Skip to content

Commit 67ff5ae

Browse files
committed
Add changes from Michael
1 parent fde0459 commit 67ff5ae

File tree

1 file changed

+2
-5
lines changed

1 file changed

+2
-5
lines changed

docs/codeql/codeql-language-guides/data-extensions-to-model-java-dependencies.rst

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,7 @@ We need to add a tuple to the **sinkModel**\(package, type, subtypes, name, sign
6363
pack: codeql/java-all
6464
extensible: sinkModel
6565
data:
66-
- ["java.sql", "Statement", True, "execute", "(String)", "", "Argument[0]", "sql", "manual"]
66+
- ["java.sql", "Statement", True, "execute", "(String)", "", "Argument[0]", "sql-injection", "manual"]
6767
6868
6969
Since we are adding a new sink, we need to add a tuple to the **sinkModel** extensible predicate.
@@ -79,7 +79,7 @@ The sixth value should be left empty and is out of scope for this documentation.
7979
The remaining values are used to define the **access path**, the **kind**, and the **provenance** (origin) of the sink.
8080

8181
- The seventh value **Argument[0]** is the **access path** to the first argument passed to the method, which means that this is the location of the sink.
82-
- The eighth value **sql** is the kind of the sink. The sink kind is used to define the queries where the sink is in scope. In this case - the SQL injection queries.
82+
- The eighth value **sql-injection** is the kind of the sink. The sink kind is used to define the queries where the sink is in scope. In this case - the SQL injection queries.
8383
- The ninth value **manual** is the provenance of the sink, which is used to identify the origin of the sink.
8484

8585
Example: Taint source from the **java.net** package
@@ -303,7 +303,6 @@ Taint source. Most taint tracking queries will use all sources added to this ext
303303

304304
- **output**: Access path to the source, where the possibly tainted data flows from.
305305
- **kind**: Kind of the source.
306-
- **provenance**: Provenance (origin) of the source definition.
307306

308307
As most sources are used by all taint tracking queries there are only a few different source kinds.
309308
The following source kinds are supported:
@@ -359,7 +358,6 @@ Flow through (summary). This extensible predicate is used to model flow through
359358
- **input**: Access path to the input of the element (where data will flow from to the output).
360359
- **output**: Access path to the output of the element (where data will flow to from the input).
361360
- **kind**: Kind of the flow through.
362-
- **provenance**: Provenance (origin) of the flow through.
363361

364362
The following kinds are supported:
365363

@@ -374,7 +372,6 @@ It only has minor impact on the data flow analysis.
374372
Manual neutrals are considered high confidence dispatch call targets and can reduce the number of dispatch call targets during data flow analysis (a performance optimization).
375373

376374
- **kind**: Kind of the neutral. For neutrals the kind can be **summary**, **source**, or **sink** to indicate that the callable is neutral with respect to flow (no summary), source (is not a source) or sink (is not a sink).
377-
- **provenance**: Provenance (origin) of the flow through.
378375

379376
.. _access-paths:
380377

0 commit comments

Comments
 (0)