Skip to content

Commit 9e49daa

Browse files
Apply suggestions from code review
Co-authored-by: Andrew Eisenberg <[email protected]>
1 parent 68a7fc9 commit 9e49daa

File tree

2 files changed

+22
-18
lines changed

2 files changed

+22
-18
lines changed

docs/codeql/codeql-language-guides/codeql-for-java.rst

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,6 @@ Experiment and learn how to write effective and efficient queries for CodeQL dat
2525
javadoc
2626
working-with-source-locations
2727
abstract-syntax-tree-classes-for-working-with-java-programs
28-
customizing-library-models-for-java
2928

3029
- :doc:`Basic query for Java code <basic-query-for-java-code>`: Learn to write and run a simple CodeQL query.
3130

docs/codeql/codeql-language-guides/customizing-library-models-for-java.rst

Lines changed: 22 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
.. _customizing-library-models-for-java:
22

3+
:orphan:
4+
:nosearch:
5+
36
Customizing Library Models for Java
47
===================================
58

@@ -14,13 +17,15 @@ A data extension file for Java is a YAML file in the form:
1417
extensions:
1518
- addsTo:
1619
pack: codeql/java-all
17-
extensible: <name of extension point>
20+
extensible: <name of extensible predicate>
1821
data:
1922
- <tuple1>
2023
- <tuple2>
2124
- ...
2225
23-
The data extension can contribute to the following extension points:
26+
Data extensions contribute to extensible predicates defined CodeQL libraries. For more information on how to define data extensions and extensible predicates as well as how to wire them up, see the following documentation...
27+
28+
The CodeQL libraries for Java expose the following extensible predicates:
2429

2530
- **sourceModel**\(package, type, subtypes, name, signature, ext, output, kind, provenance)
2631
- **sinkModel**\(package, type, subtypes, name, signature, ext, input, kind, provenance)
@@ -31,14 +36,14 @@ TODO: Link or inline documentation on how to add dataextensions.
3136
Are we going for extensions packs as the recommended default?
3237
If yes, then we probably need to elaborate with a concrete example.
3338

34-
In the sections below, we will show by example how to add tuples to the different extension points.
39+
In the sections below, we will show by example how to add tuples to the different extensible predicates.
3540
The extension points are used to customize and improve the existing dataflow queries, by providing sources, sinks, and flow through for library elements.
36-
The **Reference material** section will in more detail describe the *mini DSLs* that are used to comprise a model definition for each extension point.
41+
The **Reference material** section will provide details on the *mini DSLs* that define models for each extensible predicate.
3742

3843
Example: Taint sink in the **java.sql** package.
3944
------------------------------------------------
4045

41-
In this example we will see, how to define the argument of the **execute** method as a SQL injection sink.
46+
In this example we will show how to model the argument of the **execute** method as a SQL injection sink.
4247
This is the **execute** method in the **Statement** class, which is located in the **java.sql** package.
4348
Please note that this sink is already added to the CodeQL Java analysis.
4449

@@ -49,7 +54,7 @@ Please note that this sink is already added to the CodeQL Java analysis.
4954
stmt.execute(query); // The argument to this method is a SQL injection sink.
5055
}
5156
52-
This can be achieved by adding the following data extension.
57+
This can be achieved by adding the following row to a data extension file:
5358

5459
.. code-block:: yaml
5560
@@ -63,11 +68,11 @@ This can be achieved by adding the following data extension.
6368
Reasoning:
6469

6570
Since we are adding a new sink, we need to add a tuple to the **sinkModel** extension point.
66-
The first five values are used to identify the method (callable) which we are defining a sink on.
71+
The first five values identify the callable (in this case a method) to be modeled as a sink.
6772

6873
- The first value **java.sql** is the package name.
69-
- The second value **Statement** is the class (type) name.
70-
- The third value **True** is flag indicating, whether the sink also applies to all overrides of the method.
74+
- The second value **Statement** is the name of the class (type) that contains the method.
75+
- The third value **True** is a flag that indicates, whether or not the sink also applies to all overrides of the method.
7176
- The fourth value **execute** is the method name.
7277
- The fifth value **(String)** is the method input type signature.
7378

@@ -80,7 +85,7 @@ The remaining values are used to define the **access path**, the **kind**, and t
8085

8186
Example: Taint source from the **java.net** package.
8287
----------------------------------------------------
83-
In this example we will see, how to define the return value from the **getInputStream** method as a **remote** source.
88+
In this example we show how to model the return value from the **getInputStream** method as a **remote** source.
8489
This is the **getInputStream** method in the **Socket** class, which is located in the **java.net** package.
8590
Please note that this source is already added to the CodeQL Java analysis.
8691

@@ -108,8 +113,8 @@ Since we are adding a new source, we need to add a tuple to the **sourceModel**
108113
The first five values are used to identify the method (callable) which we are defining a source on.
109114

110115
- The first value **java.net** is the package name.
111-
- The second value **Socket** is the class (type) name.
112-
- The third value **False** is flag indicating, whether the source also applies to all overrides of the method.
116+
- The second value **Socket** is the name of the class (type) that contains the source.
117+
- The third value **False** flag indicates, whether or not the source also applies to all overrides of the method.
113118
- The fourth value **getInputStream** is the method name.
114119
- The fifth value **()** is the method input type signature.
115120

@@ -122,7 +127,7 @@ The remaining values are used to define the **access path**, the **kind**, and t
122127

123128
Example: Add flow through the **concat** method.
124129
------------------------------------------------
125-
In this example we will see, how to define flow through a method for a simple case.
130+
In this example we show how to model flow through a method for a simple case.
126131
This pattern covers many of the cases where we need to define flow through a method.
127132
Please note that the flow through the **concat** method is already added to the CodeQL Java analysis.
128133

@@ -280,17 +285,17 @@ The semantics of many of the columns of the extension points are shared.
280285
The shared columns are:
281286

282287
- **package**: Name of the package.
283-
- **type**: Name of the type.
284-
- **subtypes**: A flag indicating whether the model should also apply to all overrides of the selected element(s).
288+
- **type**: Name of the type containing the element to be modeled.
289+
- **subtypes**: A boolean flag indicating whether the model should also apply to all overrides of the selected element(s).
285290
- **name**: Name of the element (optional). If this is left blank, it means all elements matching the previous selection criteria.
286291
- **signature**: Type signature of the selected element (optional). If this is left blank it means all elements matching the previous selection criteria.
287292
- **ext**: Specifies additional API-graph-like edges (mostly empty) and out of scope for this document.
288293
- **provenance**: Provenance (origin) of the model definition.
289294

290295
The columns **package**, **type**, **subtypes**, **name**, and **signature** are used to select the element(s) that the model applies to.
291296

292-
The section Access paths describes in more detail, how access paths are composed.
293-
This is the most complicated part of the extension points and the **mini DSL** for access paths is shared accross the extension points.
297+
The Access Paths section describes how access paths are composed.
298+
This is the most complicated part of the extension points and the **mini DSL** for access paths is shared across all extension points.
294299

295300
sourceModel(package, type, subtypes, name, signature, ext, output, kind, provenance)
296301
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

0 commit comments

Comments
 (0)