Skip to content

Commit dce81cf

Browse files
kaelukakaeluka
authored
Merge pull request github#12463 from github/java/update-mad-decls-after-triage-2023-03-09T10-41-58
Java: Add MaD declarations after triage
2 parents 208ae19 + 5bc6067 commit dce81cf

File tree

396 files changed

+10534
-1910
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

396 files changed

+10534
-1910
lines changed

‎java/ql/lib/ext/com.thoughtworks.xstream.model.yml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/java-all
4+
extensible: sinkModel
5+
data:
6+
- ["com.thoughtworks.xstream", "XStream", True, "fromXML", "(File)", "", "Argument[0]", "read-file", "ai-generated"]

‎java/ql/lib/ext/hudson.remoting.model.yml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/java-all
4+
extensible: summaryModel
5+
data:
6+
- ["hudson.remoting", "URLDeserializationHelper", True, "wrapIfRequired", "(URL)", "", "Argument[0]", "ReturnValue", "taint", "ai-generated"]

‎java/ql/lib/ext/io.netty.resolver.model.yml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/java-all
4+
extensible: summaryModel
5+
data:
6+
- ["io.netty.resolver", "SimpleNameResolver", False, "resolve", "(String)", "", "Argument[0]", "ReturnValue", "taint", "ai-generated"]

‎java/ql/lib/ext/java.io.model.yml

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -87,9 +87,7 @@ extensions:
8787
- ["java.io", "OutputStream", True, "write", "(byte[],int,int)", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
8888
- ["java.io", "OutputStream", True, "write", "(int)", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
8989
- ["java.io", "Reader", True, "read", "", "", "Argument[-1]", "Argument[0]", "taint", "manual"]
90-
- ["java.io", "Reader", True, "read", "()", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
9190
- ["java.io", "StringReader", False, "StringReader", "", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
92-
- ["java.io", "Writer", True, "toString", "", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
9391
- ["java.io", "Writer", True, "write", "", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
9492
- addsTo:
9593
pack: codeql/java-all

‎java/ql/lib/ext/java.net.model.yml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,9 @@ extensions:
99
pack: codeql/java-all
1010
extensible: sinkModel
1111
data:
12+
- ["java.net", "DatagramSocket", True, "connect", "(SocketAddress)", "", "Argument[0]", "open-url", "ai-generated"]
1213
- ["java.net", "URL", False, "openConnection", "", "", "Argument[-1]", "open-url", "manual"]
14+
- ["java.net", "URL", False, "openConnection", "(Proxy)", "", "Argument[0]", "open-url", "ai-generated"]
1315
- ["java.net", "URL", False, "openStream", "", "", "Argument[-1]", "open-url", "manual"]
1416
- ["java.net", "URLClassLoader", False, "URLClassLoader", "(String,URL[],ClassLoader)", "", "Argument[1]", "open-url", "manual"]
1517
- ["java.net", "URLClassLoader", False, "URLClassLoader", "(String,URL[],ClassLoader,URLStreamHandlerFactory)", "", "Argument[1]", "open-url", "manual"]
@@ -21,6 +23,11 @@ extensions:
2123
pack: codeql/java-all
2224
extensible: summaryModel
2325
data:
26+
- ["java.net", "InetAddress", True, "getByName", "(String)", "", "Argument[0]", "ReturnValue", "taint", "ai-generated"]
27+
- ["java.net", "InetSocketAddress", True, "createUnresolved", "(String,int)", "", "Argument[0]", "ReturnValue", "taint", "ai-generated"]
28+
- ["java.net", "InetSocketAddress", True, "InetSocketAddress", "(String,int)", "", "Argument[0]", "Argument[-1]", "taint", "ai-generated"]
29+
- ["java.net", "URI", False, "resolve", "(String)", "", "Argument[0]", "ReturnValue", "taint", "ai-generated"]
30+
- ["java.net", "URI", False, "resolve", "(URI)", "", "Argument[0]", "ReturnValue", "taint", "ai-generated"]
2431
- ["java.net", "URI", False, "URI", "(String)", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
2532
- ["java.net", "URI", False, "create", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
2633
- ["java.net", "URI", False, "toASCIIString", "", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
@@ -29,4 +36,6 @@ extensions:
2936
- ["java.net", "URL", False, "URL", "(String)", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
3037
- ["java.net", "URL", False, "toURI", "", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
3138
- ["java.net", "URL", False, "toExternalForm", "", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
39+
- ["java.net", "URL", False, "URL", "(URL,String)", "", "Argument[0]", "Argument[-1]", "taint", "ai-generated"]
40+
- ["java.net", "URL", False, "URL", "(URL,String)", "", "Argument[1]", "Argument[-1]", "taint", "ai-generated"] # @atorralba: review for consistency
3241
- ["java.net", "URLDecoder", False, "decode", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]

‎java/ql/lib/ext/java.nio.file.model.yml

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,11 @@ extensions:
1212
- ["java.nio.file", "Files", False, "createSymbolicLink", "", "", "Argument[0]", "create-file", "manual"]
1313
- ["java.nio.file", "Files", False, "createTempDirectory", "(Path,String,FileAttribute[])", "", "Argument[0]", "create-file", "manual"]
1414
- ["java.nio.file", "Files", False, "createTempFile", "(Path,String,String,FileAttribute[])", "", "Argument[0]", "create-file", "manual"]
15+
- ["java.nio.file", "Files", False, "delete", "(Path)", "", "Argument[0]", "create-file", "ai-generated"] # should be delete-file
16+
- ["java.nio.file", "Files", False, "deleteIfExists", "(Path)", "", "Argument[0]", "create-file", "ai-generated"] # should be delete-file
17+
- ["java.nio.file", "Files", False, "lines", "(Path,Charset)", "", "Argument[0]", "read-file", "ai-generated"]
1518
- ["java.nio.file", "Files", False, "move", "", "", "Argument[1]", "create-file", "manual"]
19+
- ["java.nio.file", "Files", False, "newBufferedReader", "(Path,Charset)", "", "Argument[0]", "read-file", "ai-generated"]
1620
- ["java.nio.file", "Files", False, "newBufferedWriter", "", "", "Argument[0]", "create-file", "manual"]
1721
- ["java.nio.file", "Files", False, "newOutputStream", "", "", "Argument[0]", "create-file", "manual"]
1822
- ["java.nio.file", "Files", False, "write", "", "", "Argument[0]", "create-file", "manual"]
@@ -24,7 +28,6 @@ extensions:
2428
extensible: summaryModel
2529
data:
2630
- ["java.nio.file", "FileSystem", True, "getPath", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
27-
- ["java.nio.file", "FileSystem", True, "getRootDirectories", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
2831
- ["java.nio.file", "Path", True, "getParent", "", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
2932
- ["java.nio.file", "Path", True, "normalize", "", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
3033
- ["java.nio.file", "Path", True, "resolve", "", "", "Argument[-1..0]", "ReturnValue", "taint", "manual"]

‎java/ql/lib/ext/javax.xml.transform.stream.model.yml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,3 +5,8 @@ extensions:
55
data:
66
- ["javax.xml.transform.stream", "StreamSource", False, "StreamSource", "", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
77
- ["javax.xml.transform.stream", "StreamSource", False, "getInputStream", "", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
8+
- addsTo:
9+
pack: codeql/java-all
10+
extensible: sinkModel
11+
data:
12+
- ["javax.xml.transform.stream", "StreamResult", True, "StreamResult", "(File)", "", "Argument[0]", "create-file", "ai-generated"]

‎java/ql/lib/ext/org.apache.commons.compress.archivers.tar.model.yml

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,5 +3,7 @@ extensions:
33
pack: codeql/java-all
44
extensible: summaryModel
55
data:
6-
- ["org.apache.commons.compress.archivers.tar", "TarArchiveEntry", True, "TarArchiveEntry", "(String,boolean)", "", "Argument[0]", "Argument[-1]", "taint", "ai-generated"]
76
- ["org.apache.commons.compress.archivers.tar", "TarArchiveEntry", True, "TarArchiveEntry", "(String)", "", "Argument[0]", "Argument[-1]", "taint", "ai-generated"]
7+
- ["org.apache.commons.compress.archivers.tar", "TarArchiveEntry", True, "TarArchiveEntry", "(String,boolean)", "", "Argument[0]", "Argument[-1]", "taint", "ai-generated"]
8+
- ["org.apache.commons.compress.archivers.tar", "TarArchiveEntry", True, "TarArchiveEntry", "(String,byte)", "", "Argument[0]", "Argument[-1]", "taint", "ai-generated"]
9+
- ["org.apache.commons.compress.archivers.tar", "TarArchiveEntry", True, "setLinkName", "(String)", "", "Argument[0]", "Argument[-1]", "taint", "ai-generated"]

‎java/ql/lib/ext/org.apache.commons.io.model.yml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,3 +12,8 @@ extensions:
1212
- ["org.apache.commons.io", "IOUtils", True, "toByteArray", "(Reader,String)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
1313
- ["org.apache.commons.io", "IOUtils", True, "writeLines", "(Collection,String,Writer)", "", "Argument[0].Element", "Argument[2]", "taint", "manual"]
1414
- ["org.apache.commons.io", "IOUtils", True, "writeLines", "(Collection,String,Writer)", "", "Argument[1]", "Argument[2]", "taint", "manual"]
15+
- addsTo:
16+
pack: codeql/java-all
17+
extensible: sinkModel
18+
data:
19+
- ["org.apache.commons.io", "FileUtils", True, "openInputStream", "(File)", "", "Argument[0]", "read-file", "ai-generated"]

‎java/ql/lib/ext/org.apache.commons.jelly.model.yml

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/java-all
4+
extensible: sinkModel
5+
data:
6+
- ["org.apache.commons.jelly", "JellyContext", True, "JellyContext", "(JellyContext,URL,URL)", "", "Argument[1]", "open-url", "ai-generated"]
7+
- ["org.apache.commons.jelly", "JellyContext", True, "JellyContext", "(JellyContext,URL,URL)", "", "Argument[2]", "open-url", "ai-generated"]
8+
- ["org.apache.commons.jelly", "JellyContext", True, "JellyContext", "(JellyContext,URL)", "", "Argument[1]", "open-url", "ai-generated"]
9+
- ["org.apache.commons.jelly", "JellyContext", True, "JellyContext", "(URL,URL)", "", "Argument[0]", "open-url", "ai-generated"]
10+
- ["org.apache.commons.jelly", "JellyContext", True, "JellyContext", "(URL,URL)", "", "Argument[1]", "open-url", "ai-generated"]
11+
- ["org.apache.commons.jelly", "JellyContext", True, "JellyContext", "(URL)", "", "Argument[0]", "open-url", "ai-generated"]

‎java/ql/lib/ext/org.apache.tools.ant.model.yml

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/java-all
4+
extensible: sinkModel
5+
data:
6+
- ["org.apache.tools.ant", "AntClassLoader", True, "addPathComponent", "(File)", "", "Argument[0]", "read-file", "ai-generated"]
7+
- ["org.apache.tools.ant", "AntClassLoader", True, "AntClassLoader", "(ClassLoader,Project,Path,boolean)", "", "Argument[2]", "read-file", "ai-generated"]
8+
- ["org.apache.tools.ant", "AntClassLoader", True, "AntClassLoader", "(Project,Path,boolean)", "", "Argument[1]", "read-file", "ai-generated"]
9+
- ["org.apache.tools.ant", "AntClassLoader", True, "AntClassLoader", "(Project,Path)", "", "Argument[1]", "read-file", "ai-generated"]
10+
- ["org.apache.tools.ant", "DirectoryScanner", True, "setBasedir", "(File)", "", "Argument[0]", "read-file", "ai-generated"]

‎java/ql/lib/ext/org.apache.tools.ant.taskdefs.model.yml

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/java-all
4+
extensible: sinkModel
5+
data:
6+
- ["org.apache.tools.ant.taskdefs", "Copy", True, "addFileset", "(FileSet)", "", "Argument[0]", "read-file", "ai-generated"]
7+
- ["org.apache.tools.ant.taskdefs", "Copy", True, "setFile", "(File)", "", "Argument[0]", "read-file", "ai-generated"]
8+
- ["org.apache.tools.ant.taskdefs", "Copy", True, "setTodir", "(File)", "", "Argument[0]", "create-file", "ai-generated"]
9+
- ["org.apache.tools.ant.taskdefs", "Copy", True, "setTofile", "(File)", "", "Argument[0]", "create-file", "ai-generated"]
10+
- ["org.apache.tools.ant.taskdefs", "Expand", True, "setDest", "(File)", "", "Argument[0]", "create-file", "ai-generated"]
11+
- ["org.apache.tools.ant.taskdefs", "Expand", True, "setSrc", "(File)", "", "Argument[0]", "read-file", "ai-generated"]

‎java/ql/lib/ext/org.apache.tools.zip.model.yml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/java-all
4+
extensible: summaryModel
5+
data:
6+
- ["org.apache.tools.zip", "ZipEntry", True, "ZipEntry", "(String)", "", "Argument[0]", "Argument[-1]", "taint", "ai-generated"]

‎java/ql/lib/ext/org.kohsuke.stapler.framework.adjunct.model.yml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/java-all
4+
extensible: summaryModel
5+
data:
6+
- ["org.kohsuke.stapler.framework.adjunct", "AdjunctManager", True, "AdjunctManager", "(ServletContext,ClassLoader,String,long)", "", "Argument[2]", "Argument[-1].Field[org.kohsuke.stapler.framework.adjunct.AdjunctManager.rootURL]", "taint", "ai-generated"] # the class never accesses the URL, but the field is public

‎java/ql/lib/ext/org.kohsuke.stapler.framework.io.model.yml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/java-all
4+
extensible: sinkModel
5+
data:
6+
- ["org.kohsuke.stapler.framework.io", "LargeText", True, "LargeText", "(File,Charset,boolean,boolean)", "", "Argument[0]", "read-file", "ai-generated"]

‎java/ql/lib/ext/org.kohsuke.stapler.model.yml

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/java-all
4+
extensible: sinkModel
5+
data:
6+
- ["org.kohsuke.stapler", "HttpResponses", True, "redirectTo", "(String)", "", "Argument[0]", "url-redirect", "ai-generated"]
7+
- ["org.kohsuke.stapler", "HttpResponses", True, "staticResource", "(URL)", "", "Argument[0]", "open-url", "ai-generated"]

‎java/ql/lib/ext/org.openjdk.jmh.runner.options.model.yml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/java-all
4+
extensible: sinkModel
5+
data:
6+
- ["org.openjdk.jmh.runner.options", "ChainedOptionsBuilder", True, "result", "(String)", "", "Argument[0]", "create-file", "ai-generated"]

‎java/ql/test/library-tests/frameworks/apache-ant/Test.java

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
package generatedtest;
2+
3+
import org.apache.tools.zip.ZipEntry;
4+
5+
// Test case generated by GenerateFlowTestCase.ql
6+
public class Test {
7+
8+
Object source() {
9+
return null;
10+
}
11+
12+
void sink(Object o) {}
13+
14+
public void test() throws Exception {
15+
16+
{
17+
// "org.apache.tools.zip;ZipEntry;true;ZipEntry;(String);;Argument[0];Argument[-1];taint;ai-generated"
18+
ZipEntry out = null;
19+
String in = (String) source();
20+
out = new ZipEntry(in);
21+
sink(out); // $ hasTaintFlow
22+
}
23+
24+
}
25+
26+
}

‎java/ql/test/library-tests/frameworks/apache-ant/options

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
//semmle-extractor-options: --javac-args -cp ${testdir}/../../../stubs/apache-ant-1.10.13

‎java/ql/test/library-tests/frameworks/apache-ant/test.expected

Whitespace-only changes.

‎java/ql/test/library-tests/frameworks/apache-ant/test.ql

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
import java
2+
import TestUtilities.InlineFlowTest

‎java/ql/test/library-tests/frameworks/apache-commons-compress/Test.java

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,20 @@ public void test() throws Exception {
2626
out = new TarArchiveEntry(in, false);
2727
sink(out); // $ hasTaintFlow
2828
}
29+
{
30+
// "org.apache.commons.compress.archivers.tar;TarArchiveEntry;true;TarArchiveEntry;(String,byte);;Argument[0];Argument[-1];taint;ai-generated"
31+
TarArchiveEntry out = null;
32+
String in = (String) source();
33+
out = new TarArchiveEntry(in, (byte) 0);
34+
sink(out); // $ hasTaintFlow
35+
}
36+
{
37+
// "org.apache.commons.compress.archivers.tar;TarArchiveEntry;true;setLinkName;(String);;Argument[0];Argument[-1];taint;ai-generated"
38+
TarArchiveEntry out = null;
39+
String in = (String) source();
40+
out.setLinkName(in);
41+
sink(out); // $ hasTaintFlow
42+
}
2943

3044
}
3145

‎java/ql/test/library-tests/frameworks/hudson/Test.java

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
package generatedtest;
2+
3+
import hudson.remoting.URLDeserializationHelper;
4+
import java.net.URL;
5+
6+
// Test case generated by GenerateFlowTestCase.ql
7+
public class Test {
8+
9+
Object source() {
10+
return null;
11+
}
12+
13+
void sink(Object o) {
14+
}
15+
16+
public void test() throws Exception {
17+
18+
{
19+
// "hudson.remoting;URLDeserializationHelper;true;wrapIfRequired;(URL);;Argument[0];ReturnValue;taint;ai-generated"
20+
URL out = null;
21+
URL in = (URL) source();
22+
out = URLDeserializationHelper.wrapIfRequired(in);
23+
sink(out); // $ hasTaintFlow
24+
}
25+
26+
}
27+
28+
}

‎java/ql/test/library-tests/frameworks/hudson/options

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
//semmle-extractor-options: --javac-args -cp ${testdir}/../../../stubs/jenkins

‎java/ql/test/library-tests/frameworks/hudson/test.expected

Whitespace-only changes.

‎java/ql/test/library-tests/frameworks/hudson/test.ql

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
import java
2+
import TestUtilities.InlineFlowTest

0 commit comments

Comments
 (0)