Merge branch 'github:main' into couchdb

2026-02-11 20:51:06 +01:00 · 2026-01-09 17:20:40 +01:00
parent 1e1fb43534 636bbe30f9
commit 4c8058d97b
848 changed files with 122818 additions and 100889 deletions
--- a/java/ql/lib/change-notes/2024-09-24-multipart.md
+++ b/java/ql/lib/change-notes/2024-09-24-multipart.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Added more dataflow models of `org.apache.commons.fileupload.FileItem`, `javax/jakarta.servlet.http.Part` and  `org.apache.commons.fileupload.util.Streams`.
--- a/java/ql/lib/change-notes/2025-12-08-spring-websocket-handler.md
+++ b/java/ql/lib/change-notes/2025-12-08-spring-websocket-handler.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Additional remote flow sources from the `org.springframework.web.socket` package have been modeled. 
--- a/java/ql/lib/ext/jakarta.servlet.http.model.yml
+++ b/java/ql/lib/ext/jakarta.servlet.http.model.yml
@@ -3,7 +3,14 @@ extensions:
      pack: codeql/java-all
      extensible: sourceModel
    data:
-      - ["jakarta.servlet.http", "HttpServletRequest", True, "getServletPath", "", "", "ReturnValue", "remote", "manual"]
+      - ["jakarta.servlet.http", "HttpServletRequest", True, "getServletPath", "()", "", "ReturnValue", "remote", "manual"]
+      - ["jakarta.servlet.http", "Part", True, "getInputStream", "()", "", "ReturnValue", "remote", "manual"]
+      - ["jakarta.servlet.http", "Part", True, "getName", "()", "", "ReturnValue", "remote", "manual"]
+      - ["jakarta.servlet.http", "Part", True, "getContentType", "()", "", "ReturnValue", "remote", "manual"]
+      - ["jakarta.servlet.http", "Part", True, "getHeader", "(String)", "", "ReturnValue", "remote", "manual"]
+      - ["jakarta.servlet.http", "Part", True, "getHeaderNames", "()", "", "ReturnValue", "remote", "manual"]
+      - ["jakarta.servlet.http", "Part", True, "getHeaders", "(String)", "", "ReturnValue", "remote", "manual"]
+      - ["jakarta.servlet.http", "Part", True, "getSubmittedFileName", "()", "", "ReturnValue", "remote", "manual"]
      - ["jakarta.servlet.http", "HttpServletRequest", False, "getHeader", "(String)", "", "ReturnValue", "remote", "manual"]
      - ["jakarta.servlet.http", "HttpServletRequest", False, "getHeaderNames", "()", "", "ReturnValue", "remote", "manual"]
      - ["jakarta.servlet.http", "HttpServletRequest", False, "getHeaders", "(String)", "", "ReturnValue", "remote", "manual"]
--- a/java/ql/lib/ext/javax.servlet.http.model.yml
+++ b/java/ql/lib/ext/javax.servlet.http.model.yml
@@ -19,6 +19,14 @@ extensions:
      - ["javax.servlet.http", "HttpServletRequest", False, "getRequestURI", "()", "", "ReturnValue", "remote", "manual"]
      - ["javax.servlet.http", "HttpServletRequest", False, "getRequestURL", "()", "", "ReturnValue", "remote", "manual"]
      - ["javax.servlet.http", "HttpServletRequest", False, "getServletPath", "()", "", "ReturnValue", "remote", "manual"]
+      - ["javax.servlet.http", "Part", False, "getContentType", "()", "", "ReturnValue", "remote", "manual"]
+      - ["javax.servlet.http", "Part", False, "getHeader", "(String)", "", "ReturnValue", "remote", "manual"]
+      - ["javax.servlet.http", "Part", False, "getHeaderNames", "()", "", "ReturnValue", "remote", "manual"]
+      - ["javax.servlet.http", "Part", False, "getHeaders", "(String)", "", "ReturnValue", "remote", "manual"]
+      - ["javax.servlet.http", "Part", False, "getInputStream", "()", "", "ReturnValue", "remote", "manual"]
+      - ["javax.servlet.http", "Part", False, "getName", "()", "", "ReturnValue", "remote", "manual"]
+      - ["javax.servlet.http", "Part", False, "getSubmittedFileName", "()", "", "ReturnValue", "remote", "manual"]
+

  - addsTo:
      pack: codeql/java-all
--- a/java/ql/lib/ext/org.apache.commons.fileupload.model.yml
+++ b/java/ql/lib/ext/org.apache.commons.fileupload.model.yml
@@ -0,0 +1,16 @@
+extensions:
+  - addsTo:
+      pack: codeql/java-all
+      extensible: sourceModel
+    data:
+      - ["org.apache.commons.fileupload", "FileItem", True, "get", "()", "", "ReturnValue", "remote", "manual"]
+      - ["org.apache.commons.fileupload", "FileItem", True, "getContentType", "()", "", "ReturnValue", "remote", "manual"]
+      - ["org.apache.commons.fileupload", "FileItem", True, "getFieldName", "()", "", "ReturnValue", "remote", "manual"]
+      - ["org.apache.commons.fileupload", "FileItem", True, "getInputStream", "()", "", "ReturnValue", "remote", "manual"]
+      - ["org.apache.commons.fileupload", "FileItem", True, "getName", "()", "", "ReturnValue", "remote", "manual"]
+      - ["org.apache.commons.fileupload", "FileItem", True, "getString", "()", "", "ReturnValue", "remote", "manual"]
+      - ["org.apache.commons.fileupload", "FileItem", True, "getString", "(String)", "", "ReturnValue", "remote", "manual"]
+      - ["org.apache.commons.fileupload", "FileItemStream", True, "getContentType", "()", "", "ReturnValue", "remote", "manual"]
+      - ["org.apache.commons.fileupload", "FileItemStream", True, "getFieldName", "()", "", "ReturnValue", "remote", "manual"]
+      - ["org.apache.commons.fileupload", "FileItemStream", True, "getName", "()", "", "ReturnValue", "remote", "manual"]
+      - ["org.apache.commons.fileupload", "FileItemStream", True, "openStream", "()", "", "ReturnValue", "remote", "manual"]
--- a/java/ql/lib/ext/org.apache.commons.fileupload.util.model.yml
+++ b/java/ql/lib/ext/org.apache.commons.fileupload.util.model.yml
@@ -0,0 +1,9 @@
+extensions:
+  - addsTo:
+      pack: codeql/java-all
+      extensible: summaryModel
+    data:
+      - ["org.apache.commons.fileupload.util", "Streams", True, "asString", "(InputStream)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
+      - ["org.apache.commons.fileupload.util", "Streams", True, "asString", "(InputStream,String)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
+      - ["org.apache.commons.fileupload.util", "Streams", True, "copy", "(InputStream,OutputStream,boolean)", "", "Argument[0]", "Argument[1]", "taint", "manual"]
+      - ["org.apache.commons.fileupload.util", "Streams", True, "copy", "(InputStream,OutputStream,boolean,byte[])", "", "Argument[0]", "Argument[1]", "taint", "manual"]
--- a/java/ql/lib/ext/org.springframework.web.socket.model.yml
+++ b/java/ql/lib/ext/org.springframework.web.socket.model.yml
@@ -0,0 +1,23 @@
+extensions:
+  - addsTo:
+      pack: codeql/java-all
+      extensible: sourceModel
+    data:
+     - ["org.springframework.web.socket", "WebSocketHandler", True, "afterConnectionClosed", "", "", "Parameter[0]", "remote", "manual"]
+     - ["org.springframework.web.socket", "WebSocketHandler", True, "afterConnectionEstablished", "", "", "Parameter[0]", "remote", "manual"]
+     - ["org.springframework.web.socket", "WebSocketHandler", True, "handleMessage", "", "", "Parameter[0]", "remote", "manual"]
+     - ["org.springframework.web.socket", "WebSocketHandler", True, "handleMessage", "", "", "Parameter[1]", "remote", "manual"]
+     - ["org.springframework.web.socket", "WebSocketHandler", True, "handleTransportError", "", "", "Parameter[0]", "remote", "manual"]
+     - ["org.springframework.web.socket.handler", "AbstractWebSocketHandler", True, "handleBinaryMessage", "", "", "Parameter[0..1]", "remote", "manual"]
+     - ["org.springframework.web.socket.handler", "AbstractWebSocketHandler", True, "handlePongMessage", "", "", "Parameter[0..1]", "remote", "manual"]
+     - ["org.springframework.web.socket.handler", "AbstractWebSocketHandler", True, "handleTextMessage", "", "", "Parameter[0..1]", "remote", "manual"]
+  - addsTo:
+      pack: codeql/java-all
+      extensible: summaryModel
+    data:
+      - ["org.springframework.web.socket", "TextMessage", True, "asBytes", "", "", "Argument[this]", "ReturnValue", "taint", "manual"]
+      - ["org.springframework.web.socket", "WebSocketMessage", True, "getPayload", "", "", "Argument[this]", "ReturnValue", "taint", "manual"]
+      - ["org.springframework.web.socket", "WebSocketSession", True, "getAcceptedProtocol", "", "", "Argument[this]", "ReturnValue", "taint", "manual"]
+      - ["org.springframework.web.socket", "WebSocketSession", True, "getHandshakeHeaders", "", "", "Argument[this]", "ReturnValue", "taint", "manual"]
+      - ["org.springframework.web.socket", "WebSocketSession", True, "getPrincipal", "", "", "Argument[this]", "ReturnValue", "taint", "manual"]
+      - ["org.springframework.web.socket", "WebSocketSession", True, "getUri", "", "", "Argument[this]", "ReturnValue", "taint", "manual"]
--- a/java/ql/lib/semmle/code/java/ConflictingAccess.qll
+++ b/java/ql/lib/semmle/code/java/ConflictingAccess.qll
@@ -63,12 +63,23 @@ class ExposedField extends Field {
    not this.getType() instanceof LockType and
    // field is not thread-safe
    not isThreadSafeType(this.getType()) and
-    not isThreadSafeType(this.getInitializer().getType()) and
+    not isThreadSafeType(initialValue(this).getType()) and
    // the initializer guarantees thread safety
-    not isThreadSafeInitializer(this.getInitializer())
+    not isThreadSafeInitializer(initialValue(this))
  }
 }

+/**
+ * Gets the initial value for the field `f`.
+ * This is either a field initializer or an assignment in a constructor.
+ */
+Expr initialValue(Field f) {
+  result = f.getInitializer()
+  or
+  result = f.getAnAssignedValue() and
+  result.getEnclosingCallable() = f.getDeclaringType().getAConstructor()
+}
+
 /**
 * A field access that is exposed to potential data races.
 * We require the field to be in a class that is annotated as `@ThreadSafe`.
--- a/java/ql/lib/semmle/code/java/security/AndroidIntentRedirection.qll
+++ b/java/ql/lib/semmle/code/java/security/AndroidIntentRedirection.qll
@@ -35,6 +35,11 @@ private class DefaultIntentRedirectionSink extends IntentRedirectionSink {
  DefaultIntentRedirectionSink() { sinkNode(this, "intent-redirection") }
 }

+/** An external sanitizer for Intent redirection vulnerabilities. */
+private class ExternalIntentRedirectionSanitizer extends IntentRedirectionSanitizer {
+  ExternalIntentRedirectionSanitizer() { barrierNode(this, "intent-redirection") }
+}
+
 /**
 * A default sanitizer for `Intent` nodes dominated by calls to `ComponentName.getPackageName`
 * and `ComponentName.getClassName`. These are used to check whether the origin or destination
--- a/java/ql/lib/semmle/code/java/security/CommandLineQuery.qll
+++ b/java/ql/lib/semmle/code/java/security/CommandLineQuery.qll
@@ -37,6 +37,10 @@ private class DefaultCommandInjectionSink extends CommandInjectionSink {
  DefaultCommandInjectionSink() { sinkNode(this, "command-injection") }
 }

+private class ExternalCommandInjectionSanitizer extends CommandInjectionSanitizer {
+  ExternalCommandInjectionSanitizer() { barrierNode(this, "command-injection") }
+}
+
 private class DefaultCommandInjectionSanitizer extends CommandInjectionSanitizer {
  DefaultCommandInjectionSanitizer() {
    this instanceof SimpleTypeSanitizer
--- a/java/ql/lib/semmle/code/java/security/FragmentInjection.qll
+++ b/java/ql/lib/semmle/code/java/security/FragmentInjection.qll
@@ -49,6 +49,15 @@ private class DefaultFragmentInjectionSink extends FragmentInjectionSink {
  DefaultFragmentInjectionSink() { sinkNode(this, "fragment-injection") }
 }

+/**
+ * A sanitizer for Fragment injection vulnerabilities.
+ */
+abstract class FragmentInjectionSanitizer extends DataFlow::Node { }
+
+private class ExternalFragmentInjectionSanitizer extends FragmentInjectionSanitizer {
+  ExternalFragmentInjectionSanitizer() { barrierNode(this, "fragment-injection") }
+}
+
 private class DefaultFragmentInjectionAdditionalTaintStep extends FragmentInjectionAdditionalTaintStep
 {
  override predicate step(DataFlow::Node n1, DataFlow::Node n2) {
--- a/java/ql/lib/semmle/code/java/security/FragmentInjectionQuery.qll
+++ b/java/ql/lib/semmle/code/java/security/FragmentInjectionQuery.qll
@@ -14,6 +14,8 @@ module FragmentInjectionTaintConfig implements DataFlow::ConfigSig {

  predicate isSink(DataFlow::Node sink) { sink instanceof FragmentInjectionSink }

+  predicate isBarrier(DataFlow::Node node) { node instanceof FragmentInjectionSanitizer }
+
  predicate isAdditionalFlowStep(DataFlow::Node n1, DataFlow::Node n2) {
    any(FragmentInjectionAdditionalTaintStep c).step(n1, n2)
  }
--- a/java/ql/lib/semmle/code/java/security/GroovyInjection.qll
+++ b/java/ql/lib/semmle/code/java/security/GroovyInjection.qll
@@ -26,6 +26,13 @@ private class DefaultGroovyInjectionSink extends GroovyInjectionSink {
  DefaultGroovyInjectionSink() { sinkNode(this, "groovy-injection") }
 }

+/** A data flow sanitizer for Groovy expression injection vulnerabilities. */
+abstract class GroovyInjectionSanitizer extends DataFlow::ExprNode { }
+
+private class ExternalGroovyInjectionSanitizer extends GroovyInjectionSanitizer {
+  ExternalGroovyInjectionSanitizer() { barrierNode(this, "groovy-injection") }
+}
+
 /** A set of additional taint steps to consider when taint tracking Groovy related data flows. */
 private class DefaultGroovyInjectionAdditionalTaintStep extends GroovyInjectionAdditionalTaintStep {
  override predicate step(DataFlow::Node node1, DataFlow::Node node2) {
--- a/java/ql/lib/semmle/code/java/security/PathSanitizer.qll
+++ b/java/ql/lib/semmle/code/java/security/PathSanitizer.qll
@@ -289,8 +289,8 @@ private Method getSourceMethod(Method m) {
  result = m
 }

-private class DefaultPathInjectionSanitizer extends PathInjectionSanitizer {
-  DefaultPathInjectionSanitizer() { barrierNode(this, "path-injection") }
+private class ExternalPathInjectionSanitizer extends PathInjectionSanitizer {
+  ExternalPathInjectionSanitizer() { barrierNode(this, "path-injection") }
 }

 /** Holds if `g` is a guard that checks for `..` components. */
--- a/java/ql/lib/semmle/code/java/security/RequestForgery.qll
+++ b/java/ql/lib/semmle/code/java/security/RequestForgery.qll
@@ -118,8 +118,8 @@ private class ContainsUrlSanitizer extends RequestForgerySanitizer {
  }
 }

-private class DefaultRequestForgerySanitizer extends RequestForgerySanitizer {
-  DefaultRequestForgerySanitizer() { barrierNode(this, "request-forgery") }
+private class ExternalRequestForgerySanitizer extends RequestForgerySanitizer {
+  ExternalRequestForgerySanitizer() { barrierNode(this, "request-forgery") }
 }

 /**
--- a/java/ql/lib/semmle/code/java/security/TrustBoundaryViolationQuery.qll
+++ b/java/ql/lib/semmle/code/java/security/TrustBoundaryViolationQuery.qll
@@ -27,8 +27,8 @@ class TrustBoundaryViolationSink extends DataFlow::Node {
 */
 abstract class TrustBoundaryValidationSanitizer extends DataFlow::Node { }

-private class DefaultTrustBoundaryValidationSanitizer extends TrustBoundaryValidationSanitizer {
-  DefaultTrustBoundaryValidationSanitizer() { barrierNode(this, "trust-boundary-violation") }
+private class ExternalTrustBoundaryValidationSanitizer extends TrustBoundaryValidationSanitizer {
+  ExternalTrustBoundaryValidationSanitizer() { barrierNode(this, "trust-boundary-violation") }
 }

 /**
--- a/java/ql/lib/semmle/code/java/security/XSS.qll
+++ b/java/ql/lib/semmle/code/java/security/XSS.qll
@@ -54,8 +54,8 @@ private class DefaultXssSink extends XssSink {
  }
 }

-private class DefaultXssSanitizer extends XssSanitizer {
-  DefaultXssSanitizer() { barrierNode(this, ["html-injection", "js-injection"]) }
+private class ExternalXssSanitizer extends XssSanitizer {
+  ExternalXssSanitizer() { barrierNode(this, ["html-injection", "js-injection"]) }
 }

 /** A sanitizer that considers numeric and boolean typed data safe for writing to output. */
--- a/java/ql/lib/semmle/code/java/security/regexp/RegexInjection.qll
+++ b/java/ql/lib/semmle/code/java/security/regexp/RegexInjection.qll
@@ -21,8 +21,8 @@ private class DefaultRegexInjectionSink extends RegexInjectionSink {
  }
 }

-private class DefaultRegexInjectionSanitizer extends RegexInjectionSanitizer {
-  DefaultRegexInjectionSanitizer() { barrierNode(this, "regex-use") }
+private class ExternalRegexInjectionSanitizer extends RegexInjectionSanitizer {
+  ExternalRegexInjectionSanitizer() { barrierNode(this, "regex-use") }
 }

 /**
--- a/java/ql/src/change-notes/2025-11-25-thread-safe-initializers.md
+++ b/java/ql/src/change-notes/2025-11-25-thread-safe-initializers.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Java thread safety analysis now understands initialization to thread safe classes inside constructors.
--- a/java/ql/src/experimental/semmle/code/java/security/DecompressionBombQuery.qll
+++ b/java/ql/src/experimental/semmle/code/java/security/DecompressionBombQuery.qll
@@ -1,7 +1,7 @@
 deprecated module;

-import experimental.semmle.code.java.security.FileAndFormRemoteSource
 import experimental.semmle.code.java.security.DecompressionBomb::DecompressionBomb
+import semmle.code.java.dataflow.FlowSources

 module DecompressionBombsConfig implements DataFlow::ConfigSig {
  predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
--- a/java/ql/src/experimental/semmle/code/java/security/FileAndFormRemoteSource.qll
+++ b/java/ql/src/experimental/semmle/code/java/security/FileAndFormRemoteSource.qll
@@ -1,120 +0,0 @@
-deprecated module;
-
-import java
-import semmle.code.java.dataflow.FlowSources
-
-class CommonsFileUploadAdditionalTaintStep extends Unit {
-  abstract predicate step(DataFlow::Node n1, DataFlow::Node n2);
-}
-
-module ApacheCommonsFileUpload {
-  module RemoteFlowSource {
-    class TypeServletFileUpload extends RefType {
-      TypeServletFileUpload() {
-        this.hasQualifiedName("org.apache.commons.fileupload.servlet", "ServletFileUpload")
-      }
-    }
-
-    class TypeFileUpload extends RefType {
-      TypeFileUpload() {
-        this.getAStrictAncestor*().hasQualifiedName("org.apache.commons.fileupload", "FileItem")
-      }
-    }
-
-    class TypeFileItemStream extends RefType {
-      TypeFileItemStream() {
-        this.getAStrictAncestor*()
-            .hasQualifiedName("org.apache.commons.fileupload", "FileItemStream")
-      }
-    }
-
-    class ServletFileUpload extends RemoteFlowSource {
-      ServletFileUpload() {
-        exists(MethodCall ma |
-          ma.getReceiverType() instanceof TypeServletFileUpload and
-          ma.getCallee().hasName("parseRequest") and
-          this.asExpr() = ma
-        )
-      }
-
-      override string getSourceType() { result = "Apache Commons Fileupload" }
-    }
-
-    private class FileItemRemoteSource extends RemoteFlowSource {
-      FileItemRemoteSource() {
-        exists(MethodCall ma |
-          ma.getReceiverType() instanceof TypeFileUpload and
-          ma.getCallee()
-              .hasName([
-                  "getInputStream", "getFieldName", "getContentType", "get", "getName", "getString"
-                ]) and
-          this.asExpr() = ma
-        )
-      }
-
-      override string getSourceType() { result = "Apache Commons Fileupload" }
-    }
-
-    private class FileItemStreamRemoteSource extends RemoteFlowSource {
-      FileItemStreamRemoteSource() {
-        exists(MethodCall ma |
-          ma.getReceiverType() instanceof TypeFileItemStream and
-          ma.getCallee().hasName(["getContentType", "getFieldName", "getName", "openStream"]) and
-          this.asExpr() = ma
-        )
-      }
-
-      override string getSourceType() { result = "Apache Commons Fileupload" }
-    }
-  }
-
-  module Util {
-    class TypeStreams extends RefType {
-      TypeStreams() { this.hasQualifiedName("org.apache.commons.fileupload.util", "Streams") }
-    }
-
-    private class AsStringAdditionalTaintStep extends CommonsFileUploadAdditionalTaintStep {
-      override predicate step(DataFlow::Node n1, DataFlow::Node n2) {
-        exists(Call call |
-          call.getCallee().getDeclaringType() instanceof TypeStreams and
-          call.getArgument(0) = n1.asExpr() and
-          call = n2.asExpr() and
-          call.getCallee().hasName("asString")
-        )
-      }
-    }
-
-    private class CopyAdditionalTaintStep extends CommonsFileUploadAdditionalTaintStep {
-      override predicate step(DataFlow::Node n1, DataFlow::Node n2) {
-        exists(Call call |
-          call.getCallee().getDeclaringType() instanceof TypeStreams and
-          call.getArgument(0) = n1.asExpr() and
-          call.getArgument(1) = n2.asExpr() and
-          call.getCallee().hasName("copy")
-        )
-      }
-    }
-  }
-}
-
-module ServletRemoteMultiPartSources {
-  class TypePart extends RefType {
-    TypePart() { this.hasQualifiedName(["javax.servlet.http", "jakarta.servlet.http"], "Part") }
-  }
-
-  private class ServletPartCalls extends RemoteFlowSource {
-    ServletPartCalls() {
-      exists(MethodCall ma |
-        ma.getReceiverType() instanceof TypePart and
-        ma.getCallee()
-            .hasName([
-                "getInputStream", "getName", "getContentType", "getHeader", "getHeaders",
-                "getHeaderNames", "getSubmittedFileName", "write"
-              ]) and
-        this.asExpr() = ma
-      )
-    }
-
-    override string getSourceType() { result = "Javax Servlet Http" }
-  }
-}
--- a/java/ql/test/library-tests/dataflow/taintsources/FileUpload.java
+++ b/java/ql/test/library-tests/dataflow/taintsources/FileUpload.java
@@ -0,0 +1,52 @@
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import org.apache.commons.fileupload.FileItem;
+import org.apache.commons.fileupload.FileItemStream;
+import org.apache.commons.fileupload.servlet.ServletFileUpload;
+
+public class FileUpload {
+
+    private HttpServletRequest request;
+    private HttpServletResponse response;
+    private javax.servlet.http.Part filePart;
+    private FileItem fileItem;
+    private FileItemStream fileItemStream;
+    private jakarta.servlet.http.Part jakartaPart;
+    private ServletFileUpload servletFileUpload;
+
+    private static void sink(Object o) {}
+
+    public void test() throws Exception {
+        sink(filePart.getContentType());  // $ hasRemoteValueFlow
+        sink(filePart.getHeader("test")); // $ hasRemoteValueFlow
+        sink(filePart.getHeaderNames()); // $ hasRemoteValueFlow
+        sink(filePart.getHeaders("test")); // $ hasRemoteValueFlow
+        sink(filePart.getInputStream()); // $ hasRemoteValueFlow
+        sink(filePart.getName()); // $ hasRemoteValueFlow
+        sink(filePart.getSubmittedFileName()); // $ hasRemoteValueFlow
+
+        sink(fileItem.get());            // $ hasRemoteValueFlow
+        sink(fileItem.getContentType()); // $ hasRemoteValueFlow
+        sink(fileItem.getFieldName());        // $ hasRemoteValueFlow
+        sink(fileItem.getInputStream());        // $ hasRemoteValueFlow
+        sink(fileItem.getName());        // $ hasRemoteValueFlow
+        sink(fileItem.getName());        // $ hasRemoteValueFlow
+        sink(fileItem.getString());      // $ hasRemoteValueFlow
+
+        sink(fileItemStream.getContentType()); // $ hasRemoteValueFlow
+        sink(fileItemStream.getFieldName()); // $ hasRemoteValueFlow
+        sink(fileItemStream.getName()); // $ hasRemoteValueFlow
+        sink(fileItemStream.openStream()); // $ hasRemoteValueFlow
+
+        sink(jakartaPart.getContentType());  // $ hasRemoteValueFlow
+        sink(jakartaPart.getHeader("test")); // $ hasRemoteValueFlow
+        sink(jakartaPart.getHeaderNames()); // $ hasRemoteValueFlow
+        sink(jakartaPart.getHeaders("test")); // $ hasRemoteValueFlow
+        sink(jakartaPart.getInputStream()); // $ hasRemoteValueFlow
+        sink(jakartaPart.getName()); // $ hasRemoteValueFlow
+        sink(jakartaPart.getSubmittedFileName()); // $ hasRemoteValueFlow
+
+        FileItem item = servletFileUpload.parseRequest(request).get(0);
+        sink(item.getName()); // $ hasRemoteValueFlow
+    }
+}
--- a/java/ql/test/library-tests/dataflow/taintsources/options
+++ b/java/ql/test/library-tests/dataflow/taintsources/options
@@ -1 +1 @@
-//semmle-extractor-options: --javac-args -cp ${testdir}/../../../stubs/servlet-api-2.4:${testdir}/../../../stubs/springframework-5.8.x:${testdir}/../../../stubs/google-android-9.0.0:${testdir}/../../../stubs/playframework-2.6.x:${testdir}/../../../stubs/jackson-databind-2.12:${testdir}/../../../stubs/jackson-core-2.12:${testdir}/../../../stubs/akka-2.6.x:${testdir}/../../../stubs/jwtk-jjwt-0.11.2:${testdir}/../../../stubs/jenkins:${testdir}/../../../stubs/stapler-1.263
+//semmle-extractor-options: --javac-args -cp ${testdir}/../../../stubs/jakarta.servlet-api-6.0.0:${testdir}/../../../stubs/apache-commons-fileupload-1.4:${testdir}/../../../stubs/javax-servlet-2.5:${testdir}/../../../stubs/servlet-api-2.4:${testdir}/../../../stubs/springframework-5.8.x:${testdir}/../../../stubs/google-android-9.0.0:${testdir}/../../../stubs/playframework-2.6.x:${testdir}/../../../stubs/jackson-databind-2.12:${testdir}/../../../stubs/jackson-core-2.12:${testdir}/../../../stubs/akka-2.6.x:${testdir}/../../../stubs/jwtk-jjwt-0.11.2:${testdir}/../../../stubs/jenkins:${testdir}/../../../stubs/stapler-1.263
--- a/java/ql/test/library-tests/frameworks/apache-commons-fileupload-1.4/Test.java
+++ b/java/ql/test/library-tests/frameworks/apache-commons-fileupload-1.4/Test.java
@@ -0,0 +1,55 @@
+package com.mycompany.app;
+
+import org.apache.commons.fileupload.util.Streams;
+import java.io.InputStream;
+import java.io.OutputStream;
+import java.io.ByteArrayOutputStream;
+
+// Test case generated by GenerateFlowTestCase.ql
+public class Test {
+
+	Object source() {
+		return null;
+	}
+
+	void sink(Object o) {
+	}
+
+	public void test() throws Exception {
+
+		{
+            InputStream in = (InputStream)source();
+            OutputStream os = new ByteArrayOutputStream(1024); 
+
+			InputStream in2 = (InputStream)source();
+            OutputStream os2 = new ByteArrayOutputStream(1024); 
+
+			byte[] myArray = new byte[1024];
+
+			// "org.apache.commons.fileupload.util;Streams;true;copy;(InputStream,OutputStream,boolean,byte[]);;Argument[0];Argument[1];taint;manual"
+			long status = Streams.copy(in, os, true, myArray);
+			sink(os); // $ hasTaintFlow
+			// "org.apache.commons.fileupload.util;Streams;true;copy;(InputStream,OutputStream,boolean);;Argument[0];Argument[1];taint;manual"
+			long status2 = Streams.copy(in2, os2, true);
+			sink(os2); // $ hasTaintFlow
+		}
+
+	}
+	public void test2() throws Exception {
+
+		{
+			
+            InputStream in = (InputStream)source();
+			// "org.apache.commons.fileupload.util;Streams;true;asString;(InputStream,String);;Argument[0];ReturnValue;taint;manual"
+			String result = Streams.asString(in);
+			sink(result); // $ hasTaintFlow
+
+            InputStream in1 = (InputStream)source();
+			// "org.apache.commons.fileupload.util;Streams;true;asString;(InputStream,String);;Argument[0];ReturnValue;taint;manual"
+            String result1 = Streams.asString(in1, "test");
+            sink(result1); // $ hasTaintFlow
+		}
+
+	}
+
+}
--- a/java/ql/test/library-tests/frameworks/apache-commons-fileupload-1.4/options
+++ b/java/ql/test/library-tests/frameworks/apache-commons-fileupload-1.4/options
@@ -0,0 +1 @@
+//semmle-extractor-options: --javac-args -cp ${testdir}/../../../stubs/apache-commons-fileupload-1.4
--- a/java/ql/test/library-tests/frameworks/apache-commons-fileupload-1.4/test.expected
+++ b/java/ql/test/library-tests/frameworks/apache-commons-fileupload-1.4/test.expected
@@ -0,0 +1,45 @@
+models
+| 1 | Summary: org.apache.commons.fileupload.util; Streams; true; asString; (InputStream); ; Argument[0]; ReturnValue; taint; manual |
+| 2 | Summary: org.apache.commons.fileupload.util; Streams; true; asString; (InputStream,String); ; Argument[0]; ReturnValue; taint; manual |
+| 3 | Summary: org.apache.commons.fileupload.util; Streams; true; copy; (InputStream,OutputStream,boolean); ; Argument[0]; Argument[1]; taint; manual |
+| 4 | Summary: org.apache.commons.fileupload.util; Streams; true; copy; (InputStream,OutputStream,boolean,byte[]); ; Argument[0]; Argument[1]; taint; manual |
+edges
+| Test.java:21:30:21:50 | (...)... : InputStream | Test.java:30:31:30:32 | in : InputStream | provenance |  |
+| Test.java:21:43:21:50 | source(...) : Object | Test.java:21:30:21:50 | (...)... : InputStream | provenance |  |
+| Test.java:24:22:24:42 | (...)... : InputStream | Test.java:33:32:33:34 | in2 : InputStream | provenance |  |
+| Test.java:24:35:24:42 | source(...) : Object | Test.java:24:22:24:42 | (...)... : InputStream | provenance |  |
+| Test.java:30:31:30:32 | in : InputStream | Test.java:30:35:30:36 | os [post update] : ByteArrayOutputStream | provenance | MaD:4 |
+| Test.java:30:35:30:36 | os [post update] : ByteArrayOutputStream | Test.java:31:9:31:10 | os | provenance |  |
+| Test.java:33:32:33:34 | in2 : InputStream | Test.java:33:37:33:39 | os2 [post update] : ByteArrayOutputStream | provenance | MaD:3 |
+| Test.java:33:37:33:39 | os2 [post update] : ByteArrayOutputStream | Test.java:34:9:34:11 | os2 | provenance |  |
+| Test.java:42:30:42:50 | (...)... : InputStream | Test.java:44:37:44:38 | in : InputStream | provenance |  |
+| Test.java:42:43:42:50 | source(...) : Object | Test.java:42:30:42:50 | (...)... : InputStream | provenance |  |
+| Test.java:44:20:44:39 | asString(...) : String | Test.java:45:9:45:14 | result | provenance |  |
+| Test.java:44:37:44:38 | in : InputStream | Test.java:44:20:44:39 | asString(...) : String | provenance | MaD:1 |
+| Test.java:47:31:47:51 | (...)... : InputStream | Test.java:49:47:49:49 | in1 : InputStream | provenance |  |
+| Test.java:47:44:47:51 | source(...) : Object | Test.java:47:31:47:51 | (...)... : InputStream | provenance |  |
+| Test.java:49:30:49:58 | asString(...) : String | Test.java:50:18:50:24 | result1 | provenance |  |
+| Test.java:49:47:49:49 | in1 : InputStream | Test.java:49:30:49:58 | asString(...) : String | provenance | MaD:2 |
+nodes
+| Test.java:21:30:21:50 | (...)... : InputStream | semmle.label | (...)... : InputStream |
+| Test.java:21:43:21:50 | source(...) : Object | semmle.label | source(...) : Object |
+| Test.java:24:22:24:42 | (...)... : InputStream | semmle.label | (...)... : InputStream |
+| Test.java:24:35:24:42 | source(...) : Object | semmle.label | source(...) : Object |
+| Test.java:30:31:30:32 | in : InputStream | semmle.label | in : InputStream |
+| Test.java:30:35:30:36 | os [post update] : ByteArrayOutputStream | semmle.label | os [post update] : ByteArrayOutputStream |
+| Test.java:31:9:31:10 | os | semmle.label | os |
+| Test.java:33:32:33:34 | in2 : InputStream | semmle.label | in2 : InputStream |
+| Test.java:33:37:33:39 | os2 [post update] : ByteArrayOutputStream | semmle.label | os2 [post update] : ByteArrayOutputStream |
+| Test.java:34:9:34:11 | os2 | semmle.label | os2 |
+| Test.java:42:30:42:50 | (...)... : InputStream | semmle.label | (...)... : InputStream |
+| Test.java:42:43:42:50 | source(...) : Object | semmle.label | source(...) : Object |
+| Test.java:44:20:44:39 | asString(...) : String | semmle.label | asString(...) : String |
+| Test.java:44:37:44:38 | in : InputStream | semmle.label | in : InputStream |
+| Test.java:45:9:45:14 | result | semmle.label | result |
+| Test.java:47:31:47:51 | (...)... : InputStream | semmle.label | (...)... : InputStream |
+| Test.java:47:44:47:51 | source(...) : Object | semmle.label | source(...) : Object |
+| Test.java:49:30:49:58 | asString(...) : String | semmle.label | asString(...) : String |
+| Test.java:49:47:49:49 | in1 : InputStream | semmle.label | in1 : InputStream |
+| Test.java:50:18:50:24 | result1 | semmle.label | result1 |
+subpaths
+testFailures
--- a/java/ql/test/library-tests/frameworks/apache-commons-fileupload-1.4/test.ql
+++ b/java/ql/test/library-tests/frameworks/apache-commons-fileupload-1.4/test.ql
@@ -0,0 +1,4 @@
+import java
+import utils.test.InlineFlowTest
+import DefaultFlowTest
+import TaintFlow::PathGraph
--- a/java/ql/test/library-tests/frameworks/spring/websocket/Test.java
+++ b/java/ql/test/library-tests/frameworks/spring/websocket/Test.java
@@ -0,0 +1,64 @@
+
+import org.springframework.web.socket.handler.TextWebSocketHandler;
+import org.springframework.web.socket.WebSocketSession;
+import org.springframework.web.socket.WebSocketMessage;
+import org.springframework.web.socket.TextMessage;
+import org.springframework.web.socket.BinaryMessage;
+import org.springframework.web.socket.PongMessage;
+import org.springframework.web.socket.CloseStatus;
+
+
+public class Test  {
+    void sink(Object o) {}
+
+    public class A extends TextWebSocketHandler {
+        @Override
+        public void handleMessage(WebSocketSession s, WebSocketMessage<?> m) {
+            sink(s); // $hasTaintFlow
+            sink(s.getAcceptedProtocol()); // $hasTaintFlow
+            sink(s.getHandshakeHeaders()); // $hasTaintFlow
+            sink(s.getPrincipal()); // $hasTaintFlow
+            sink(s.getUri()); // $hasTaintFlow
+
+            sink(m); // $hasTaintFlow
+            sink(m.getPayload()); // $hasTaintFlow
+
+        }
+
+        @Override 
+        protected void handleTextMessage(WebSocketSession s, TextMessage m) {
+            sink(s);  // $hasTaintFlow
+            sink(m);  // $hasTaintFlow
+            sink(m.asBytes()); // $hasTaintFlow
+        }
+
+        @Override 
+        protected void handleBinaryMessage(WebSocketSession s, BinaryMessage m) {
+            sink(s); // $hasTaintFlow
+            sink(m); // $hasTaintFlow
+        }
+
+        @Override
+        protected void handlePongMessage(WebSocketSession s, PongMessage m) {
+            sink(s); // $hasTaintFlow
+            sink(m); // $hasTaintFlow
+        }
+
+        @Override
+        public void afterConnectionEstablished(WebSocketSession s) {
+            sink(s); // $hasTaintFlow
+        }
+
+        @Override 
+        public void afterConnectionClosed(WebSocketSession s, CloseStatus c) {
+            sink(s); // $hasTaintFlow
+        }
+
+        @Override 
+        public void handleTransportError(WebSocketSession s, Throwable exc) { 
+            sink(s);  // $hasTaintFlow
+        }
+
+    }
+
+}
--- a/java/ql/test/library-tests/frameworks/spring/websocket/options
+++ b/java/ql/test/library-tests/frameworks/spring/websocket/options
@@ -0,0 +1 @@
+//semmle-extractor-options: --javac-args -cp ${testdir}/../../../../stubs/springframework-5.8.x:${testdir}/../../../../stubs/javax-servlet-2.5:${testdir}/../../../../stubs/apache-commons-logging-1.2
--- a/java/ql/test/library-tests/frameworks/spring/websocket/test.expected
+++ b/java/ql/test/library-tests/frameworks/spring/websocket/test.expected
--- a/java/ql/test/library-tests/frameworks/spring/websocket/test.ql
+++ b/java/ql/test/library-tests/frameworks/spring/websocket/test.ql
@@ -0,0 +1,16 @@
+import java
+import semmle.code.java.dataflow.DataFlow
+import semmle.code.java.dataflow.FlowSources
+import utils.test.InlineFlowTest
+
+module Config implements DataFlow::ConfigSig {
+  predicate isSource(DataFlow::Node node) {
+    DefaultFlowConfig::isSource(node)
+    or
+    node instanceof ActiveThreatModelSource
+  }
+
+  predicate isSink = DefaultFlowConfig::isSink/1;
+}
+
+import FlowTest<DefaultFlowConfig, Config>
--- a/java/ql/test/query-tests/ThreadSafe/ThreadSafe.expected
+++ b/java/ql/test/query-tests/ThreadSafe/ThreadSafe.expected
@@ -43,3 +43,4 @@
 | examples/Test.java:60:5:60:10 | this.y | This field access (publicly accessible via $@) is not protected by any monitor, but the class is annotated as @ThreadSafe. | examples/Test.java:60:5:60:10 | this.y | this expression |
 | examples/Test.java:74:5:74:10 | this.y | This field access (publicly accessible via $@) is not protected by any monitor, but the class is annotated as @ThreadSafe. | examples/Test.java:74:5:74:10 | this.y | this expression |
 | examples/Test.java:74:14:74:14 | y | This field access (publicly accessible via $@) is not protected by any monitor, but the class is annotated as @ThreadSafe. | examples/Test.java:74:14:74:14 | y | this expression |
+| examples/ThreadSafeInitializers.java:45:9:45:14 | this.y | This field access (publicly accessible via $@) is not protected by any monitor, but the class is annotated as @ThreadSafe. | examples/ThreadSafeInitializers.java:45:9:45:14 | this.y | this expression |
--- a/java/ql/test/query-tests/ThreadSafe/examples/ThreadSafeInitializers.java
+++ b/java/ql/test/query-tests/ThreadSafe/examples/ThreadSafeInitializers.java
@@ -0,0 +1,55 @@
+package examples;
+
+import java.util.Map;
+import java.util.Set;
+import java.util.HashMap;
+import java.util.Collections;
+import java.util.concurrent.ConcurrentHashMap;
+
+@ThreadSafe
+public class ThreadSafeInitializers {
+
+    private int y;
+    private final Map<Integer, Integer> sync_map;
+    private final Map<Integer, Integer> sync_map_initialised = Collections.synchronizedMap(new HashMap<Integer, Integer>());
+
+    
+    private final Map<String, String> cmap;
+    private final Map<String, String> cmap_initialised = new ConcurrentHashMap();
+    private final Set<Integer> set;
+    private final Set<Integer> set_initialised = ConcurrentHashMap.newKeySet();
+    
+    public ThreadSafeInitializers() {
+        sync_map = Collections.synchronizedMap(new HashMap<Integer, Integer>());
+        cmap = new ConcurrentHashMap();
+        set = ConcurrentHashMap.newKeySet();
+    }
+
+    public void sync_map_put(Integer i, Integer v) {
+        sync_map.put(i,v);
+    }
+
+    public void sync_map_initialised_put(Integer i, Integer v) {
+        sync_map_initialised.put(i,v);
+    }
+
+    public void cmap_put(String s1, String s2) {
+        cmap.put(s1, s2);
+    }
+
+    public void cmap_initialised_put(String s1, String s2) {
+        cmap_initialised.put(s1, s2);
+    }
+
+    public void setY(int y) {
+        this.y = y; // $ Alert
+    }
+
+    public void set_add(Integer i) {
+        set.add(i);
+    }
+
+    public void set_initialised_add(Integer i) {
+        set_initialised.add(i);
+    }
+}
--- a/java/ql/test/stubs/apache-commons-fileupload-1.4/org/apache/commons/fileupload/FileItemStream.java
+++ b/java/ql/test/stubs/apache-commons-fileupload-1.4/org/apache/commons/fileupload/FileItemStream.java
@@ -0,0 +1,14 @@
+package org.apache.commons.fileupload;
+
+import java.io.InputStream;
+import org.apache.commons.fileupload.FileItemHeadersSupport;
+
+
+public interface FileItemStream extends FileItemHeadersSupport 
+{
+    InputStream openStream() throws java.io.IOException;
+    String getContentType();
+    String getName();
+    String getFieldName();
+    boolean isFormField();
+}
--- a/java/ql/test/stubs/apache-commons-fileupload-1.4/org/apache/commons/fileupload/servlet/ServletFileUpload.java
+++ b/java/ql/test/stubs/apache-commons-fileupload-1.4/org/apache/commons/fileupload/servlet/ServletFileUpload.java
@@ -0,0 +1,11 @@
+// Generated automatically from org.apache.commons.fileupload.servlet.ServletFileUpload for testing purposes
+
+package org.apache.commons.fileupload.servlet;
+
+import java.util.List;
+import javax.servlet.http.HttpServletRequest;
+import org.apache.commons.fileupload.FileItem;
+
+public class ServletFileUpload {
+    public List<FileItem> parseRequest(HttpServletRequest p0){ return null; }
+}
--- a/java/ql/test/stubs/apache-commons-fileupload-1.4/org/apache/commons/fileupload/util/Streams.java
+++ b/java/ql/test/stubs/apache-commons-fileupload-1.4/org/apache/commons/fileupload/util/Streams.java
@@ -0,0 +1,16 @@
+// Generated automatically from org.apache.commons.fileupload.util.Streams for testing purposes
+
+package org.apache.commons.fileupload.util;
+
+import java.io.InputStream;
+import java.io.OutputStream;
+
+public class Streams
+{
+    protected Streams() {}
+    public static String asString(InputStream p0){ return null; }
+    public static String asString(InputStream p0, String p1){ return null; }
+    public static String checkFileName(String p0){ return null; }
+    public static long copy(InputStream p0, OutputStream p1, boolean p2){ return 0; }
+    public static long copy(InputStream p0, OutputStream p1, boolean p2, byte[] p3){ return 0; }
+}
--- a/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/AsyncContext.java
+++ b/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/AsyncContext.java
@@ -0,0 +1,31 @@
+// Generated automatically from jakarta.servlet.AsyncContext for testing purposes
+
+package jakarta.servlet;
+
+import jakarta.servlet.AsyncListener;
+import jakarta.servlet.ServletContext;
+import jakarta.servlet.ServletRequest;
+import jakarta.servlet.ServletResponse;
+
+public interface AsyncContext
+{
+    <T extends AsyncListener> T createListener(java.lang.Class<T> p0);
+    ServletRequest getRequest();
+    ServletResponse getResponse();
+    boolean hasOriginalRequestAndResponse();
+    long getTimeout();
+    static String ASYNC_CONTEXT_PATH = null;
+    static String ASYNC_MAPPING = null;
+    static String ASYNC_PATH_INFO = null;
+    static String ASYNC_QUERY_STRING = null;
+    static String ASYNC_REQUEST_URI = null;
+    static String ASYNC_SERVLET_PATH = null;
+    void addListener(AsyncListener p0);
+    void addListener(AsyncListener p0, ServletRequest p1, ServletResponse p2);
+    void complete();
+    void dispatch();
+    void dispatch(ServletContext p0, String p1);
+    void dispatch(String p0);
+    void setTimeout(long p0);
+    void start(Runnable p0);
+}
--- a/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/AsyncEvent.java
+++ b/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/AsyncEvent.java
@@ -0,0 +1,20 @@
+// Generated automatically from jakarta.servlet.AsyncEvent for testing purposes
+
+package jakarta.servlet;
+
+import jakarta.servlet.AsyncContext;
+import jakarta.servlet.ServletRequest;
+import jakarta.servlet.ServletResponse;
+
+public class AsyncEvent
+{
+    protected AsyncEvent() {}
+    public AsyncContext getAsyncContext(){ return null; }
+    public AsyncEvent(AsyncContext p0){}
+    public AsyncEvent(AsyncContext p0, ServletRequest p1, ServletResponse p2){}
+    public AsyncEvent(AsyncContext p0, ServletRequest p1, ServletResponse p2, Throwable p3){}
+    public AsyncEvent(AsyncContext p0, Throwable p1){}
+    public ServletRequest getSuppliedRequest(){ return null; }
+    public ServletResponse getSuppliedResponse(){ return null; }
+    public Throwable getThrowable(){ return null; }
+}
--- a/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/AsyncListener.java
+++ b/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/AsyncListener.java
@@ -0,0 +1,14 @@
+// Generated automatically from jakarta.servlet.AsyncListener for testing purposes
+
+package jakarta.servlet;
+
+import jakarta.servlet.AsyncEvent;
+import java.util.EventListener;
+
+public interface AsyncListener extends EventListener
+{
+    void onComplete(AsyncEvent p0);
+    void onError(AsyncEvent p0);
+    void onStartAsync(AsyncEvent p0);
+    void onTimeout(AsyncEvent p0);
+}
--- a/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/DispatcherType.java
+++ b/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/DispatcherType.java
@@ -0,0 +1,10 @@
+// Generated automatically from jakarta.servlet.DispatcherType for testing purposes
+
+package jakarta.servlet;
+
+
+public enum DispatcherType
+{
+    ASYNC, ERROR, FORWARD, INCLUDE, REQUEST;
+    private DispatcherType() {}
+}
--- a/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/Filter.java
+++ b/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/Filter.java
@@ -0,0 +1,15 @@
+// Generated automatically from jakarta.servlet.Filter for testing purposes
+
+package jakarta.servlet;
+
+import jakarta.servlet.FilterChain;
+import jakarta.servlet.FilterConfig;
+import jakarta.servlet.ServletRequest;
+import jakarta.servlet.ServletResponse;
+
+public interface Filter
+{
+    default void destroy(){}
+    default void init(FilterConfig p0){}
+    void doFilter(ServletRequest p0, ServletResponse p1, FilterChain p2);
+}
--- a/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/FilterChain.java
+++ b/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/FilterChain.java
@@ -0,0 +1,11 @@
+// Generated automatically from jakarta.servlet.FilterChain for testing purposes
+
+package jakarta.servlet;
+
+import jakarta.servlet.ServletRequest;
+import jakarta.servlet.ServletResponse;
+
+public interface FilterChain
+{
+    void doFilter(ServletRequest p0, ServletResponse p1);
+}
--- a/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/FilterConfig.java
+++ b/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/FilterConfig.java
@@ -0,0 +1,14 @@
+// Generated automatically from jakarta.servlet.FilterConfig for testing purposes
+
+package jakarta.servlet;
+
+import jakarta.servlet.ServletContext;
+import java.util.Enumeration;
+
+public interface FilterConfig
+{
+    Enumeration<String> getInitParameterNames();
+    ServletContext getServletContext();
+    String getFilterName();
+    String getInitParameter(String p0);
+}
--- a/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/FilterRegistration.java
+++ b/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/FilterRegistration.java
@@ -0,0 +1,19 @@
+// Generated automatically from jakarta.servlet.FilterRegistration for testing purposes
+
+package jakarta.servlet;
+
+import jakarta.servlet.DispatcherType;
+import jakarta.servlet.Registration;
+import java.util.Collection;
+import java.util.EnumSet;
+
+public interface FilterRegistration extends Registration
+{
+    Collection<String> getServletNameMappings();
+    Collection<String> getUrlPatternMappings();
+    static public interface Dynamic extends FilterRegistration, Registration.Dynamic
+    {
+    }
+    void addMappingForServletNames(EnumSet<DispatcherType> p0, boolean p1, String... p2);
+    void addMappingForUrlPatterns(EnumSet<DispatcherType> p0, boolean p1, String... p2);
+}
--- a/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/HttpConstraintElement.java
+++ b/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/HttpConstraintElement.java
@@ -0,0 +1,16 @@
+// Generated automatically from jakarta.servlet.HttpConstraintElement for testing purposes
+
+package jakarta.servlet;
+
+import jakarta.servlet.annotation.ServletSecurity;
+
+public class HttpConstraintElement
+{
+    public HttpConstraintElement(){}
+    public HttpConstraintElement(ServletSecurity.EmptyRoleSemantic p0){}
+    public HttpConstraintElement(ServletSecurity.EmptyRoleSemantic p0, ServletSecurity.TransportGuarantee p1, String... p2){}
+    public HttpConstraintElement(ServletSecurity.TransportGuarantee p0, String... p1){}
+    public ServletSecurity.EmptyRoleSemantic getEmptyRoleSemantic(){ return null; }
+    public ServletSecurity.TransportGuarantee getTransportGuarantee(){ return null; }
+    public String[] getRolesAllowed(){ return null; }
+}
--- a/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/HttpMethodConstraintElement.java
+++ b/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/HttpMethodConstraintElement.java
@@ -0,0 +1,13 @@
+// Generated automatically from jakarta.servlet.HttpMethodConstraintElement for testing purposes
+
+package jakarta.servlet;
+
+import jakarta.servlet.HttpConstraintElement;
+
+public class HttpMethodConstraintElement extends HttpConstraintElement
+{
+    protected HttpMethodConstraintElement() {}
+    public HttpMethodConstraintElement(String p0){}
+    public HttpMethodConstraintElement(String p0, HttpConstraintElement p1){}
+    public String getMethodName(){ return null; }
+}
--- a/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/MultipartConfigElement.java
+++ b/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/MultipartConfigElement.java
@@ -0,0 +1,17 @@
+// Generated automatically from jakarta.servlet.MultipartConfigElement for testing purposes
+
+package jakarta.servlet;
+
+import jakarta.servlet.annotation.MultipartConfig;
+
+public class MultipartConfigElement
+{
+    protected MultipartConfigElement() {}
+    public MultipartConfigElement(MultipartConfig p0){}
+    public MultipartConfigElement(String p0){}
+    public MultipartConfigElement(String p0, long p1, long p2, int p3){}
+    public String getLocation(){ return null; }
+    public int getFileSizeThreshold(){ return 0; }
+    public long getMaxFileSize(){ return 0; }
+    public long getMaxRequestSize(){ return 0; }
+}
--- a/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/ReadListener.java
+++ b/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/ReadListener.java
@@ -0,0 +1,12 @@
+// Generated automatically from jakarta.servlet.ReadListener for testing purposes
+
+package jakarta.servlet;
+
+import java.util.EventListener;
+
+public interface ReadListener extends EventListener
+{
+    void onAllDataRead();
+    void onDataAvailable();
+    void onError(Throwable p0);
+}
--- a/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/Registration.java
+++ b/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/Registration.java
@@ -0,0 +1,20 @@
+// Generated automatically from jakarta.servlet.Registration for testing purposes
+
+package jakarta.servlet;
+
+import java.util.Map;
+import java.util.Set;
+
+public interface Registration
+{
+    Map<String, String> getInitParameters();
+    Set<String> setInitParameters(Map<String, String> p0);
+    String getClassName();
+    String getInitParameter(String p0);
+    String getName();
+    boolean setInitParameter(String p0, String p1);
+    static public interface Dynamic extends Registration
+    {
+        void setAsyncSupported(boolean p0);
+    }
+}
--- a/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/RequestDispatcher.java
+++ b/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/RequestDispatcher.java
@@ -0,0 +1,30 @@
+// Generated automatically from jakarta.servlet.RequestDispatcher for testing purposes
+
+package jakarta.servlet;
+
+import jakarta.servlet.ServletRequest;
+import jakarta.servlet.ServletResponse;
+
+public interface RequestDispatcher
+{
+    static String ERROR_EXCEPTION = null;
+    static String ERROR_EXCEPTION_TYPE = null;
+    static String ERROR_MESSAGE = null;
+    static String ERROR_REQUEST_URI = null;
+    static String ERROR_SERVLET_NAME = null;
+    static String ERROR_STATUS_CODE = null;
+    static String FORWARD_CONTEXT_PATH = null;
+    static String FORWARD_MAPPING = null;
+    static String FORWARD_PATH_INFO = null;
+    static String FORWARD_QUERY_STRING = null;
+    static String FORWARD_REQUEST_URI = null;
+    static String FORWARD_SERVLET_PATH = null;
+    static String INCLUDE_CONTEXT_PATH = null;
+    static String INCLUDE_MAPPING = null;
+    static String INCLUDE_PATH_INFO = null;
+    static String INCLUDE_QUERY_STRING = null;
+    static String INCLUDE_REQUEST_URI = null;
+    static String INCLUDE_SERVLET_PATH = null;
+    void forward(ServletRequest p0, ServletResponse p1);
+    void include(ServletRequest p0, ServletResponse p1);
+}
--- a/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/Servlet.java
+++ b/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/Servlet.java
@@ -0,0 +1,16 @@
+// Generated automatically from jakarta.servlet.Servlet for testing purposes
+
+package jakarta.servlet;
+
+import jakarta.servlet.ServletConfig;
+import jakarta.servlet.ServletRequest;
+import jakarta.servlet.ServletResponse;
+
+public interface Servlet
+{
+    ServletConfig getServletConfig();
+    String getServletInfo();
+    void destroy();
+    void init(ServletConfig p0);
+    void service(ServletRequest p0, ServletResponse p1);
+}
--- a/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/ServletConfig.java
+++ b/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/ServletConfig.java
@@ -0,0 +1,14 @@
+// Generated automatically from jakarta.servlet.ServletConfig for testing purposes
+
+package jakarta.servlet;
+
+import jakarta.servlet.ServletContext;
+import java.util.Enumeration;
+
+public interface ServletConfig
+{
+    Enumeration<String> getInitParameterNames();
+    ServletContext getServletContext();
+    String getInitParameter(String p0);
+    String getServletName();
+}
--- a/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/ServletConnection.java
+++ b/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/ServletConnection.java
@@ -0,0 +1,12 @@
+// Generated automatically from jakarta.servlet.ServletConnection for testing purposes
+
+package jakarta.servlet;
+
+
+public interface ServletConnection
+{
+    String getConnectionId();
+    String getProtocol();
+    String getProtocolConnectionId();
+    boolean isSecure();
+}
--- a/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/ServletContext.java
+++ b/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/ServletContext.java
@@ -0,0 +1,79 @@
+// Generated automatically from jakarta.servlet.ServletContext for testing purposes
+
+package jakarta.servlet;
+
+import jakarta.servlet.Filter;
+import jakarta.servlet.FilterRegistration;
+import jakarta.servlet.RequestDispatcher;
+import jakarta.servlet.Servlet;
+import jakarta.servlet.ServletRegistration;
+import jakarta.servlet.SessionCookieConfig;
+import jakarta.servlet.SessionTrackingMode;
+import jakarta.servlet.descriptor.JspConfigDescriptor;
+import java.io.InputStream;
+import java.net.URL;
+import java.util.Enumeration;
+import java.util.EventListener;
+import java.util.Map;
+import java.util.Set;
+
+public interface ServletContext
+{
+    <T extends EventListener> T createListener(java.lang.Class<T> p0);
+    <T extends EventListener> void addListener(T p0);
+    <T extends Filter> T createFilter(java.lang.Class<T> p0);
+    <T extends Servlet> T createServlet(java.lang.Class<T> p0);
+    ClassLoader getClassLoader();
+    Enumeration<String> getAttributeNames();
+    Enumeration<String> getInitParameterNames();
+    FilterRegistration getFilterRegistration(String p0);
+    FilterRegistration.Dynamic addFilter(String p0, Class<? extends Filter> p1);
+    FilterRegistration.Dynamic addFilter(String p0, Filter p1);
+    FilterRegistration.Dynamic addFilter(String p0, String p1);
+    InputStream getResourceAsStream(String p0);
+    JspConfigDescriptor getJspConfigDescriptor();
+    Map<String, ? extends FilterRegistration> getFilterRegistrations();
+    Map<String, ? extends ServletRegistration> getServletRegistrations();
+    Object getAttribute(String p0);
+    RequestDispatcher getNamedDispatcher(String p0);
+    RequestDispatcher getRequestDispatcher(String p0);
+    ServletContext getContext(String p0);
+    ServletRegistration getServletRegistration(String p0);
+    ServletRegistration.Dynamic addJspFile(String p0, String p1);
+    ServletRegistration.Dynamic addServlet(String p0, Class<? extends Servlet> p1);
+    ServletRegistration.Dynamic addServlet(String p0, Servlet p1);
+    ServletRegistration.Dynamic addServlet(String p0, String p1);
+    SessionCookieConfig getSessionCookieConfig();
+    Set<SessionTrackingMode> getDefaultSessionTrackingModes();
+    Set<SessionTrackingMode> getEffectiveSessionTrackingModes();
+    Set<String> getResourcePaths(String p0);
+    String getContextPath();
+    String getInitParameter(String p0);
+    String getMimeType(String p0);
+    String getRealPath(String p0);
+    String getRequestCharacterEncoding();
+    String getResponseCharacterEncoding();
+    String getServerInfo();
+    String getServletContextName();
+    String getVirtualServerName();
+    URL getResource(String p0);
+    boolean setInitParameter(String p0, String p1);
+    int getEffectiveMajorVersion();
+    int getEffectiveMinorVersion();
+    int getMajorVersion();
+    int getMinorVersion();
+    int getSessionTimeout();
+    static String ORDERED_LIBS = null;
+    static String TEMPDIR = null;
+    void addListener(Class<? extends EventListener> p0);
+    void addListener(String p0);
+    void declareRoles(String... p0);
+    void log(String p0);
+    void log(String p0, Throwable p1);
+    void removeAttribute(String p0);
+    void setAttribute(String p0, Object p1);
+    void setRequestCharacterEncoding(String p0);
+    void setResponseCharacterEncoding(String p0);
+    void setSessionTimeout(int p0);
+    void setSessionTrackingModes(Set<SessionTrackingMode> p0);
+}
--- a/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/ServletInputStream.java
+++ b/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/ServletInputStream.java
@@ -0,0 +1,15 @@
+// Generated automatically from jakarta.servlet.ServletInputStream for testing purposes
+
+package jakarta.servlet;
+
+import jakarta.servlet.ReadListener;
+import java.io.InputStream;
+
+abstract public class ServletInputStream extends InputStream
+{
+    protected ServletInputStream(){}
+    public abstract boolean isFinished();
+    public abstract boolean isReady();
+    public abstract void setReadListener(ReadListener p0);
+    public int readLine(byte[] p0, int p1, int p2){ return 0; }
+}
--- a/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/ServletOutputStream.java
+++ b/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/ServletOutputStream.java
@@ -0,0 +1,28 @@
+// Generated automatically from jakarta.servlet.ServletOutputStream for testing purposes
+
+package jakarta.servlet;
+
+import jakarta.servlet.WriteListener;
+import java.io.OutputStream;
+
+abstract public class ServletOutputStream extends OutputStream
+{
+    protected ServletOutputStream(){}
+    public abstract boolean isReady();
+    public abstract void setWriteListener(WriteListener p0);
+    public void print(String p0){}
+    public void print(boolean p0){}
+    public void print(char p0){}
+    public void print(double p0){}
+    public void print(float p0){}
+    public void print(int p0){}
+    public void print(long p0){}
+    public void println(){}
+    public void println(String p0){}
+    public void println(boolean p0){}
+    public void println(char p0){}
+    public void println(double p0){}
+    public void println(float p0){}
+    public void println(int p0){}
+    public void println(long p0){}
+}
--- a/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/ServletRegistration.java
+++ b/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/ServletRegistration.java
@@ -0,0 +1,23 @@
+// Generated automatically from jakarta.servlet.ServletRegistration for testing purposes
+
+package jakarta.servlet;
+
+import jakarta.servlet.MultipartConfigElement;
+import jakarta.servlet.Registration;
+import jakarta.servlet.ServletSecurityElement;
+import java.util.Collection;
+import java.util.Set;
+
+public interface ServletRegistration extends Registration
+{
+    Collection<String> getMappings();
+    Set<String> addMapping(String... p0);
+    String getRunAsRole();
+    static public interface Dynamic extends Registration.Dynamic, ServletRegistration
+    {
+        Set<String> setServletSecurity(ServletSecurityElement p0);
+        void setLoadOnStartup(int p0);
+        void setMultipartConfig(MultipartConfigElement p0);
+        void setRunAsRole(String p0);
+    }
+}
--- a/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/ServletRequest.java
+++ b/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/ServletRequest.java
@@ -0,0 +1,58 @@
+// Generated automatically from jakarta.servlet.ServletRequest for testing purposes
+
+package jakarta.servlet;
+
+import jakarta.servlet.AsyncContext;
+import jakarta.servlet.DispatcherType;
+import jakarta.servlet.RequestDispatcher;
+import jakarta.servlet.ServletConnection;
+import jakarta.servlet.ServletContext;
+import jakarta.servlet.ServletInputStream;
+import jakarta.servlet.ServletResponse;
+import java.io.BufferedReader;
+import java.util.Enumeration;
+import java.util.Locale;
+import java.util.Map;
+
+public interface ServletRequest
+{
+    AsyncContext getAsyncContext();
+    AsyncContext startAsync();
+    AsyncContext startAsync(ServletRequest p0, ServletResponse p1);
+    BufferedReader getReader();
+    DispatcherType getDispatcherType();
+    Enumeration<Locale> getLocales();
+    Enumeration<String> getAttributeNames();
+    Enumeration<String> getParameterNames();
+    Locale getLocale();
+    Map<String, String[]> getParameterMap();
+    Object getAttribute(String p0);
+    RequestDispatcher getRequestDispatcher(String p0);
+    ServletConnection getServletConnection();
+    ServletContext getServletContext();
+    ServletInputStream getInputStream();
+    String getCharacterEncoding();
+    String getContentType();
+    String getLocalAddr();
+    String getLocalName();
+    String getParameter(String p0);
+    String getProtocol();
+    String getProtocolRequestId();
+    String getRemoteAddr();
+    String getRemoteHost();
+    String getRequestId();
+    String getScheme();
+    String getServerName();
+    String[] getParameterValues(String p0);
+    boolean isAsyncStarted();
+    boolean isAsyncSupported();
+    boolean isSecure();
+    int getContentLength();
+    int getLocalPort();
+    int getRemotePort();
+    int getServerPort();
+    long getContentLengthLong();
+    void removeAttribute(String p0);
+    void setAttribute(String p0, Object p1);
+    void setCharacterEncoding(String p0);
+}
--- a/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/ServletResponse.java
+++ b/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/ServletResponse.java
@@ -0,0 +1,27 @@
+// Generated automatically from jakarta.servlet.ServletResponse for testing purposes
+
+package jakarta.servlet;
+
+import jakarta.servlet.ServletOutputStream;
+import java.io.PrintWriter;
+import java.util.Locale;
+
+public interface ServletResponse
+{
+    Locale getLocale();
+    PrintWriter getWriter();
+    ServletOutputStream getOutputStream();
+    String getCharacterEncoding();
+    String getContentType();
+    boolean isCommitted();
+    int getBufferSize();
+    void flushBuffer();
+    void reset();
+    void resetBuffer();
+    void setBufferSize(int p0);
+    void setCharacterEncoding(String p0);
+    void setContentLength(int p0);
+    void setContentLengthLong(long p0);
+    void setContentType(String p0);
+    void setLocale(Locale p0);
+}
--- a/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/ServletSecurityElement.java
+++ b/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/ServletSecurityElement.java
@@ -0,0 +1,19 @@
+// Generated automatically from jakarta.servlet.ServletSecurityElement for testing purposes
+
+package jakarta.servlet;
+
+import jakarta.servlet.HttpConstraintElement;
+import jakarta.servlet.HttpMethodConstraintElement;
+import jakarta.servlet.annotation.ServletSecurity;
+import java.util.Collection;
+
+public class ServletSecurityElement extends HttpConstraintElement
+{
+    public Collection<HttpMethodConstraintElement> getHttpMethodConstraints(){ return null; }
+    public Collection<String> getMethodNames(){ return null; }
+    public ServletSecurityElement(){}
+    public ServletSecurityElement(Collection<HttpMethodConstraintElement> p0){}
+    public ServletSecurityElement(HttpConstraintElement p0){}
+    public ServletSecurityElement(HttpConstraintElement p0, Collection<HttpMethodConstraintElement> p1){}
+    public ServletSecurityElement(ServletSecurity p0){}
+}
--- a/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/SessionCookieConfig.java
+++ b/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/SessionCookieConfig.java
@@ -0,0 +1,26 @@
+// Generated automatically from jakarta.servlet.SessionCookieConfig for testing purposes
+
+package jakarta.servlet;
+
+import java.util.Map;
+
+public interface SessionCookieConfig
+{
+    Map<String, String> getAttributes();
+    String getAttribute(String p0);
+    String getComment();
+    String getDomain();
+    String getName();
+    String getPath();
+    boolean isHttpOnly();
+    boolean isSecure();
+    int getMaxAge();
+    void setAttribute(String p0, String p1);
+    void setComment(String p0);
+    void setDomain(String p0);
+    void setHttpOnly(boolean p0);
+    void setMaxAge(int p0);
+    void setName(String p0);
+    void setPath(String p0);
+    void setSecure(boolean p0);
+}
--- a/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/SessionTrackingMode.java
+++ b/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/SessionTrackingMode.java
@@ -0,0 +1,10 @@
+// Generated automatically from jakarta.servlet.SessionTrackingMode for testing purposes
+
+package jakarta.servlet;
+
+
+public enum SessionTrackingMode
+{
+    COOKIE, SSL, URL;
+    private SessionTrackingMode() {}
+}
--- a/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/WriteListener.java
+++ b/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/WriteListener.java
@@ -0,0 +1,11 @@
+// Generated automatically from jakarta.servlet.WriteListener for testing purposes
+
+package jakarta.servlet;
+
+import java.util.EventListener;
+
+public interface WriteListener extends EventListener
+{
+    void onError(Throwable p0);
+    void onWritePossible();
+}
--- a/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/annotation/HttpConstraint.java
+++ b/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/annotation/HttpConstraint.java
@@ -0,0 +1,18 @@
+// Generated automatically from jakarta.servlet.annotation.HttpConstraint for testing purposes
+
+package jakarta.servlet.annotation;
+
+import jakarta.servlet.annotation.ServletSecurity;
+import java.lang.annotation.Annotation;
+import java.lang.annotation.Documented;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+
+@Documented
+@Retention(value=java.lang.annotation.RetentionPolicy.RUNTIME)
+public @interface HttpConstraint
+{
+    ServletSecurity.EmptyRoleSemantic value();
+    ServletSecurity.TransportGuarantee transportGuarantee();
+    String[] rolesAllowed();
+}
--- a/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/annotation/HttpMethodConstraint.java
+++ b/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/annotation/HttpMethodConstraint.java
@@ -0,0 +1,19 @@
+// Generated automatically from jakarta.servlet.annotation.HttpMethodConstraint for testing purposes
+
+package jakarta.servlet.annotation;
+
+import jakarta.servlet.annotation.ServletSecurity;
+import java.lang.annotation.Annotation;
+import java.lang.annotation.Documented;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+
+@Documented
+@Retention(value=java.lang.annotation.RetentionPolicy.RUNTIME)
+public @interface HttpMethodConstraint
+{
+    ServletSecurity.EmptyRoleSemantic emptyRoleSemantic();
+    ServletSecurity.TransportGuarantee transportGuarantee();
+    String value();
+    String[] rolesAllowed();
+}
--- a/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/annotation/MultipartConfig.java
+++ b/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/annotation/MultipartConfig.java
@@ -0,0 +1,19 @@
+// Generated automatically from jakarta.servlet.annotation.MultipartConfig for testing purposes
+
+package jakarta.servlet.annotation;
+
+import java.lang.annotation.Annotation;
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+@Retention(value=java.lang.annotation.RetentionPolicy.RUNTIME)
+@Target(value={java.lang.annotation.ElementType.TYPE})
+public @interface MultipartConfig
+{
+    String location();
+    int fileSizeThreshold();
+    long maxFileSize();
+    long maxRequestSize();
+}
--- a/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/annotation/ServletSecurity.java
+++ b/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/annotation/ServletSecurity.java
@@ -0,0 +1,33 @@
+// Generated automatically from jakarta.servlet.annotation.ServletSecurity for testing purposes
+
+package jakarta.servlet.annotation;
+
+import jakarta.servlet.annotation.HttpConstraint;
+import jakarta.servlet.annotation.HttpMethodConstraint;
+import java.lang.annotation.Annotation;
+import java.lang.annotation.Documented;
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Inherited;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+@Documented
+@Inherited
+@Retention(value=java.lang.annotation.RetentionPolicy.RUNTIME)
+@Target(value={java.lang.annotation.ElementType.TYPE})
+public @interface ServletSecurity
+{
+    HttpConstraint value();
+    HttpMethodConstraint[] httpMethodConstraints();
+    static public enum EmptyRoleSemantic
+    {
+        DENY, PERMIT;
+        private EmptyRoleSemantic() {}
+    }
+    static public enum TransportGuarantee
+    {
+        CONFIDENTIAL, NONE;
+        private TransportGuarantee() {}
+    }
+}
--- a/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/descriptor/JspConfigDescriptor.java
+++ b/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/descriptor/JspConfigDescriptor.java
@@ -0,0 +1,13 @@
+// Generated automatically from jakarta.servlet.descriptor.JspConfigDescriptor for testing purposes
+
+package jakarta.servlet.descriptor;
+
+import jakarta.servlet.descriptor.JspPropertyGroupDescriptor;
+import jakarta.servlet.descriptor.TaglibDescriptor;
+import java.util.Collection;
+
+public interface JspConfigDescriptor
+{
+    Collection<JspPropertyGroupDescriptor> getJspPropertyGroups();
+    Collection<TaglibDescriptor> getTaglibs();
+}
--- a/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/descriptor/JspPropertyGroupDescriptor.java
+++ b/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/descriptor/JspPropertyGroupDescriptor.java
@@ -0,0 +1,22 @@
+// Generated automatically from jakarta.servlet.descriptor.JspPropertyGroupDescriptor for testing purposes
+
+package jakarta.servlet.descriptor;
+
+import java.util.Collection;
+
+public interface JspPropertyGroupDescriptor
+{
+    Collection<String> getIncludeCodas();
+    Collection<String> getIncludePreludes();
+    Collection<String> getUrlPatterns();
+    String getBuffer();
+    String getDefaultContentType();
+    String getDeferredSyntaxAllowedAsLiteral();
+    String getElIgnored();
+    String getErrorOnELNotFound();
+    String getErrorOnUndeclaredNamespace();
+    String getIsXml();
+    String getPageEncoding();
+    String getScriptingInvalid();
+    String getTrimDirectiveWhitespaces();
+}
--- a/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/descriptor/TaglibDescriptor.java
+++ b/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/descriptor/TaglibDescriptor.java
@@ -0,0 +1,10 @@
+// Generated automatically from jakarta.servlet.descriptor.TaglibDescriptor for testing purposes
+
+package jakarta.servlet.descriptor;
+
+
+public interface TaglibDescriptor
+{
+    String getTaglibLocation();
+    String getTaglibURI();
+}
--- a/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/http/Cookie.java
+++ b/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/http/Cookie.java
@@ -0,0 +1,36 @@
+// Generated automatically from jakarta.servlet.http.Cookie for testing purposes
+
+package jakarta.servlet.http;
+
+import java.io.Serializable;
+import java.util.Map;
+
+public class Cookie implements Cloneable, Serializable
+{
+    protected Cookie() {}
+    public Cookie(String p0, String p1){}
+    public Map<String, String> getAttributes(){ return null; }
+    public Object clone(){ return null; }
+    public String getAttribute(String p0){ return null; }
+    public String getComment(){ return null; }
+    public String getDomain(){ return null; }
+    public String getName(){ return null; }
+    public String getPath(){ return null; }
+    public String getValue(){ return null; }
+    public String toString(){ return null; }
+    public boolean equals(Object p0){ return false; }
+    public boolean getSecure(){ return false; }
+    public boolean isHttpOnly(){ return false; }
+    public int getMaxAge(){ return 0; }
+    public int getVersion(){ return 0; }
+    public int hashCode(){ return 0; }
+    public void setAttribute(String p0, String p1){}
+    public void setComment(String p0){}
+    public void setDomain(String p0){}
+    public void setHttpOnly(boolean p0){}
+    public void setMaxAge(int p0){}
+    public void setPath(String p0){}
+    public void setSecure(boolean p0){}
+    public void setValue(String p0){}
+    public void setVersion(int p0){}
+}
--- a/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/http/HttpServletMapping.java
+++ b/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/http/HttpServletMapping.java
@@ -0,0 +1,13 @@
+// Generated automatically from jakarta.servlet.http.HttpServletMapping for testing purposes
+
+package jakarta.servlet.http;
+
+import jakarta.servlet.http.MappingMatch;
+
+public interface HttpServletMapping
+{
+    MappingMatch getMappingMatch();
+    String getMatchValue();
+    String getPattern();
+    String getServletName();
+}
--- a/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/http/HttpServletRequest.java
+++ b/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/http/HttpServletRequest.java
@@ -0,0 +1,59 @@
+// Generated automatically from jakarta.servlet.http.HttpServletRequest for testing purposes
+
+package jakarta.servlet.http;
+
+import jakarta.servlet.ServletRequest;
+import jakarta.servlet.http.Cookie;
+import jakarta.servlet.http.HttpServletMapping;
+import jakarta.servlet.http.HttpServletResponse;
+import jakarta.servlet.http.HttpSession;
+import jakarta.servlet.http.HttpUpgradeHandler;
+import jakarta.servlet.http.Part;
+import jakarta.servlet.http.PushBuilder;
+import java.security.Principal;
+import java.util.Collection;
+import java.util.Enumeration;
+import java.util.Map;
+
+public interface HttpServletRequest extends ServletRequest
+{
+    <T extends HttpUpgradeHandler> T upgrade(java.lang.Class<T> p0);
+    Collection<Part> getParts();
+    Cookie[] getCookies();
+    Enumeration<String> getHeaderNames();
+    Enumeration<String> getHeaders(String p0);
+    HttpSession getSession();
+    HttpSession getSession(boolean p0);
+    Part getPart(String p0);
+    Principal getUserPrincipal();
+    String changeSessionId();
+    String getAuthType();
+    String getContextPath();
+    String getHeader(String p0);
+    String getMethod();
+    String getPathInfo();
+    String getPathTranslated();
+    String getQueryString();
+    String getRemoteUser();
+    String getRequestURI();
+    String getRequestedSessionId();
+    String getServletPath();
+    StringBuffer getRequestURL();
+    boolean authenticate(HttpServletResponse p0);
+    boolean isRequestedSessionIdFromCookie();
+    boolean isRequestedSessionIdFromURL();
+    boolean isRequestedSessionIdValid();
+    boolean isUserInRole(String p0);
+    default HttpServletMapping getHttpServletMapping(){ return null; }
+    default Map<String, String> getTrailerFields(){ return null; }
+    default PushBuilder newPushBuilder(){ return null; }
+    default boolean isTrailerFieldsReady(){ return false; }
+    int getIntHeader(String p0);
+    long getDateHeader(String p0);
+    static String BASIC_AUTH = null;
+    static String CLIENT_CERT_AUTH = null;
+    static String DIGEST_AUTH = null;
+    static String FORM_AUTH = null;
+    void login(String p0, String p1);
+    void logout();
+}
--- a/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/http/HttpServletResponse.java
+++ b/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/http/HttpServletResponse.java
@@ -0,0 +1,74 @@
+// Generated automatically from jakarta.servlet.http.HttpServletResponse for testing purposes
+
+package jakarta.servlet.http;
+
+import jakarta.servlet.ServletResponse;
+import jakarta.servlet.http.Cookie;
+import java.util.Collection;
+import java.util.Map;
+import java.util.function.Supplier;
+
+public interface HttpServletResponse extends ServletResponse
+{
+    Collection<String> getHeaderNames();
+    Collection<String> getHeaders(String p0);
+    String encodeRedirectURL(String p0);
+    String encodeURL(String p0);
+    String getHeader(String p0);
+    boolean containsHeader(String p0);
+    default Supplier<Map<String, String>> getTrailerFields(){ return null; }
+    default void setTrailerFields(Supplier<Map<String, String>> p0){}
+    int getStatus();
+    static int SC_ACCEPTED = 0;
+    static int SC_BAD_GATEWAY = 0;
+    static int SC_BAD_REQUEST = 0;
+    static int SC_CONFLICT = 0;
+    static int SC_CONTINUE = 0;
+    static int SC_CREATED = 0;
+    static int SC_EXPECTATION_FAILED = 0;
+    static int SC_FORBIDDEN = 0;
+    static int SC_FOUND = 0;
+    static int SC_GATEWAY_TIMEOUT = 0;
+    static int SC_GONE = 0;
+    static int SC_HTTP_VERSION_NOT_SUPPORTED = 0;
+    static int SC_INTERNAL_SERVER_ERROR = 0;
+    static int SC_LENGTH_REQUIRED = 0;
+    static int SC_METHOD_NOT_ALLOWED = 0;
+    static int SC_MOVED_PERMANENTLY = 0;
+    static int SC_MOVED_TEMPORARILY = 0;
+    static int SC_MULTIPLE_CHOICES = 0;
+    static int SC_NON_AUTHORITATIVE_INFORMATION = 0;
+    static int SC_NOT_ACCEPTABLE = 0;
+    static int SC_NOT_FOUND = 0;
+    static int SC_NOT_IMPLEMENTED = 0;
+    static int SC_NOT_MODIFIED = 0;
+    static int SC_NO_CONTENT = 0;
+    static int SC_OK = 0;
+    static int SC_PARTIAL_CONTENT = 0;
+    static int SC_PAYMENT_REQUIRED = 0;
+    static int SC_PRECONDITION_FAILED = 0;
+    static int SC_PROXY_AUTHENTICATION_REQUIRED = 0;
+    static int SC_REQUESTED_RANGE_NOT_SATISFIABLE = 0;
+    static int SC_REQUEST_ENTITY_TOO_LARGE = 0;
+    static int SC_REQUEST_TIMEOUT = 0;
+    static int SC_REQUEST_URI_TOO_LONG = 0;
+    static int SC_RESET_CONTENT = 0;
+    static int SC_SEE_OTHER = 0;
+    static int SC_SERVICE_UNAVAILABLE = 0;
+    static int SC_SWITCHING_PROTOCOLS = 0;
+    static int SC_TEMPORARY_REDIRECT = 0;
+    static int SC_UNAUTHORIZED = 0;
+    static int SC_UNSUPPORTED_MEDIA_TYPE = 0;
+    static int SC_USE_PROXY = 0;
+    void addCookie(Cookie p0);
+    void addDateHeader(String p0, long p1);
+    void addHeader(String p0, String p1);
+    void addIntHeader(String p0, int p1);
+    void sendError(int p0);
+    void sendError(int p0, String p1);
+    void sendRedirect(String p0);
+    void setDateHeader(String p0, long p1);
+    void setHeader(String p0, String p1);
+    void setIntHeader(String p0, int p1);
+    void setStatus(int p0);
+}
--- a/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/http/HttpSession.java
+++ b/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/http/HttpSession.java
@@ -0,0 +1,22 @@
+// Generated automatically from jakarta.servlet.http.HttpSession for testing purposes
+
+package jakarta.servlet.http;
+
+import jakarta.servlet.ServletContext;
+import java.util.Enumeration;
+
+public interface HttpSession
+{
+    Enumeration<String> getAttributeNames();
+    Object getAttribute(String p0);
+    ServletContext getServletContext();
+    String getId();
+    boolean isNew();
+    int getMaxInactiveInterval();
+    long getCreationTime();
+    long getLastAccessedTime();
+    void invalidate();
+    void removeAttribute(String p0);
+    void setAttribute(String p0, Object p1);
+    void setMaxInactiveInterval(int p0);
+}
--- a/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/http/HttpUpgradeHandler.java
+++ b/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/http/HttpUpgradeHandler.java
@@ -0,0 +1,11 @@
+// Generated automatically from jakarta.servlet.http.HttpUpgradeHandler for testing purposes
+
+package jakarta.servlet.http;
+
+import jakarta.servlet.http.WebConnection;
+
+public interface HttpUpgradeHandler
+{
+    void destroy();
+    void init(WebConnection p0);
+}
--- a/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/http/MappingMatch.java
+++ b/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/http/MappingMatch.java
@@ -0,0 +1,10 @@
+// Generated automatically from jakarta.servlet.http.MappingMatch for testing purposes
+
+package jakarta.servlet.http;
+
+
+public enum MappingMatch
+{
+    CONTEXT_ROOT, DEFAULT, EXACT, EXTENSION, PATH;
+    private MappingMatch() {}
+}
--- a/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/http/Part.java
+++ b/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/http/Part.java
@@ -0,0 +1,20 @@
+// Generated automatically from jakarta.servlet.http.Part for testing purposes
+
+package jakarta.servlet.http;
+
+import java.io.InputStream;
+import java.util.Collection;
+
+public interface Part
+{
+    Collection<String> getHeaderNames();
+    Collection<String> getHeaders(String p0);
+    InputStream getInputStream();
+    String getContentType();
+    String getHeader(String p0);
+    String getName();
+    String getSubmittedFileName();
+    long getSize();
+    void delete();
+    void write(String p0);
+}
--- a/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/http/PushBuilder.java
+++ b/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/http/PushBuilder.java
@@ -0,0 +1,23 @@
+// Generated automatically from jakarta.servlet.http.PushBuilder for testing purposes
+
+package jakarta.servlet.http;
+
+import java.util.Set;
+
+public interface PushBuilder
+{
+    PushBuilder addHeader(String p0, String p1);
+    PushBuilder method(String p0);
+    PushBuilder path(String p0);
+    PushBuilder queryString(String p0);
+    PushBuilder removeHeader(String p0);
+    PushBuilder sessionId(String p0);
+    PushBuilder setHeader(String p0, String p1);
+    Set<String> getHeaderNames();
+    String getHeader(String p0);
+    String getMethod();
+    String getPath();
+    String getQueryString();
+    String getSessionId();
+    void push();
+}
--- a/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/http/WebConnection.java
+++ b/java/ql/test/stubs/jakarta.servlet-api-6.0.0/jakarta/servlet/http/WebConnection.java
@@ -0,0 +1,12 @@
+// Generated automatically from jakarta.servlet.http.WebConnection for testing purposes
+
+package jakarta.servlet.http;
+
+import jakarta.servlet.ServletInputStream;
+import jakarta.servlet.ServletOutputStream;
+
+public interface WebConnection extends AutoCloseable
+{
+    ServletInputStream getInputStream();
+    ServletOutputStream getOutputStream();
+}
--- a/java/ql/test/stubs/springframework-5.8.x/org/springframework/web/socket/AbstractWebSocketMessage.java
+++ b/java/ql/test/stubs/springframework-5.8.x/org/springframework/web/socket/AbstractWebSocketMessage.java
@@ -0,0 +1,16 @@
+// Generated automatically from org.springframework.web.socket.AbstractWebSocketMessage for testing purposes
+
+package org.springframework.web.socket;
+
+import org.springframework.web.socket.WebSocketMessage;
+
+abstract public class AbstractWebSocketMessage<T> implements WebSocketMessage<T>
+{
+    protected AbstractWebSocketMessage() {}
+    protected abstract String toStringPayload();
+    public String toString(){ return null; }
+    public T getPayload(){ return null; }
+    public boolean equals(Object p0){ return false; }
+    public boolean isLast(){ return false; }
+    public int hashCode(){ return 0; }
+}
--- a/java/ql/test/stubs/springframework-5.8.x/org/springframework/web/socket/BinaryMessage.java
+++ b/java/ql/test/stubs/springframework-5.8.x/org/springframework/web/socket/BinaryMessage.java
@@ -0,0 +1,18 @@
+// Generated automatically from org.springframework.web.socket.BinaryMessage for testing purposes
+
+package org.springframework.web.socket;
+
+import java.nio.ByteBuffer;
+import org.springframework.web.socket.AbstractWebSocketMessage;
+
+public class BinaryMessage extends AbstractWebSocketMessage<ByteBuffer>
+{
+    protected BinaryMessage() {}
+    protected String toStringPayload(){ return null; }
+    public BinaryMessage(ByteBuffer p0){}
+    public BinaryMessage(ByteBuffer p0, boolean p1){}
+    public BinaryMessage(byte[] p0){}
+    public BinaryMessage(byte[] p0, boolean p1){}
+    public BinaryMessage(byte[] p0, int p1, int p2, boolean p3){}
+    public int getPayloadLength(){ return 0; }
+}
--- a/java/ql/test/stubs/springframework-5.8.x/org/springframework/web/socket/CloseStatus.java
+++ b/java/ql/test/stubs/springframework-5.8.x/org/springframework/web/socket/CloseStatus.java
@@ -0,0 +1,34 @@
+// Generated automatically from org.springframework.web.socket.CloseStatus for testing purposes
+
+package org.springframework.web.socket;
+
+import java.io.Serializable;
+
+public class CloseStatus implements Serializable
+{
+    protected CloseStatus() {}
+    public CloseStatus withReason(String p0){ return null; }
+    public CloseStatus(int p0){}
+    public CloseStatus(int p0, String p1){}
+    public String getReason(){ return null; }
+    public String toString(){ return null; }
+    public boolean equals(Object p0){ return false; }
+    public boolean equalsCode(CloseStatus p0){ return false; }
+    public int getCode(){ return 0; }
+    public int hashCode(){ return 0; }
+    public static CloseStatus BAD_DATA = null;
+    public static CloseStatus GOING_AWAY = null;
+    public static CloseStatus NORMAL = null;
+    public static CloseStatus NOT_ACCEPTABLE = null;
+    public static CloseStatus NO_CLOSE_FRAME = null;
+    public static CloseStatus NO_STATUS_CODE = null;
+    public static CloseStatus POLICY_VIOLATION = null;
+    public static CloseStatus PROTOCOL_ERROR = null;
+    public static CloseStatus REQUIRED_EXTENSION = null;
+    public static CloseStatus SERVER_ERROR = null;
+    public static CloseStatus SERVICE_OVERLOAD = null;
+    public static CloseStatus SERVICE_RESTARTED = null;
+    public static CloseStatus SESSION_NOT_RELIABLE = null;
+    public static CloseStatus TLS_HANDSHAKE_FAILURE = null;
+    public static CloseStatus TOO_BIG_TO_PROCESS = null;
+}
--- a/java/ql/test/stubs/springframework-5.8.x/org/springframework/web/socket/PongMessage.java
+++ b/java/ql/test/stubs/springframework-5.8.x/org/springframework/web/socket/PongMessage.java
@@ -0,0 +1,14 @@
+// Generated automatically from org.springframework.web.socket.PongMessage for testing purposes
+
+package org.springframework.web.socket;
+
+import java.nio.ByteBuffer;
+import org.springframework.web.socket.AbstractWebSocketMessage;
+
+public class PongMessage extends AbstractWebSocketMessage<ByteBuffer>
+{
+    protected String toStringPayload(){ return null; }
+    public PongMessage(){}
+    public PongMessage(ByteBuffer p0){}
+    public int getPayloadLength(){ return 0; }
+}
--- a/java/ql/test/stubs/springframework-5.8.x/org/springframework/web/socket/TextMessage.java
+++ b/java/ql/test/stubs/springframework-5.8.x/org/springframework/web/socket/TextMessage.java
@@ -0,0 +1,16 @@
+// Generated automatically from org.springframework.web.socket.TextMessage for testing purposes
+
+package org.springframework.web.socket;
+
+import org.springframework.web.socket.AbstractWebSocketMessage;
+
+public class TextMessage extends AbstractWebSocketMessage<String>
+{
+    protected TextMessage() {}
+    protected String toStringPayload(){ return null; }
+    public TextMessage(CharSequence p0){}
+    public TextMessage(CharSequence p0, boolean p1){}
+    public TextMessage(byte[] p0){}
+    public byte[] asBytes(){ return null; }
+    public int getPayloadLength(){ return 0; }
+}
--- a/java/ql/test/stubs/springframework-5.8.x/org/springframework/web/socket/WebSocketExtension.java
+++ b/java/ql/test/stubs/springframework-5.8.x/org/springframework/web/socket/WebSocketExtension.java
@@ -0,0 +1,19 @@
+// Generated automatically from org.springframework.web.socket.WebSocketExtension for testing purposes
+
+package org.springframework.web.socket;
+
+import java.util.List;
+import java.util.Map;
+
+public class WebSocketExtension
+{
+    protected WebSocketExtension() {}
+    public Map<String, String> getParameters(){ return null; }
+    public String getName(){ return null; }
+    public String toString(){ return null; }
+    public WebSocketExtension(String p0){}
+    public WebSocketExtension(String p0, Map<String, String> p1){}
+    public boolean equals(Object p0){ return false; }
+    public int hashCode(){ return 0; }
+    public static List<WebSocketExtension> parseExtensions(String p0){ return null; }
+}
--- a/java/ql/test/stubs/springframework-5.8.x/org/springframework/web/socket/WebSocketHandler.java
+++ b/java/ql/test/stubs/springframework-5.8.x/org/springframework/web/socket/WebSocketHandler.java
@@ -0,0 +1,16 @@
+// Generated automatically from org.springframework.web.socket.WebSocketHandler for testing purposes
+
+package org.springframework.web.socket;
+
+import org.springframework.web.socket.CloseStatus;
+import org.springframework.web.socket.WebSocketMessage;
+import org.springframework.web.socket.WebSocketSession;
+
+public interface WebSocketHandler
+{
+    boolean supportsPartialMessages();
+    void afterConnectionClosed(WebSocketSession p0, CloseStatus p1);
+    void afterConnectionEstablished(WebSocketSession p0);
+    void handleMessage(WebSocketSession p0, WebSocketMessage<? extends Object> p1);
+    void handleTransportError(WebSocketSession p0, Throwable p1);
+}
--- a/java/ql/test/stubs/springframework-5.8.x/org/springframework/web/socket/WebSocketMessage.java
+++ b/java/ql/test/stubs/springframework-5.8.x/org/springframework/web/socket/WebSocketMessage.java
@@ -0,0 +1,11 @@
+// Generated automatically from org.springframework.web.socket.WebSocketMessage for testing purposes
+
+package org.springframework.web.socket;
+
+
+public interface WebSocketMessage<T>
+{
+    T getPayload();
+    boolean isLast();
+    int getPayloadLength();
+}
--- a/java/ql/test/stubs/springframework-5.8.x/org/springframework/web/socket/WebSocketSession.java
+++ b/java/ql/test/stubs/springframework-5.8.x/org/springframework/web/socket/WebSocketSession.java
@@ -0,0 +1,35 @@
+// Generated automatically from org.springframework.web.socket.WebSocketSession for testing purposes
+
+package org.springframework.web.socket;
+
+import java.io.Closeable;
+import java.net.InetSocketAddress;
+import java.net.URI;
+import java.security.Principal;
+import java.util.List;
+import java.util.Map;
+import org.springframework.http.HttpHeaders;
+import org.springframework.web.socket.CloseStatus;
+import org.springframework.web.socket.WebSocketExtension;
+import org.springframework.web.socket.WebSocketMessage;
+
+public interface WebSocketSession extends Closeable
+{
+    HttpHeaders getHandshakeHeaders();
+    InetSocketAddress getLocalAddress();
+    InetSocketAddress getRemoteAddress();
+    List<WebSocketExtension> getExtensions();
+    Map<String, Object> getAttributes();
+    Principal getPrincipal();
+    String getAcceptedProtocol();
+    String getId();
+    URI getUri();
+    boolean isOpen();
+    int getBinaryMessageSizeLimit();
+    int getTextMessageSizeLimit();
+    void close();
+    void close(CloseStatus p0);
+    void sendMessage(WebSocketMessage<? extends Object> p0);
+    void setBinaryMessageSizeLimit(int p0);
+    void setTextMessageSizeLimit(int p0);
+}
--- a/java/ql/test/stubs/springframework-5.8.x/org/springframework/web/socket/handler/AbstractWebSocketHandler.java
+++ b/java/ql/test/stubs/springframework-5.8.x/org/springframework/web/socket/handler/AbstractWebSocketHandler.java
@@ -0,0 +1,24 @@
+// Generated automatically from org.springframework.web.socket.handler.AbstractWebSocketHandler for testing purposes
+
+package org.springframework.web.socket.handler;
+
+import org.springframework.web.socket.BinaryMessage;
+import org.springframework.web.socket.CloseStatus;
+import org.springframework.web.socket.PongMessage;
+import org.springframework.web.socket.TextMessage;
+import org.springframework.web.socket.WebSocketHandler;
+import org.springframework.web.socket.WebSocketMessage;
+import org.springframework.web.socket.WebSocketSession;
+
+abstract public class AbstractWebSocketHandler implements WebSocketHandler
+{
+    protected void handleBinaryMessage(WebSocketSession p0, BinaryMessage p1){}
+    protected void handlePongMessage(WebSocketSession p0, PongMessage p1){}
+    protected void handleTextMessage(WebSocketSession p0, TextMessage p1){}
+    public AbstractWebSocketHandler(){}
+    public boolean supportsPartialMessages(){ return false; }
+    public void afterConnectionClosed(WebSocketSession p0, CloseStatus p1){}
+    public void afterConnectionEstablished(WebSocketSession p0){}
+    public void handleMessage(WebSocketSession p0, WebSocketMessage<? extends Object> p1){}
+    public void handleTransportError(WebSocketSession p0, Throwable p1){}
+}
--- a/java/ql/test/stubs/springframework-5.8.x/org/springframework/web/socket/handler/TextWebSocketHandler.java
+++ b/java/ql/test/stubs/springframework-5.8.x/org/springframework/web/socket/handler/TextWebSocketHandler.java
@@ -0,0 +1,13 @@
+// Generated automatically from org.springframework.web.socket.handler.TextWebSocketHandler for testing purposes
+
+package org.springframework.web.socket.handler;
+
+import org.springframework.web.socket.BinaryMessage;
+import org.springframework.web.socket.WebSocketSession;
+import org.springframework.web.socket.handler.AbstractWebSocketHandler;
+
+public class TextWebSocketHandler extends AbstractWebSocketHandler
+{
+    protected void handleBinaryMessage(WebSocketSession p0, BinaryMessage p1){}
+    public TextWebSocketHandler(){}
+}
				`@@ -0,0 +1 @@`
				`//semmle-extractor-options: --javac-args -cp ${testdir}/../../../stubs/apache-commons-fileupload-1.4`