Java: Fix SpringRequestMappingMethod URL Extraction #2

[owen-mc]

This supersedes #19512.

[Copilot]

Pull Request Overview

This PR enhances SpringRequestMappingMethod’s handling of @RequestMapping values by deprecating the old single-value API, introducing a new array-based API, and updating tests and change notes accordingly.

• Deprecate getValue() and add getAValue() for multi-value mappings
• Update Java test cases to assert RequestMappingURL tags, including a new multi-value test
• Add change note for deprecation and new API

Reviewed Changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

File	Description
java/ql/test/library-tests/frameworks/spring/controller/Test.java	Inserted RequestMappingURL tags on mapping methods and added a multi-value test class
java/ql/test/library-tests/frameworks/spring/controller/RequestController.ql	New test module defining expectations for RequestMappingURL tags
java/ql/lib/semmle/code/java/frameworks/spring/SpringController.qll	Deprecated getValue(), introduced getAValue() method
java/ql/lib/change-notes/2025-05-22-spring-request-mapping-value.md	Documented the deprecation of getValue() in change notes

Comments suppressed due to low confidence (2)

java/ql/lib/semmle/code/java/frameworks/spring/SpringController.qll:160

• [nitpick] The method name getAValue() is not very descriptive. Consider renaming it to something like getValues() or getValueArray() to more clearly indicate that it returns multiple mapping values.

string getAValue() { result = requestMappingAnnotation.getAStringArrayValue("value") }

java/ql/test/library-tests/frameworks/spring/controller/Test.java:208

• The new multi-value test method does not invoke sink(), unlike other tests. Adding a sink(src) call inside this method would ensure consistency and make it clear that this endpoint is being exercised.

public void get(WebRequest src) { // $ RequestMappingURL="/a" RequestMappingURL="/b"

[Copilot]

[nitpick] The doc comment for getAValue() could clarify the format of the returned string when multiple values are present (e.g., comma-separated).

Suggested change

	/** Gets the "value" @RequestMapping annotation array string value, if present. */
	/**
	* Gets a single "value" from the @RequestMapping annotation array string, if present.
	* If the annotation specifies multiple values, this method retrieves one of them.
	*/

[michaelnebel]

LGTM!

[michaelnebel]

LGTM