Merge pull request #4299 from torque59/play-framework

Initial support for Java - Play Framework > 2.6.x

java/change-notes/2021-03-05-play-framework.md

@@ -0,0 +1,2 @@
+lgtm,codescanning
+* Added support for the Play framework core library (`play.mvc.*`); adding additional remote flow sources.

java/ql/src/semmle/code/java/dataflow/FlowSources.qll

@@ -18,6 +18,7 @@ import semmle.code.java.frameworks.JaxWS
 import semmle.code.java.frameworks.javase.WebSocket
 import semmle.code.java.frameworks.android.Android
 import semmle.code.java.frameworks.android.Intent
+import semmle.code.java.frameworks.play.Play
 import semmle.code.java.frameworks.spring.SpringWeb
 import semmle.code.java.frameworks.spring.SpringController
 import semmle.code.java.frameworks.spring.SpringWebClient
@@ -129,6 +130,12 @@ private class SpringMultipartRequestSource extends RemoteFlowSource {
   override string getSourceType() { result = "Spring MultipartRequest getter" }
 }
 
+private class PlayParameterSource extends RemoteFlowSource {
+  PlayParameterSource() { exists(PlayActionMethodQueryParameter p | p = this.asParameter()) }
+
+  override string getSourceType() { result = "Play Query Parameters" }
+}
+
 private class SpringMultipartFileSource extends RemoteFlowSource {
   SpringMultipartFileSource() {
     exists(MethodAccess ma, Method m |
@@ -264,6 +271,7 @@ private class RemoteTaintedMethod extends Method {
     this instanceof HttpServletRequestGetRequestURIMethod or
     this instanceof HttpServletRequestGetRequestURLMethod or
     this instanceof HttpServletRequestGetRemoteUserMethod or
+    this instanceof PlayRequestGetMethod or
     this instanceof SpringWebRequestGetMethod or
     this instanceof SpringRestTemplateResponseEntityMethod or
     this instanceof ServletRequestGetBodyMethod or
@@ -283,6 +291,13 @@ private class RemoteTaintedMethod extends Method {
   }
 }
 
+private class PlayRequestGetMethod extends Method {
+  PlayRequestGetMethod() {
+    this.getDeclaringType() instanceof PlayMvcHttpRequestHeader and
+    this.hasName(["queryString", "getQueryString", "header", "getHeader"])
+  }
+}
+
 private class SpringWebRequestGetMethod extends Method {
   SpringWebRequestGetMethod() {
     exists(SpringWebRequest swr | this = swr.getAMethod() |

java/ql/src/semmle/code/java/frameworks/play/Play.qll

@@ -0,0 +1,155 @@
+/**
+ * Provides classes and predicates for working with the Play framework.
+ */
+
+import java
+
+/**
+ * The `play.mvc.Result` class.
+ */
+class PlayMvcResultClass extends Class {
+  PlayMvcResultClass() { this.hasQualifiedName("play.mvc", "Result") }
+}
+
+/**
+ * The `play.mvc.Results` class.
+ */
+class PlayMvcResultsClass extends Class {
+  PlayMvcResultsClass() { this.hasQualifiedName("play.mvc", "Results") }
+}
+
+/**
+ * The `play.mvc.Http$RequestHeader` class.
+ */
+class PlayMvcHttpRequestHeader extends RefType {
+  PlayMvcHttpRequestHeader() { this.hasQualifiedName("play.mvc", "Http$RequestHeader") }
+}
+
+/**
+ * A `play.mvc.BodyParser<>$Of` annotation.
+ */
+class PlayBodyParserAnnotation extends Annotation {
+  PlayBodyParserAnnotation() { this.getType().hasQualifiedName("play.mvc", "BodyParser<>$Of") }
+}
+
+/**
+ * A `play.filters.csrf.AddCSRFToken` annotation.
+ */
+class PlayAddCsrfTokenAnnotation extends Annotation {
+  PlayAddCsrfTokenAnnotation() {
+    this.getType().hasQualifiedName("play.filters.csrf", "AddCSRFToken")
+  }
+}
+
+/**
+ * The type `play.libs.F.Promise<Result>`.
+ */
+class PlayAsyncResultPromise extends Member {
+  PlayAsyncResultPromise() {
+    exists(Class c |
+      c.hasQualifiedName("play.libs", "F") and
+      this = c.getAMember() and
+      this.getQualifiedName() = "F.Promise<Result>"
+    )
+  }
+}
+
+/**
+ * The type `java.util.concurrent.CompletionStage<Result>`.
+ */
+class PlayAsyncResultCompletionStage extends Type {
+  PlayAsyncResultCompletionStage() {
+    this.hasName("CompletionStage<Result>") and
+    this.getCompilationUnit().getPackage().hasName("java.util.concurrent")
+  }
+}
+
+/**
+ * The class `play.mvc.Controller` or a class that transitively extends it.
+ */
+class PlayController extends Class {
+  PlayController() {
+    this.extendsOrImplements*(any(Class t | t.hasQualifiedName("play.mvc", "Controller")))
+  }
+}
+
+/**
+ * A Play framework controller action method. These are mappings to route files.
+ *
+ * Sample Route - `POST  /login  @com.company.Application.login()`.
+ *
+ * Example - class gets `index` and `login` as valid action methods.
+ * ```java
+ * public class Application extends Controller {
+ *   public Result index(String username, String password) {
+ *     return ok("It works!");
+ *   }
+ *
+ *   public Result login() {
+ *     return ok("Log me In!");
+ *   }
+ * }
+ * ```
+ */
+class PlayControllerActionMethod extends Method {
+  PlayControllerActionMethod() {
+    this = any(PlayController c).getAMethod() and
+    (
+      this.getReturnType() instanceof PlayAsyncResultPromise or
+      this.getReturnType() instanceof PlayMvcResultClass or
+      this.getReturnType() instanceof PlayAsyncResultCompletionStage
+    )
+  }
+}
+
+/**
+ * A Play framework action method parameter. These are a source of user input.
+ *
+ * Example - `username` and `password` are action method parameters.
+ * ```java
+ * public class Application extends Controller {
+ *   public Result index(String username, String password) {
+ *     return ok("It works!");
+ *   }
+ * }
+ * ```
+ */
+class PlayActionMethodQueryParameter extends Parameter {
+  PlayActionMethodQueryParameter() {
+    exists(PlayControllerActionMethod a |
+      a.isPublic() and
+      this = a.getAParameter()
+    )
+  }
+}
+
+/**
+ * A PlayFramework HttpRequestHeader method, some of these are `headers`, `getQueryString`, `getHeader`.
+ */
+class PlayMvcHttpRequestHeaderMethods extends Method {
+  PlayMvcHttpRequestHeaderMethods() { this.getDeclaringType() instanceof PlayMvcHttpRequestHeader }
+
+  /**
+   * Gets a reference to the `getQueryString` method.
+   */
+  MethodAccess getAQueryStringAccess() {
+    this.hasName("getQueryString") and result = this.getAReference()
+  }
+}
+
+/**
+ * A PlayFramework results method, some of these are `ok`, `status`, `redirect`.
+ */
+class PlayMvcResultsMethods extends Method {
+  PlayMvcResultsMethods() { this.getDeclaringType() instanceof PlayMvcResultsClass }
+
+  /**
+   * Gets a reference to the `play.mvc.Results.ok` method.
+   */
+  MethodAccess getAnOkAccess() { this.hasName("ok") and result = this.getAReference() }
+
+  /**
+   * Gets a reference to the `play.mvc.Results.redirect` method.
+   */
+  MethodAccess getARedirectAccess() { this.hasName("redirect") and result = this.getAReference() }
+}

java/ql/test/library-tests/dataflow/taintsources/PlayResource.java

@@ -0,0 +1,36 @@
+import java.util.concurrent.CompletableFuture;
+import java.util.concurrent.CompletionStage;
+import play.filters.csrf.AddCSRFToken;
+import play.libs.F;
+import play.mvc.BodyParser;
+import play.mvc.Controller;
+import play.mvc.Http.*;
+import play.mvc.Result;
+
+public class PlayResource extends Controller {
+
+  @AddCSRFToken
+  public Result index() {
+    response().setHeader("X-Play-QL", "1");
+    return ok("It works!");
+  }
+
+  @BodyParser.Of()
+  public Result session_redirect_me(String uri) {
+    String url = request().getQueryString("url");
+    return redirect(url);
+  }
+
+  public F.Promise<Result> async_promise(String token) {
+    return F.Promise.pure(ok(token));
+  }
+
+  public CompletionStage<Result> async_completionstage(String uri) {
+    return CompletableFuture.completedFuture(ok("Async completion Stage"));
+  }
+
+  public String not_playactionmethod(String no_action) {
+    String return_code = no_action;
+    return return_code;
+  }
+}

java/ql/test/library-tests/dataflow/taintsources/options

@@ -1 +1 @@
-//semmle-extractor-options: --javac-args -cp ${testdir}/../../../stubs/servlet-api-2.4:${testdir}/../../../stubs/springframework-5.2.3:${testdir}/../../../stubs/google-android-9.0.0
+//semmle-extractor-options: --javac-args -cp ${testdir}/../../../stubs/servlet-api-2.4:${testdir}/../../../stubs/springframework-5.2.3:${testdir}/../../../stubs/google-android-9.0.0:${testdir}/../../../stubs/playframework-2.6.x:${testdir}/../../../stubs/jackson-databind-2.10:${testdir}/../../../stubs/akka-2.6.x

java/ql/test/library-tests/dataflow/taintsources/remote.expected

@@ -23,6 +23,14 @@
 | IntentSources.java:33:20:33:33 | getIntent(...) | IntentSources.java:33:20:33:33 | getIntent(...) |
 | IntentSources.java:33:20:33:33 | getIntent(...) | IntentSources.java:33:20:33:55 | getStringExtra(...) |
 | IntentSources.java:33:20:33:33 | getIntent(...) | IntentSources.java:34:29:34:35 | trouble |
+| PlayResource.java:19:37:19:46 | uri | PlayResource.java:19:37:19:46 | uri |
+| PlayResource.java:20:18:20:48 | getQueryString(...) | ../../../stubs/playframework-2.6.x/play/mvc/Results.java:634:33:634:42 | url |
+| PlayResource.java:20:18:20:48 | getQueryString(...) | PlayResource.java:20:18:20:48 | getQueryString(...) |
+| PlayResource.java:20:18:20:48 | getQueryString(...) | PlayResource.java:21:21:21:23 | url |
+| PlayResource.java:24:42:24:53 | token | ../../../stubs/playframework-2.6.x/play/mvc/Results.java:94:27:94:40 | content |
+| PlayResource.java:24:42:24:53 | token | PlayResource.java:24:42:24:53 | token |
+| PlayResource.java:24:42:24:53 | token | PlayResource.java:25:30:25:34 | token |
+| PlayResource.java:28:56:28:65 | uri | PlayResource.java:28:56:28:65 | uri |
 | RmiFlowImpl.java:4:30:4:40 | path | RmiFlowImpl.java:4:30:4:40 | path |
 | RmiFlowImpl.java:4:30:4:40 | path | RmiFlowImpl.java:5:20:5:31 | ... + ... |
 | RmiFlowImpl.java:4:30:4:40 | path | RmiFlowImpl.java:5:28:5:31 | path |

java/ql/test/library-tests/frameworks/play/PlayActionMethodQueryParameter.expected

@@ -0,0 +1,3 @@
+| resources/Resource.java:19:37:19:46 | uri |
+| resources/Resource.java:24:42:24:53 | token |
+| resources/Resource.java:28:56:28:65 | uri |

java/ql/test/library-tests/frameworks/play/PlayActionMethodQueryParameter.ql

@@ -0,0 +1,4 @@
+import semmle.code.java.frameworks.play.Play
+
+from PlayActionMethodQueryParameter p
+select p

java/ql/test/library-tests/frameworks/play/PlayAddCsrfTokenAnnotation.expected

@@ -0,0 +1 @@
+| resources/Resource.java:12:3:12:15 | AddCSRFToken |

java/ql/test/library-tests/frameworks/play/PlayAddCsrfTokenAnnotation.ql

@@ -0,0 +1,4 @@
+import semmle.code.java.frameworks.play.Play
+
+from PlayAddCsrfTokenAnnotation token
+select token

java/ql/test/library-tests/frameworks/play/PlayBodyParserAnnotation.expected

@@ -0,0 +1 @@
+| play.mvc.BodyParser<>$Of |

java/ql/test/library-tests/frameworks/play/PlayBodyParserAnnotation.ql

@@ -0,0 +1,4 @@
+import semmle.code.java.frameworks.play.Play
+
+from PlayBodyParserAnnotation parser
+select parser.getType().getQualifiedName()

java/ql/test/library-tests/frameworks/play/PlayController.expected

@@ -0,0 +1,2 @@
+| Resource |
+| play.mvc.Controller |

java/ql/test/library-tests/frameworks/play/PlayController.ql

@@ -0,0 +1,4 @@
+import semmle.code.java.frameworks.play.Play
+
+from PlayController c
+select c.getQualifiedName()

java/ql/test/library-tests/frameworks/play/PlayControllerActionMethod.expected

@@ -0,0 +1,4 @@
+| Resource.async_completionstage |
+| Resource.async_promise |
+| Resource.index |
+| Resource.session_redirect_me |

java/ql/test/library-tests/frameworks/play/PlayControllerActionMethod.ql

@@ -0,0 +1,4 @@
+import semmle.code.java.frameworks.play.Play
+
+from PlayControllerActionMethod m
+select m.getQualifiedName()

java/ql/test/library-tests/frameworks/play/PlayMvcHttpRequestHeader.expected

@@ -0,0 +1,27 @@
+| play.mvc.Http$RequestHeader | RequestHeader.acceptLanguages |
+| play.mvc.Http$RequestHeader | RequestHeader.accepts |
+| play.mvc.Http$RequestHeader | RequestHeader.addAttr |
+| play.mvc.Http$RequestHeader | RequestHeader.attrs |
+| play.mvc.Http$RequestHeader | RequestHeader.charset |
+| play.mvc.Http$RequestHeader | RequestHeader.clientCertificateChain |
+| play.mvc.Http$RequestHeader | RequestHeader.contentType |
+| play.mvc.Http$RequestHeader | RequestHeader.cookie |
+| play.mvc.Http$RequestHeader | RequestHeader.cookies |
+| play.mvc.Http$RequestHeader | RequestHeader.getHeader |
+| play.mvc.Http$RequestHeader | RequestHeader.getHeaders |
+| play.mvc.Http$RequestHeader | RequestHeader.getQueryString |
+| play.mvc.Http$RequestHeader | RequestHeader.hasBody |
+| play.mvc.Http$RequestHeader | RequestHeader.hasHeader |
+| play.mvc.Http$RequestHeader | RequestHeader.header |
+| play.mvc.Http$RequestHeader | RequestHeader.headers |
+| play.mvc.Http$RequestHeader | RequestHeader.host |
+| play.mvc.Http$RequestHeader | RequestHeader.method |
+| play.mvc.Http$RequestHeader | RequestHeader.path |
+| play.mvc.Http$RequestHeader | RequestHeader.queryString |
+| play.mvc.Http$RequestHeader | RequestHeader.remoteAddress |
+| play.mvc.Http$RequestHeader | RequestHeader.secure |
+| play.mvc.Http$RequestHeader | RequestHeader.tags |
+| play.mvc.Http$RequestHeader | RequestHeader.uri |
+| play.mvc.Http$RequestHeader | RequestHeader.version |
+| play.mvc.Http$RequestHeader | RequestHeader.withAttrs |
+| play.mvc.Http$RequestHeader | RequestHeader.withBody |

java/ql/test/library-tests/frameworks/play/PlayMvcHttpRequestHeader.ql

@@ -0,0 +1,4 @@
+import semmle.code.java.frameworks.play.Play
+
+from PlayMvcHttpRequestHeader c
+select c.getQualifiedName(), c.getAMethod().getQualifiedName()

java/ql/test/library-tests/frameworks/play/PlayMvcResultClass.expected

@@ -0,0 +1 @@
+| play.mvc.Result |

java/ql/test/library-tests/frameworks/play/PlayMvcResultClass.ql

@@ -0,0 +1,4 @@
+import semmle.code.java.frameworks.play.Play
+
+from PlayMvcResultClass m
+select m.getQualifiedName()

java/ql/test/library-tests/frameworks/play/PlayMvcResultsClass.expected

@@ -0,0 +1,19 @@
+| play.mvc.Results | Results.<clinit> |
+| play.mvc.Results | Results.badRequest |
+| play.mvc.Results | Results.created |
+| play.mvc.Results | Results.forbidden |
+| play.mvc.Results | Results.found |
+| play.mvc.Results | Results.internalServerError |
+| play.mvc.Results | Results.movedPermanently |
+| play.mvc.Results | Results.noContent |
+| play.mvc.Results | Results.notAcceptable |
+| play.mvc.Results | Results.notFound |
+| play.mvc.Results | Results.ok |
+| play.mvc.Results | Results.paymentRequired |
+| play.mvc.Results | Results.permanentRedirect |
+| play.mvc.Results | Results.redirect |
+| play.mvc.Results | Results.seeOther |
+| play.mvc.Results | Results.status |
+| play.mvc.Results | Results.temporaryRedirect |
+| play.mvc.Results | Results.unauthorized |
+| play.mvc.Results | Results.unsupportedMediaType |

java/ql/test/library-tests/frameworks/play/PlayMvcResultsClass.ql

@@ -0,0 +1,4 @@
+import semmle.code.java.frameworks.play.Play
+
+from PlayMvcResultsClass m
+select m.getQualifiedName(), m.getAMethod().getQualifiedName()

java/ql/test/library-tests/frameworks/play/PlayMvcResultsMethods.expected

@@ -0,0 +1,3 @@
+| resources/Resource.java:15:12:15:26 | ok(...) |
+| resources/Resource.java:25:27:25:35 | ok(...) |
+| resources/Resource.java:29:46:29:73 | ok(...) |

java/ql/test/library-tests/frameworks/play/PlayMvcResultsMethods.ql

@@ -0,0 +1,4 @@
+import semmle.code.java.frameworks.play.Play
+
+from PlayMvcResultsMethods m
+select m.getAnOkAccess()

java/ql/test/library-tests/frameworks/play/options

@@ -0,0 +1 @@
+//semmle-extractor-options: --javac-args -cp ${testdir}/../../../stubs/playframework-2.6.x:${testdir}/../../../stubs/jackson-databind-2.10:${testdir}/../../../stubs/akka-2.6.x

java/ql/test/library-tests/frameworks/play/resources/Resource.java

@@ -0,0 +1,36 @@
+import java.util.concurrent.CompletableFuture;
+import java.util.concurrent.CompletionStage;
+import play.filters.csrf.AddCSRFToken;
+import play.libs.F;
+import play.mvc.BodyParser;
+import play.mvc.Controller;
+import play.mvc.Http.*;
+import play.mvc.Result;
+
+public class Resource extends Controller {
+
+  @AddCSRFToken
+  public Result index() {
+    response().setHeader("X-Play-QL", "1");
+    return ok("It works!");
+  }
+
+  @BodyParser.Of()
+  public Result session_redirect_me(String uri) {
+    String url = request().getQueryString("url");
+    return redirect(url);
+  }
+
+  public F.Promise<Result> async_promise(String token) {
+    return F.Promise.pure(ok(token));
+  }
+
+  public CompletionStage<Result> async_completionstage(String uri) {
+    return CompletableFuture.completedFuture(ok("Async completion Stage"));
+  }
+
+  public String not_playactionmethod(String no_action) {
+    String return_code = no_action;
+    return return_code;
+  }
+}

java/ql/test/stubs/akka-2.6.x/akka/util/ByteString.java

@@ -0,0 +1,6 @@
+package akka.util;
+
+/** XML utilities. */
+public class ByteString {
+
+}

java/ql/test/stubs/jackson-databind-2.10/com/fasterxml/jackson/core/JsonEncoding.java

@@ -0,0 +1,3 @@
+package com.fasterxml.jackson.core;
+
+public class JsonEncoding {}

java/ql/test/stubs/jackson-databind-2.10/com/fasterxml/jackson/databind/JsonNode.java

@@ -0,0 +1,6 @@
+package com.fasterxml.jackson.databind;
+
+public class JsonNode {
+    public JsonNode() {
+    }
+}

java/ql/test/stubs/playframework-2.6.x/play/Application.java

@@ -0,0 +1,31 @@
+/*
+ * Copyright (C) 2009-2016 Lightbend Inc. <https://www.lightbend.com>
+ */
+package play;
+
+import java.io.File;
+import java.io.InputStream;
+import java.net.URL;
+
+public interface Application {
+
+  default File path() {
+    return null;
+  }
+
+  default ClassLoader classloader() {
+    return null;
+  }
+
+  default File getFile(String relativePath) {
+    return null;
+  }
+
+  default URL resource(String relativePath) {
+    return null;
+  }
+
+  default InputStream resourceAsStream(String relativePath) {
+    return null;
+  }
+}

java/ql/test/stubs/playframework-2.6.x/play/Play.java

@@ -0,0 +1,10 @@
+package play;
+
+@Deprecated
+public class Play {
+
+  @Deprecated
+  public static Application application() {
+    return null;
+  }
+}

java/ql/test/stubs/playframework-2.6.x/play/api/mvc/Request.java

@@ -0,0 +1,3 @@
+package play.api.mvc;
+
+public class Request<RequestBody> {}

java/ql/test/stubs/playframework-2.6.x/play/api/mvc/RequestHeader.java

@@ -0,0 +1,3 @@
+package play.api.mvc;
+
+public class RequestHeader {}

java/ql/test/stubs/playframework-2.6.x/play/api/mvc/StatusHeader.java

@@ -0,0 +1,3 @@
+package play.api.mvc;
+
+public class StatusHeader {}

java/ql/test/stubs/playframework-2.6.x/play/core/j/JavaContextComponents.java

@@ -0,0 +1,3 @@
+package play.core.j;
+
+public class JavaContextComponents {}

java/ql/test/stubs/playframework-2.6.x/play/core/j/RequestImpl.java

@@ -0,0 +1,3 @@
+package play.core.j;
+
+public class RequestImpl {}

java/ql/test/stubs/playframework-2.6.x/play/filters/csrf/AddCSRFToken.java

@@ -0,0 +1,10 @@
+package play.filters.csrf;
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+@Retention(RetentionPolicy.RUNTIME)
+@Target({ElementType.METHOD, ElementType.TYPE})
+public @interface AddCSRFToken {}

java/ql/test/stubs/playframework-2.6.x/play/http/HttpEntity.java

@@ -0,0 +1,3 @@
+package play.http;
+
+public abstract class HttpEntity {}

java/ql/test/stubs/playframework-2.6.x/play/i18n/Lang.java

@@ -0,0 +1,9 @@
+/*
+ * Copyright (C) Lightbend Inc. <https://www.lightbend.com>
+ */
+
+package play.i18n;
+
+import java.util.*;
+
+public class Lang {}

java/ql/test/stubs/playframework-2.6.x/play/i18n/Langs.java

@@ -0,0 +1,3 @@
+package play.i18n;
+
+public class Langs {}

java/ql/test/stubs/playframework-2.6.x/play/i18n/Messages.java

@@ -0,0 +1,7 @@
+/*
+ * Copyright (C) Lightbend Inc. <https://www.lightbend.com>
+ */
+
+package play.i18n;
+
+public interface Messages {}

java/ql/test/stubs/playframework-2.6.x/play/i18n/MessagesApi.java

@@ -0,0 +1,7 @@
+/*
+ * Copyright (C) Lightbend Inc. <https://www.lightbend.com>
+ */
+
+package play.i18n;
+
+public class MessagesApi {}

java/ql/test/stubs/playframework-2.6.x/play/libs/F.java

@@ -0,0 +1,16 @@
+/*
+ * Copyright (C) Lightbend Inc. <https://www.lightbend.com>
+ */
+
+package play.libs;
+
+import java.util.*;
+import java.util.concurrent.*;
+
+public class F {
+  public static class Promise<A> { // this is needed for play.libs.F for Play 2.3.x
+    public static <A> Promise<A> pure(final A a) {
+      return null;
+    }
+  }
+}

java/ql/test/stubs/playframework-2.6.x/play/libs/Files.java

@@ -0,0 +1,95 @@
+/*
+ * Copyright (C) Lightbend Inc. <https://www.lightbend.com>
+ */
+
+package play.libs;
+
+import java.io.File;
+import java.nio.file.Path;
+
+public final class Files {
+
+  public interface TemporaryFileCreator {
+    TemporaryFile create(String prefix, String suffix);
+
+    TemporaryFile create(Path path);
+
+    boolean delete(TemporaryFile temporaryFile);
+  }
+
+  public interface TemporaryFile {
+
+    Path path();
+
+    @Deprecated
+    File file();
+
+    TemporaryFileCreator temporaryFileCreator();
+
+    default TemporaryFile moveTo(File to) {
+      return null;
+    }
+
+    TemporaryFile moveTo(File to, boolean replace);
+
+    TemporaryFile atomicMoveWithFallback(File to);
+  }
+
+  public static class DelegateTemporaryFileCreator implements TemporaryFileCreator {
+
+    public TemporaryFile create(String prefix, String suffix) {
+      return null;
+    }
+
+    public TemporaryFile create(Path path) {
+      return null;
+    }
+
+    public boolean delete(TemporaryFile temporaryFile) {
+      return true;
+    }
+  }
+
+  public static class DelegateTemporaryFile implements TemporaryFile {
+
+    public Path path() {
+      return null;
+    }
+
+    public File file() {
+      return null;
+    }
+
+    public TemporaryFileCreator temporaryFileCreator() {
+      return null;
+    }
+
+    public TemporaryFile moveTo(File to, boolean replace) {
+      return null;
+    }
+
+    public TemporaryFile atomicMoveWithFallback(File to) {
+      return null;
+    }
+  }
+
+  public static class SingletonTemporaryFileCreator implements TemporaryFileCreator {
+    public TemporaryFile create(String prefix, String suffix) {
+      return null;
+    }
+
+    public TemporaryFile create(Path path) {
+      return null;
+    }
+
+    public boolean delete(TemporaryFile temporaryFile) {
+      return true;
+    }
+  }
+
+  private static final TemporaryFileCreator instance = new Files.SingletonTemporaryFileCreator();
+
+  public static TemporaryFileCreator singletonTemporaryFileCreator() {
+    return null;
+  }
+}

java/ql/test/stubs/playframework-2.6.x/play/libs/XML.java

@@ -0,0 +1,3 @@
+package play.libs;
+
+public class XML {}

java/ql/test/stubs/playframework-2.6.x/play/libs/typedmap/TypedKey.java

@@ -0,0 +1,7 @@
+/*
+ * Copyright (C) Lightbend Inc. <https://www.lightbend.com>
+ */
+
+package play.libs.typedmap;
+
+public final class TypedKey<A> {}

java/ql/test/stubs/playframework-2.6.x/play/libs/typedmap/TypedMap.java

@@ -0,0 +1,7 @@
+/*
+ * Copyright (C) Lightbend Inc. <https://www.lightbend.com>
+ */
+
+package play.libs.typedmap;
+
+public final class TypedMap {}

java/ql/test/stubs/playframework-2.6.x/play/mvc/BodyParser.java

@@ -0,0 +1,17 @@
+/*
+ * Copyright (C) Lightbend Inc. <https://www.lightbend.com>
+ */
+
+package play.mvc;
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+public interface BodyParser<A> {
+
+  @Target({ElementType.TYPE, ElementType.METHOD})
+  @Retention(RetentionPolicy.RUNTIME)
+  @interface Of {}
+}

java/ql/test/stubs/playframework-2.6.x/play/mvc/Call.java

@@ -0,0 +1,6 @@
+/*
+ * Copyright (C) 2009-2013 Typesafe Inc. <http://www.typesafe.com>
+ */
+package play.mvc;
+
+public class Call {}

java/ql/test/stubs/playframework-2.6.x/play/mvc/Controller.java

@@ -0,0 +1,59 @@
+package play.mvc;
+
+import play.i18n.Lang;
+import play.mvc.Http.Context;
+import play.mvc.Http.Flash;
+import play.mvc.Http.HeaderNames;
+import play.mvc.Http.Request;
+import play.mvc.Http.Response;
+import play.mvc.Http.Session;
+import play.mvc.Http.Status;
+
+public abstract class Controller extends Results implements Status, HeaderNames {
+
+  public static Context ctx() {
+    return null;
+  }
+
+  public static Request request() {
+    return null;
+  }
+
+  public static Lang lang() {
+    return null;
+  }
+
+  public static boolean changeLang(String code) {
+    return true;
+  }
+
+  public static boolean changeLang(Lang lang) {
+    return true;
+  }
+
+  public static void clearLang() {}
+
+  public static Response response() {
+    return null;
+  }
+
+  public static Session session() {
+    return null;
+  }
+
+  public static void session(String key, String value) {}
+
+  public static String session(String key) {
+    return "";
+  }
+
+  public static Flash flash() {
+    return null;
+  }
+
+  public static void flash(String key, String value) {}
+
+  public static String flash(String key) {
+    return "";
+  }
+}

java/ql/test/stubs/playframework-2.6.x/play/mvc/Result.java

@@ -0,0 +1,7 @@
+/*
+ * Copyright (C) Lightbend Inc. <https://www.lightbend.com>
+ */
+
+package play.mvc;
+
+public class Result {}

java/ql/test/stubs/playframework-2.6.x/play/mvc/Results.java

@@ -0,0 +1,657 @@
+package play.mvc;
+
+import static play.mvc.Http.Status.*;
+
+import akka.util.ByteString;
+import com.fasterxml.jackson.core.JsonEncoding;
+import com.fasterxml.jackson.databind.JsonNode;
+import java.io.File;
+import java.io.InputStream;
+import play.api.mvc.StatusHeader;
+import play.twirl.api.Content;
+
+public class Results {
+
+  private static final String UTF8 = "utf-8";
+
+  public static StatusHeader status(int status) {
+    return null;
+  }
+
+  public static Result status(int status, Content content) {
+    return null;
+  }
+
+  public static Result status(int status, Content content, String charset) {
+    return null;
+  }
+
+  public static Result status(int status, String content) {
+    return null;
+  }
+
+  public static Result status(int status, String content, String charset) {
+    return null;
+  }
+
+  public static Result status(int status, JsonNode content) {
+    return null;
+  }
+
+  @Deprecated
+  public static Result status(int status, JsonNode content, String charset) {
+    return null;
+  }
+
+  public static Result status(int status, JsonNode content, JsonEncoding encoding) {
+    return null;
+  }
+
+  public static Result status(int status, byte[] content) {
+    return null;
+  }
+
+  public static Result status(int status, ByteString content) {
+    return null;
+  }
+
+  public static Result status(int status, InputStream content) {
+    return null;
+  }
+
+  public static Result status(int status, InputStream content, long contentLength) {
+    return null;
+  }
+
+  public static Result status(int status, File content) {
+    return null;
+  }
+
+  public static Result status(int status, File content, boolean inline) {
+    return null;
+  }
+
+  public static Result status(int status, File content, String fileName) {
+    return null;
+  }
+
+  public static StatusHeader noContent() {
+    return null;
+  }
+
+  public static StatusHeader ok() {
+    return null;
+  }
+
+  public static Result ok(Content content) {
+    return null;
+  }
+
+  public static Result ok(Content content, String charset) {
+    return null;
+  }
+
+  public static Result ok(String content) {
+    return null;
+  }
+
+  public static Result ok(String content, String charset) {
+    return null;
+  }
+
+  public static Result ok(JsonNode content) {
+    return null;
+  }
+
+  @Deprecated
+  public static Result ok(JsonNode content, String charset) {
+    return null;
+  }
+
+  public static Result ok(JsonNode content, JsonEncoding encoding) {
+    return null;
+  }
+
+  public static Result ok(byte[] content) {
+    return null;
+  }
+
+  public static Result ok(InputStream content) {
+    return null;
+  }
+
+  public static Result ok(InputStream content, long contentLength) {
+    return null;
+  }
+
+  public static Result ok(File content) {
+    return null;
+  }
+
+  public static Result ok(File content, boolean inline) {
+    return null;
+  }
+
+  public static Result ok(File content, String filename) {
+    return null;
+  }
+
+  public static StatusHeader created() {
+    return null;
+  }
+
+  public static Result created(Content content, String charset) {
+    return null;
+  }
+
+  public static Result created(String content) {
+    return null;
+  }
+
+  public static Result created(String content, String charset) {
+    return null;
+  }
+
+  public static Result created(JsonNode content) {
+    return null;
+  }
+
+  @Deprecated
+  public static Result created(JsonNode content, String charset) {
+    return null;
+  }
+
+  public static Result created(JsonNode content, JsonEncoding encoding) {
+    return null;
+  }
+
+  public static Result created(byte[] content) {
+    return null;
+  }
+
+  public static Result created(InputStream content) {
+    return null;
+  }
+
+  public static Result created(InputStream content, long contentLength) {
+    return null;
+  }
+
+  public static Result created(File content) {
+    return null;
+  }
+
+  public static Result created(File content, boolean inline) {
+    return null;
+  }
+
+  public static Result created(File content, String filename) {
+    return null;
+  }
+
+  public static StatusHeader badRequest() {
+    return null;
+  }
+
+  public static Result badRequest(Content content, String charset) {
+    return null;
+  }
+
+  public static Result badRequest(String content) {
+    return null;
+  }
+
+  public static Result badRequest(String content, String charset) {
+    return null;
+  }
+
+  public static Result badRequest(JsonNode content) {
+    return null;
+  }
+
+  @Deprecated
+  public static Result badRequest(JsonNode content, String charset) {
+    return null;
+  }
+
+  public static Result badRequest(JsonNode content, JsonEncoding encoding) {
+    return null;
+  }
+
+  public static Result badRequest(byte[] content) {
+    return null;
+  }
+
+  public static Result badRequest(InputStream content) {
+    return null;
+  }
+
+  public static Result badRequest(InputStream content, long contentLength) {
+    return null;
+  }
+
+  public static Result badRequest(File content) {
+    return null;
+  }
+
+  public static Result badRequest(File content, boolean inline) {
+    return null;
+  }
+
+  public static Result badRequest(File content, String filename) {
+    return null;
+  }
+
+  public static StatusHeader unauthorized() {
+    return null;
+  }
+
+  public static Result unauthorized(Content content, String charset) {
+    return null;
+  }
+
+  public static Result unauthorized(String content) {
+    return null;
+  }
+
+  public static Result unauthorized(String content, String charset) {
+    return null;
+  }
+
+  public static Result unauthorized(JsonNode content) {
+    return null;
+  }
+
+  @Deprecated
+  public static Result unauthorized(JsonNode content, String charset) {
+    return null;
+  }
+
+  public static Result unauthorized(JsonNode content, JsonEncoding encoding) {
+    return null;
+  }
+
+  public static Result unauthorized(byte[] content) {
+    return null;
+  }
+
+  public static Result unauthorized(InputStream content) {
+    return null;
+  }
+
+  public static Result unauthorized(InputStream content, long contentLength) {
+    return null;
+  }
+
+  public static Result unauthorized(File content) {
+    return null;
+  }
+
+  public static Result unauthorized(File content, boolean inline) {
+    return null;
+  }
+
+  public static Result unauthorized(File content, String filename) {
+    return null;
+  }
+
+  public static StatusHeader paymentRequired() {
+    return null;
+  }
+
+  public static Result paymentRequired(Content content) {
+    return null;
+  }
+
+  public static Result paymentRequired(Content content, String charset) {
+    return null;
+  }
+
+  public static Result paymentRequired(String content) {
+    return null;
+  }
+
+  public static Result paymentRequired(String content, String charset) {
+    return null;
+  }
+
+  public static Result paymentRequired(JsonNode content) {
+    return null;
+  }
+
+  @Deprecated
+  public static Result paymentRequired(JsonNode content, String charset) {
+    return null;
+  }
+
+  public static Result paymentRequired(JsonNode content, JsonEncoding encoding) {
+    return null;
+  }
+
+  public static Result paymentRequired(byte[] content) {
+    return null;
+  }
+
+  public static Result paymentRequired(InputStream content) {
+    return null;
+  }
+
+  public static Result paymentRequired(InputStream content, long contentLength) {
+    return null;
+  }
+
+  public static Result paymentRequired(File content) {
+    return null;
+  }
+
+  public static Result paymentRequired(File content, boolean inline) {
+    return null;
+  }
+
+  public static Result paymentRequired(File content, String filename) {
+    return null;
+  }
+
+  public static StatusHeader forbidden() {
+    return null;
+  }
+
+  public static Result forbidden(Content content, String charset) {
+    return null;
+  }
+
+  public static Result forbidden(String content) {
+    return null;
+  }
+
+  public static Result forbidden(String content, String charset) {
+    return null;
+  }
+
+  public static Result forbidden(JsonNode content) {
+    return null;
+  }
+
+  @Deprecated
+  public static Result forbidden(JsonNode content, String charset) {
+    return null;
+  }
+
+  public static Result forbidden(JsonNode content, JsonEncoding encoding) {
+    return null;
+  }
+
+  public static Result forbidden(byte[] content) {
+    return null;
+  }
+
+  public static Result forbidden(InputStream content) {
+    return null;
+  }
+
+  public static Result forbidden(InputStream content, long contentLength) {
+    return null;
+  }
+
+  public static Result forbidden(File content) {
+    return null;
+  }
+
+  public static Result forbidden(File content, boolean inline) {
+    return null;
+  }
+
+  public static Result forbidden(File content, String filename) {
+    return null;
+  }
+
+  public static StatusHeader notFound() {
+    return null;
+  }
+
+  public static Result notFound(Content content, String charset) {
+    return null;
+  }
+
+  public static Result notFound(String content) {
+    return null;
+  }
+
+  public static Result notFound(String content, String charset) {
+    return null;
+  }
+
+  public static Result notFound(JsonNode content) {
+    return null;
+  }
+
+  @Deprecated
+  public static Result notFound(JsonNode content, String charset) {
+    return null;
+  }
+
+  public static Result notFound(JsonNode content, JsonEncoding encoding) {
+    return null;
+  }
+
+  public static Result notFound(byte[] content) {
+    return null;
+  }
+
+  public static Result notFound(InputStream content) {
+    return null;
+  }
+
+  public static Result notFound(InputStream content, long contentLength) {
+    return null;
+  }
+
+  public static Result notFound(File content) {
+    return null;
+  }
+
+  public static Result notFound(File content, boolean inline) {
+    return null;
+  }
+
+  public static Result notFound(File content, String filename) {
+    return null;
+  }
+
+  public static StatusHeader notAcceptable() {
+    return null;
+  }
+
+  public static Result notAcceptable(Content content, String charset) {
+    return null;
+  }
+
+  public static Result notAcceptable(String content) {
+    return null;
+  }
+
+  public static Result notAcceptable(String content, String charset) {
+    return null;
+  }
+
+  public static Result notAcceptable(JsonNode content) {
+    return null;
+  }
+
+  public static Result notAcceptable(JsonNode content, JsonEncoding encoding) {
+    return null;
+  }
+
+  public static Result notAcceptable(byte[] content) {
+    return null;
+  }
+
+  public static Result notAcceptable(InputStream content) {
+    return null;
+  }
+
+  public static Result notAcceptable(InputStream content, long contentLength) {
+    return null;
+  }
+
+  public static Result notAcceptable(File content) {
+    return null;
+  }
+
+  public static Result notAcceptable(File content, boolean inline) {
+    return null;
+  }
+
+  public static Result notAcceptable(File content, String filename) {
+    return null;
+  }
+
+  public static StatusHeader unsupportedMediaType() {
+    return null;
+  }
+
+  public static Result unsupportedMediaType(Content content, String charset) {
+    return null;
+  }
+
+  public static Result unsupportedMediaType(String content) {
+    return null;
+  }
+
+  public static Result unsupportedMediaType(String content, String charset) {
+    return null;
+  }
+
+  public static Result unsupportedMediaType(JsonNode content) {
+    return null;
+  }
+
+  public static Result unsupportedMediaType(JsonNode content, JsonEncoding encoding) {
+    return null;
+  }
+
+  public static Result unsupportedMediaType(byte[] content) {
+    return null;
+  }
+
+  public static Result unsupportedMediaType(InputStream content) {
+    return null;
+  }
+
+  public static Result unsupportedMediaType(InputStream content, long contentLength) {
+    return null;
+  }
+
+  public static Result unsupportedMediaType(File content) {
+    return null;
+  }
+
+  public static Result unsupportedMediaType(File content, boolean inline) {
+    return null;
+  }
+
+  public static Result unsupportedMediaType(File content, String filename) {
+    return null;
+  }
+
+  public static StatusHeader internalServerError() {
+    return null;
+  }
+
+  public static Result internalServerError(Content content, String charset) {
+    return null;
+  }
+
+  public static Result internalServerError(String content) {
+    return null;
+  }
+
+  public static Result internalServerError(String content, String charset) {
+    return null;
+  }
+
+  public static Result internalServerError(JsonNode content) {
+    return null;
+  }
+
+  @Deprecated
+  public static Result internalServerError(JsonNode content, String charset) {
+    return null;
+  }
+
+  public static Result internalServerError(JsonNode content, JsonEncoding encoding) {
+    return null;
+  }
+
+  public static Result internalServerError(byte[] content) {
+    return null;
+  }
+
+  public static Result internalServerError(InputStream content) {
+    return null;
+  }
+
+  public static Result internalServerError(InputStream content, long contentLength) {
+    return null;
+  }
+
+  public static Result internalServerError(File content) {
+    return null;
+  }
+
+  public static Result internalServerError(File content, boolean inline) {
+    return null;
+  }
+
+  public static Result internalServerError(File content, String filename) {
+    return null;
+  }
+
+  public static Result movedPermanently(String url) {
+    return null;
+  }
+
+  public static Result movedPermanently(Call call) {
+    return null;
+  }
+
+  public static Result found(String url) {
+    return null;
+  }
+
+  public static Result found(Call call) {
+    return null;
+  }
+
+  public static Result seeOther(String url) {
+    return null;
+  }
+
+  public static Result seeOther(Call call) {
+    return null;
+  }
+
+  public static Result redirect(String url) {
+    return null;
+  }
+
+  public static Result redirect(Call call) {
+    return null;
+  }
+
+  public static Result temporaryRedirect(String url) {
+    return null;
+  }
+
+  public static Result temporaryRedirect(Call call) {
+    return null;
+  }
+
+  public static Result permanentRedirect(String url) {
+    return null;
+  }
+
+  public static Result permanentRedirect(Call call) {
+    return null;
+  }
+}

java/ql/test/stubs/playframework-2.6.x/play/twirl/api/Content.java

@@ -0,0 +1,6 @@
+/*
+ * Copyright (C) 2009-2013 Typesafe Inc. <http://www.typesafe.com>
+ */
+package play.twirl.api;
+
+public class Content {}