From 22f119186cd14e4b616ca86694f078f00bd4d552 Mon Sep 17 00:00:00 2001
From: Martin Todorov <martin.steve.todorov@sap.com>
Date: Fri, 8 Dec 2023 02:38:30 +0200
Subject: [PATCH 1/3] carlspring/vertx-codeql-queries#14 : Implement a CodeQL
 query that checks for invocations of Vertx.vertx()

* Implemented CodeQL query.
* Implemented test case.
* Added a query help file.
---
 .../vertx/http/InvocationOfVertxVertx.java    | 16 ++++
 src/main/ql/InvocationOfVertxVertx.qhelp      | 46 ++++++++++
 src/main/ql/InvocationOfVertxVertx.ql         | 35 ++++++++
 .../InvocationOfVertxVertx.expected           |  1 +
 .../InvocationOfVertxVertx.java               | 16 ++++
 .../InvocationOfVertxVertx.qlref              |  1 +
 .../InvocationOfVertxVertx/options            |  1 +
 .../InvocationOfVertxVertx/pom.xml            | 83 +++++++++++++++++++
 8 files changed, 199 insertions(+)
 create mode 100644 src/main/java/org/carlspring/security/vertx/http/InvocationOfVertxVertx.java
 create mode 100644 src/main/ql/InvocationOfVertxVertx.qhelp
 create mode 100644 src/main/ql/InvocationOfVertxVertx.ql
 create mode 100644 src/test/ql/test/query-tests/InvocationOfVertxVertx/InvocationOfVertxVertx.expected
 create mode 100644 src/test/ql/test/query-tests/InvocationOfVertxVertx/InvocationOfVertxVertx.java
 create mode 100644 src/test/ql/test/query-tests/InvocationOfVertxVertx/InvocationOfVertxVertx.qlref
 create mode 100644 src/test/ql/test/query-tests/InvocationOfVertxVertx/options
 create mode 100644 src/test/ql/test/query-tests/InvocationOfVertxVertx/pom.xml

diff --git a/src/main/java/org/carlspring/security/vertx/http/InvocationOfVertxVertx.java b/src/main/java/org/carlspring/security/vertx/http/InvocationOfVertxVertx.java
new file mode 100644
index 0000000..a37e5ab
--- /dev/null
+++ b/src/main/java/org/carlspring/security/vertx/http/InvocationOfVertxVertx.java
@@ -0,0 +1,16 @@
+package org.carlspring.security.vertx.http;
+
+import io.vertx.core.Vertx;
+
+/**
+ * @author carlspring
+ */
+public class InvocationOfVertxVertx
+{
+
+    public void start()
+    {
+        Vertx.vertx();
+    }
+
+}
diff --git a/src/main/ql/InvocationOfVertxVertx.qhelp b/src/main/ql/InvocationOfVertxVertx.qhelp
new file mode 100644
index 0000000..e8198f2
--- /dev/null
+++ b/src/main/ql/InvocationOfVertxVertx.qhelp
@@ -0,0 +1,46 @@
+<!DOCTYPE qhelp PUBLIC
+        "-//Semmle//qhelp//EN"
+        "qhelp.dtd">
+<qhelp>
+    <overview>
+        <p>
+            An HTTP server which does not use SSL/TLS is vulnerable to man-in-the-middle attacks.
+        </p>
+        <p>
+            Please, note that it may be safe to ignore this, only if you intend your application to be placed
+            behind a loadbalancer, which is itself securing the connections with the appropriate certificates.
+        </p>
+    </overview>
+
+    <recommendation>
+        <p>Use SSL/TLS to encrypt the communication between the client and the server.</p>
+    </recommendation>
+
+    <example>
+        <p>Instead of setting up a plain HTTP server that doesn't use SSL, such as this one:</p>
+
+        <sample src="InsecureHttpServer.java" />
+
+        <p>
+            when creating an HTTP server, the <code>setSsl</code> method should be called on the
+            <code>HttpServerOptions</code>
+            object, and the <code>setKeyStoreOptions</code> method should be called on the
+            <code>HttpServerOptions</code>
+            object with a <code>KeyStoreOptions</code>
+            object as an argument.
+
+            For example, code such as the one illustrated below should be used to create an HTTP server and secure
+            it with SSL:
+        </p>
+
+        <sample src="SecureHttpServer.java" />
+    </example>
+
+    <references>
+        <li>
+            <a href="https://vertx.io/docs/vertx-core/java/#_writing_http_servers_and_clients">
+                Vert.x documentation
+            </a>
+        </li>
+    </references>
+</qhelp>
diff --git a/src/main/ql/InvocationOfVertxVertx.ql b/src/main/ql/InvocationOfVertxVertx.ql
new file mode 100644
index 0000000..327f0dd
--- /dev/null
+++ b/src/main/ql/InvocationOfVertxVertx.ql
@@ -0,0 +1,35 @@
+/**
+ * @name Invocation of VertX.vertx()
+ * @description The VertX.vertx() method should not be invoked directly.
+ * @kind problem
+ * @problem.severity high
+ * @id java/vertx/invocation-of-vertx-vertx
+ * @tags security java/vertx
+ */
+
+import java
+
+class Vertx extends RefType {
+  Vertx() {
+    this.getASourceSupertype*().hasQualifiedName("io.vertx.core", "Vertx")
+  }
+}
+
+class VertxCreateHttpServerMethodAccess extends MethodAccess {
+  VertxCreateHttpServerMethodAccess() {
+    exists(Method m |
+      this.getMethod() = m and
+      m.getName().matches("vertx") and
+      m.getDeclaringType() instanceof Vertx
+    )
+  }
+}
+
+from VertxCreateHttpServerMethodAccess call
+where
+  not call.getEnclosingCallable().getDeclaringType() instanceof Vertx and
+  not call.getLocation().getFile().getRelativePath().matches("%src/test/%") and
+  call.getNumArgument() = 0
+select
+  call,
+  "Invocation of VertX.vertx()"
diff --git a/src/test/ql/test/query-tests/InvocationOfVertxVertx/InvocationOfVertxVertx.expected b/src/test/ql/test/query-tests/InvocationOfVertxVertx/InvocationOfVertxVertx.expected
new file mode 100644
index 0000000..8c4487e
--- /dev/null
+++ b/src/test/ql/test/query-tests/InvocationOfVertxVertx/InvocationOfVertxVertx.expected
@@ -0,0 +1 @@
+| InvocationOfVertxVertx.java:13:9:13:21 | vertx(...) | Invocation of VertX.vertx() |
diff --git a/src/test/ql/test/query-tests/InvocationOfVertxVertx/InvocationOfVertxVertx.java b/src/test/ql/test/query-tests/InvocationOfVertxVertx/InvocationOfVertxVertx.java
new file mode 100644
index 0000000..a37e5ab
--- /dev/null
+++ b/src/test/ql/test/query-tests/InvocationOfVertxVertx/InvocationOfVertxVertx.java
@@ -0,0 +1,16 @@
+package org.carlspring.security.vertx.http;
+
+import io.vertx.core.Vertx;
+
+/**
+ * @author carlspring
+ */
+public class InvocationOfVertxVertx
+{
+
+    public void start()
+    {
+        Vertx.vertx();
+    }
+
+}
diff --git a/src/test/ql/test/query-tests/InvocationOfVertxVertx/InvocationOfVertxVertx.qlref b/src/test/ql/test/query-tests/InvocationOfVertxVertx/InvocationOfVertxVertx.qlref
new file mode 100644
index 0000000..9ce67e9
--- /dev/null
+++ b/src/test/ql/test/query-tests/InvocationOfVertxVertx/InvocationOfVertxVertx.qlref
@@ -0,0 +1 @@
+InvocationOfVertxVertx.ql
diff --git a/src/test/ql/test/query-tests/InvocationOfVertxVertx/options b/src/test/ql/test/query-tests/InvocationOfVertxVertx/options
new file mode 100644
index 0000000..a16b40d
--- /dev/null
+++ b/src/test/ql/test/query-tests/InvocationOfVertxVertx/options
@@ -0,0 +1 @@
+//semmle-extractor-options: --javac-args -cp ${testdir}/../../stubs/ -source 17
diff --git a/src/test/ql/test/query-tests/InvocationOfVertxVertx/pom.xml b/src/test/ql/test/query-tests/InvocationOfVertxVertx/pom.xml
new file mode 100644
index 0000000..38f2317
--- /dev/null
+++ b/src/test/ql/test/query-tests/InvocationOfVertxVertx/pom.xml
@@ -0,0 +1,83 @@
+<project xmlns="http://maven.apache.org/POM/4.0.0">
+
+    <modelVersion>4.0.0</modelVersion>
+
+    <groupId>org.carlspring.security</groupId>
+    <artifactId>vertx-vulns-test-invocation-of-vertx-vertx</artifactId>
+    <version>1.0.0-SNAPSHOT</version>
+
+    <properties>
+        <version.vertx>4.4.4</version.vertx>
+    </properties>
+
+    <build>
+        <plugins>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-clean-plugin</artifactId>
+                <version>3.3.1</version>
+            </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-compiler-plugin</artifactId>
+                <version>3.11.0</version>
+                <configuration>
+                    <source>17</source>
+                    <target>17</target>
+                    <debug>true</debug>
+                </configuration>
+            </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-install-plugin</artifactId>
+                <version>3.1.1</version>
+            </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-resources-plugin</artifactId>
+                <version>3.3.1</version>
+                <configuration>
+                    <includeEmptyDirs>true</includeEmptyDirs>
+                </configuration>
+            </plugin>
+        </plugins>
+    </build>
+
+    <dependencies>
+        <dependency>
+            <groupId>io.vertx</groupId>
+            <artifactId>vertx-core</artifactId>
+            <version>${version.vertx}</version>
+        </dependency>
+        <dependency>
+            <groupId>io.vertx</groupId>
+            <artifactId>vertx-web</artifactId>
+            <version>${version.vertx}</version>
+        </dependency>
+        <dependency>
+            <groupId>io.vertx</groupId>
+            <artifactId>vertx-web-client</artifactId>
+            <version>${version.vertx}</version>
+        </dependency>
+
+        <dependency>
+            <groupId>io.vertx</groupId>
+            <artifactId>vertx-jdbc-client</artifactId>
+            <version>${version.vertx}</version>
+        </dependency>
+
+        <dependency>
+            <groupId>io.vertx</groupId>
+            <artifactId>vertx-rx-java2</artifactId>
+            <version>${version.vertx}</version>
+        </dependency>
+
+        <dependency>
+            <groupId>io.vertx</groupId>
+            <artifactId>vertx-sql-client</artifactId>
+            <version>${version.vertx}</version>
+        </dependency>
+
+    </dependencies>
+
+</project>

From b7decffca0c653b441530f713fa196d18200a679 Mon Sep 17 00:00:00 2001
From: Martin Todorov <martin.steve.todorov@sap.com>
Date: Tue, 4 Aug 2026 02:44:20 +0300
Subject: [PATCH 2/3] Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
 src/main/ql/InvocationOfVertxVertx.ql | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/main/ql/InvocationOfVertxVertx.ql b/src/main/ql/InvocationOfVertxVertx.ql
index 327f0dd..8d5e2e9 100644
--- a/src/main/ql/InvocationOfVertxVertx.ql
+++ b/src/main/ql/InvocationOfVertxVertx.ql
@@ -15,8 +15,8 @@ class Vertx extends RefType {
   }
 }
 
-class VertxCreateHttpServerMethodAccess extends MethodAccess {
-  VertxCreateHttpServerMethodAccess() {
+class VertxVertxMethodAccess extends MethodAccess {
+  VertxVertxMethodAccess() {
     exists(Method m |
       this.getMethod() = m and
       m.getName().matches("vertx") and
@@ -25,7 +25,7 @@ class VertxCreateHttpServerMethodAccess extends MethodAccess {
   }
 }
 
-from VertxCreateHttpServerMethodAccess call
+from VertxVertxMethodAccess call
 where
   not call.getEnclosingCallable().getDeclaringType() instanceof Vertx and
   not call.getLocation().getFile().getRelativePath().matches("%src/test/%") and

From 2226039c7a963146280559bb641b5a48f89ab073 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 3 Aug 2026 23:46:25 +0000
Subject: [PATCH 3/3] Add negative test for Vertx.vertx query

Co-authored-by: carlspring <1436265+carlspring@users.noreply.github.com>
---
 .../SecureInvocationOfVertxVertx.java            | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)
 create mode 100644 src/test/ql/test/query-tests/InvocationOfVertxVertx/SecureInvocationOfVertxVertx.java

diff --git a/src/test/ql/test/query-tests/InvocationOfVertxVertx/SecureInvocationOfVertxVertx.java b/src/test/ql/test/query-tests/InvocationOfVertxVertx/SecureInvocationOfVertxVertx.java
new file mode 100644
index 0000000..a8a20ed
--- /dev/null
+++ b/src/test/ql/test/query-tests/InvocationOfVertxVertx/SecureInvocationOfVertxVertx.java
@@ -0,0 +1,16 @@
+package org.carlspring.security.vertx.http;
+
+import io.vertx.core.Vertx;
+
+/**
+ * @author carlspring
+ */
+public class SecureInvocationOfVertxVertx
+{
+
+    public void start(Vertx vertx)
+    {
+        vertx.deployVerticle("example");
+    }
+
+}