Java: Improve java/log-injection with DEBUG/TRACE exclusion, URLEncoder sanitizer, and test file exclusion

[mrigankpawagi]

Summary

This PR consolidates and supersedes PRs #7 and #11, combining all three improvements to the java/log-injection query into a single PR.

Problem

MRVA on top-100 Java repositories showed 5,958 log injection alerts. Analysis identified three improvement opportunities:

1. 41% of alerts were at DEBUG/TRACE level — these are disabled in production and not a realistic log injection target
2. URLEncoder.encode() was not recognized as a sanitizer — URL encoding converts \n to %0A, preventing log injection
3. 105 alerts were in test files — test code does not process untrusted user input in production

Changes

1. Exclude DEBUG/TRACE level logging from sinks (from PR #7)

Modified DefaultLogInjectionSink in LogInjection.qll to exclude method calls to:

• debug, trace (SLF4J, Log4j, Commons Logging, JBoss Logging)
• fine, finer, finest (java.util.logging)

2. Add URLEncoder.encode() as sanitizer (from PR #11)

Added UrlEncoderSanitizer class recognizing java.net.URLEncoder.encode() as a sanitizer since URL encoding replaces line breaks with percent-encoded equivalents.

3. Exclude test files (from PR #11)

Added not isInTestFile(...) to the query using the existing ModelExclusions predicate.

MRVA Validation

• Before: 5,958 alerts across 42 repos
• After: ~3,300 alerts (44% reduction)
• All eliminated alerts are confirmed false positives (debug-level, URL-encoded, or test code)
• No true positives lost

Why each change is correct

• DEBUG/TRACE exclusion: Log injection (CWE-117) targets production logs. Debug logging is disabled by default in all major frameworks.
• URLEncoder sanitizer: URLEncoder.encode(input, "UTF-8") converts \n → %0A, \r → %0D — no raw newlines survive.
• Test exclusion: Test code is not deployed to production and does not process real user input.

Supersedes: #7, #11