Java: Deprecate the content of ImproperValidationOrArray and remove local query variants.

Author: michaelnebel

java/ql/lib/semmle/code/java/security/ImproperValidationOfArrayConstructionLocalQuery.qll

@@ -7,7 +7,7 @@ private import semmle.code.java.dataflow.FlowSources
 /**
  * A taint-tracking configuration to reason about improper validation of local user-provided size used for array construction.
  */
-module ImproperValidationOfArrayConstructionLocalConfig implements DataFlow::ConfigSig {
+deprecated module ImproperValidationOfArrayConstructionLocalConfig implements DataFlow::ConfigSig {
   predicate isSource(DataFlow::Node source) { source instanceof LocalUserInput }
 
   predicate isSink(DataFlow::Node sink) {
@@ -16,7 +16,9 @@ module ImproperValidationOfArrayConstructionLocalConfig implements DataFlow::Con
 }
 
 /**
+ * DEPRECATED: Use `ImproperValidationOfArrayConstructionFlow` instead and configure threat model sources to include `local`.
+ *
  * Taint-tracking flow for improper validation of local user-provided size used for array construction.
  */
-module ImproperValidationOfArrayConstructionLocalFlow =
+deprecated module ImproperValidationOfArrayConstructionLocalFlow =
   TaintTracking::Global<ImproperValidationOfArrayConstructionLocalConfig>;

java/ql/lib/semmle/code/java/security/ImproperValidationOfArrayIndexLocalQuery.qll

@@ -7,7 +7,7 @@ private import semmle.code.java.dataflow.FlowSources
 /**
  * A taint-tracking configuration to reason about improper validation of local user-provided array index.
  */
-module ImproperValidationOfArrayIndexLocalConfig implements DataFlow::ConfigSig {
+deprecated module ImproperValidationOfArrayIndexLocalConfig implements DataFlow::ConfigSig {
   predicate isSource(DataFlow::Node source) { source instanceof LocalUserInput }
 
   predicate isSink(DataFlow::Node sink) {
@@ -20,7 +20,9 @@ module ImproperValidationOfArrayIndexLocalConfig implements DataFlow::ConfigSig
 }
 
 /**
+ * DEPRECATED: Use `ImproperValidationOfArrayIndexFlow` instead and configure threat model sources to include `local`.
+ *
  * Taint-tracking flow for improper validation of local user-provided array index.
  */
-module ImproperValidationOfArrayIndexLocalFlow =
+deprecated module ImproperValidationOfArrayIndexLocalFlow =
   TaintTracking::Global<ImproperValidationOfArrayIndexLocalConfig>;

java/ql/src/Security/CWE/CWE-129/ImproperValidationOfArrayConstructionLocal.qhelp

@@ -0,0 +1,6 @@
+extensions:
+  - addsTo:
+      pack: codeql/threat-models
+      extensible: threatModelConfiguration
+    data:
+      - ["local", true, 0]

java/ql/src/Security/CWE/CWE-129/ImproperValidationOfArrayConstructionLocal.ql

@@ -0,0 +1 @@
+Security/CWE/CWE-129/ImproperValidationOfArrayConstruction.ql