Add classification and type to queries

Author: koesie10

extensions/ql-vscode/src/data-extensions-editor/queries/csharp.ts

@@ -22,12 +22,16 @@ class ExternalApi extends CallableMethod {
 
 private Call aUsage(ExternalApi api) { result.getTarget().getUnboundDeclaration() = api }
 
-from ExternalApi api, string apiName, boolean supported, Call usage
+from
+  ExternalApi api, string apiName, boolean supported, Call usage, string type, string classification
 where
   apiName = api.getApiName() and
   supported = isSupported(api) and
-  usage = aUsage(api)
-select usage, apiName, supported.toString(), "supported", api.getFile().getBaseName(), "library"
+  usage = aUsage(api) and
+  type = supportedType(api) and
+  classification = methodClassification(usage)
+select usage, apiName, supported.toString(), "supported", api.getFile().getBaseName(), "library",
+  type, "type", classification, "classification"
 `,
   frameworkModeQuery: `/**
  * @name Public methods
@@ -46,12 +50,13 @@ class PublicMethod extends CallableMethod {
   PublicMethod() { this.fromSource() and not this.getFile() instanceof TestFile }
 }
 
-from PublicMethod publicMethod, string apiName, boolean supported
+from PublicMethod publicMethod, string apiName, boolean supported, string type
 where
   apiName = publicMethod.getApiName() and
-  supported = isSupported(publicMethod)
+  supported = isSupported(publicMethod) and
+  type = supportedType(publicMethod)
 select publicMethod, apiName, supported.toString(), "supported",
-  publicMethod.getFile().getBaseName(), "library"
+  publicMethod.getFile().getBaseName(), "library", type, "type", "unknown", "classification"
 `,
   dependencies: {
     "AutomodelVsCode.qll": `/** Provides classes and predicates related to handling APIs for the VS Code extension. */
@@ -66,6 +71,7 @@ private import semmle.code.csharp.dataflow.internal.DataFlowPrivate
 private import semmle.code.csharp.dataflow.internal.DataFlowDispatch as DataFlowDispatch
 private import semmle.code.csharp.dataflow.internal.FlowSummaryImpl as FlowSummaryImpl
 private import semmle.code.csharp.dataflow.internal.TaintTrackingPrivate
+private import semmle.code.csharp.frameworks.Test
 private import semmle.code.csharp.security.dataflow.flowsources.Remote
 
 pragma[nomagic]
@@ -180,6 +186,25 @@ boolean isSupported(CallableMethod callableMethod) {
   result = false
 }
 
+string supportedType(CallableMethod method) {
+  method.isSink() and result = "sink"
+  or
+  method.isSource() and result = "source"
+  or
+  method.hasSummary() and result = "summary"
+  or
+  method.isNeutral() and result = "neutral"
+  or
+  not method.isSupported() and result = "none"
+}
+
+string methodClassification(Call method) {
+  method.getFile() instanceof TestFile and result = "test"
+  or
+  not method.getFile() instanceof TestFile and
+  result = "source"
+}
+
 /**
  * Gets the nested name of the declaration.
  *

extensions/ql-vscode/src/data-extensions-editor/queries/java.ts

@@ -16,17 +16,19 @@ class ExternalApi extends CallableMethod {
   ExternalApi() { not this.fromSource() }
 }
 
-private Call aUsage(ExternalApi api) {
-  result.getCallee().getSourceDeclaration() = api and
-  not result.getFile() instanceof GeneratedFile
-}
+private Call aUsage(ExternalApi api) { result.getCallee().getSourceDeclaration() = api }
 
-from ExternalApi externalApi, string apiName, boolean supported, Call usage
+from
+  ExternalApi externalApi, string apiName, boolean supported, Call usage, string type,
+  string classification
 where
   apiName = externalApi.getApiName() and
   supported = isSupported(externalApi) and
-  usage = aUsage(externalApi)
-select usage, apiName, supported.toString(), "supported", externalApi.jarContainer(), "library"
+  usage = aUsage(externalApi) and
+  type = supportedType(externalApi) and
+  classification = methodClassification(usage)
+select usage, apiName, supported.toString(), "supported", externalApi.jarContainer(), "library",
+  type, "type", classification, "classification"
 `,
   frameworkModeQuery: `/**
  * @name Public methods
@@ -41,12 +43,14 @@ import AutomodelVsCode
 
 class PublicMethodFromSource extends CallableMethod, ModelApi { }
 
-from PublicMethodFromSource publicMethod, string apiName, boolean supported
+from PublicMethodFromSource publicMethod, string apiName, boolean supported, string type
 where
   apiName = publicMethod.getApiName() and
-  supported = isSupported(publicMethod)
+  supported = isSupported(publicMethod) and
+  type = supportedType(publicMethod)
 select publicMethod, apiName, supported.toString(), "supported",
-  publicMethod.getCompilationUnit().getParentContainer().getBaseName(), "library"
+  publicMethod.getCompilationUnit().getParentContainer().getBaseName(), "library", type, "type",
+  "unknown", "classification"
 `,
   dependencies: {
     "AutomodelVsCode.qll": `/** Provides classes and predicates related to handling APIs for the VS Code extension. */
@@ -147,6 +151,28 @@ boolean isSupported(CallableMethod method) {
   not method.isSupported() and result = false
 }
 
+string supportedType(CallableMethod method) {
+  method.isSink() and result = "sink"
+  or
+  method.isSource() and result = "source"
+  or
+  method.hasSummary() and result = "summary"
+  or
+  method.isNeutral() and result = "neutral"
+  or
+  not method.isSupported() and result = "none"
+}
+
+string methodClassification(Call method) {
+  isInTestFile(method.getLocation().getFile()) and result = "test"
+  or
+  method.getFile() instanceof GeneratedFile and result = "generated"
+  or
+  not isInTestFile(method.getLocation().getFile()) and
+  not method.getFile() instanceof GeneratedFile and
+  result = "source"
+}
+
 // The below is a copy of https://github.com/github/codeql/blob/249f9f863db1e94e3c46ca85b49fb0ec32f8ca92/java/ql/lib/semmle/code/java/dataflow/internal/ModelExclusions.qll
 // to avoid the use of internal modules.
 /** Holds if the given package \`p\` is a test package. */

extensions/ql-vscode/src/data-extensions-editor/queries/query.ts

@@ -9,6 +9,10 @@ export type Query = {
    * - "supported": a string literal. This is required to make the query a valid problem query.
    * - libraryName: the name of the library that contains the external API. This is a string and usually the basename of a file.
    * - "library": a string literal. This is required to make the query a valid problem query.
+   * - type: the modeled kind of the method, either "sink", "source", "summary", or "neutral"
+   * - "type": a string literal. This is required to make the query a valid problem query.
+   * - classification: the classification of the use of the method, either "source", "test", "generated", or "unknown"
+   * - "classification: a string literal. This is required to make the query a valid problem query.
    */
   applicationModeQuery: string;
   /**
@@ -22,6 +26,10 @@ export type Query = {
    * - "supported": a string literal. This is required to make the query a valid problem query.
    * - libraryName: an arbitrary string. This is required to make it match the structure of the application query.
    * - "library": a string literal. This is required to make the query a valid problem query.
+   * - type: the modeled kind of the method, either "sink", "source", "summary", or "neutral"
+   * - "type": a string literal. This is required to make the query a valid problem query.
+   * - "unknown": a string literal. This is required to make it match the structure of the application query.
+   * - "classification: a string literal. This is required to make the query a valid problem query.
    */
   frameworkModeQuery: string;
   dependencies?: {