Java: Add URL.getHost() to SSRF host validation sanitizer

java/ql/lib/semmle/code/java/security/RequestForgery.qll

@@ -133,7 +133,10 @@ private predicate isHostComparisonSanitizer(Guard guard, Expr e, boolean branch)
       branch = true and
       exists(MethodCall hostCall |
         hostCall = [equalsCall.getQualifier(), equalsCall.getArgument(0)] and
-        hostCall.getMethod().hasQualifiedName("java.net", "URI", "getHost") and
+        (
+          hostCall.getMethod().hasQualifiedName("java.net", "URI", "getHost") or
+          hostCall.getMethod().hasQualifiedName("java.net", "URL", "getHost")
+        ) and
         e = hostCall.getQualifier()
       )
     )

java/ql/test/query-tests/security/CWE-918/UrlHostValidationTest.java

@@ -0,0 +1,35 @@
+import java.io.IOException;
+import java.net.URI;
+import java.net.URL;
+import java.net.http.HttpClient;
+import java.net.http.HttpRequest;
+
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+public class UrlHostValidationTest extends HttpServlet {
+    private static final String ALLOWED_HOST = "api.example.com";
+    private HttpClient client = HttpClient.newHttpClient();
+
+    protected void doGet(HttpServletRequest request, HttpServletResponse response)
+            throws ServletException, IOException {
+        try {
+            // GOOD: URL.getHost() is validated before use
+            String userUrl = request.getParameter("url");
+            URL parsedUrl = new URL(userUrl);
+            if (ALLOWED_HOST.equals(parsedUrl.getHost())) {
+                HttpRequest r = HttpRequest.newBuilder(parsedUrl.toURI()).build();
+                client.send(r, null);
+            }
+
+            // BAD: no host validation
+            String unsafeUrl = request.getParameter("url2"); // $ Source
+            HttpRequest unsafeReq = HttpRequest.newBuilder(new URI(unsafeUrl)).build(); // $ Alert
+            client.send(unsafeReq, null); // $ Alert
+        } catch (Exception e) {
+            // handle exception
+        }
+    }
+}