Merge pull request #3372 from aibaars/spring-multipart

Java: add `org.springframework.web.multipart.MultipartFile::getX` as RemoteFlowSource

java/ql/src/semmle/code/java/dataflow/FlowSources.qll

@@ -103,6 +103,19 @@ private class MessageBodyReaderParameterSource extends RemoteFlowSource {
   override string getSourceType() { result = "MessageBodyReader parameter" }
 }
 
+private class SpringMultipartFileSource extends RemoteFlowSource {
+  SpringMultipartFileSource() {
+    exists(MethodAccess ma, Method m |
+      ma = this.asExpr() and
+      m = ma.getMethod() and
+      m.getDeclaringType().hasQualifiedName("org.springframework.web.multipart", "MultipartFile") and
+      m.getName().matches("get%")
+    )
+  }
+
+  override string getSourceType() { result = "Spring MultipartFile getter" }
+}
+
 private class SpringServletInputParameterSource extends RemoteFlowSource {
   SpringServletInputParameterSource() {
     this.asParameter().getAnAnnotation() instanceof SpringServletInputAnnotation

java/ql/test/library-tests/dataflow/taintsources/SpringMultiPart.java

@@ -0,0 +1,15 @@
+import org.springframework.web.multipart.MultipartFile;
+
+public class SpringMultiPart {
+	MultipartFile file;
+
+	public void test() throws Exception {
+		file.getBytes();
+		file.isEmpty();
+		file.getInputStream();
+		file.getResource();
+		file.getName();
+		file.getContentType();
+		file.getOriginalFilename();
+	}
+}

java/ql/test/library-tests/dataflow/taintsources/options

@@ -1 +1 @@
-//semmle-extractor-options: --javac-args -cp ${testdir}/../../../stubs/servlet-api-2.4
+//semmle-extractor-options: --javac-args -cp ${testdir}/../../../stubs/servlet-api-2.4:${testdir}/../../../stubs/springframework-5.2.3

java/ql/test/library-tests/dataflow/taintsources/remote.expected

@@ -9,3 +9,9 @@
 | RmiFlowImpl.java:4:30:4:40 | path | RmiFlowImpl.java:5:20:5:31 | ... + ... |
 | RmiFlowImpl.java:4:30:4:40 | path | RmiFlowImpl.java:5:28:5:31 | path |
 | RmiFlowImpl.java:4:30:4:40 | path | RmiFlowImpl.java:6:29:6:35 | command |
+| SpringMultiPart.java:7:3:7:17 | getBytes(...) | SpringMultiPart.java:7:3:7:17 | getBytes(...) |
+| SpringMultiPart.java:9:3:9:23 | getInputStream(...) | SpringMultiPart.java:9:3:9:23 | getInputStream(...) |
+| SpringMultiPart.java:10:3:10:20 | getResource(...) | SpringMultiPart.java:10:3:10:20 | getResource(...) |
+| SpringMultiPart.java:11:3:11:16 | getName(...) | SpringMultiPart.java:11:3:11:16 | getName(...) |
+| SpringMultiPart.java:12:3:12:23 | getContentType(...) | SpringMultiPart.java:12:3:12:23 | getContentType(...) |
+| SpringMultiPart.java:13:3:13:28 | getOriginalFilename(...) | SpringMultiPart.java:13:3:13:28 | getOriginalFilename(...) |

java/ql/test/stubs/springframework-5.2.3/LICENSE.txt

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        https://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "{}"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright {yyyy} {name of copyright owner}
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       https://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

java/ql/test/stubs/springframework-5.2.3/org/springframework/core/io/InputStreamSource.java

@@ -0,0 +1,56 @@
+/*
+ * Copyright 2002-2017 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.core.io;
+
+import java.io.IOException;
+import java.io.InputStream;
+
+/**
+ * Simple interface for objects that are sources for an {@link InputStream}.
+ *
+ * <p>This is the base interface for Spring's more extensive {@link Resource} interface.
+ *
+ * <p>For single-use streams, {@link InputStreamResource} can be used for any
+ * given {@code InputStream}. Spring's {@link ByteArrayResource} or any
+ * file-based {@code Resource} implementation can be used as a concrete
+ * instance, allowing one to read the underlying content stream multiple times.
+ * This makes this interface useful as an abstract content source for mail
+ * attachments, for example.
+ *
+ * @author Juergen Hoeller
+ * @since 20.01.2004
+ * @see java.io.InputStream
+ * @see Resource
+ * @see InputStreamResource
+ * @see ByteArrayResource
+ */
+public interface InputStreamSource {
+
+	/**
+	 * Return an {@link InputStream} for the content of an underlying resource.
+	 * <p>It is expected that each call creates a <i>fresh</i> stream.
+	 * <p>This requirement is particularly important when you consider an API such
+	 * as JavaMail, which needs to be able to read the stream multiple times when
+	 * creating mail attachments. For such a use case, it is <i>required</i>
+	 * that each {@code getInputStream()} call returns a fresh stream.
+	 * @return the input stream for the underlying resource (must not be {@code null})
+	 * @throws java.io.FileNotFoundException if the underlying resource doesn't exist
+	 * @throws IOException if the content stream could not be opened
+	 */
+	InputStream getInputStream() throws IOException;
+
+}

java/ql/test/stubs/springframework-5.2.3/org/springframework/core/io/Resource.java

@@ -0,0 +1,178 @@
+/*
+ * Copyright 2002-2018 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.core.io;
+
+import java.io.File;
+import java.io.IOException;
+import java.io.InputStream;
+import java.net.URI;
+import java.net.URL;
+import java.nio.channels.Channels;
+import java.nio.channels.ReadableByteChannel;
+
+import org.springframework.lang.Nullable;
+
+/**
+ * Interface for a resource descriptor that abstracts from the actual
+ * type of underlying resource, such as a file or class path resource.
+ *
+ * <p>An InputStream can be opened for every resource if it exists in
+ * physical form, but a URL or File handle can just be returned for
+ * certain resources. The actual behavior is implementation-specific.
+ *
+ * @author Juergen Hoeller
+ * @since 28.12.2003
+ * @see #getInputStream()
+ * @see #getURL()
+ * @see #getURI()
+ * @see #getFile()
+ * @see WritableResource
+ * @see ContextResource
+ * @see UrlResource
+ * @see FileUrlResource
+ * @see FileSystemResource
+ * @see ClassPathResource
+ * @see ByteArrayResource
+ * @see InputStreamResource
+ */
+public interface Resource extends InputStreamSource {
+
+	/**
+	 * Determine whether this resource actually exists in physical form.
+	 * <p>This method performs a definitive existence check, whereas the
+	 * existence of a {@code Resource} handle only guarantees a valid
+	 * descriptor handle.
+	 */
+	boolean exists();
+
+	/**
+	 * Indicate whether non-empty contents of this resource can be read via
+	 * {@link #getInputStream()}.
+	 * <p>Will be {@code true} for typical resource descriptors that exist
+	 * since it strictly implies {@link #exists()} semantics as of 5.1.
+	 * Note that actual content reading may still fail when attempted.
+	 * However, a value of {@code false} is a definitive indication
+	 * that the resource content cannot be read.
+	 * @see #getInputStream()
+	 * @see #exists()
+	 */
+	default boolean isReadable() {
+		return exists();
+	}
+
+	/**
+	 * Indicate whether this resource represents a handle with an open stream.
+	 * If {@code true}, the InputStream cannot be read multiple times,
+	 * and must be read and closed to avoid resource leaks.
+	 * <p>Will be {@code false} for typical resource descriptors.
+	 */
+	default boolean isOpen() {
+		return false;
+	}
+
+	/**
+	 * Determine whether this resource represents a file in a file system.
+	 * A value of {@code true} strongly suggests (but does not guarantee)
+	 * that a {@link #getFile()} call will succeed.
+	 * <p>This is conservatively {@code false} by default.
+	 * @since 5.0
+	 * @see #getFile()
+	 */
+	default boolean isFile() {
+		return false;
+	}
+
+	/**
+	 * Return a URL handle for this resource.
+	 * @throws IOException if the resource cannot be resolved as URL,
+	 * i.e. if the resource is not available as descriptor
+	 */
+	URL getURL() throws IOException;
+
+	/**
+	 * Return a URI handle for this resource.
+	 * @throws IOException if the resource cannot be resolved as URI,
+	 * i.e. if the resource is not available as descriptor
+	 * @since 2.5
+	 */
+	URI getURI() throws IOException;
+
+	/**
+	 * Return a File handle for this resource.
+	 * @throws java.io.FileNotFoundException if the resource cannot be resolved as
+	 * absolute file path, i.e. if the resource is not available in a file system
+	 * @throws IOException in case of general resolution/reading failures
+	 * @see #getInputStream()
+	 */
+	File getFile() throws IOException;
+
+	/**
+	 * Return a {@link ReadableByteChannel}.
+	 * <p>It is expected that each call creates a <i>fresh</i> channel.
+	 * <p>The default implementation returns {@link Channels#newChannel(InputStream)}
+	 * with the result of {@link #getInputStream()}.
+	 * @return the byte channel for the underlying resource (must not be {@code null})
+	 * @throws java.io.FileNotFoundException if the underlying resource doesn't exist
+	 * @throws IOException if the content channel could not be opened
+	 * @since 5.0
+	 * @see #getInputStream()
+	 */
+	default ReadableByteChannel readableChannel() throws IOException {
+		return Channels.newChannel(getInputStream());
+	}
+
+	/**
+	 * Determine the content length for this resource.
+	 * @throws IOException if the resource cannot be resolved
+	 * (in the file system or as some other known physical resource type)
+	 */
+	long contentLength() throws IOException;
+
+	/**
+	 * Determine the last-modified timestamp for this resource.
+	 * @throws IOException if the resource cannot be resolved
+	 * (in the file system or as some other known physical resource type)
+	 */
+	long lastModified() throws IOException;
+
+	/**
+	 * Create a resource relative to this resource.
+	 * @param relativePath the relative path (relative to this resource)
+	 * @return the resource handle for the relative resource
+	 * @throws IOException if the relative resource cannot be determined
+	 */
+	Resource createRelative(String relativePath) throws IOException;
+
+	/**
+	 * Determine a filename for this resource, i.e. typically the last
+	 * part of the path: for example, "myfile.txt".
+	 * <p>Returns {@code null} if this type of resource does not
+	 * have a filename.
+	 */
+	@Nullable
+	String getFilename();
+
+	/**
+	 * Return a description for this resource,
+	 * to be used for error output when working with the resource.
+	 * <p>Implementations are also encouraged to return this value
+	 * from their {@code toString} method.
+	 * @see Object#toString()
+	 */
+	String getDescription();
+
+}

java/ql/test/stubs/springframework-5.2.3/org/springframework/lang/Nullable.java

@@ -0,0 +1,49 @@
+/*
+ * Copyright 2002-2019 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.lang;
+
+import java.lang.annotation.Documented;
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+/**
+ * A common Spring annotation to declare that annotated elements can be {@code null} under
+ * some circumstance.
+ *
+ * <p>Leverages JSR-305 meta-annotations to indicate nullability in Java to common
+ * tools with JSR-305 support and used by Kotlin to infer nullability of Spring API.
+ *
+ * <p>Should be used at parameter, return value, and field level. Methods override should
+ * repeat parent {@code @Nullable} annotations unless they behave differently.
+ *
+ * <p>Can be used in association with {@code @NonNullApi} or {@code @NonNullFields} to
+ * override the default non-nullable semantic to nullable.
+ *
+ * @author Sebastien Deleuze
+ * @author Juergen Hoeller
+ * @since 5.0
+ * @see NonNullApi
+ * @see NonNullFields
+ * @see NonNull
+ */
+@Target({ElementType.METHOD, ElementType.PARAMETER, ElementType.FIELD})
+@Retention(RetentionPolicy.RUNTIME)
+@Documented
+public @interface Nullable {
+}

java/ql/test/stubs/springframework-5.2.3/org/springframework/util/MultiValueMap.java

@@ -0,0 +1,96 @@
+/*
+ * Copyright 2002-2019 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.util;
+
+import java.util.List;
+import java.util.Map;
+
+import org.springframework.lang.Nullable;
+
+/**
+ * Extension of the {@code Map} interface that stores multiple values.
+ *
+ * @author Arjen Poutsma
+ * @since 3.0
+ * @param <K> the key type
+ * @param <V> the value element type
+ */
+public interface MultiValueMap<K, V> extends Map<K, List<V>> {
+
+	/**
+	 * Return the first value for the given key.
+	 * @param key the key
+	 * @return the first value for the specified key, or {@code null} if none
+	 */
+	@Nullable
+	V getFirst(K key);
+
+	/**
+	 * Add the given single value to the current list of values for the given key.
+	 * @param key the key
+	 * @param value the value to be added
+	 */
+	void add(K key, @Nullable V value);
+
+	/**
+	 * Add all the values of the given list to the current list of values for the given key.
+	 * @param key they key
+	 * @param values the values to be added
+	 * @since 5.0
+	 */
+	void addAll(K key, List<? extends V> values);
+
+	/**
+	 * Add all the values of the given {@code MultiValueMap} to the current values.
+	 * @param values the values to be added
+	 * @since 5.0
+	 */
+	void addAll(MultiValueMap<K, V> values);
+
+	/**
+	 * {@link #add(Object, Object) Add} the given value, only when the map does not
+	 * {@link #containsKey(Object) contain} the given key.
+	 * @param key the key
+	 * @param value the value to be added
+	 * @since 5.2
+	 */
+	default void addIfAbsent(K key, @Nullable V value) {
+		if (!containsKey(key)) {
+			add(key, value);
+		}
+	}
+
+	/**
+	 * Set the given single value under the given key.
+	 * @param key the key
+	 * @param value the value to set
+	 */
+	void set(K key, @Nullable V value);
+
+	/**
+	 * Set the given values under.
+	 * @param values the values.
+	 */
+	void setAll(Map<K, V> values);
+
+	/**
+	 * Return a {@code Map} with the first values contained in this {@code MultiValueMap}.
+	 * @return a single value representation of this map
+	 */
+	Map<K, V> toSingleValueMap();
+
+}

java/ql/test/stubs/springframework-5.2.3/org/springframework/web/multipart/MultipartFile.java

@@ -0,0 +1,138 @@
+/*
+ * Copyright 2002-2018 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.web.multipart;
+
+import java.io.File;
+import java.io.IOException;
+import java.io.InputStream;
+import java.nio.file.Files;
+import java.nio.file.Path;
+
+import org.springframework.core.io.InputStreamSource;
+import org.springframework.core.io.Resource;
+import org.springframework.lang.Nullable;
+
+/**
+ * A representation of an uploaded file received in a multipart request.
+ *
+ * <p>The file contents are either stored in memory or temporarily on disk.
+ * In either case, the user is responsible for copying file contents to a
+ * session-level or persistent store as and if desired. The temporary storage
+ * will be cleared at the end of request processing.
+ *
+ * @author Juergen Hoeller
+ * @author Trevor D. Cook
+ * @since 29.09.2003
+ * @see org.springframework.web.multipart.MultipartHttpServletRequest
+ * @see org.springframework.web.multipart.MultipartResolver
+ */
+public interface MultipartFile extends InputStreamSource {
+
+	/**
+	 * Return the name of the parameter in the multipart form.
+	 * @return the name of the parameter (never {@code null} or empty)
+	 */
+	String getName();
+
+	/**
+	 * Return the original filename in the client's filesystem.
+	 * <p>This may contain path information depending on the browser used,
+	 * but it typically will not with any other than Opera.
+	 * @return the original filename, or the empty String if no file has been chosen
+	 * in the multipart form, or {@code null} if not defined or not available
+	 * @see org.apache.commons.fileupload.FileItem#getName()
+	 * @see org.springframework.web.multipart.commons.CommonsMultipartFile#setPreserveFilename
+	 */
+	@Nullable
+	String getOriginalFilename();
+
+	/**
+	 * Return the content type of the file.
+	 * @return the content type, or {@code null} if not defined
+	 * (or no file has been chosen in the multipart form)
+	 */
+	@Nullable
+	String getContentType();
+
+	/**
+	 * Return whether the uploaded file is empty, that is, either no file has
+	 * been chosen in the multipart form or the chosen file has no content.
+	 */
+	boolean isEmpty();
+
+	/**
+	 * Return the size of the file in bytes.
+	 * @return the size of the file, or 0 if empty
+	 */
+	long getSize();
+
+	/**
+	 * Return the contents of the file as an array of bytes.
+	 * @return the contents of the file as bytes, or an empty byte array if empty
+	 * @throws IOException in case of access errors (if the temporary store fails)
+	 */
+	byte[] getBytes() throws IOException;
+
+	/**
+	 * Return an InputStream to read the contents of the file from.
+	 * <p>The user is responsible for closing the returned stream.
+	 * @return the contents of the file as stream, or an empty stream if empty
+	 * @throws IOException in case of access errors (if the temporary store fails)
+	 */
+	@Override
+	InputStream getInputStream() throws IOException;
+
+	/**
+	 * Return a Resource representation of this MultipartFile. This can be used
+	 * as input to the {@code RestTemplate} or the {@code WebClient} to expose
+	 * content length and the filename along with the InputStream.
+	 * @return this MultipartFile adapted to the Resource contract
+	 * @since 5.1
+	 */
+	Resource getResource();
+
+	/**
+	 * Transfer the received file to the given destination file.
+	 * <p>This may either move the file in the filesystem, copy the file in the
+	 * filesystem, or save memory-held contents to the destination file. If the
+	 * destination file already exists, it will be deleted first.
+	 * <p>If the target file has been moved in the filesystem, this operation
+	 * cannot be invoked again afterwards. Therefore, call this method just once
+	 * in order to work with any storage mechanism.
+	 * <p><b>NOTE:</b> Depending on the underlying provider, temporary storage
+	 * may be container-dependent, including the base directory for relative
+	 * destinations specified here (e.g. with Servlet 3.0 multipart handling).
+	 * For absolute destinations, the target file may get renamed/moved from its
+	 * temporary location or newly copied, even if a temporary copy already exists.
+	 * @param dest the destination file (typically absolute)
+	 * @throws IOException in case of reading or writing errors
+	 * @throws IllegalStateException if the file has already been moved
+	 * in the filesystem and is not available anymore for another transfer
+	 * @see org.apache.commons.fileupload.FileItem#write(File)
+	 * @see javax.servlet.http.Part#write(String)
+	 */
+	void transferTo(File dest) throws IOException, IllegalStateException;
+
+	/**
+	 * Transfer the received file to the given destination file.
+	 * <p>The default implementation simply copies the file input stream.
+	 * @since 5.1
+	 * @see #getInputStream()
+	 * @see #transferTo(File)
+ 	 */
+	void transferTo(Path dest) throws IOException, IllegalStateException;
+}

java/ql/test/stubs/springframework-5.2.3/org/springframework/web/multipart/MultipartRequest.java

@@ -0,0 +1,87 @@
+/*
+ * Copyright 2002-2016 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.web.multipart;
+
+import java.util.Iterator;
+import java.util.List;
+import java.util.Map;
+
+import org.springframework.lang.Nullable;
+import org.springframework.util.MultiValueMap;
+
+/**
+ * This interface defines the multipart request access operations that are exposed
+ * for actual multipart requests. It is extended by {@link MultipartHttpServletRequest}.
+ *
+ * @author Juergen Hoeller
+ * @author Arjen Poutsma
+ * @since 2.5.2
+ */
+public interface MultipartRequest {
+
+	/**
+	 * Return an {@link java.util.Iterator} of String objects containing the
+	 * parameter names of the multipart files contained in this request. These
+	 * are the field names of the form (like with normal parameters), not the
+	 * original file names.
+	 * @return the names of the files
+	 */
+	Iterator<String> getFileNames();
+
+	/**
+	 * Return the contents plus description of an uploaded file in this request,
+	 * or {@code null} if it does not exist.
+	 * @param name a String specifying the parameter name of the multipart file
+	 * @return the uploaded content in the form of a {@link MultipartFile} object
+	 */
+	@Nullable
+	MultipartFile getFile(String name);
+
+	/**
+	 * Return the contents plus description of uploaded files in this request,
+	 * or an empty list if it does not exist.
+	 * @param name a String specifying the parameter name of the multipart file
+	 * @return the uploaded content in the form of a {@link MultipartFile} list
+	 * @since 3.0
+	 */
+	List<MultipartFile> getFiles(String name);
+
+	/**
+	 * Return a {@link java.util.Map} of the multipart files contained in this request.
+	 * @return a map containing the parameter names as keys, and the
+	 * {@link MultipartFile} objects as values
+	 */
+	Map<String, MultipartFile> getFileMap();
+
+	/**
+	 * Return a {@link MultiValueMap} of the multipart files contained in this request.
+	 * @return a map containing the parameter names as keys, and a list of
+	 * {@link MultipartFile} objects as values
+	 * @since 3.0
+	 */
+	MultiValueMap<String, MultipartFile> getMultiFileMap();
+
+	/**
+	 * Determine the content type of the specified request part.
+	 * @param paramOrFileName the name of the part
+	 * @return the associated content type, or {@code null} if not defined
+	 * @since 3.1
+	 */
+	@Nullable
+	String getMultipartContentType(String paramOrFileName);
+
+}