Java: Remove omittable exists variables

2026-04-30 11:15:13 +02:00 · 2022-12-21 16:31:20 +01:00
parent 7a92970d89
commit 32471d326e
63 changed files with 319 additions and 418 deletions
--- a/java/ql/test/library-tests/dataflow/entrypoint-types/EntryPointTypesTest.ql
+++ b/java/ql/test/library-tests/dataflow/entrypoint-types/EntryPointTypesTest.ql
@@ -25,7 +25,7 @@ class HasFlowTest extends InlineExpectationsTest {

  override predicate hasActualResult(Location location, string element, string tag, string value) {
    tag = "hasTaintFlow" and
-    exists(DataFlow::Node src, DataFlow::Node sink, TaintFlowConf conf | conf.hasFlow(src, sink) |
+    exists(DataFlow::Node sink, TaintFlowConf conf | conf.hasFlowTo(sink) |
      sink.getLocation() = location and
      element = sink.toString() and
      value = ""
--- a/java/ql/test/library-tests/dataflow/taintsources/local.ql
+++ b/java/ql/test/library-tests/dataflow/taintsources/local.ql
@@ -33,7 +33,7 @@ class LocalFlowTest extends InlineExpectationsTest {

  override predicate hasActualResult(Location location, string element, string tag, string value) {
    tag = "hasLocalValueFlow" and
-    exists(DataFlow::Node src, DataFlow::Node sink | any(LocalValueConf c).hasFlow(src, sink) |
+    exists(DataFlow::Node sink | any(LocalValueConf c).hasFlowTo(sink) |
      sink.getLocation() = location and
      element = sink.toString() and
      value = ""
--- a/java/ql/test/library-tests/dataflow/taintsources/remote.ql
+++ b/java/ql/test/library-tests/dataflow/taintsources/remote.ql
@@ -29,7 +29,7 @@ class RemoteFlowTest extends InlineExpectationsTest {

  override predicate hasActualResult(Location location, string element, string tag, string value) {
    tag = "hasRemoteValueFlow" and
-    exists(DataFlow::Node src, DataFlow::Node sink | any(RemoteValueConf c).hasFlow(src, sink) |
+    exists(DataFlow::Node sink | any(RemoteValueConf c).hasFlowTo(sink) |
      sink.getLocation() = location and
      element = sink.toString() and
      value = ""
--- a/java/ql/test/library-tests/frameworks/android/taint-database/flowSteps.ql
+++ b/java/ql/test/library-tests/frameworks/android/taint-database/flowSteps.ql
@@ -22,8 +22,8 @@ class FlowStepTest extends InlineExpectationsTest {
  override predicate hasActualResult(Location l, string element, string tag, string value) {
    tag = "taintReachesReturn" and
    value = "" and
-    exists(Conf conf, DataFlow::Node source, DataFlow::Node sink |
-      conf.hasFlow(source, sink) and
+    exists(Conf conf, DataFlow::Node source |
+      conf.hasFlow(source, _) and
      l = source.getLocation() and
      element = source.toString()
    )
--- a/java/ql/test/library-tests/frameworks/android/taint-database/sinks.ql
+++ b/java/ql/test/library-tests/frameworks/android/taint-database/sinks.ql
@@ -22,8 +22,8 @@ class SinkTest extends InlineExpectationsTest {
  override predicate hasActualResult(Location l, string element, string tag, string value) {
    tag = "taintReachesSink" and
    value = "" and
-    exists(Conf conf, DataFlow::Node source, DataFlow::Node sink |
-      conf.hasFlow(source, sink) and
+    exists(Conf conf, DataFlow::Node source |
+      conf.hasFlow(source, _) and
      l = source.getLocation() and
      element = source.toString()
    )
--- a/java/ql/test/library-tests/frameworks/guava/handwritten/flow.ql
+++ b/java/ql/test/library-tests/frameworks/guava/handwritten/flow.ql
@@ -46,9 +46,7 @@ class HasFlowTest extends InlineExpectationsTest {
    )
    or
    tag = "numValueFlow" and
-    exists(DataFlow::Node src, DataFlow::Node sink, ValueFlowConf vconf, int num |
-      vconf.hasFlow(src, sink)
-    |
+    exists(DataFlow::Node sink, ValueFlowConf vconf, int num | vconf.hasFlowTo(sink) |
      value = num.toString() and
      sink.getLocation() = location and
      element = sink.toString() and
--- a/java/ql/test/library-tests/frameworks/jms/FlowTest.ql
+++ b/java/ql/test/library-tests/frameworks/jms/FlowTest.ql
@@ -21,9 +21,7 @@ class JmsFlowTest extends InlineExpectationsTest {

  override predicate hasActualResult(Location location, string element, string tag, string value) {
    tag = "tainted" and
-    exists(DataFlow::PathNode source, DataFlow::PathNode sink, TestConfig conf |
-      conf.hasFlowPath(source, sink)
-    |
+    exists(DataFlow::PathNode sink, TestConfig conf | conf.hasFlowPath(_, sink) |
      location = sink.getNode().getLocation() and element = sink.getNode().toString() and value = ""
    )
  }
--- a/java/ql/test/library-tests/frameworks/ratpack/flow.ql
+++ b/java/ql/test/library-tests/frameworks/ratpack/flow.ql
@@ -24,7 +24,7 @@ class HasFlowTest extends InlineExpectationsTest {

  override predicate hasActualResult(Location location, string element, string tag, string value) {
    tag = "hasTaintFlow" and
-    exists(DataFlow::Node src, DataFlow::Node sink, Conf conf | conf.hasFlow(src, sink) |
+    exists(DataFlow::Node sink, Conf conf | conf.hasFlowTo(sink) |
      sink.getLocation() = location and
      element = sink.toString() and
      value = ""
--- a/java/ql/test/query-tests/security/CWE-074/JndiInjectionTest.ql
+++ b/java/ql/test/query-tests/security/CWE-074/JndiInjectionTest.ql
@@ -9,9 +9,7 @@ class HasJndiInjectionTest extends InlineExpectationsTest {

  override predicate hasActualResult(Location location, string element, string tag, string value) {
    tag = "hasJndiInjection" and
-    exists(DataFlow::Node src, DataFlow::Node sink, JndiInjectionFlowConfig conf |
-      conf.hasFlow(src, sink)
-    |
+    exists(DataFlow::Node sink, JndiInjectionFlowConfig conf | conf.hasFlowTo(sink) |
      sink.getLocation() = location and
      element = sink.toString() and
      value = ""
--- a/java/ql/test/query-tests/security/CWE-074/XsltInjectionTest.ql
+++ b/java/ql/test/query-tests/security/CWE-074/XsltInjectionTest.ql
@@ -11,9 +11,7 @@ class HasXsltInjectionTest extends InlineExpectationsTest {

  override predicate hasActualResult(Location location, string element, string tag, string value) {
    tag = "hasXsltInjection" and
-    exists(DataFlow::Node src, DataFlow::Node sink, XsltInjectionFlowConfig conf |
-      conf.hasFlow(src, sink)
-    |
+    exists(DataFlow::Node sink, XsltInjectionFlowConfig conf | conf.hasFlowTo(sink) |
      sink.getLocation() = location and
      element = sink.toString() and
      value = ""
--- a/java/ql/test/query-tests/security/CWE-079/semmle/tests/XSS.ql
+++ b/java/ql/test/query-tests/security/CWE-079/semmle/tests/XSS.ql
@@ -24,7 +24,7 @@ class XssTest extends InlineExpectationsTest {

  override predicate hasActualResult(Location location, string element, string tag, string value) {
    tag = "xss" and
-    exists(DataFlow::Node src, DataFlow::Node sink, XssConfig conf | conf.hasFlow(src, sink) |
+    exists(DataFlow::Node sink, XssConfig conf | conf.hasFlowTo(sink) |
      sink.getLocation() = location and
      element = sink.toString() and
      value = ""
--- a/java/ql/test/query-tests/security/CWE-089/semmle/examples/springjdbc.ql
+++ b/java/ql/test/query-tests/security/CWE-089/semmle/examples/springjdbc.ql
@@ -30,9 +30,7 @@ class HasFlowTest extends InlineExpectationsTest {

  override predicate hasActualResult(Location location, string element, string tag, string value) {
    tag = "sqlInjection" and
-    exists(DataFlow::Node src, DataFlow::Node sink, QueryInjectionFlowConfig conf |
-      conf.hasFlow(src, sink)
-    |
+    exists(DataFlow::Node sink, QueryInjectionFlowConfig conf | conf.hasFlowTo(sink) |
      sink.getLocation() = location and
      element = sink.toString() and
      value = ""
--- a/java/ql/test/query-tests/security/CWE-094/GroovyInjectionTest.ql
+++ b/java/ql/test/query-tests/security/CWE-094/GroovyInjectionTest.ql
@@ -11,9 +11,7 @@ class HasGroovyInjectionTest extends InlineExpectationsTest {

  override predicate hasActualResult(Location location, string element, string tag, string value) {
    tag = "hasGroovyInjection" and
-    exists(DataFlow::Node src, DataFlow::Node sink, GroovyInjectionConfig conf |
-      conf.hasFlow(src, sink)
-    |
+    exists(DataFlow::Node sink, GroovyInjectionConfig conf | conf.hasFlowTo(sink) |
      sink.getLocation() = location and
      element = sink.toString() and
      value = ""
--- a/java/ql/test/query-tests/security/CWE-094/JexlInjectionTest.ql
+++ b/java/ql/test/query-tests/security/CWE-094/JexlInjectionTest.ql
@@ -9,9 +9,7 @@ class JexlInjectionTest extends InlineExpectationsTest {

  override predicate hasActualResult(Location location, string element, string tag, string value) {
    tag = "hasJexlInjection" and
-    exists(DataFlow::Node src, DataFlow::Node sink, JexlInjectionConfig conf |
-      conf.hasFlow(src, sink)
-    |
+    exists(DataFlow::Node sink, JexlInjectionConfig conf | conf.hasFlowTo(sink) |
      sink.getLocation() = location and
      element = sink.toString() and
      value = ""
--- a/java/ql/test/query-tests/security/CWE-094/MvelInjectionTest.ql
+++ b/java/ql/test/query-tests/security/CWE-094/MvelInjectionTest.ql
@@ -11,9 +11,7 @@ class HasMvelInjectionTest extends InlineExpectationsTest {

  override predicate hasActualResult(Location location, string element, string tag, string value) {
    tag = "hasMvelInjection" and
-    exists(DataFlow::Node src, DataFlow::Node sink, MvelInjectionFlowConfig conf |
-      conf.hasFlow(src, sink)
-    |
+    exists(DataFlow::Node sink, MvelInjectionFlowConfig conf | conf.hasFlowTo(sink) |
      sink.getLocation() = location and
      element = sink.toString() and
      value = ""
--- a/java/ql/test/query-tests/security/CWE-094/SpelInjectionTest.ql
+++ b/java/ql/test/query-tests/security/CWE-094/SpelInjectionTest.ql
@@ -11,9 +11,7 @@ class HasSpelInjectionTest extends InlineExpectationsTest {

  override predicate hasActualResult(Location location, string element, string tag, string value) {
    tag = "hasSpelInjection" and
-    exists(DataFlow::Node src, DataFlow::Node sink, SpelInjectionConfig conf |
-      conf.hasFlow(src, sink)
-    |
+    exists(DataFlow::Node sink, SpelInjectionConfig conf | conf.hasFlowTo(sink) |
      sink.getLocation() = location and
      element = sink.toString() and
      value = ""
--- a/java/ql/test/query-tests/security/CWE-094/TemplateInjectionTest.ql
+++ b/java/ql/test/query-tests/security/CWE-094/TemplateInjectionTest.ql
@@ -9,9 +9,7 @@ class TemplateInjectionTest extends InlineExpectationsTest {

  override predicate hasActualResult(Location location, string element, string tag, string value) {
    tag = "hasTemplateInjection" and
-    exists(DataFlow::Node src, DataFlow::Node sink, TemplateInjectionFlowConfig conf |
-      conf.hasFlow(src, sink)
-    |
+    exists(DataFlow::Node sink, TemplateInjectionFlowConfig conf | conf.hasFlowTo(sink) |
      sink.getLocation() = location and
      element = sink.toString() and
      value = ""
--- a/java/ql/test/query-tests/security/CWE-1204/StaticInitializationVectorTest.ql
+++ b/java/ql/test/query-tests/security/CWE-1204/StaticInitializationVectorTest.ql
@@ -9,9 +9,7 @@ class StaticInitializationVectorTest extends InlineExpectationsTest {

  override predicate hasActualResult(Location location, string element, string tag, string value) {
    tag = "staticInitializationVector" and
-    exists(DataFlow::Node src, DataFlow::Node sink, StaticInitializationVectorConfig conf |
-      conf.hasFlow(src, sink)
-    |
+    exists(DataFlow::Node sink, StaticInitializationVectorConfig conf | conf.hasFlowTo(sink) |
      sink.getLocation() = location and
      element = sink.toString() and
      value = ""
--- a/java/ql/test/query-tests/security/CWE-326/InsufficientKeySizeTest.ql
+++ b/java/ql/test/query-tests/security/CWE-326/InsufficientKeySizeTest.ql
@@ -9,9 +9,7 @@ class InsufficientKeySizeTest extends InlineExpectationsTest {

  override predicate hasActualResult(Location location, string element, string tag, string value) {
    tag = "hasInsufficientKeySize" and
-    exists(DataFlow::PathNode source, DataFlow::PathNode sink |
-      exists(KeySizeConfiguration cfg | cfg.hasFlowPath(source, sink))
-    |
+    exists(DataFlow::PathNode sink | exists(KeySizeConfiguration cfg | cfg.hasFlowPath(_, sink)) |
      sink.getNode().getLocation() = location and
      element = sink.getNode().toString() and
      value = ""
--- a/java/ql/test/query-tests/security/CWE-347/MissingJWTSignatureCheckTest.ql
+++ b/java/ql/test/query-tests/security/CWE-347/MissingJWTSignatureCheckTest.ql
@@ -9,9 +9,7 @@ class HasMissingJwtSignatureCheckTest extends InlineExpectationsTest {

  override predicate hasActualResult(Location location, string element, string tag, string value) {
    tag = "hasMissingJwtSignatureCheck" and
-    exists(DataFlow::Node source, DataFlow::Node sink, MissingJwtSignatureCheckConf conf |
-      conf.hasFlow(source, sink)
-    |
+    exists(DataFlow::Node sink, MissingJwtSignatureCheckConf conf | conf.hasFlowTo(sink) |
      sink.getLocation() = location and
      element = sink.toString() and
      value = ""
--- a/java/ql/test/query-tests/security/CWE-522/InsecureBasicAuthTest.ql
+++ b/java/ql/test/query-tests/security/CWE-522/InsecureBasicAuthTest.ql
@@ -9,9 +9,7 @@ class HasInsecureBasicAuthTest extends InlineExpectationsTest {

  override predicate hasActualResult(Location location, string element, string tag, string value) {
    tag = "hasInsecureBasicAuth" and
-    exists(DataFlow::Node src, DataFlow::Node sink, BasicAuthFlowConfig conf |
-      conf.hasFlow(src, sink)
-    |
+    exists(DataFlow::Node sink, BasicAuthFlowConfig conf | conf.hasFlowTo(sink) |
      sink.getLocation() = location and
      element = sink.toString() and
      value = ""
--- a/java/ql/test/query-tests/security/CWE-643/XPathInjectionTest.ql
+++ b/java/ql/test/query-tests/security/CWE-643/XPathInjectionTest.ql
@@ -19,7 +19,7 @@ class HasXPathInjectionTest extends InlineExpectationsTest {

  override predicate hasActualResult(Location location, string element, string tag, string value) {
    tag = "hasXPathInjection" and
-    exists(DataFlow::Node src, DataFlow::Node sink, Conf conf | conf.hasFlow(src, sink) |
+    exists(DataFlow::Node sink, Conf conf | conf.hasFlowTo(sink) |
      sink.getLocation() = location and
      element = sink.toString() and
      value = ""
--- a/java/ql/test/query-tests/security/CWE-730/PolynomialReDoS.ql
+++ b/java/ql/test/query-tests/security/CWE-730/PolynomialReDoS.ql
@@ -8,11 +8,8 @@ class HasPolyRedos extends InlineExpectationsTest {

  override predicate hasActualResult(Location location, string element, string tag, string value) {
    tag = "hasPolyRedos" and
-    exists(
-      DataFlow::PathNode source, DataFlow::PathNode sink,
-      SuperlinearBackTracking::PolynomialBackTrackingTerm regexp
-    |
-      hasPolynomialReDoSResult(source, sink, regexp) and
+    exists(DataFlow::PathNode sink |
+      hasPolynomialReDoSResult(_, sink, _) and
      location = sink.getNode().getLocation() and
      element = sink.getNode().toString() and
      value = ""
--- a/java/ql/test/query-tests/security/CWE-730/ReDoS.ql
+++ b/java/ql/test/query-tests/security/CWE-730/ReDoS.ql
@@ -11,8 +11,8 @@ class HasExpRedos extends InlineExpectationsTest {

  override predicate hasActualResult(Location location, string element, string tag, string value) {
    tag = "hasExpRedos" and
-    exists(TreeView::RegExpTerm t, string pump, ExponentialBackTracking::State s, string prefixMsg |
-      ExponentialBackTracking::hasReDoSResult(t, pump, s, prefixMsg) and
+    exists(TreeView::RegExpTerm t |
+      ExponentialBackTracking::hasReDoSResult(t, _, _, _) and
      not t.getRegex().getAMode() = "VERBOSE" and
      value = "" and
      location = t.getLocation() and
--- a/java/ql/test/query-tests/security/CWE-730/RegexInjectionTest.ql
+++ b/java/ql/test/query-tests/security/CWE-730/RegexInjectionTest.ql
@@ -9,9 +9,7 @@ class RegexInjectionTest extends InlineExpectationsTest {

  override predicate hasActualResult(Location location, string element, string tag, string value) {
    tag = "hasRegexInjection" and
-    exists(DataFlow::PathNode source, DataFlow::PathNode sink, RegexInjectionConfiguration c |
-      c.hasFlowPath(source, sink)
-    |
+    exists(DataFlow::PathNode sink, RegexInjectionConfiguration c | c.hasFlowPath(_, sink) |
      location = sink.getNode().getLocation() and
      element = sink.getNode().toString() and
      value = ""
--- a/java/ql/test/query-tests/security/CWE-749/UnsafeAndroidAccessTest.ql
+++ b/java/ql/test/query-tests/security/CWE-749/UnsafeAndroidAccessTest.ql
@@ -9,9 +9,7 @@ class UnsafeAndroidAccessTest extends InlineExpectationsTest {

  override predicate hasActualResult(Location location, string element, string tag, string value) {
    tag = "hasUnsafeAndroidAccess" and
-    exists(DataFlow::Node src, DataFlow::Node sink, FetchUntrustedResourceConfiguration conf |
-      conf.hasFlow(src, sink)
-    |
+    exists(DataFlow::Node sink, FetchUntrustedResourceConfiguration conf | conf.hasFlowTo(sink) |
      sink.getLocation() = location and
      element = sink.toString() and
      value = ""
--- a/java/ql/test/query-tests/security/CWE-807/semmle/tests/ConditionalBypassTest.ql
+++ b/java/ql/test/query-tests/security/CWE-807/semmle/tests/ConditionalBypassTest.ql
@@ -9,9 +9,7 @@ class ConditionalBypassTest extends InlineExpectationsTest {

  override predicate hasActualResult(Location location, string element, string tag, string value) {
    tag = "hasConditionalBypassTest" and
-    exists(DataFlow::Node src, DataFlow::Node sink, ConditionalBypassFlowConfig conf |
-      conf.hasFlow(src, sink)
-    |
+    exists(DataFlow::Node sink, ConditionalBypassFlowConfig conf | conf.hasFlowTo(sink) |
      sink.getLocation() = location and
      element = sink.toString() and
      value = ""
--- a/java/ql/test/query-tests/security/CWE-917/OgnlInjectionTest.ql
+++ b/java/ql/test/query-tests/security/CWE-917/OgnlInjectionTest.ql
@@ -9,9 +9,7 @@ class OgnlInjectionTest extends InlineExpectationsTest {

  override predicate hasActualResult(Location location, string element, string tag, string value) {
    tag = "hasOgnlInjection" and
-    exists(DataFlow::Node src, DataFlow::Node sink, OgnlInjectionFlowConfig conf |
-      conf.hasFlow(src, sink)
-    |
+    exists(DataFlow::Node sink, OgnlInjectionFlowConfig conf | conf.hasFlowTo(sink) |
      sink.getLocation() = location and
      element = sink.toString() and
      value = ""
--- a/java/ql/test/query-tests/security/CWE-927/ImplicitPendingIntentsTest.ql
+++ b/java/ql/test/query-tests/security/CWE-927/ImplicitPendingIntentsTest.ql
@@ -9,9 +9,7 @@ class ImplicitPendingIntentsTest extends InlineExpectationsTest {

  override predicate hasActualResult(Location location, string element, string tag, string value) {
    tag = "hasImplicitPendingIntent" and
-    exists(DataFlow::Node src, DataFlow::Node sink |
-      any(ImplicitPendingIntentStartConf c).hasFlow(src, sink)
-    |
+    exists(DataFlow::Node sink | any(ImplicitPendingIntentStartConf c).hasFlowTo(sink) |
      sink.getLocation() = location and
      element = sink.toString() and
      value = ""
--- a/java/ql/test/query-tests/security/CWE-940/AndroidIntentRedirectionTest.ql
+++ b/java/ql/test/query-tests/security/CWE-940/AndroidIntentRedirectionTest.ql
@@ -9,9 +9,7 @@ class HasAndroidIntentRedirectionTest extends InlineExpectationsTest {

  override predicate hasActualResult(Location location, string element, string tag, string value) {
    tag = "hasAndroidIntentRedirection" and
-    exists(DataFlow::Node src, DataFlow::Node sink, IntentRedirectionConfiguration conf |
-      conf.hasFlow(src, sink)
-    |
+    exists(DataFlow::Node sink, IntentRedirectionConfiguration conf | conf.hasFlowTo(sink) |
      sink.getLocation() = location and
      element = sink.toString() and
      value = ""
--- a/java/ql/test/utils/model-generator/typebasedflow/CaptureTypeBasedSummaryModels.ql
+++ b/java/ql/test/utils/model-generator/typebasedflow/CaptureTypeBasedSummaryModels.ql
@@ -7,7 +7,7 @@ private string expects() {
  )
 }

-private string flows() { exists(TypeBasedFlowTargetApi api | result = captureFlow(api)) }
+private string flows() { result = captureFlow(_) }

 query predicate unexpectedSummary(string msg) {
  exists(string flow |