpringRestTemplateResponseEntityMethod or
-    this instanceof CookieGetValueMethod or
-    this instanceof CookieGetNameMethod or
-    this instanceof CookieGetCommentMethod or
     this instanceof ApacheHttpGetParams or
     this instanceof ApacheHttpEntityGetContent or
     // In the setting of Android we assume that XML has been transmitted over