You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/codeql/codeql-language-guides/customizing-library-models-for-java.rst
+22-17Lines changed: 22 additions & 17 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,5 +1,8 @@
1
1
.. _customizing-library-models-for-java:
2
2
3
+
:orphan:
4
+
:nosearch:
5
+
3
6
Customizing Library Models for Java
4
7
===================================
5
8
@@ -14,13 +17,15 @@ A data extension file for Java is a YAML file in the form:
14
17
extensions:
15
18
- addsTo:
16
19
pack: codeql/java-all
17
-
extensible: <name of extension point>
20
+
extensible: <name of extensible predicate>
18
21
data:
19
22
- <tuple1>
20
23
- <tuple2>
21
24
- ...
22
25
23
-
The data extension can contribute to the following extension points:
26
+
Data extensions contribute to extensible predicates defined CodeQL libraries. For more information on how to define data extensions and extensible predicates as well as how to wire them up, see the following documentation...
27
+
28
+
The CodeQL libraries for Java expose the following extensible predicates:
@@ -31,14 +36,14 @@ TODO: Link or inline documentation on how to add dataextensions.
31
36
Are we going for extensions packs as the recommended default?
32
37
If yes, then we probably need to elaborate with a concrete example.
33
38
34
-
In the sections below, we will show by example how to add tuples to the different extension points.
39
+
In the sections below, we will show by example how to add tuples to the different extensible predicates.
35
40
The extension points are used to customize and improve the existing dataflow queries, by providing sources, sinks, and flow through for library elements.
36
-
The **Reference material** section will in more detail describe the *mini DSLs* that are used to comprise a model definition for each extension point.
41
+
The **Reference material** section will provide details on the *mini DSLs* that define models for each extensible predicate.
37
42
38
43
Example: Taint sink in the **java.sql** package.
39
44
------------------------------------------------
40
45
41
-
In this example we will see, how to define the argument of the **execute** method as a SQL injection sink.
46
+
In this example we will show how to model the argument of the **execute** method as a SQL injection sink.
42
47
This is the **execute** method in the **Statement** class, which is located in the **java.sql** package.
43
48
Please note that this sink is already added to the CodeQL Java analysis.
44
49
@@ -49,7 +54,7 @@ Please note that this sink is already added to the CodeQL Java analysis.
49
54
stmt.execute(query); // The argument to this method is a SQL injection sink.
50
55
}
51
56
52
-
This can be achieved by adding the following data extension.
57
+
This can be achieved by adding the following row to a data extension file:
53
58
54
59
.. code-block:: yaml
55
60
@@ -63,11 +68,11 @@ This can be achieved by adding the following data extension.
63
68
Reasoning:
64
69
65
70
Since we are adding a new sink, we need to add a tuple to the **sinkModel** extension point.
66
-
The first five values are used to identify the method (callable) which we are defining a sink on.
71
+
The first five values identify the callable (in this case a method) to be modeled as a sink.
67
72
68
73
- The first value **java.sql** is the package name.
69
-
- The second value **Statement** is the class (type) name.
70
-
- The third value **True** is flag indicating, whether the sink also applies to all overrides of the method.
74
+
- The second value **Statement** is the name of the class (type) that contains the method.
75
+
- The third value **True** is a flag that indicates, whether or not the sink also applies to all overrides of the method.
71
76
- The fourth value **execute** is the method name.
72
77
- The fifth value **(String)** is the method input type signature.
73
78
@@ -80,7 +85,7 @@ The remaining values are used to define the **access path**, the **kind**, and t
80
85
81
86
Example: Taint source from the **java.net** package.
In this example we will see, how to define the return value from the **getInputStream** method as a **remote** source.
88
+
In this example we show how to model the return value from the **getInputStream** method as a **remote** source.
84
89
This is the **getInputStream** method in the **Socket** class, which is located in the **java.net** package.
85
90
Please note that this source is already added to the CodeQL Java analysis.
86
91
@@ -108,8 +113,8 @@ Since we are adding a new source, we need to add a tuple to the **sourceModel**
108
113
The first five values are used to identify the method (callable) which we are defining a source on.
109
114
110
115
- The first value **java.net** is the package name.
111
-
- The second value **Socket** is the class (type) name.
112
-
- The third value **False** is flag indicating, whether the source also applies to all overrides of the method.
116
+
- The second value **Socket** is the name of the class (type) that contains the source.
117
+
- The third value **False** flag indicates, whether or not the source also applies to all overrides of the method.
113
118
- The fourth value **getInputStream** is the method name.
114
119
- The fifth value **()** is the method input type signature.
115
120
@@ -122,7 +127,7 @@ The remaining values are used to define the **access path**, the **kind**, and t
122
127
123
128
Example: Add flow through the **concat** method.
124
129
------------------------------------------------
125
-
In this example we will see, how to define flow through a method for a simple case.
130
+
In this example we show how to model flow through a method for a simple case.
126
131
This pattern covers many of the cases where we need to define flow through a method.
127
132
Please note that the flow through the **concat** method is already added to the CodeQL Java analysis.
128
133
@@ -280,17 +285,17 @@ The semantics of many of the columns of the extension points are shared.
280
285
The shared columns are:
281
286
282
287
- **package**: Name of the package.
283
-
- **type**: Name of the type.
284
-
- **subtypes**: A flag indicating whether the model should also apply to all overrides of the selected element(s).
288
+
- **type**: Name of the type containing the element to be modeled.
289
+
- **subtypes**: A boolean flag indicating whether the model should also apply to all overrides of the selected element(s).
285
290
- **name**: Name of the element (optional). If this is left blank, it means all elements matching the previous selection criteria.
286
291
- **signature**: Type signature of the selected element (optional). If this is left blank it means all elements matching the previous selection criteria.
287
292
- **ext**: Specifies additional API-graph-like edges (mostly empty) and out of scope for this document.
288
293
- **provenance**: Provenance (origin) of the model definition.
289
294
290
295
The columns **package**, **type**, **subtypes**, **name**, and **signature** are used to select the element(s) that the model applies to.
291
296
292
-
The section Access paths describes in more detail, how access paths are composed.
293
-
This is the most complicated part of the extension points and the **mini DSL** for access paths is shared accross the extension points.
297
+
The Access Paths section describes how access paths are composed.
298
+
This is the most complicated part of the extension points and the **mini DSL** for access paths is shared across all extension points.
0 commit comments