Java : Add Log Injection Vulnerability

[ghost]

This is a continuation of @dellalibera's #3882.

CC: @smowton @Marcono1234 @intrigus-lgtm

[ghost]

There is already a bounty application open with GHSL. See github/securitylab#144

[intrigus-lgtm]

Just some comments.
The .qhelp file has only been checked for missing <code> tags and nothing else.

[owen-mc]

It would be great to have some tests.

[ghost]

@owen-mc I have the latest changes here. As for the tests, let this PR be merged as experimental. I keep running it issues with stubbing Java dependencies again and again. So I have decided to write a simple tool to generate the stubs for me. Until that is fully functional, I won't be adding any tests to any of my Java PR's.

[owen-mc]

I have set two LGTM runs going, one with the sanitizer guards and one without. I sympathise about stubbing. For codeql for Go there is a tool called Depstubber to do stubbing.

[owen-mc]

I did two lgtm runs. There were a lot of results, and not much difference between the two runs. There were results in 7066 projects for the run with sanitizers and 7073 for the run without. Some projects also had different numbers of results. Unfortunately lgtm doesn't make it particularly easy to diff the two outputs. CruxFramework/crux is one of the projects that had results in the second run but not the first. I looked at one of its results and it seems to be inappropriately sanitizer-guarded by endswith. The rest of the results for that repo are very similar, so I think the same must be the case.

I stand by my suggestion about which sanitizer guards to remove.

[owen-mc]

@porcupineyhairs Do you intend to update the sanitizer guards? I will then move this to the next stage of the process.

[ghost]

@owen-mc I have removed the sanitizers and rebased the PR to the latest main.

Changes have been made