Skip to content

Commit 4c590d1

Browse files
Jami CogswellJami Cogswell
Jami Cogswell
authored and
Jami Cogswell
committed
Java: move most negative models to package.model.yml files
1 parent b7016fe commit 4c590d1

File tree

4 files changed

+95
-38
lines changed

4 files changed

+95
-38
lines changed

‎java/ql/lib/ext/TopJdkApis.model.yml

Lines changed: 43 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -90,42 +90,47 @@ extensions:
9090
extensible: extNegativeSummaryModel
9191
data:
9292
# namespace; type; name; signature; provenance (5)
93-
- ["java.util", "Objects", "equals", "(Object,Object)", "manual"] # UNSUPPORTED: type as sanitizer
94-
- ["java.util", "Collection", "size", "()", "manual"] # UNSUPPORTED: type as sanitizer
95-
- ["java.util", "Collections", "emptyList", "()", "manual"] # UNSUPPORTED: just gives an emptylist
96-
- ["java.util", "Iterator", "hasNext", "()", "manual"] # UNSUPPORTED: type as sanitizer
97-
- ["java.util", "Set", "contains", "(Object)", "manual"] # UNSUPPORTED: type as sanitizer
98-
- ["java.util", "Set", "size", "()", "manual"] # UNSUPPORTED: type as sanitizer
99-
- ["java.util", "Set", "isEmpty", "()", "manual"] # UNSUPPORTED: type as sanitizer
100-
- ["java.util", "List", "size", "()", "manual"] # UNSUPPORTED: type as sanitizer
101-
- ["java.util", "List", "contains", "(Object)", "manual"] # UNSUPPORTED: type as sanitizer
102-
- ["java.util", "List", "isEmpty", "()", "manual"] # UNSUPPORTED: type as sanitizer
103-
- ["java.util", "Map", "containsKey", "(Object)", "manual"] # UNSUPPORTED: type as sanitizer
104-
- ["java.util", "Map", "size", "()", "manual"] # UNSUPPORTED: type as sanitizer
105-
- ["java.util", "Map", "isEmpty", "()", "manual"] # UNSUPPORTED: type as sanitizer
106-
- ["java.util", "Optional", "isPresent", "()", "manual"] # UNSUPPORTED: type as sanitizer
107-
- ["java.util", "Optional", "empty", "()", "manual"] # UNSUPPORTED: just gives empty Optional instance
108-
- ["java.util", "UUID", "randomUUID", "()", "manual"] # UNSUPPORTED: just gives UUID, no flow
109-
- ["java.util", "UUID", "toString", "()", "manual"] # UNSUPPORTED: shouldn't model due to causing problems with dataflow?
110-
- ["java.lang", "Object", "toString", "()", "manual"] # UNSUPPORTED: shouldn't model due to causing problems with dataflow?
111-
- ["java.lang", "Object", "equals", "(Object)", "manual"] # **COLLISION** (both supported and unsupported per initial telemetry query): type as sanitizer
112-
- ["java.lang", "Object", "getClass", "()", "manual"] # UNSUPPORTED: only returns the class of the object, no dataflow?
113-
- ["java.lang", "Class", "getName", "()", "manual"] # UNSUPPORTED: just returns class name, no flow as far as I can tell
114-
- ["java.lang", "Class", "getSimpleName", "()", "manual"] # UNSUPPORTED: just returns class name, no flow as far as I can tell
115-
- ["java.lang", "String", "equals", "(Object)", "manual"] # **SUPPORTED**: should be negative per Michael, but "supported" according to telemetry results (Note: no obvious MaD row... look into further, has the model been removed recently?)
116-
- ["java.lang", "String", "equalsIgnoreCase", "(String)", "manual"] # UNSUPPORTED: type as sanitizer
117-
- ["java.lang", "String", "length", "()", "manual"] # UNSUPPORTED: negative per Michael
118-
- ["java.lang", "String", "isEmpty", "()", "manual"] # UNSUPPORTED: type as sanitizer
119-
- ["java.lang", "String", "contains", "(CharSequence)", "manual"] # UNSUPPORTED: type as sanitizer
120-
- ["java.lang", "String", "startsWith", "(String)", "manual"] # UNSUPPORTED: type as sanitizer
121-
- ["java.lang", "Enum", "equals", "(Object)", "manual"] # UNSUPPORTED: type as sanitizer
122-
- ["java.lang", "Enum", "toString", "()", "manual"] # UNSUPPORTED: shouldn't model due to causing problems with dataflow?
123-
- ["java.lang", "System", "currentTimeMillis", "()", "manual"] # UNSUPPORTED: just gives current time
124-
- ["java.lang", "Enum", "Enum", "(String,int)", "manual"] # UNSUPPORTED: per Javadocs, "Programmers cannot invoke this constructor."
125-
- ["java.lang", "Enum", "name", "()", "manual"] # UNSUPPORTED: just gets name, no flow?, similar usage to toString() per Javadocs
126-
- ["java.util.stream", "Collectors", "toList", "()", "manual"] # UNSUPPORTED: shouldn't have a model per Anders
127-
- ["java.lang", "String", "valueOf", "(Object)", "manual"] # UNSUPPORTED: per Anders: "this is a complex case that we haven't fully decided how to deal with"
128-
- ["java.util", "Objects", "hash", "(Object[])", "manual"] # UNSUPPORTED: do we care about controlling the hashcode value? - no per Anders
129-
- ["java.lang", "Object", "hashCode", "()", "manual"] # UNSUPPORTED: do we care about controlling the hashcode value? - no per Anders
130-
- ["java.lang", "String", "hashCode", "()", "manual"] # UNSUPPORTED: do we care about controlling the hashcode value? - no per Anders
93+
# COMMENT OUT ONCE MOVED TO `<packagename>.model.yml` FILE
94+
# - ["java.util", "Objects", "equals", "(Object,Object)", "manual"] # UNSUPPORTED: type as sanitizer
95+
# - ["java.util", "Collection", "size", "()", "manual"] # UNSUPPORTED: type as sanitizer
96+
# - ["java.util", "Collections", "emptyList", "()", "manual"] # UNSUPPORTED: just gives an emptylist
97+
# - ["java.util", "Iterator", "hasNext", "()", "manual"] # UNSUPPORTED: type as sanitizer
98+
# - ["java.util", "Set", "contains", "(Object)", "manual"] # UNSUPPORTED: type as sanitizer
99+
# - ["java.util", "Set", "size", "()", "manual"] # UNSUPPORTED: type as sanitizer
100+
# - ["java.util", "Set", "isEmpty", "()", "manual"] # UNSUPPORTED: type as sanitizer
101+
# - ["java.util", "List", "size", "()", "manual"] # UNSUPPORTED: type as sanitizer
102+
# - ["java.util", "List", "contains", "(Object)", "manual"] # UNSUPPORTED: type as sanitizer
103+
# - ["java.util", "List", "isEmpty", "()", "manual"] # UNSUPPORTED: type as sanitizer
104+
# - ["java.util", "Map", "containsKey", "(Object)", "manual"] # UNSUPPORTED: type as sanitizer
105+
# - ["java.util", "Map", "size", "()", "manual"] # UNSUPPORTED: type as sanitizer
106+
# - ["java.util", "Map", "isEmpty", "()", "manual"] # UNSUPPORTED: type as sanitizer
107+
# - ["java.util", "Optional", "isPresent", "()", "manual"] # UNSUPPORTED: type as sanitizer
108+
# - ["java.util", "Optional", "empty", "()", "manual"] # UNSUPPORTED: just gives empty Optional instance
109+
# - ["java.util", "UUID", "randomUUID", "()", "manual"] # UNSUPPORTED: just gives UUID, no flow
110+
# - ["java.util", "UUID", "toString", "()", "manual"] # UNSUPPORTED: shouldn't model due to causing problems with dataflow?
111+
# - ["java.util", "Objects", "hash", "(Object[])", "manual"] # UNSUPPORTED: do we care about controlling the hashcode value? - no per Anders
112+
113+
# - ["java.util.stream", "Collectors", "toList", "()", "manual"] # UNSUPPORTED: shouldn't have a model per Anders
114+
115+
# - ["java.lang", "Object", "toString", "()", "manual"] # UNSUPPORTED: shouldn't model due to causing problems with dataflow?
116+
# - ["java.lang", "Object", "equals", "(Object)", "manual"] # **COLLISION** (both supported and unsupported per initial telemetry query): type as sanitizer
117+
# - ["java.lang", "Object", "getClass", "()", "manual"] # UNSUPPORTED: only returns the class of the object, no dataflow?
118+
# - ["java.lang", "Class", "getName", "()", "manual"] # UNSUPPORTED: just returns class name, no flow as far as I can tell
119+
# - ["java.lang", "Class", "getSimpleName", "()", "manual"] # UNSUPPORTED: just returns class name, no flow as far as I can tell
120+
# - ["java.lang", "String", "equals", "(Object)", "manual"] # **SUPPORTED**: should be negative per Michael, but "supported" according to telemetry results (Note: no obvious MaD row... look into further, has the model been removed recently?)
121+
# - ["java.lang", "String", "equalsIgnoreCase", "(String)", "manual"] # UNSUPPORTED: type as sanitizer
122+
# - ["java.lang", "String", "length", "()", "manual"] # UNSUPPORTED: negative per Michael
123+
# - ["java.lang", "String", "isEmpty", "()", "manual"] # UNSUPPORTED: type as sanitizer
124+
# - ["java.lang", "String", "contains", "(CharSequence)", "manual"] # UNSUPPORTED: type as sanitizer
125+
# - ["java.lang", "String", "startsWith", "(String)", "manual"] # UNSUPPORTED: type as sanitizer
126+
# - ["java.lang", "Enum", "equals", "(Object)", "manual"] # UNSUPPORTED: type as sanitizer
127+
# - ["java.lang", "Enum", "toString", "()", "manual"] # UNSUPPORTED: shouldn't model due to causing problems with dataflow?
128+
# - ["java.lang", "System", "currentTimeMillis", "()", "manual"] # UNSUPPORTED: just gives current time
129+
# - ["java.lang", "Enum", "Enum", "(String,int)", "manual"] # UNSUPPORTED: per Javadocs, "Programmers cannot invoke this constructor."
130+
# - ["java.lang", "Enum", "name", "()", "manual"] # UNSUPPORTED: just gets name, no flow?, similar usage to toString() per Javadocs
131+
# - ["java.lang", "Object", "hashCode", "()", "manual"] # UNSUPPORTED: do we care about controlling the hashcode value? - no per Anders
132+
# - ["java.lang", "String", "hashCode", "()", "manual"] # UNSUPPORTED: do we care about controlling the hashcode value? - no per Anders
133+
134+
# Ask Tony:
131135
- ["java.lang", "Throwable", "printStackTrace", "()", "manual"] # UNSUPPORTED: per Anders: "This should probably not be a general step, but there might be specialised queries that care."
136+
- ["java.lang", "String", "valueOf", "(Object)", "manual"] # UNSUPPORTED: per Anders: "this is a complex case that we haven't fully decided how to deal with"

‎java/ql/lib/ext/java.lang.model.yml

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -86,3 +86,26 @@ extensions:
8686
- ["java.lang", "StringBuffer", True, "StringBuffer", "(String)", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
8787
- ["java.lang", "StringBuilder", True, "StringBuilder", "", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
8888
- ["java.lang", "System", False, "arraycopy", "", "", "Argument[0]", "Argument[2]", "taint", "manual"]
89+
90+
- addsTo:
91+
pack: codeql/java-all
92+
extensible: extNegativeSummaryModel
93+
data:
94+
- ["java.lang", "Object", "toString", "()", "manual"]
95+
- ["java.lang", "Object", "equals", "(Object)", "manual"]
96+
- ["java.lang", "Object", "getClass", "()", "manual"]
97+
- ["java.lang", "Class", "getName", "()", "manual"]
98+
- ["java.lang", "Class", "getSimpleName", "()", "manual"]
99+
- ["java.lang", "String", "equals", "(Object)", "manual"]
100+
- ["java.lang", "String", "equalsIgnoreCase", "(String)", "manual"]
101+
- ["java.lang", "String", "length", "()", "manual"]
102+
- ["java.lang", "String", "isEmpty", "()", "manual"]
103+
- ["java.lang", "String", "contains", "(CharSequence)", "manual"]
104+
- ["java.lang", "String", "startsWith", "(String)", "manual"]
105+
- ["java.lang", "Enum", "equals", "(Object)", "manual"]
106+
- ["java.lang", "Enum", "toString", "()", "manual"]
107+
- ["java.lang", "System", "currentTimeMillis", "()", "manual"]
108+
- ["java.lang", "Enum", "Enum", "(String,int)", "manual"]
109+
- ["java.lang", "Enum", "name", "()", "manual"]
110+
- ["java.lang", "Object", "hashCode", "()", "manual"]
111+
- ["java.lang", "String", "hashCode", "()", "manual"]

‎java/ql/lib/ext/java.util.model.yml

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -355,3 +355,26 @@ extensions:
355355
- ["java.util", "Vector", True, "setElementAt", "(Object,int)", "", "Argument[0]", "Argument[-1].Element", "value", "manual"]
356356
- ["java.util", "WeakHashMap", False, "WeakHashMap", "(Map)", "", "Argument[0].MapKey", "Argument[-1].MapKey", "value", "manual"]
357357
- ["java.util", "WeakHashMap", False, "WeakHashMap", "(Map)", "", "Argument[0].MapValue", "Argument[-1].MapValue", "value", "manual"]
358+
359+
- addsTo:
360+
pack: codeql/java-all
361+
extensible: extNegativeSummaryModel
362+
data:
363+
- ["java.util", "Objects", "equals", "(Object,Object)", "manual"]
364+
- ["java.util", "Collection", "size", "()", "manual"]
365+
- ["java.util", "Collections", "emptyList", "()", "manual"]
366+
- ["java.util", "Iterator", "hasNext", "()", "manual"]
367+
- ["java.util", "Set", "contains", "(Object)", "manual"]
368+
- ["java.util", "Set", "size", "()", "manual"]
369+
- ["java.util", "Set", "isEmpty", "()", "manual"]
370+
- ["java.util", "List", "size", "()", "manual"]
371+
- ["java.util", "List", "contains", "(Object)", "manual"]
372+
- ["java.util", "List", "isEmpty", "()", "manual"]
373+
- ["java.util", "Map", "containsKey", "(Object)", "manual"]
374+
- ["java.util", "Map", "size", "()", "manual"]
375+
- ["java.util", "Map", "isEmpty", "()", "manual"]
376+
- ["java.util", "Optional", "isPresent", "()", "manual"]
377+
- ["java.util", "Optional", "empty", "()", "manual"]
378+
- ["java.util", "UUID", "randomUUID", "()", "manual"]
379+
- ["java.util", "UUID", "toString", "()", "manual"]
380+
- ["java.util", "Objects", "hash", "(Object[])", "manual"]

‎java/ql/lib/ext/java.util.stream.model.yml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -87,3 +87,9 @@ extensions:
8787
- ["java.util.stream", "Stream", True, "takeWhile", "(Predicate)", "", "Argument[-1].Element", "ReturnValue.Element", "value", "manual"]
8888
- ["java.util.stream", "Stream", True, "toArray", "", "", "Argument[-1].Element", "ReturnValue.ArrayElement", "value", "manual"]
8989
- ["java.util.stream", "Stream", True, "toList", "()", "", "Argument[-1].Element", "ReturnValue.Element", "value", "manual"]
90+
91+
- addsTo:
92+
pack: codeql/java-all
93+
extensible: extNegativeSummaryModel
94+
data:
95+
- ["java.util.stream", "Collectors", "toList", "()", "manual"]

0 commit comments

Comments
 (0)