Implement a CodeQL rule for cases where WebClient.create is used without setting a WebClientOptions with an explicit setIdleTimeout

[carlspring]

Task Description

As a follow-up of carlspring/vertx-vulns#18, we need to implement a CodeQL rule for cases where WebClient.create is used without setting a WebClientOptions with an explicit setIdleTimeout.

Open Questions

• What should be the severity of this?

Notes

Task List

The following tasks will need to be carried out:

• Implement the query.
• Set up query annotations.
• Provide a help file.
• Test the fix.
• Update the documentation.

Useful Commands

Incurred Costs

Task Relationships

This task:

• Is a sub-task of:
• Depends on:
• Is a follow-up of:
  • Insecure communication (e.g., use of HTTP instead of HTTPS) vertx-vulns#6
• Is required for:
  • Create a CodeQL query pack #1
• Relates to:

Resources

Useful Links

• CodeQL: Set up query annotations
• CodeQL: Defining the results of a query

Points of Contact

• @carlspring