Fix password models

2026-04-20 22:44:52 +02:00 · 2023-08-16 01:10:08 -04:00
parent 4f8908106b
commit 35e19eac96
30 changed files with 114 additions and 114 deletions
--- a/java/ql/lib/ext/com.sun.crypto.provider.model.yml
+++ b/java/ql/lib/ext/com.sun.crypto.provider.model.yml
@@ -3,14 +3,6 @@ extensions:
      pack: codeql/java-all
      extensible: sinkModel
    data:
-      - ["com.sun.crypto.provider", "JceKeyStore", False, "engineGetKey", "(String, char[])", "credential-password", "Argument[1]", "manual"]
-      - ["com.sun.crypto.provider", "JceKeyStore", False, "engineLoad", "(InputStream, char[])", "credential-password", "Argument[1]", "manual"]
-      - ["com.sun.crypto.provider", "JceKeyStore", False, "engineSetKeyEntry", "(String, Key, char[], Certificate[])", "credential-password", "Argument[2]", "manual"]
-      - ["com.sun.crypto.provider", "JceKeyStore", False, "engineStore", "(OutputStream, char[])", "credential-password", "Argument[1]", "manual"]
-      - ["com.sun.crypto.provider", "JceKeyStore", False, "getPreKeyedHash", "(char[])", "credential-password", "Argument[0]", "manual"]
-      - ["com.sun.crypto.provider", "KeyProtector", False, "KeyProtector", "(char[])", "credential-password", "Argument[0]", "manual"]
-      - ["com.sun.crypto.provider", "PBKDF2KeyImpl", False, "deriveKey", "(Mac, byte[], byte[], int, int)", "credential-password", "Argument[1]", "manual"]
-      - ["com.sun.crypto.provider", "PBKDF2KeyImpl", False, "getPasswordBytes", "(char[])", "credential-password", "Argument[0]", "manual"]
      - ["com.sun.crypto.provider", "AESCipher", False, "engineUnwrap", "(byte[], String, int)", "crypto-parameter", "Argument[0]", "manual"]
      - ["com.sun.crypto.provider", "AESCrypt", False, "init", "(boolean, String, byte[])", "crypto-parameter", "Argument[2]", "manual"]
      - ["com.sun.crypto.provider", "AESWrapCipher", False, "engineUnwrap", "(byte[], String, int)", "crypto-parameter", "Argument[0]", "manual"]
@@ -65,3 +57,11 @@ extensions:
      - ["com.sun.crypto.provider", "RSACipher", False, "engineUnwrap", "(byte[], String, int)", "crypto-parameter", "Argument[0]", "manual"]
      - ["com.sun.crypto.provider", "SymmetricCipher", False, "init", "(boolean, String, byte[])", "crypto-parameter", "Argument[2]", "manual"]
      - ["com.sun.crypto.provider", "TlsMasterSecretGenerator$TlsMasterSecretKey", False, "TlsMasterSecretKey", "(byte[], int, int)", "crypto-parameter", "Argument[0]", "manual"]
+      - ["com.sun.crypto.provider", "JceKeyStore", False, "engineGetKey", "(String, char[])", "", "Argument[1]", "credential-password", "manual"]
+      - ["com.sun.crypto.provider", "JceKeyStore", False, "engineLoad", "(InputStream, char[])", "", "Argument[1]", "credential-password", "manual"]
+      - ["com.sun.crypto.provider", "JceKeyStore", False, "engineSetKeyEntry", "(String, Key, char[], Certificate[])", "", "Argument[2]", "credential-password", "manual"]
+      - ["com.sun.crypto.provider", "JceKeyStore", False, "engineStore", "(OutputStream, char[])", "", "Argument[1]", "credential-password", "manual"]
+      - ["com.sun.crypto.provider", "JceKeyStore", False, "getPreKeyedHash", "(char[])", "", "Argument[0]", "credential-password", "manual"]
+      - ["com.sun.crypto.provider", "KeyProtector", False, "KeyProtector", "(char[])", "", "Argument[0]", "credential-password", "manual"]
+      - ["com.sun.crypto.provider", "PBKDF2KeyImpl", False, "deriveKey", "(Mac, byte[], byte[], int, int)", "", "Argument[1]", "credential-password", "manual"]
+      - ["com.sun.crypto.provider", "PBKDF2KeyImpl", False, "getPasswordBytes", "(char[])", "", "Argument[0]", "credential-password", "manual"]
--- a/java/ql/lib/ext/com.sun.istack.internal.tools.model.yml
+++ b/java/ql/lib/ext/com.sun.istack.internal.tools.model.yml
@@ -3,5 +3,5 @@ extensions:
      pack: codeql/java-all
      extensible: sinkModel
    data:
-      - ["com.sun.istack.internal.tools", "DefaultAuthenticator$AuthInfo", False, "AuthInfo", "(URL, String, String)", "credential-password", "Argument[2]", "manual"]
-      - ["com.sun.istack.internal.tools", "DefaultAuthenticator$AuthInfo", False, "AuthInfo", "(URL, String, String)", "credential-username", "Argument[1]", "manual"]
+      - ["com.sun.istack.internal.tools", "DefaultAuthenticator$AuthInfo", False, "AuthInfo", "(URL, String, String)", "", "Argument[2]", "credential-password", "manual"]
+      - ["com.sun.istack.internal.tools", "DefaultAuthenticator$AuthInfo", False, "AuthInfo", "(URL, String, String)", "", "Argument[1]", "credential-username", "manual"]
--- a/java/ql/lib/ext/com.sun.net.httpserver.model.yml
+++ b/java/ql/lib/ext/com.sun.net.httpserver.model.yml
@@ -3,6 +3,6 @@ extensions:
      pack: codeql/java-all
      extensible: sinkModel
    data:
-      - ["com.sun.net.httpserver", "BasicAuthenticator", False, "checkCredentials", "(String, String)", "credential-password", "Argument[1]", "manual"]
-      - ["com.sun.net.httpserver", "BasicAuthenticator", False, "checkCredentials", "(String, String)", "credential-username", "Argument[0]", "manual"]
-      - ["com.sun.net.httpserver", "HttpPrincipal", False, "HttpPrincipal", "(String, String)", "credential-username", "Argument[0]", "manual"]
+      - ["com.sun.net.httpserver", "BasicAuthenticator", False, "checkCredentials", "(String, String)", "", "Argument[1]", "credential-password", "manual"]
+      - ["com.sun.net.httpserver", "BasicAuthenticator", False, "checkCredentials", "(String, String)", "", "Argument[0]", "credential-username", "manual"]
+      - ["com.sun.net.httpserver", "HttpPrincipal", False, "HttpPrincipal", "(String, String)", "", "Argument[0]", "credential-username", "manual"]
--- a/java/ql/lib/ext/com.sun.net.ssl.model.yml
+++ b/java/ql/lib/ext/com.sun.net.ssl.model.yml
@@ -3,6 +3,6 @@ extensions:
      pack: codeql/java-all
      extensible: sinkModel
    data:
-      - ["com.sun.net.ssl", "KeyManagerFactory", False, "init", "(KeyStore, char[])", "credential-password", "Argument[1]", "manual"]
-      - ["com.sun.net.ssl", "KeyManagerFactorySpi", False, "engineInit", "(KeyStore, char[])", "credential-password", "Argument[1]", "manual"]
-      - ["com.sun.net.ssl", "KeyManagerFactorySpiWrapper", False, "engineInit", "(KeyStore, char[])", "credential-password", "Argument[1]", "manual"]
+      - ["com.sun.net.ssl", "KeyManagerFactory", False, "init", "(KeyStore, char[])", "", "Argument[1]", "credential-password", "manual"]
+      - ["com.sun.net.ssl", "KeyManagerFactorySpi", False, "engineInit", "(KeyStore, char[])", "", "Argument[1]", "credential-password", "manual"]
+      - ["com.sun.net.ssl", "KeyManagerFactorySpiWrapper", False, "engineInit", "(KeyStore, char[])", "", "Argument[1]", "credential-password", "manual"]
--- a/java/ql/lib/ext/com.sun.org.apache.xml.internal.security.keys.keyresolver.implementations.model.yml
+++ b/java/ql/lib/ext/com.sun.org.apache.xml.internal.security.keys.keyresolver.implementations.model.yml
@@ -3,5 +3,5 @@ extensions:
      pack: codeql/java-all
      extensible: sinkModel
    data:
-      - ["com.sun.org.apache.xml.internal.security.keys.keyresolver.implementations", "PrivateKeyResolver", False, "PrivateKeyResolver", "(KeyStore, char[])", "credential-password", "Argument[1]", "manual"]
-      - ["com.sun.org.apache.xml.internal.security.keys.keyresolver.implementations", "SecretKeyResolver", False, "SecretKeyResolver", "(KeyStore, char[])", "credential-password", "Argument[1]", "manual"]
+      - ["com.sun.org.apache.xml.internal.security.keys.keyresolver.implementations", "PrivateKeyResolver", False, "PrivateKeyResolver", "(KeyStore, char[])", "", "Argument[1]", "credential-password", "manual"]
+      - ["com.sun.org.apache.xml.internal.security.keys.keyresolver.implementations", "SecretKeyResolver", False, "SecretKeyResolver", "(KeyStore, char[])", "", "Argument[1]", "credential-password", "manual"]
--- a/java/ql/lib/ext/com.sun.rowset.model.yml
+++ b/java/ql/lib/ext/com.sun.rowset.model.yml
@@ -3,6 +3,6 @@ extensions:
      pack: codeql/java-all
      extensible: sinkModel
    data:
-      - ["com.sun.rowset", "JdbcRowSetImpl", False, "JdbcRowSetImpl", "(String, String, String)", "credential-password", "Argument[2]", "manual"]
-      - ["com.sun.rowset", "JdbcRowSetImpl", False, "setPassword", "(String)", "credential-password", "Argument[0]", "manual"]
      - ["com.sun.rowset", "JdbcRowSetImpl", False, "JdbcRowSetImpl", "(String, String, String)", "credential-username", "Argument[1]", "manual"]
+      - ["com.sun.rowset", "JdbcRowSetImpl", False, "JdbcRowSetImpl", "(String, String, String)", "", "Argument[2]", "credential-password", "manual"]
+      - ["com.sun.rowset", "JdbcRowSetImpl", False, "setPassword", "(String)", "", "Argument[0]", "credential-password", "manual"]
--- a/java/ql/lib/ext/com.sun.security.auth.module.model.yml
+++ b/java/ql/lib/ext/com.sun.security.auth.module.model.yml
@@ -3,5 +3,5 @@ extensions:
      pack: codeql/java-all
      extensible: sinkModel
    data:
-      - ["com.sun.security.auth.module", "JndiLoginModule", False, "verifyPassword", "(String, String)", "credential-password", "Argument[0]", "manual"]
-      - ["com.sun.security.auth.module", "JndiLoginModule", False, "verifyPassword", "(String, String)", "credential-password", "Argument[1]", "manual"]
+      - ["com.sun.security.auth.module", "JndiLoginModule", False, "verifyPassword", "(String, String)", "", "Argument[0]", "credential-password", "manual"]
+      - ["com.sun.security.auth.module", "JndiLoginModule", False, "verifyPassword", "(String, String)", "", "Argument[1]", "credential-password", "manual"]
--- a/java/ql/lib/ext/com.sun.security.ntlm.model.yml
+++ b/java/ql/lib/ext/com.sun.security.ntlm.model.yml
@@ -3,8 +3,8 @@ extensions:
      pack: codeql/java-all
      extensible: sinkModel
    data:
-      - ["com.sun.security.ntlm", "Client", False, "Client", "(String, String, String, String, char[])", "credential-password", "Argument[4]", "manual"]
-      - ["com.sun.security.ntlm", "NTLM", False, "getP1", "(char[])", "credential-password", "Argument[0]", "manual"]
-      - ["com.sun.security.ntlm", "NTLM", False, "getP2", "(char[])", "credential-password", "Argument[0]", "manual"]
+      - ["com.sun.security.ntlm", "Client", False, "Client", "(String, String, String, String, char[])", "", "Argument[4]", "credential-password", "manual"]
+      - ["com.sun.security.ntlm", "NTLM", False, "getP1", "(char[])", "", "Argument[0]", "credential-password", "manual"]
+      - ["com.sun.security.ntlm", "NTLM", False, "getP2", "(char[])", "", "Argument[0]", "credential-password", "manual"]
      - ["com.sun.security.ntlm", "Client", False, "Client", "(String, String, String, String, char[])", "credential-username", "Argument[2]", "manual"]
      - ["com.sun.security.ntlm", "Server", False, "getPassword", "(String, String)", "credential-username", "Argument[1]", "manual"]
--- a/java/ql/lib/ext/com.sun.security.sasl.digest.model.yml
+++ b/java/ql/lib/ext/com.sun.security.sasl.digest.model.yml
@@ -3,6 +3,6 @@ extensions:
      pack: codeql/java-all
      extensible: sinkModel
    data:
-      - ["com.sun.security.sasl.digest", "DigestMD5Base", False, "generateResponseValue", "(String, String, String, String, String, char[], byte[], byte[], int, byte[])", "credential-password", "Argument[5]", "manual"]
-      - ["com.sun.security.sasl.digest", "DigestMD5Server", False, "generateResponseAuth", "(String, char[], byte[], int, byte[])", "credential-password", "Argument[1]", "manual"]
+      - ["com.sun.security.sasl.digest", "DigestMD5Base", False, "generateResponseValue", "(String, String, String, String, String, char[], byte[], byte[], int, byte[])", "", "Argument[5]", "credential-password", "manual"]
+      - ["com.sun.security.sasl.digest", "DigestMD5Server", False, "generateResponseAuth", "(String, char[], byte[], int, byte[])", "", "Argument[1]", "credential-password", "manual"]
      - ["com.sun.security.sasl.digest", "DigestMD5Server", False, "generateResponseAuth", "(String, char[], byte[], int, byte[])", "credential-username", "Argument[0]", "manual"]
--- a/java/ql/lib/ext/com.sun.tools.internal.ws.wscompile.model.yml
+++ b/java/ql/lib/ext/com.sun.tools.internal.ws.wscompile.model.yml
@@ -3,5 +3,5 @@ extensions:
      pack: codeql/java-all
      extensible: sinkModel
    data:
-      - ["com.sun.tools.internal.ws.wscompile", "AuthInfo", False, "AuthInfo", "(URL, String, String)", "credential-password", "Argument[2]", "manual"]
+      - ["com.sun.tools.internal.ws.wscompile", "AuthInfo", False, "AuthInfo", "(URL, String, String)", "", "Argument[2]", "credential-password", "manual"]
      - ["com.sun.tools.internal.ws.wscompile", "AuthInfo", False, "AuthInfo", "(URL, String, String)", "credential-username", "Argument[1]", "manual"]
--- a/java/ql/lib/ext/java.net.model.yml
+++ b/java/ql/lib/ext/java.net.model.yml
@@ -10,7 +10,7 @@ extensions:
      extensible: sinkModel
    data:
      - ["java.net", "DatagramSocket", True, "connect", "(SocketAddress)", "", "Argument[0]", "request-forgery", "ai-manual"]
-      - ["java.net", "PasswordAuthentication", False, "PasswordAuthentication", "(String, char[])", "credential-password", "Argument[1]", "manual"]
+      - ["java.net", "PasswordAuthentication", False, "PasswordAuthentication", "(String, char[])", "", "Argument[1]", "credential-password", "manual"]
      - ["java.net", "Socket", True, "Socket", "(String,int)", "", "Argument[0]", "request-forgery", "ai-manual"]
      - ["java.net", "URL", False, "openConnection", "", "", "Argument[this]", "request-forgery", "manual"]
      - ["java.net", "URL", False, "openConnection", "(Proxy)", "", "Argument[0]", "request-forgery", "ai-manual"]
--- a/java/ql/lib/ext/java.security.model.yml
+++ b/java/ql/lib/ext/java.security.model.yml
@@ -3,15 +3,15 @@ extensions:
      pack: codeql/java-all
      extensible: sinkModel
    data:
-      - ["java.security", "KeyStore", False, "getKey", "(String, char[])", "credential-password", "Argument[1]", "manual"]
-      - ["java.security", "KeyStore", False, "load", "(InputStream, char[])", "credential-password", "Argument[1]", "manual"]
-      - ["java.security", "KeyStore", False, "setKeyEntry", "(String, Key, char[], Certificate[])", "credential-password", "Argument[2]", "manual"]
-      - ["java.security", "KeyStore", False, "store", "(OutputStream, char[])", "credential-password", "Argument[1]", "manual"]
-      - ["java.security", "KeyStore$PasswordProtection", False, "PasswordProtection", "(char[])", "credential-password", "Argument[0]", "manual"]
-      - ["java.security", "KeyStore$PasswordProtection", False, "PasswordProtection", "(char[], String, AlgorithmParameterSpec)", "credential-password", "Argument[0]", "manual"]
-      - ["java.security", "KeyStoreSpi", False, "engineGetKey", "(String, char[])", "credential-password", "Argument[1]", "manual"]
-      - ["java.security", "KeyStoreSpi", False, "engineLoad", "(InputStream, char[])", "credential-password", "Argument[1]", "manual"]
-      - ["java.security", "KeyStoreSpi", False, "engineSetKeyEntry", "(String, Key, char[], Certificate[])", "credential-password", "Argument[2]", "manual"]
-      - ["java.security", "KeyStoreSpi", False, "engineStore", "(OutputStream, char[])", "credential-password", "Argument[1]", "manual"]
      - ["java.security", "KeyStore", False, "setKeyEntry", "(String, byte[], Certificate[])", "crypto-parameter", "Argument[1]", "manual"]
      - ["java.security", "KeyStoreSpi", False, "engineSetKeyEntry", "(String, byte[], Certificate[])", "crypto-parameter", "Argument[1]", "manual"]
+      - ["java.security", "KeyStore", False, "getKey", "(String, char[])", "", "Argument[1]", "credential-password", "manual"]
+      - ["java.security", "KeyStore", False, "load", "(InputStream, char[])", "", "Argument[1]", "credential-password", "manual"]
+      - ["java.security", "KeyStore", False, "setKeyEntry", "(String, Key, char[], Certificate[])", "", "Argument[2]", "credential-password", "manual"]
+      - ["java.security", "KeyStore", False, "store", "(OutputStream, char[])", "", "Argument[1]", "credential-password", "manual"]
+      - ["java.security", "KeyStore$PasswordProtection", False, "PasswordProtection", "(char[])", "", "Argument[0]", "credential-password", "manual"]
+      - ["java.security", "KeyStore$PasswordProtection", False, "PasswordProtection", "(char[], String, AlgorithmParameterSpec)", "", "Argument[0]", "credential-password", "manual"]
+      - ["java.security", "KeyStoreSpi", False, "engineGetKey", "(String, char[])", "", "Argument[1]", "credential-password", "manual"]
+      - ["java.security", "KeyStoreSpi", False, "engineLoad", "(InputStream, char[])", "", "Argument[1]", "credential-password", "manual"]
+      - ["java.security", "KeyStoreSpi", False, "engineSetKeyEntry", "(String, Key, char[], Certificate[])", "", "Argument[2]", "credential-password", "manual"]
+      - ["java.security", "KeyStoreSpi", False, "engineStore", "(OutputStream, char[])", "", "Argument[1]", "credential-password", "manual"]
--- a/java/ql/lib/ext/java.sql.model.yml
+++ b/java/ql/lib/ext/java.sql.model.yml
@@ -11,7 +11,7 @@ extensions:
      - ["java.sql", "DriverManager", False, "getConnection", "(String)", "", "Argument[0]", "request-forgery", "manual"]
      - ["java.sql", "DriverManager", False, "getConnection", "(String,Properties)", "", "Argument[0]", "request-forgery", "manual"]
      - ["java.sql", "DriverManager", False, "getConnection", "(String,String,String)", "", "Argument[0]", "request-forgery", "manual"]
-      - ["java.sql", "DriverManager", False, "getConnection", "(String, String, String)", "credential-password", "Argument[2]", "manual"]
+      - ["java.sql", "DriverManager", False, "getConnection", "(String, String, String)", "", "Argument[2]", "credential-password", "manual"]
      - ["java.sql", "Statement", True, "addBatch", "", "", "Argument[0]", "sql-injection", "manual"]
      - ["java.sql", "Statement", True, "execute", "", "", "Argument[0]", "sql-injection", "manual"]
      - ["java.sql", "Statement", True, "executeLargeUpdate", "", "", "Argument[0]", "sql-injection", "manual"]
--- a/java/ql/lib/ext/javax.crypto.spec.model.yml
+++ b/java/ql/lib/ext/javax.crypto.spec.model.yml
@@ -11,9 +11,6 @@ extensions:
      pack: codeql/java-all
      extensible: sinkModel
    data:
-      - ["javax.crypto.spec", "PBEKeySpec", False, "PBEKeySpec", "(char[])", "credential-password", "Argument[0]", "manual"]
-      - ["javax.crypto.spec", "PBEKeySpec", False, "PBEKeySpec", "(char[], byte[], int)", "credential-password", "Argument[0]", "manual"]
-      - ["javax.crypto.spec", "PBEKeySpec", False, "PBEKeySpec", "(char[], byte[], int, int)", "credential-password", "Argument[0]", "manual"]
      - ["javax.crypto.spec", "DESKeySpec", False, "DESKeySpec", "(byte[])", "crypto-parameter", "Argument[0]", "manual"]
      - ["javax.crypto.spec", "DESKeySpec", False, "DESKeySpec", "(byte[], int)", "crypto-parameter", "Argument[0]", "manual"]
      - ["javax.crypto.spec", "DESKeySpec", False, "isParityAdjusted", "(byte[], int)", "crypto-parameter", "Argument[0]", "manual"]
@@ -25,3 +22,6 @@ extensions:
      - ["javax.crypto.spec", "SecretKeySpec", False, "SecretKeySpec", "(byte[], int, int, String)", "crypto-parameter", "Argument[0]", "manual"]
      - ["javax.crypto.spec", "IvParameterSpec", False, "IvParameterSpec", "(byte[])", "credential-other", "Argument[0]", "manual"]
      - ["javax.crypto.spec", "IvParameterSpec", False, "IvParameterSpec", "(byte[], int, int)", "credential-other", "Argument[0]", "manual"]
+      - ["javax.crypto.spec", "PBEKeySpec", False, "PBEKeySpec", "(char[])", "", "Argument[0]", "credential-password", "manual"]
+      - ["javax.crypto.spec", "PBEKeySpec", False, "PBEKeySpec", "(char[], byte[], int)", "", "Argument[0]", "credential-password", "manual"]
+      - ["javax.crypto.spec", "PBEKeySpec", False, "PBEKeySpec", "(char[], byte[], int, int)", "", "Argument[0]", "credential-password", "manual"]
--- a/java/ql/lib/ext/javax.net.ssl.model.yml
+++ b/java/ql/lib/ext/javax.net.ssl.model.yml
@@ -5,5 +5,5 @@ extensions:
    data:
      - ["javax.net.ssl", "HttpsURLConnection", True, "setDefaultHostnameVerifier", "", "", "Argument[0]", "hostname-verification", "manual"]
      - ["javax.net.ssl", "HttpsURLConnection", True, "setHostnameVerifier", "", "", "Argument[0]", "hostname-verification", "manual"]
-      - ["javax.net.ssl", "KeyManagerFactory", False, "init", "(KeyStore, char[])", "credential-password", "Argument[1]", "manual"]
-      - ["javax.net.ssl", "KeyManagerFactorySpi", False, "engineInit", "(KeyStore, char[])", "credential-password", "Argument[1]", "manual"]
+      - ["javax.net.ssl", "KeyManagerFactory", False, "init", "(KeyStore, char[])", "", "Argument[1]", "credential-password", "manual"]
+      - ["javax.net.ssl", "KeyManagerFactorySpi", False, "engineInit", "(KeyStore, char[])", "", "Argument[1]", "credential-password", "manual"]
--- a/java/ql/lib/ext/javax.security.auth.callback.model.yml
+++ b/java/ql/lib/ext/javax.security.auth.callback.model.yml
@@ -3,4 +3,4 @@ extensions:
      pack: codeql/java-all
      extensible: sinkModel
    data:
-      - ["javax.security.auth.callback", "PasswordCallback", False, "setPassword", "(char[])", "credential-password", "Argument[0]", "manual"]
+      - ["javax.security.auth.callback", "PasswordCallback", False, "setPassword", "(char[])", "", "Argument[0]", "credential-password", "manual"]
--- a/java/ql/lib/ext/javax.security.auth.kerberos.model.yml
+++ b/java/ql/lib/ext/javax.security.auth.kerberos.model.yml
@@ -3,9 +3,9 @@ extensions:
      pack: codeql/java-all
      extensible: sinkModel
    data:
-      - ["javax.security.auth.kerberos", "KerberosKey", False, "KerberosKey", "(KerberosPrincipal, char[], String)", "credential-password", "Argument[1]", "manual"]
-      - ["javax.security.auth.kerberos", "KeyImpl", False, "KeyImpl", "(KerberosPrincipal, char[], String)", "credential-password", "Argument[1]", "manual"]
      - ["javax.security.auth.kerberos", "KerberosKey", False, "KerberosKey", "(KerberosPrincipal, byte[], int, int)", "crypto-parameter", "Argument[1]", "manual"]
      - ["javax.security.auth.kerberos", "KerberosTicket", False, "KerberosTicket", "(byte[], KerberosPrincipal, KerberosPrincipal, byte[], int, boolean[], Date, Date, Date, Date, InetAddress[])", "crypto-parameter", "Argument[3]", "manual"]
      - ["javax.security.auth.kerberos", "KerberosTicket", False, "init", "(byte[], KerberosPrincipal, KerberosPrincipal, byte[], int, boolean[], Date, Date, Date, Date, InetAddress[])", "crypto-parameter", "Argument[3]", "manual"]
      - ["javax.security.auth.kerberos", "KeyImpl", False, "KeyImpl", "(byte[], int)", "crypto-parameter", "Argument[0]", "manual"]
+      - ["javax.security.auth.kerberos", "KerberosKey", False, "KerberosKey", "(KerberosPrincipal, char[], String)", "", "Argument[1]", "credential-password", "manual"]
+      - ["javax.security.auth.kerberos", "KeyImpl", False, "KeyImpl", "(KerberosPrincipal, char[], String)", "", "Argument[1]", "credential-password", "manual"]
--- a/java/ql/lib/ext/javax.sql.model.yml
+++ b/java/ql/lib/ext/javax.sql.model.yml
@@ -3,10 +3,10 @@ extensions:
      pack: codeql/java-all
      extensible: sinkModel
    data:
-      - ["javax.sql", "ConnectionPoolDataSource", False, "getPooledConnection", "(String, String)", "credential-password", "Argument[1]", "manual"]
-      - ["javax.sql", "DataSource", False, "getConnection", "(String, String)", "credential-password", "Argument[1]", "manual"]
-      - ["javax.sql", "RowSet", False, "setPassword", "(String)", "credential-password", "Argument[0]", "manual"]
-      - ["javax.sql", "XADataSource", False, "getXAConnection", "(String, String)", "credential-password", "Argument[1]", "manual"]
      - ["javax.sql", "ConnectionPoolDataSource", False, "getPooledConnection", "(String, String)", "credential-username", "Argument[0]", "manual"]
      - ["javax.sql", "DataSource", False, "getConnection", "(String, String)", "credential-username", "Argument[0]", "manual"]
      - ["javax.sql", "XADataSource", False, "getXAConnection", "(String, String)", "credential-username", "Argument[0]", "manual"]
+      - ["javax.sql", "ConnectionPoolDataSource", False, "getPooledConnection", "(String, String)", "", "Argument[1]", "credential-password", "manual"]
+      - ["javax.sql", "DataSource", False, "getConnection", "(String, String)", "", "Argument[1]", "credential-password", "manual"]
+      - ["javax.sql", "RowSet", False, "setPassword", "(String)", "", "Argument[0]", "credential-password", "manual"]
+      - ["javax.sql", "XADataSource", False, "getXAConnection", "(String, String)", "", "Argument[1]", "credential-password", "manual"]
--- a/java/ql/lib/ext/sun.net.ftp.impl.model.yml
+++ b/java/ql/lib/ext/sun.net.ftp.impl.model.yml
@@ -3,9 +3,9 @@ extensions:
      pack: codeql/java-all
      extensible: sinkModel
    data:
-      - ["sun.net.ftp.impl", "FtpClient", False, "login", "(String, char[])", "credential-password", "Argument[1]", "manual"]
-      - ["sun.net.ftp.impl", "FtpClient", False, "login", "(String, char[], String)", "credential-password", "Argument[1]", "manual"]
-      - ["sun.net.ftp.impl", "FtpClient", False, "tryLogin", "(String, char[])", "credential-password", "Argument[1]", "manual"]
      - ["sun.net.ftp.impl", "FtpClient", False, "login", "(String, char[])", "credential-username", "Argument[0]", "manual"]
      - ["sun.net.ftp.impl", "FtpClient", False, "login", "(String, char[], String)", "credential-username", "Argument[0]", "manual"]
      - ["sun.net.ftp.impl", "FtpClient", False, "tryLogin", "(String, char[])", "credential-username", "Argument[0]", "manual"]
+      - ["sun.net.ftp.impl", "FtpClient", False, "login", "(String, char[])", "", "Argument[1]", "credential-password", "manual"]
+      - ["sun.net.ftp.impl", "FtpClient", False, "login", "(String, char[], String)", "", "Argument[1]", "credential-password", "manual"]
+      - ["sun.net.ftp.impl", "FtpClient", False, "tryLogin", "(String, char[])", "", "Argument[1]", "credential-password", "manual"]
--- a/java/ql/lib/ext/sun.net.ftp.model.yml
+++ b/java/ql/lib/ext/sun.net.ftp.model.yml
@@ -3,8 +3,8 @@ extensions:
      pack: codeql/java-all
      extensible: sinkModel
    data:
-      - ["sun.net.ftp", "FtpClient", False, "login", "(String, char[])", "credential-password", "Argument[1]", "manual"]
-      - ["sun.net.ftp", "FtpClient", False, "login", "(String, char[], String)", "credential-password", "Argument[1]", "manual"]
      - ["sun.net.ftp", "FtpClient", False, "login", "(String, char[])", "credential-username", "Argument[0]", "manual"]
      - ["sun.net.ftp", "FtpClient", False, "login", "(String, char[], String)", "credential-username", "Argument[0]", "manual"]
      - ["sun.net.ftp", "FtpDirEntry", False, "setUser", "(String)", "credential-username", "Argument[0]", "manual"]
+      - ["sun.net.ftp", "FtpClient", False, "login", "(String, char[])", "", "Argument[1]", "credential-password", "manual"]
+      - ["sun.net.ftp", "FtpClient", False, "login", "(String, char[], String)", "", "Argument[1]", "credential-password", "manual"]
--- a/java/ql/lib/ext/sun.net.www.protocol.http.model.yml
+++ b/java/ql/lib/ext/sun.net.www.protocol.http.model.yml
@@ -3,6 +3,6 @@ extensions:
      pack: codeql/java-all
      extensible: sinkModel
    data:
-      - ["sun.net.www.protocol.http", "DigestAuthentication", False, "computeDigest", "(boolean, String, char[], String, String, String, String, String, String)", "credential-password", "Argument[2]", "manual"]
-      - ["sun.net.www.protocol.http", "DigestAuthentication", False, "encode", "(String, char[], MessageDigest)", "credential-password", "Argument[1]", "manual"]
      - ["sun.net.www.protocol.http", "DigestAuthentication", False, "computeDigest", "(boolean, String, char[], String, String, String, String, String, String)", "credential-username", "Argument[1]", "manual"]
+      - ["sun.net.www.protocol.http", "DigestAuthentication", False, "computeDigest", "(boolean, String, char[], String, String, String, String, String, String)", "", "Argument[2]", "credential-password", "manual"]
+      - ["sun.net.www.protocol.http", "DigestAuthentication", False, "encode", "(String, char[], MessageDigest)", "", "Argument[1]", "credential-password", "manual"]
--- a/java/ql/lib/ext/sun.security.krb5.internal.crypto.dk.model.yml
+++ b/java/ql/lib/ext/sun.security.krb5.internal.crypto.dk.model.yml
@@ -3,8 +3,6 @@ extensions:
      pack: codeql/java-all
      extensible: sinkModel
    data:
-      - ["sun.security.krb5.internal.crypto.dk", "AesDkCrypto", False, "stringToKey", "(char[], String, byte[])", "credential-password", "Argument[0]", "manual"]
-      - ["sun.security.krb5.internal.crypto.dk", "ArcFourCrypto", False, "stringToKey", "(char[])", "credential-password", "Argument[0]", "manual"]
      - ["sun.security.krb5.internal.crypto.dk", "AesDkCrypto", False, "calculateChecksum", "(byte[], int, byte[], int, int)", "crypto-parameter", "Argument[0]", "manual"]
      - ["sun.security.krb5.internal.crypto.dk", "AesDkCrypto", False, "decrypt", "(byte[], int, byte[], byte[], int, int)", "crypto-parameter", "Argument[0]", "manual"]
      - ["sun.security.krb5.internal.crypto.dk", "AesDkCrypto", False, "decryptCTS", "(byte[], int, byte[], byte[], int, int, boolean)", "crypto-parameter", "Argument[0]", "manual"]
@@ -36,3 +34,5 @@ extensions:
      - ["sun.security.krb5.internal.crypto.dk", "DkCrypto", False, "encryptRaw", "(byte[], int, byte[], byte[], int, int)", "crypto-parameter", "Argument[0]", "manual"]
      - ["sun.security.krb5.internal.crypto.dk", "DkCrypto", False, "getCipher", "(byte[], byte[], int)", "crypto-parameter", "Argument[0]", "manual"]
      - ["sun.security.krb5.internal.crypto.dk", "DkCrypto", False, "getHmac", "(byte[], byte[])", "crypto-parameter", "Argument[0]", "manual"]
+      - ["sun.security.krb5.internal.crypto.dk", "AesDkCrypto", False, "stringToKey", "(char[], String, byte[])", "", "Argument[0]", "credential-password", "manual"]
+      - ["sun.security.krb5.internal.crypto.dk", "ArcFourCrypto", False, "stringToKey", "(char[])", "", "Argument[0]", "credential-password", "manual"]
--- a/java/ql/lib/ext/sun.security.krb5.internal.crypto.model.yml
+++ b/java/ql/lib/ext/sun.security.krb5.internal.crypto.model.yml
@@ -3,11 +3,6 @@ extensions:
      pack: codeql/java-all
      extensible: sinkModel
    data:
-      - ["sun.security.krb5.internal.crypto", "Aes128", False, "stringToKey", "(char[], String, byte[])", "credential-password", "Argument[0]", "manual"]
-      - ["sun.security.krb5.internal.crypto", "Aes256", False, "stringToKey", "(char[], String, byte[])", "credential-password", "Argument[0]", "manual"]
-      - ["sun.security.krb5.internal.crypto", "ArcFourHmac", False, "stringToKey", "(char[])", "credential-password", "Argument[0]", "manual"]
-      - ["sun.security.krb5.internal.crypto", "Des", False, "char_to_key", "(char[])", "credential-password", "Argument[0]", "manual"]
-      - ["sun.security.krb5.internal.crypto", "Des", False, "string_to_key_bytes", "(char[])", "credential-password", "Argument[0]", "manual"]
      - ["sun.security.krb5.internal.crypto", "Aes128", False, "calculateChecksum", "(byte[], int, byte[], int, int)", "crypto-parameter", "Argument[0]", "manual"]
      - ["sun.security.krb5.internal.crypto", "Aes128", False, "decrypt", "(byte[], int, byte[], byte[], int, int)", "crypto-parameter", "Argument[0]", "manual"]
      - ["sun.security.krb5.internal.crypto", "Aes128", False, "decryptRaw", "(byte[], int, byte[], byte[], int, int)", "crypto-parameter", "Argument[0]", "manual"]
@@ -86,3 +81,8 @@ extensions:
      - ["sun.security.krb5.internal.crypto", "RsaMd5DesCksumType", False, "calculateKeyedChecksum", "(byte[], int, byte[], int)", "crypto-parameter", "Argument[2]", "manual"]
      - ["sun.security.krb5.internal.crypto", "RsaMd5DesCksumType", False, "decryptKeyedChecksum", "(byte[], byte[])", "crypto-parameter", "Argument[1]", "manual"]
      - ["sun.security.krb5.internal.crypto", "RsaMd5DesCksumType", False, "verifyKeyedChecksum", "(byte[], int, byte[], byte[], int)", "crypto-parameter", "Argument[2]", "manual"]
+      - ["sun.security.krb5.internal.crypto", "Aes128", False, "stringToKey", "(char[], String, byte[])", "", "Argument[0]", "credential-password", "manual"]
+      - ["sun.security.krb5.internal.crypto", "Aes256", False, "stringToKey", "(char[], String, byte[])", "", "Argument[0]", "credential-password", "manual"]
+      - ["sun.security.krb5.internal.crypto", "ArcFourHmac", False, "stringToKey", "(char[])", "", "Argument[0]", "credential-password", "manual"]
+      - ["sun.security.krb5.internal.crypto", "Des", False, "char_to_key", "(char[])", "", "Argument[0]", "credential-password", "manual"]
+      - ["sun.security.krb5.internal.crypto", "Des", False, "string_to_key_bytes", "(char[])", "", "Argument[0]", "credential-password", "manual"]
--- a/java/ql/lib/ext/sun.security.krb5.model.yml
+++ b/java/ql/lib/ext/sun.security.krb5.model.yml
@@ -3,12 +3,12 @@ extensions:
      pack: codeql/java-all
      extensible: sinkModel
    data:
-      - ["sun.security.krb5", "EncryptionKey", False, "EncryptionKey", "(char[], String, String)", "credential-password", "Argument[0]", "manual"]
-      - ["sun.security.krb5", "EncryptionKey", False, "acquireSecretKey", "(PrincipalName, char[], int, SaltAndParams)", "credential-password", "Argument[1]", "manual"]
-      - ["sun.security.krb5", "EncryptionKey", False, "acquireSecretKey", "(char[], String, int, byte[])", "credential-password", "Argument[0]", "manual"]
-      - ["sun.security.krb5", "EncryptionKey", False, "acquireSecretKeys", "(char[], String)", "credential-password", "Argument[0]", "manual"]
-      - ["sun.security.krb5", "EncryptionKey", False, "stringToKey", "(char[], String, byte[], int)", "credential-password", "Argument[0]", "manual"]
-      - ["sun.security.krb5", "KrbAsRep", False, "decryptUsingPassword", "(char[], KrbAsReq, PrincipalName)", "credential-password", "Argument[0]", "manual"]
      - ["sun.security.krb5", "Credentials", False, "Credentials", "(byte[], String, String, byte[], int, boolean[], Date, Date, Date, Date, InetAddress[])", "crypto-parameter", "Argument[3]", "manual"]
      - ["sun.security.krb5", "EncryptionKey", False, "EncryptionKey", "(byte[], int, Integer)", "crypto-parameter", "Argument[0]", "manual"]
      - ["sun.security.krb5", "EncryptionKey", False, "EncryptionKey", "(int, byte[])", "crypto-parameter", "Argument[1]", "manual"]
+      - ["sun.security.krb5", "EncryptionKey", False, "EncryptionKey", "(char[], String, String)", "", "Argument[0]", "credential-password", "manual"]
+      - ["sun.security.krb5", "EncryptionKey", False, "acquireSecretKey", "(PrincipalName, char[], int, SaltAndParams)", "", "Argument[1]", "credential-password", "manual"]
+      - ["sun.security.krb5", "EncryptionKey", False, "acquireSecretKey", "(char[], String, int, byte[])", "", "Argument[0]", "credential-password", "manual"]
+      - ["sun.security.krb5", "EncryptionKey", False, "acquireSecretKeys", "(char[], String)", "", "Argument[0]", "credential-password", "manual"]
+      - ["sun.security.krb5", "EncryptionKey", False, "stringToKey", "(char[], String, byte[], int)", "", "Argument[0]", "credential-password", "manual"]
+      - ["sun.security.krb5", "KrbAsRep", False, "decryptUsingPassword", "(char[], KrbAsReq, PrincipalName)", "", "Argument[0]", "credential-password", "manual"]
--- a/java/ql/lib/ext/sun.security.pkcs11.model.yml
+++ b/java/ql/lib/ext/sun.security.pkcs11.model.yml
@@ -3,12 +3,6 @@ extensions:
      pack: codeql/java-all
      extensible: sinkModel
    data:
-      - ["sun.security.pkcs11", "P11KeyStore", False, "engineGetKey", "(String, char[])", "credential-password", "Argument[1]", "manual"]
-      - ["sun.security.pkcs11", "P11KeyStore", False, "engineLoad", "(InputStream, char[])", "credential-password", "Argument[1]", "manual"]
-      - ["sun.security.pkcs11", "P11KeyStore", False, "engineSetKeyEntry", "(String, Key, char[], Certificate[])", "credential-password", "Argument[2]", "manual"]
-      - ["sun.security.pkcs11", "P11KeyStore", False, "engineStore", "(OutputStream, char[])", "credential-password", "Argument[1]", "manual"]
-      - ["sun.security.pkcs11", "P11KeyStore$PasswordCallbackHandler", False, "PasswordCallbackHandler", "(char[])", "credential-password", "Argument[0]", "manual"]
-      - ["sun.security.pkcs11", "Secmod$KeyStoreLoadParameter", False, "KeyStoreLoadParameter", "(TrustType, char[])", "credential-password", "Argument[1]", "manual"]
      - ["sun.security.pkcs11", "ConstructKeys", False, "constructPrivateKey", "(byte[], String)", "crypto-parameter", "Argument[0]", "manual"]
      - ["sun.security.pkcs11", "ConstructKeys", False, "constructPublicKey", "(byte[], String)", "crypto-parameter", "Argument[0]", "manual"]
      - ["sun.security.pkcs11", "ConstructKeys", False, "constructSecretKey", "(byte[], String)", "crypto-parameter", "Argument[0]", "manual"]
@@ -16,3 +10,9 @@ extensions:
      - ["sun.security.pkcs11", "P11KeyStore", False, "engineSetKeyEntry", "(String, byte[], Certificate[])", "crypto-parameter", "Argument[1]", "manual"]
      - ["sun.security.pkcs11", "P11RSACipher", False, "engineUnwrap", "(byte[], String, int)", "crypto-parameter", "Argument[0]", "manual"]
      - ["sun.security.pkcs11", "P11SecretKeyFactory", False, "fixDESParity", "(byte[], int)", "crypto-parameter", "Argument[0]", "manual"]
+      - ["sun.security.pkcs11", "P11KeyStore", False, "engineGetKey", "(String, char[])", "", "Argument[1]", "credential-password", "manual"]
+      - ["sun.security.pkcs11", "P11KeyStore", False, "engineLoad", "(InputStream, char[])", "", "Argument[1]", "credential-password", "manual"]
+      - ["sun.security.pkcs11", "P11KeyStore", False, "engineSetKeyEntry", "(String, Key, char[], Certificate[])", "", "Argument[2]", "credential-password", "manual"]
+      - ["sun.security.pkcs11", "P11KeyStore", False, "engineStore", "(OutputStream, char[])", "", "Argument[1]", "credential-password", "manual"]
+      - ["sun.security.pkcs11", "P11KeyStore$PasswordCallbackHandler", False, "PasswordCallbackHandler", "(char[])", "", "Argument[0]", "credential-password", "manual"]
+      - ["sun.security.pkcs11", "Secmod$KeyStoreLoadParameter", False, "KeyStoreLoadParameter", "(TrustType, char[])", "", "Argument[1]", "credential-password", "manual"]
--- a/java/ql/lib/ext/sun.security.pkcs12.model.yml
+++ b/java/ql/lib/ext/sun.security.pkcs12.model.yml
@@ -3,13 +3,13 @@ extensions:
      pack: codeql/java-all
      extensible: sinkModel
    data:
-      - ["sun.security.pkcs12", "PKCS12KeyStore", False, "calculateMac", "(char[], byte[])", "credential-password", "Argument[0]", "manual"]
-      - ["sun.security.pkcs12", "PKCS12KeyStore", False, "createEncryptedData", "(char[])", "credential-password", "Argument[0]", "manual"]
-      - ["sun.security.pkcs12", "PKCS12KeyStore", False, "encryptContent", "(byte[], char[])", "credential-password", "Argument[1]", "manual"]
-      - ["sun.security.pkcs12", "PKCS12KeyStore", False, "engineGetKey", "(String, char[])", "credential-password", "Argument[1]", "manual"]
-      - ["sun.security.pkcs12", "PKCS12KeyStore", False, "engineLoad", "(InputStream, char[])", "credential-password", "Argument[1]", "manual"]
-      - ["sun.security.pkcs12", "PKCS12KeyStore", False, "engineSetKeyEntry", "(String, Key, char[], Certificate[])", "credential-password", "Argument[2]", "manual"]
-      - ["sun.security.pkcs12", "PKCS12KeyStore", False, "engineStore", "(OutputStream, char[])", "credential-password", "Argument[1]", "manual"]
-      - ["sun.security.pkcs12", "PKCS12KeyStore", False, "getPBEKey", "(char[])", "credential-password", "Argument[0]", "manual"]
-      - ["sun.security.pkcs12", "PKCS12KeyStore", False, "loadSafeContents", "(DerInputStream, char[])", "credential-password", "Argument[1]", "manual"]
      - ["sun.security.pkcs12", "PKCS12KeyStore", False, "engineSetKeyEntry", "(String, byte[], Certificate[])", "crypto-parameter", "Argument[1]", "manual"]
+      - ["sun.security.pkcs12", "PKCS12KeyStore", False, "calculateMac", "(char[], byte[])", "", "Argument[0]", "credential-password", "manual"]
+      - ["sun.security.pkcs12", "PKCS12KeyStore", False, "createEncryptedData", "(char[])", "", "Argument[0]", "credential-password", "manual"]
+      - ["sun.security.pkcs12", "PKCS12KeyStore", False, "encryptContent", "(byte[], char[])", "", "Argument[1]", "credential-password", "manual"]
+      - ["sun.security.pkcs12", "PKCS12KeyStore", False, "engineGetKey", "(String, char[])", "", "Argument[1]", "credential-password", "manual"]
+      - ["sun.security.pkcs12", "PKCS12KeyStore", False, "engineLoad", "(InputStream, char[])", "", "Argument[1]", "credential-password", "manual"]
+      - ["sun.security.pkcs12", "PKCS12KeyStore", False, "engineSetKeyEntry", "(String, Key, char[], Certificate[])", "", "Argument[2]", "credential-password", "manual"]
+      - ["sun.security.pkcs12", "PKCS12KeyStore", False, "engineStore", "(OutputStream, char[])", "", "Argument[1]", "credential-password", "manual"]
+      - ["sun.security.pkcs12", "PKCS12KeyStore", False, "getPBEKey", "(char[])", "", "Argument[0]", "credential-password", "manual"]
+      - ["sun.security.pkcs12", "PKCS12KeyStore", False, "loadSafeContents", "(DerInputStream, char[])", "", "Argument[1]", "credential-password", "manual"]
--- a/java/ql/lib/ext/sun.security.provider.model.yml
+++ b/java/ql/lib/ext/sun.security.provider.model.yml
@@ -3,15 +3,15 @@ extensions:
      pack: codeql/java-all
      extensible: sinkModel
    data:
-      - ["sun.security.provider", "DomainKeyStore", False, "engineGetKey", "(String, char[])", "credential-password", "Argument[1]", "manual"]
-      - ["sun.security.provider", "DomainKeyStore", False, "engineLoad", "(InputStream, char[])", "credential-password", "Argument[1]", "manual"]
-      - ["sun.security.provider", "DomainKeyStore", False, "engineSetKeyEntry", "(String, Key, char[], Certificate[])", "credential-password", "Argument[2]", "manual"]
-      - ["sun.security.provider", "DomainKeyStore", False, "engineStore", "(OutputStream, char[])", "credential-password", "Argument[1]", "manual"]
-      - ["sun.security.provider", "JavaKeyStore", False, "engineGetKey", "(String, char[])", "credential-password", "Argument[1]", "manual"]
-      - ["sun.security.provider", "JavaKeyStore", False, "engineLoad", "(InputStream, char[])", "credential-password", "Argument[1]", "manual"]
-      - ["sun.security.provider", "JavaKeyStore", False, "engineSetKeyEntry", "(String, Key, char[], Certificate[])", "credential-password", "Argument[2]", "manual"]
-      - ["sun.security.provider", "JavaKeyStore", False, "engineStore", "(OutputStream, char[])", "credential-password", "Argument[1]", "manual"]
-      - ["sun.security.provider", "JavaKeyStore", False, "getPreKeyedHash", "(char[])", "credential-password", "Argument[0]", "manual"]
-      - ["sun.security.provider", "KeyProtector", False, "KeyProtector", "(char[])", "credential-password", "Argument[0]", "manual"]
      - ["sun.security.provider", "DomainKeyStore", False, "engineSetKeyEntry", "(String, byte[], Certificate[])", "crypto-parameter", "Argument[1]", "manual"]
      - ["sun.security.provider", "JavaKeyStore", False, "engineSetKeyEntry", "(String, byte[], Certificate[])", "crypto-parameter", "Argument[1]", "manual"]
+      - ["sun.security.provider", "DomainKeyStore", False, "engineGetKey", "(String, char[])", "", "Argument[1]", "credential-password", "manual"]
+      - ["sun.security.provider", "DomainKeyStore", False, "engineLoad", "(InputStream, char[])", "", "Argument[1]", "credential-password", "manual"]
+      - ["sun.security.provider", "DomainKeyStore", False, "engineSetKeyEntry", "(String, Key, char[], Certificate[])", "", "Argument[2]", "credential-password", "manual"]
+      - ["sun.security.provider", "DomainKeyStore", False, "engineStore", "(OutputStream, char[])", "", "Argument[1]", "credential-password", "manual"]
+      - ["sun.security.provider", "JavaKeyStore", False, "engineGetKey", "(String, char[])", "", "Argument[1]", "credential-password", "manual"]
+      - ["sun.security.provider", "JavaKeyStore", False, "engineLoad", "(InputStream, char[])", "", "Argument[1]", "credential-password", "manual"]
+      - ["sun.security.provider", "JavaKeyStore", False, "engineSetKeyEntry", "(String, Key, char[], Certificate[])", "", "Argument[2]", "credential-password", "manual"]
+      - ["sun.security.provider", "JavaKeyStore", False, "engineStore", "(OutputStream, char[])", "", "Argument[1]", "credential-password", "manual"]
+      - ["sun.security.provider", "JavaKeyStore", False, "getPreKeyedHash", "(char[])", "", "Argument[0]", "credential-password", "manual"]
+      - ["sun.security.provider", "KeyProtector", False, "KeyProtector", "(char[])", "", "Argument[0]", "credential-password", "manual"]
--- a/java/ql/lib/ext/sun.security.ssl.model.yml
+++ b/java/ql/lib/ext/sun.security.ssl.model.yml
@@ -3,6 +3,6 @@ extensions:
      pack: codeql/java-all
      extensible: sinkModel
    data:
-      - ["sun.security.ssl", "KeyManagerFactoryImpl$SunX509", False, "engineInit", "(KeyStore, char[])", "credential-password", "Argument[1]", "manual"]
-      - ["sun.security.ssl", "KeyManagerFactoryImpl$X509", False, "engineInit", "(KeyStore, char[])", "credential-password", "Argument[1]", "manual"]
-      - ["sun.security.ssl", "SunX509KeyManagerImpl", False, "SunX509KeyManagerImpl", "(KeyStore, char[])", "credential-password", "Argument[1]", "manual"]
+      - ["sun.security.ssl", "KeyManagerFactoryImpl$SunX509", False, "engineInit", "(KeyStore, char[])", "", "Argument[1]", "credential-password", "manual"]
+      - ["sun.security.ssl", "KeyManagerFactoryImpl$X509", False, "engineInit", "(KeyStore, char[])", "", "Argument[1]", "credential-password", "manual"]
+      - ["sun.security.ssl", "SunX509KeyManagerImpl", False, "SunX509KeyManagerImpl", "(KeyStore, char[])", "", "Argument[1]", "credential-password", "manual"]
--- a/java/ql/lib/ext/sun.security.tools.keytool.model.yml
+++ b/java/ql/lib/ext/sun.security.tools.keytool.model.yml
@@ -3,6 +3,6 @@ extensions:
      pack: codeql/java-all
      extensible: sinkModel
    data:
-      - ["sun.security.tools.keytool", "Main", False, "getNewPasswd", "(String, char[])", "credential-password", "Argument[1]", "manual"]
      - ["sun.security.tools.keytool", "Main", False, "getKeyPasswd", "(String, String, char[])", "crypto-parameter", "Argument[2]", "manual"]
      - ["sun.security.tools.keytool", "Main", False, "recoverKey", "(String, char[], char[])", "crypto-parameter", "Argument[2]", "manual"]
+      - ["sun.security.tools.keytool", "Main", False, "getNewPasswd", "(String, char[])", "", "Argument[1]", "credential-password", "manual"]
--- a/java/ql/lib/ext/sun.tools.jconsole.model.yml
+++ b/java/ql/lib/ext/sun.tools.jconsole.model.yml
@@ -3,19 +3,6 @@ extensions:
      pack: codeql/java-all
      extensible: sinkModel
    data:
-      - ["sun.tools.jconsole", "ConnectDialog", False, "setConnectionParameters", "(String, String, int, String, String, String)", "credential-password", "Argument[4]", "manual"]
-      - ["sun.tools.jconsole", "JConsole", False, "addHost", "(String, int, String, String)", "credential-password", "Argument[3]", "manual"]
-      - ["sun.tools.jconsole", "JConsole", False, "addHost", "(String, int, String, String, boolean)", "credential-password", "Argument[3]", "manual"]
-      - ["sun.tools.jconsole", "JConsole", False, "addUrl", "(String, String, String, boolean)", "credential-password", "Argument[2]", "manual"]
-      - ["sun.tools.jconsole", "JConsole", False, "failed", "(Exception, String, String, String)", "credential-password", "Argument[3]", "manual"]
-      - ["sun.tools.jconsole", "JConsole", False, "showConnectDialog", "(String, String, int, String, String, String)", "credential-password", "Argument[4]", "manual"]
-      - ["sun.tools.jconsole", "ProxyClient", False, "ProxyClient", "(String, String, String)", "credential-password", "Argument[2]", "manual"]
-      - ["sun.tools.jconsole", "ProxyClient", False, "ProxyClient", "(String, int, String, String)", "credential-password", "Argument[3]", "manual"]
-      - ["sun.tools.jconsole", "ProxyClient", False, "getCacheKey", "(String, String, String)", "credential-password", "Argument[2]", "manual"]
-      - ["sun.tools.jconsole", "ProxyClient", False, "getCacheKey", "(String, int, String, String)", "credential-password", "Argument[3]", "manual"]
-      - ["sun.tools.jconsole", "ProxyClient", False, "getProxyClient", "(String, String, String)", "credential-password", "Argument[2]", "manual"]
-      - ["sun.tools.jconsole", "ProxyClient", False, "getProxyClient", "(String, int, String, String)", "credential-password", "Argument[3]", "manual"]
-      - ["sun.tools.jconsole", "ProxyClient", False, "setParameters", "(JMXServiceURL, String, String)", "credential-password", "Argument[2]", "manual"]
      - ["sun.tools.jconsole", "ConnectDialog", False, "setConnectionParameters", "(String, String, int, String, String, String)", "credential-username", "Argument[3]", "manual"]
      - ["sun.tools.jconsole", "JConsole", False, "addHost", "(String, int, String, String)", "credential-username", "Argument[2]", "manual"]
      - ["sun.tools.jconsole", "JConsole", False, "addHost", "(String, int, String, String, boolean)", "credential-username", "Argument[2]", "manual"]
@@ -31,3 +18,16 @@ extensions:
      - ["sun.tools.jconsole", "ProxyClient", False, "getProxyClient", "(String, String, String)", "credential-username", "Argument[1]", "manual"]
      - ["sun.tools.jconsole", "ProxyClient", False, "getProxyClient", "(String, int, String, String)", "credential-username", "Argument[2]", "manual"]
      - ["sun.tools.jconsole", "ProxyClient", False, "setParameters", "(JMXServiceURL, String, String)", "credential-username", "Argument[1]", "manual"]
+      - ["sun.tools.jconsole", "ConnectDialog", False, "setConnectionParameters", "(String, String, int, String, String, String)", "", "Argument[4]", "credential-password", "manual"]
+      - ["sun.tools.jconsole", "JConsole", False, "addHost", "(String, int, String, String)", "", "Argument[3]", "credential-password", "manual"]
+      - ["sun.tools.jconsole", "JConsole", False, "addHost", "(String, int, String, String, boolean)", "", "Argument[3]", "credential-password", "manual"]
+      - ["sun.tools.jconsole", "JConsole", False, "addUrl", "(String, String, String, boolean)", "", "Argument[2]", "credential-password", "manual"]
+      - ["sun.tools.jconsole", "JConsole", False, "failed", "(Exception, String, String, String)", "", "Argument[3]", "credential-password", "manual"]
+      - ["sun.tools.jconsole", "JConsole", False, "showConnectDialog", "(String, String, int, String, String, String)", "", "Argument[4]", "credential-password", "manual"]
+      - ["sun.tools.jconsole", "ProxyClient", False, "ProxyClient", "(String, String, String)", "", "Argument[2]", "credential-password", "manual"]
+      - ["sun.tools.jconsole", "ProxyClient", False, "ProxyClient", "(String, int, String, String)", "", "Argument[3]", "credential-password", "manual"]
+      - ["sun.tools.jconsole", "ProxyClient", False, "getCacheKey", "(String, String, String)", "", "Argument[2]", "credential-password", "manual"]
+      - ["sun.tools.jconsole", "ProxyClient", False, "getCacheKey", "(String, int, String, String)", "", "Argument[3]", "credential-password", "manual"]
+      - ["sun.tools.jconsole", "ProxyClient", False, "getProxyClient", "(String, String, String)", "", "Argument[2]", "credential-password", "manual"]
+      - ["sun.tools.jconsole", "ProxyClient", False, "getProxyClient", "(String, int, String, String)", "", "Argument[3]", "credential-password", "manual"]
+      - ["sun.tools.jconsole", "ProxyClient", False, "setParameters", "(JMXServiceURL, String, String)", "", "Argument[2]", "credential-password", "manual"]