Skip to content

Commit 17e0920

Browse files
Jami CogswellJami Cogswell
Jami Cogswell
authored and
Jami Cogswell
committed
Java: resolve more conflicts
1 parent 275634e commit 17e0920

22 files changed

Lines changed: 214 additions & 102 deletions

‎java/ql/lib/ext/java.awt.model.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,8 @@ extensions:
33
pack: codeql/java-all
44
extensible: summaryModel
55
data:
6-
- ["java.awt", "Container", True, "add", "(Component)", "", "Argument[0]", "Argument[-1].Element", "value", "manual"] # ! signature as "" instead?
6+
- ["java.awt", "Container", True, "add", "(Component)", "", "Argument[0]", "Argument[-1].Element", "value", "manual"]
7+
- ["java.awt", "Container", True, "add", "(Component)", "", "Argument[0]", "ReturnValue", "value", "manual"]
78
- ["java.awt", "Container", True, "add", "(Component,Object)", "", "Argument[0]", "Argument[-1].Element", "value", "manual"]
89

910
- addsTo:

‎java/ql/lib/ext/java.io.model.yml‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,9 @@ extensions:
6969
- ["java.io", "File", True, "getCanonicalFile", "", "", "Argument[this]", "ReturnValue", "taint", "manual"]
7070
- ["java.io", "File", True, "getCanonicalPath", "", "", "Argument[this]", "ReturnValue", "taint", "manual"]
7171
- ["java.io", "File", True, "getName", "()", "", "Argument[this]", "ReturnValue", "taint", "manual"]
72-
- ["java.io", "File", False, "getPath", "()", "", "Argument[-1]", "ReturnValue", "taint", "manual"] # ! True versus False (maybe it's private/hidden?).. (and neutral instead?)
72+
- ["java.io", "File", True, "getParentFile", "()", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
73+
- ["java.io", "File", True, "getPath", "()", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
74+
- ["java.io", "File", True, "listFiles", "()", "", "Argument[-1]", "ReturnValue.ArrayElement", "taint", "manual"]
7375
- ["java.io", "File", True, "toPath", "", "", "Argument[this]", "ReturnValue", "taint", "manual"]
7476
- ["java.io", "File", True, "toString", "", "", "Argument[this]", "ReturnValue", "taint", "manual"]
7577
- ["java.io", "File", True, "toURI", "", "", "Argument[this]", "ReturnValue", "taint", "manual"]
@@ -90,24 +92,23 @@ extensions:
9092
- ["java.io", "OutputStream", True, "write", "(int)", "", "Argument[0]", "Argument[this]", "taint", "manual"]
9193
- ["java.io", "Reader", True, "read", "", "", "Argument[this]", "Argument[0]", "taint", "manual"]
9294
- ["java.io", "StringReader", False, "StringReader", "", "", "Argument[0]", "Argument[this]", "taint", "manual"]
93-
- ["java.io", "StringWriter", False, "toString", "()", "", "Argument[-1]", "ReturnValue", "taint", "manual"] # ! currently supported by taintPreservingQualifierToMethod?
95+
- ["java.io", "StringWriter", False, "toString", "()", "", "Argument[-1]", "ReturnValue", "taint", "manual"] # ! keep an eye on this one for FP flow, already modeled in `taintPreservingQualifierToMethod` predicate?
9496
- ["java.io", "UncheckedIOException", False, "UncheckedIOException", "(IOException)", "", "Argument[0]", "Argument[-1].SyntheticField[java.lang.Throwable.cause]", "value", "manual"]
9597
- ["java.io", "Writer", True, "write", "", "", "Argument[0]", "Argument[this]", "taint", "manual"]
9698
- addsTo:
9799
pack: codeql/java-all
98100
extensible: neutralModel
99101
data:
100102
- ["java.io", "Closeable", "close", "()", "manual"]
103+
- ["java.io", "DataOutput", "writeBoolean", "(boolean)", "manual"]
101104
- ["java.io", "File", "delete", "()", "manual"]
102105
- ["java.io", "File", "exists", "()", "manual"]
103-
- ["java.io", "File", "getParentFile", "()", "manual"] # ! little unsure about this as a neutral
104106
- ["java.io", "File", "isFile", "()", "manual"]
105107
- ["java.io", "File", "length", "()", "manual"]
106-
- ["java.io", "File", "listFiles", "()", "manual"] # ! little unsure about this as a neutral
107108
- ["java.io", "File", "isDirectory", "()", "manual"]
108109
- ["java.io", "File", "mkdirs", "()", "manual"]
109110
- ["java.io", "InputStream", "close", "()", "manual"]
110-
- ["java.io", "OutputStream", "flush", "()", "manual"] # ! little unsure about this as a neutral, but not sure how to represent output if summary model...
111+
- ["java.io", "OutputStream", "flush", "()", "manual"]
111112

112113
# The below APIs have numeric flow and are currently being stored as neutral models.
113114
# These may be changed to summary models with kinds "value-numeric" and "taint-numeric" (or similar) in the future.

‎java/ql/lib/ext/java.lang.model.yml‎

Lines changed: 22 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -108,30 +108,33 @@ extensions:
108108
- ["java.lang", "String", False, "valueOf", "(char)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
109109
- ["java.lang", "String", False, "valueOf", "(char[])", "", "Argument[0]", "ReturnValue", "taint", "manual"]
110110
- ["java.lang", "String", False, "valueOf", "(char[],int,int)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
111-
# ! why do below have subtype=True for constructors?
112111
- ["java.lang", "StringBuffer", True, "StringBuffer", "(CharSequence)", "", "Argument[0]", "Argument[this]", "taint", "manual"]
113112
- ["java.lang", "StringBuffer", True, "StringBuffer", "(String)", "", "Argument[0]", "Argument[this]", "taint", "manual"]
114113
- ["java.lang", "StringBuilder", True, "StringBuilder", "", "", "Argument[0]", "Argument[this]", "taint", "manual"]
115114
- ["java.lang", "StringBuilder", False, "delete", "(int,int)", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
116115
- ["java.lang", "System", False, "arraycopy", "", "", "Argument[0]", "Argument[2]", "taint", "manual"]
117-
- ["java.lang", "System", False, "getenv", "(String)", "", "Argument[-1].MapValue", "ReturnValue", "value", "manual"] # ! neutral instead?
118-
- ["java.lang", "System", False, "getenv", "(String)", "", "Argument[0]", "ReturnValue", "taint", "manual"] # ! really unsure about this...; neutral instead? -- or unmodelled
119-
- ["java.lang", "Thread", False, "Thread", "(Runnable)", "", "Argument[0]", "Argument[-1]", "taint", "manual"] # ! neutral instead?
116+
- ["java.lang", "Thread", False, "Thread", "(Runnable)", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
117+
- ["java.lang", "Thread", False, "Thread", "(String)", "", "Argument[0]", "Argument[-1].SyntheticField[java.lang.Thread.name]", "value", "manual"]
120118
- ["java.lang", "Thread", True, "getName", "()", "", "Argument[-1].SyntheticField[java.lang.Thread.name]", "ReturnValue", "value", "manual"]
121-
- ["java.lang", "ThreadLocal", True, "get", "()", "", "Argument[-1].SyntheticField[java.lang.ThreadLocal.value]", "ReturnValue", "value", "manual"] # ! not sure if this model is correct, and if should be neutral model instead
119+
- ["java.lang", "ThreadLocal", True, "get", "()", "", "Argument[-1].SyntheticField[java.lang.ThreadLocal.value]", "ReturnValue", "value", "manual"]
120+
- ["java.lang", "ThreadLocal", True, "set", "(Object)", "", "Argument[0]", "Argument[-1].SyntheticField[java.lang.ThreadLocal.value]", "value", "manual"]
122121
- ["java.lang", "Throwable", False, "Throwable", "(Throwable)", "", "Argument[0]", "Argument[this].SyntheticField[java.lang.Throwable.cause]", "value", "manual"]
122+
- ["java.lang", "Throwable", False, "Throwable", "(String)", "", "Argument[0]", "Argument[-1].SyntheticField[java.lang.Throwable.message]", "value", "manual"]
123123
- ["java.lang", "Throwable", True, "getCause", "()", "", "Argument[this].SyntheticField[java.lang.Throwable.cause]", "ReturnValue", "value", "manual"]
124124
- ["java.lang", "Throwable", True, "getMessage", "()", "", "Argument[this].SyntheticField[java.lang.Throwable.message]", "ReturnValue", "value", "manual"]
125-
- ["java.lang", "Throwable", True, "getLocalizedMessage", "()", "", "Argument[-1].SyntheticField[java.lang.Throwable.message]", "ReturnValue", "value", "manual"] # ! should the field used be different?
126-
- ["java.lang", "Throwable", True, "toString", "()", "", "Argument[-1].SyntheticField[java.lang.Throwable.message]", "ReturnValue", "taint", "manual"] # ! little unsure about this one...
125+
- ["java.lang", "Throwable", True, "getLocalizedMessage", "()", "", "Argument[-1].SyntheticField[java.lang.Throwable.message]", "ReturnValue", "value", "manual"]
126+
- ["java.lang", "Throwable", True, "toString", "()", "", "Argument[-1].SyntheticField[java.lang.Throwable.message]", "ReturnValue", "taint", "manual"] # ! watch for FPs
127+
127128
- addsTo:
128129
pack: codeql/java-all
129130
extensible: neutralModel
130131
data:
131132
- ["java.lang", "AbstractStringBuilder", "length", "()", "manual"]
132-
- ["java.lang", "AbstractStringBuilder", "setCharAt", "(int,char)", "manual"] # ! char manipulation not interesting? (or interesting since could set many chars... prbly switch to summary model)
133-
- ["java.lang", "AbstractStringBuilder", "setLength", "(int)", "manual"] # ! summary?
133+
- ["java.lang", "AbstractStringBuilder", "setCharAt", "(int,char)", "manual"]
134+
- ["java.lang", "AbstractStringBuilder", "setLength", "(int)", "manual"]
135+
- ["java.lang", "Boolean", "booleanValue", "()", "manual"]
134136
- ["java.lang", "Boolean", "equals", "(Object)", "manual"]
137+
- ["java.lang", "Boolean", "parseBoolean", "(String)", "manual"]
135138
- ["java.lang", "Boolean", "valueOf", "(boolean)", "manual"]
136139
- ["java.lang", "CharSequence", "length", "()", "manual"]
137140
- ["java.lang", "Class", "forName", "(String)", "manual"]
@@ -179,42 +182,35 @@ extensions:
179182
- ["java.lang", "String", "valueOf", "(boolean)", "manual"]
180183
- ["java.lang", "System", "currentTimeMillis", "()", "manual"]
181184
- ["java.lang", "System", "exit", "(int)", "manual"]
185+
- ["java.lang", "System", "getenv", "(String)", "manual"]
182186
- ["java.lang", "System", "identityHashCode", "(Object)", "manual"]
183-
- ["java.lang", "System", "lineSeparator", "()", "manual"] # ! double-check...
187+
- ["java.lang", "System", "lineSeparator", "()", "manual"]
184188
- ["java.lang", "System", "nanoTime", "()", "manual"]
185189
- ["java.lang", "Thread", "currentThread", "()", "manual"]
186-
- ["java.lang", "Thread", "getContextClassLoader", "()", "manual"] # ! summary instead?
190+
- ["java.lang", "Thread", "getContextClassLoader", "()", "manual"]
187191
- ["java.lang", "Thread", "interrupt", "()", "manual"]
188192
- ["java.lang", "Thread", "sleep", "(long)", "manual"]
189193
- ["java.lang", "Thread", "start", "()", "manual"]
190194
# The below APIs have numeric flow and are currently being stored as neutral models.
191195
# These may be changed to summary models with kinds "value-numeric" and "taint-numeric" (or similar) in the future.
192-
- ["java.lang", "Boolean", "booleanValue", "()", "manual"] # taint-numeric
193-
- ["java.lang", "Boolean", "parseBoolean", "(String)", "manual"] # taint-numeric
194196
- ["java.lang", "Double", "doubleToLongBits", "(double)", "manual"] # taint-numeric
195197
- ["java.lang", "Double", "parseDouble", "(String)", "manual"] # taint-numeric
196198
- ["java.lang", "Double", "valueOf", "(double)", "manual"] # taint-numeric
197199
- ["java.lang", "Integer", "Integer", "(int)", "manual"] # taint-numeric
198200
- ["java.lang", "Integer", "intValue", "()", "manual"] # taint-numeric
199201
- ["java.lang", "Integer", "parseInt", "(String)", "manual"] # taint-numeric
200202
- ["java.lang", "Integer", "toHexString", "(int)", "manual"] # taint-numeric
201-
- ["java.lang", "Integer", "toString", "()", "manual"] # taint-numeric
202-
- ["java.lang", "Integer", "toString", "(int)", "manual"] # taint-numeric
203-
- ["java.lang", "Integer", "valueOf", "(int)", "manual"] # taint-numeric
204-
- ["java.lang", "Integer", "valueOf", "(String)", "manual"] # taint-numeric # ! should probably make this and others like it have a "" signature instead...
203+
- ["java.lang", "Integer", "toString", "", "manual"] # taint-numeric
204+
- ["java.lang", "Integer", "valueOf", "", "manual"] # taint-numeric
205205
- ["java.lang", "Long", "Long", "(long)", "manual"] # taint-numeric
206206
- ["java.lang", "Long", "intValue", "()", "manual"] # taint-numeric
207207
- ["java.lang", "Long", "longValue", "()", "manual"] # taint-numeric
208208
- ["java.lang", "Long", "parseLong", "(String)", "manual"] # taint-numeric
209-
- ["java.lang", "Long", "toString", "()", "manual"] # taint-numeric
210-
- ["java.lang", "Long", "toString", "(long)", "manual"] # taint-numeric
211-
- ["java.lang", "Long", "valueOf", "(long)", "manual"] # taint-numeric
212-
- ["java.lang", "Long", "valueOf", "(String)", "manual"] # taint-numeric
213-
- ["java.lang", "Math", "max", "(int,int)", "manual"] # value-numeric
214-
- ["java.lang", "Math", "max", "(long,long)", "manual"] # value-numeric
215-
- ["java.lang", "Math", "min", "(int,int)", "manual"] # value-numeric
216-
- ["java.lang", "Math", "min", "(long,long)", "manual"] # value-numeric
217-
- ["java.lang", "Number", "doubleValue", "()", "manual"] # taint-numeric # ! remove others that could rely on subtyping through Number instead? (e.g. Double, Integer, etc.)
209+
- ["java.lang", "Long", "toString", "", "manual"] # taint-numeric
210+
- ["java.lang", "Long", "valueOf", "", "manual"] # taint-numeric
211+
- ["java.lang", "Math", "max", "", "manual"] # value-numeric
212+
- ["java.lang", "Math", "min", "", "manual"] # value-numeric
213+
- ["java.lang", "Number", "doubleValue", "()", "manual"] # taint-numeric
218214
- ["java.lang", "Number", "intValue", "()", "manual"] # taint-numeric
219215
- ["java.lang", "Number", "longValue", "()", "manual"] # taint-numeric
220216
- ["java.lang", "String", "valueOf", "(int)", "manual"] # taint-numeric

‎java/ql/lib/ext/java.lang.reflect.model.yml‎

Lines changed: 4 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,9 @@
11
extensions:
2-
- addsTo:
3-
pack: codeql/java-all
4-
extensible: summaryModel
5-
data:
6-
- ["java.lang.reflect", "Constructor", False, "newInstance", "(Object[])", "", "Argument[0].ArrayElement", "ReturnValue.Parameter", "value", "manual"] # ! unsure about input/output
7-
- ["java.lang.reflect", "Field", False, "get", "(Object)", "", "Argument[0].Field", "ReturnValue", "value", "manual"] # ! very unsure about
8-
- ["java.lang.reflect", "Method", False, "invoke", "(Object,Object[])", "", "Argument[1].ArrayElement", "Argument[-1].Parameter[0]", "value", "manual"] # ! very unsure if this model is correct...
9-
102
- addsTo:
113
pack: codeql/java-all
124
extensible: neutralModel
135
data:
14-
- ["java.lang.reflect", "Method", "getName", "()", "manual"] # ! seems uninteresting flow to me, but maybe double-check
6+
- ["java.lang.reflect", "Constructor", "newInstance", "(Object[])", "manual"]
7+
- ["java.lang.reflect", "Field", "get", "(Object)", "manual"]
8+
- ["java.lang.reflect", "Method", "getName", "()", "manual"]
9+
- ["java.lang.reflect", "Method", "invoke", "(Object,Object[])", "manual"]

‎java/ql/lib/ext/java.math.model.yml‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,7 @@ extensions:
77

88
# The below APIs have numeric flow and are currently being stored as neutral models.
99
# These may be changed to summary models with kinds "value-numeric" and "taint-numeric" (or similar) in the future.
10-
- ["java.math", "BigDecimal", "BigDecimal", "(int)", "manual"] # taint-numeric
11-
- ["java.math", "BigDecimal", "BigDecimal", "(String)", "manual"] # taint-numeric
10+
- ["java.math", "BigDecimal", "BigDecimal", "", "manual"] # taint-numeric
1211
- ["java.math", "BigDecimal", "add", "(BigDecimal)", "manual"] # taint-numeric
1312
- ["java.math", "BigDecimal", "doubleValue", "()", "manual"] # taint-numeric
1413
- ["java.math", "BigDecimal", "intValue", "()", "manual"] # taint-numeric
@@ -17,8 +16,7 @@ extensions:
1716
- ["java.math", "BigDecimal", "subtract", "(BigDecimal)", "manual"] # taint-numeric
1817
- ["java.math", "BigDecimal", "toBigInteger", "()", "manual"] # taint-numeric
1918
- ["java.math", "BigDecimal", "toString", "()", "manual"] # taint-numeric
20-
- ["java.math", "BigDecimal", "valueOf", "(double)", "manual"] # taint-numeric
21-
- ["java.math", "BigDecimal", "valueOf", "(long)", "manual"] # taint-numeric
19+
- ["java.math", "BigDecimal", "valueOf", "", "manual"] # taint-numeric
2220
- ["java.math", "BigInteger", "BigInteger", "(String)", "manual"] # taint-numeric
2321
- ["java.math", "BigInteger", "or", "(BigInteger)", "manual"] # taint-numeric
2422
- ["java.math", "BigInteger", "valueOf", "(long)", "manual"] # taint-numeric

‎java/ql/lib/ext/java.nio.charset.model.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
extensions:
22
- addsTo:
33
pack: codeql/java-all
4-
extensible: summaryModel
4+
extensible: neutralModel
55
data:
6-
- ["java.nio.charset", "Charset", False, "name", "()", "", "Argument[-1].SyntheticField[java.nio.charset.Charset.canonicalName]", "ReturnValue", "value", "manual"]
6+
- ["java.nio.charset", "Charset", "name", "()", "manual"]

‎java/ql/lib/ext/java.nio.file.model.yml‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -44,9 +44,8 @@ extensions:
4444
- ["java.nio.file", "FileSystem", True, "getPathMatcher", "(String)", "", "Argument[0]", "ReturnValue", "taint", "ai-generated"]
4545
- ["java.nio.file", "FileSystem", True, "getRootDirectories", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
4646
- ["java.nio.file", "Path", True, "getParent", "", "", "Argument[this]", "ReturnValue", "taint", "manual"]
47-
# ! should Path have subtyping of False for all methods instead? Why is `toFile` different?
4847
- ["java.nio.file", "Path", True, "normalize", "", "", "Argument[this]", "ReturnValue", "taint", "manual"]
49-
- ["java.nio.file", "Path", False, "getFileName", "()", "", "Argument[-1]", "ReturnValue", "taint", "manual"] # ! maybe need more field flow?
48+
- ["java.nio.file", "Path", True, "getFileName", "", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
5049
- ["java.nio.file", "Path", True, "of", "(String,String[])", "", "Argument[0]", "ReturnValue", "taint", "ai-generated"]
5150
- ["java.nio.file", "Path", True, "of", "(String,String[])", "", "Argument[1]", "ReturnValue", "taint", "ai-generated"]
5251
- ["java.nio.file", "Path", True, "of", "(URI)", "", "Argument[0]", "ReturnValue", "taint", "ai-generated"]

‎java/ql/lib/ext/java.nio.model.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,6 @@ extensions:
1111
pack: codeql/java-all
1212
extensible: neutralModel
1313
data:
14-
- ["java.nio", "Buffer", "position", "()", "manual"] # ! maybe should be summary?
14+
- ["java.nio", "Buffer", "position", "()", "manual"]
1515
- ["java.nio", "Buffer", "remaining", "()", "manual"]
1616
- ["java.nio", "ByteBuffer", "allocate", "(int)", "manual"]

0 commit comments

Comments
 (0)