|
| 1 | +import { Query } from "./query"; |
| 2 | + |
| 3 | +export const fetchExternalApisQuery: Query = { |
| 4 | + mainQuery: `/** |
| 5 | + * @name Usage of APIs coming from external libraries |
| 6 | + * @description A list of 3rd party APIs used in the codebase. Excludes test and generated code. |
| 7 | + * @tags telemetry |
| 8 | + * @id java/telemetry/fetch-external-apis |
| 9 | + */ |
| 10 | +
|
| 11 | +import java |
| 12 | +import semmle.code.java.dataflow.internal.FlowSummaryImpl as FlowSummaryImpl |
| 13 | +import ExternalApi |
| 14 | +
|
| 15 | +private Call aUsage(ExternalApi api) { |
| 16 | + result.getCallee().getSourceDeclaration() = api and |
| 17 | + not result.getFile() instanceof GeneratedFile |
| 18 | +} |
| 19 | +
|
| 20 | +private boolean isSupported(ExternalApi api) { |
| 21 | + api.isSupported() and result = true |
| 22 | + or |
| 23 | + api = any(FlowSummaryImpl::Public::NeutralCallable nsc).asCallable() and result = true |
| 24 | + or |
| 25 | + not api.isSupported() and |
| 26 | + not api = any(FlowSummaryImpl::Public::NeutralCallable nsc).asCallable() and |
| 27 | + result = false |
| 28 | +} |
| 29 | +
|
| 30 | +from ExternalApi api, string apiName, boolean supported, Call usage |
| 31 | +where |
| 32 | + apiName = api.getApiName() and |
| 33 | + supported = isSupported(api) and |
| 34 | + usage = aUsage(api) |
| 35 | +select apiName, supported, usage |
| 36 | +`, |
| 37 | + dependencies: { |
| 38 | + "ExternalApi.qll": `/** Provides classes and predicates related to handling APIs from external libraries. */ |
| 39 | +
|
| 40 | +private import java |
| 41 | +private import semmle.code.java.dataflow.DataFlow |
| 42 | +private import semmle.code.java.dataflow.ExternalFlow |
| 43 | +private import semmle.code.java.dataflow.FlowSources |
| 44 | +private import semmle.code.java.dataflow.FlowSummary |
| 45 | +private import semmle.code.java.dataflow.internal.DataFlowPrivate |
| 46 | +private import semmle.code.java.dataflow.TaintTracking |
| 47 | +
|
| 48 | +pragma[nomagic] |
| 49 | +private predicate isTestPackage(Package p) { |
| 50 | + p.getName() |
| 51 | + .matches([ |
| 52 | + "org.junit%", "junit.%", "org.mockito%", "org.assertj%", |
| 53 | + "com.github.tomakehurst.wiremock%", "org.hamcrest%", "org.springframework.test.%", |
| 54 | + "org.springframework.mock.%", "org.springframework.boot.test.%", "reactor.test%", |
| 55 | + "org.xmlunit%", "org.testcontainers.%", "org.opentest4j%", "org.mockserver%", |
| 56 | + "org.powermock%", "org.skyscreamer.jsonassert%", "org.rnorth.visibleassertions", |
| 57 | + "org.openqa.selenium%", "com.gargoylesoftware.htmlunit%", "org.jboss.arquillian.testng%", |
| 58 | + "org.testng%" |
| 59 | + ]) |
| 60 | +} |
| 61 | +
|
| 62 | +/** |
| 63 | + * A test library. |
| 64 | + */ |
| 65 | +private class TestLibrary extends RefType { |
| 66 | + TestLibrary() { isTestPackage(this.getPackage()) } |
| 67 | +} |
| 68 | +
|
| 69 | +private string containerAsJar(Container container) { |
| 70 | + if container instanceof JarFile then result = container.getBaseName() else result = "rt.jar" |
| 71 | +} |
| 72 | +
|
| 73 | +/** Holds if the given callable is not worth supporting. */ |
| 74 | +private predicate isUninteresting(Callable c) { |
| 75 | + c.getDeclaringType() instanceof TestLibrary or |
| 76 | + c.(Constructor).isParameterless() |
| 77 | +} |
| 78 | +
|
| 79 | +/** |
| 80 | + * An external API from either the Standard Library or a 3rd party library. |
| 81 | + */ |
| 82 | +class ExternalApi extends Callable { |
| 83 | + ExternalApi() { not this.fromSource() and not isUninteresting(this) } |
| 84 | +
|
| 85 | + /** |
| 86 | + * Gets information about the external API in the form expected by the MaD modeling framework. |
| 87 | + */ |
| 88 | + string getApiName() { |
| 89 | + result = |
| 90 | + this.getDeclaringType().getPackage() + "." + this.getDeclaringType().getSourceDeclaration() + |
| 91 | + "#" + this.getName() + paramsString(this) |
| 92 | + } |
| 93 | +
|
| 94 | + /** |
| 95 | + * Gets the jar file containing this API. Normalizes the Java Runtime to "rt.jar" despite the presence of modules. |
| 96 | + */ |
| 97 | + string jarContainer() { result = containerAsJar(this.getCompilationUnit().getParentContainer*()) } |
| 98 | +
|
| 99 | + /** Gets a node that is an input to a call to this API. */ |
| 100 | + private DataFlow::Node getAnInput() { |
| 101 | + exists(Call call | call.getCallee().getSourceDeclaration() = this | |
| 102 | + result.asExpr().(Argument).getCall() = call or |
| 103 | + result.(ArgumentNode).getCall().asCall() = call |
| 104 | + ) |
| 105 | + } |
| 106 | +
|
| 107 | + /** Gets a node that is an output from a call to this API. */ |
| 108 | + private DataFlow::Node getAnOutput() { |
| 109 | + exists(Call call | call.getCallee().getSourceDeclaration() = this | |
| 110 | + result.asExpr() = call or |
| 111 | + result.(DataFlow::PostUpdateNode).getPreUpdateNode().(ArgumentNode).getCall().asCall() = call |
| 112 | + ) |
| 113 | + } |
| 114 | +
|
| 115 | + /** Holds if this API has a supported summary. */ |
| 116 | + pragma[nomagic] |
| 117 | + predicate hasSummary() { |
| 118 | + this = any(SummarizedCallable sc).asCallable() or |
| 119 | + TaintTracking::localAdditionalTaintStep(this.getAnInput(), _) |
| 120 | + } |
| 121 | +
|
| 122 | + pragma[nomagic] |
| 123 | + predicate isSource() { |
| 124 | + this.getAnOutput() instanceof RemoteFlowSource or sourceNode(this.getAnOutput(), _) |
| 125 | + } |
| 126 | +
|
| 127 | + /** Holds if this API is a known sink. */ |
| 128 | + pragma[nomagic] |
| 129 | + predicate isSink() { sinkNode(this.getAnInput(), _) } |
| 130 | +
|
| 131 | + /** Holds if this API is supported by existing CodeQL libraries, that is, it is either a recognized source or sink or has a flow summary. */ |
| 132 | + predicate isSupported() { this.hasSummary() or this.isSource() or this.isSink() } |
| 133 | +} |
| 134 | +
|
| 135 | +/** DEPRECATED: Alias for ExternalApi */ |
| 136 | +deprecated class ExternalAPI = ExternalApi; |
| 137 | +
|
| 138 | +/** |
| 139 | + * Gets the limit for the number of results produced by a telemetry query. |
| 140 | + */ |
| 141 | +int resultLimit() { result = 1000 } |
| 142 | +
|
| 143 | +/** |
| 144 | + * Holds if it is relevant to count usages of \`api\`. |
| 145 | + */ |
| 146 | +signature predicate relevantApi(ExternalApi api); |
| 147 | +
|
| 148 | +/** |
| 149 | + * Given a predicate to count relevant API usages, this module provides a predicate |
| 150 | + * for restricting the number or returned results based on a certain limit. |
| 151 | + */ |
| 152 | +module Results<relevantApi/1 getRelevantUsages> { |
| 153 | + private int getUsages(string apiName) { |
| 154 | + result = |
| 155 | + strictcount(Call c, ExternalApi api | |
| 156 | + c.getCallee().getSourceDeclaration() = api and |
| 157 | + not c.getFile() instanceof GeneratedFile and |
| 158 | + apiName = api.getApiName() and |
| 159 | + getRelevantUsages(api) |
| 160 | + ) |
| 161 | + } |
| 162 | +
|
| 163 | + private int getOrder(string apiInfo) { |
| 164 | + apiInfo = |
| 165 | + rank[result](string info, int usages | |
| 166 | + usages = getUsages(info) |
| 167 | + | |
| 168 | + info order by usages desc, info |
| 169 | + ) |
| 170 | + } |
| 171 | +
|
| 172 | + /** |
| 173 | + * Holds if there exists an API with \`apiName\` that is being used \`usages\` times |
| 174 | + * and if it is in the top results (guarded by resultLimit). |
| 175 | + */ |
| 176 | + predicate restrict(string apiName, int usages) { |
| 177 | + usages = getUsages(apiName) and |
| 178 | + getOrder(apiName) <= resultLimit() |
| 179 | + } |
| 180 | +} |
| 181 | +`, |
| 182 | + }, |
| 183 | +}; |
0 commit comments