Merge pull request github#5368 from joefarebrother/guava-convert-to-csv

Java: Convert existing Guava models to CSV format

Author: aschackmull

java/ql/src/semmle/code/java/frameworks/guava/Base.qll

@@ -0,0 +1,40 @@
+/** Definitions of flow steps through utility methods of `com.google.common.base`. */
+
+import java
+private import semmle.code.java.dataflow.ExternalFlow
+
+private class GuavaBaseCsv extends SummaryModelCsv {
+  override predicate row(string row) {
+    row =
+      [
+        //"package;type;overrides;name;signature;ext;inputspec;outputspec;kind",
+        "com.google.common.base;Strings;false;emptyToNull;(String);;Argument[0];ReturnValue;value",
+        "com.google.common.base;Strings;false;nullToEmpty;(String);;Argument[0];ReturnValue;value",
+        "com.google.common.base;Strings;false;padStart;(String,int,char);;Argument[0];ReturnValue;taint",
+        "com.google.common.base;Strings;false;padEnd;(String,int,char);;Argument[0];ReturnValue;taint",
+        "com.google.common.base;Strings;false;repeat;(String,int);;Argument[0];ReturnValue;taint",
+        "com.google.common.base;Strings;false;lenientFormat;(String,Object[]);;Argument;ReturnValue;taint",
+        "com.google.common.base;Joiner;false;on;(String);;Argument[0];ReturnValue;taint",
+        "com.google.common.base;Joiner;false;skipNulls;();;Argument[-1];ReturnValue;taint",
+        "com.google.common.base;Joiner;false;useForNull;(String);;Argument[-1];ReturnValue;taint",
+        "com.google.common.base;Joiner;false;useForNull;(String);;Argument[0];ReturnValue;taint",
+        "com.google.common.base;Joiner;false;withKeyValueSeparator;(String);;Argument[0];ReturnValue;taint",
+        "com.google.common.base;Joiner;false;withKeyValueSeparator;(String);;Argument[-1];ReturnValue;taint",
+        "com.google.common.base;Joiner;false;withKeyValueSeparator;(char);;Argument[-1];ReturnValue;taint",
+        // Note: The signatures of some of the appendTo methods involve collection flow
+        "com.google.common.base;Joiner;false;appendTo;;;Argument;Argument[0];taint",
+        "com.google.common.base;Joiner;false;appendTo;;;Argument[0];ReturnValue;value",
+        "com.google.common.base;Joiner;false;join;;;Argument;ReturnValue;taint",
+        "com.google.common.base;Joiner$MapJoiner;false;useForNull;(String);;Argument[0];ReturnValue;taint",
+        "com.google.common.base;Joiner$MapJoiner;false;useForNull;(String);;Argument[-1];ReturnValue;taint",
+        "com.google.common.base;Joiner$MapJoiner;false;appendTo;;;Argument;Argument[0];taint",
+        "com.google.common.base;Joiner$MapJoiner;false;appendTo;;;Argument[0];ReturnValue;value",
+        "com.google.common.base;Joiner$MapJoiner;false;join;;;Argument;ReturnValue;taint",
+        "com.google.common.base;Splitter;false;split;(CharSequence);;Argument[0];ReturnValue;taint",
+        "com.google.common.base;Splitter;false;splitToList;(CharSequence);;Argument[0];ReturnValue;taint",
+        "com.google.common.base;Splitter;false;splitToStream;(CharSequence);;Argument[0];ReturnValue;taint",
+        "com.google.common.base;Splitter$MapSplitter;false;split;(CharSequence);;Argument[0];ReturnValue;taint",
+        "com.google.common.base;Preconditions;false;checkNotNull;;;Argument[0];ReturnValue;value"
+      ]
+  }
+}

java/ql/src/semmle/code/java/frameworks/guava/Guava.qll

@@ -3,7 +3,6 @@
  */
 
 import java
-import StringUtils
+import Base
 import Collections
-import Preconditions
 import IO

java/ql/src/semmle/code/java/frameworks/guava/Preconditions.qll

@@ -1,12 +1,9 @@
-
-import com.google.common.base.Strings;
-import com.google.common.base.Splitter;
-import com.google.common.base.Joiner;
+package com.google.common.base;
 
 import java.util.Map;
 import java.util.HashMap;
 
-class TestStrings {
+class TestBase {
     String taint() { return "tainted"; }
 
     void sink(Object o) {}
@@ -59,4 +56,8 @@ void test3() {
         m.put("k2", x);
         sink(safeJoiner.withKeyValueSeparator("=").join(m)); // $numTaintFlow=1
     }
+
+    void test4() {
+        sink(Preconditions.checkNotNull(taint())); // $numTaintFlow=1
+    }
 }