Merge pull request #10096 from erik-krogh/acronyms-part1

make acronyms camelcase

java/ql/src/Likely Bugs/Serialization/NonSerializableField.ql

@@ -81,7 +81,7 @@ predicate exceptions(Class c, Field f) {
     // Stateless session beans are not normally serialized during their usual life-cycle
     // but are forced by their expected supertype to be serializable.
     // Arguably, warnings for their non-serializable fields can therefore be suppressed in practice.
-    c instanceof StatelessSessionEJB
+    c instanceof StatelessSessionEjb
     or
     // Enum types are serialized by name, so it doesn't matter if they have non-serializable fields.
     c instanceof EnumType

java/ql/src/Security/CWE/CWE-319/UseSSL.ql

@@ -33,10 +33,10 @@ where
     or
     c instanceof Socket and type = "socket"
   ) and
-  not c instanceof SSLClass and
+  not c instanceof SslClass and
   not exists(RefType t |
     exprTypeFlow(m.getQualifier(), t, _) and
-    t instanceof SSLClass
+    t instanceof SslClass
   ) and
   (
     m.getMethod().getName() = "getInputStream" or

java/ql/src/Security/CWE/CWE-319/UseSSLSocketFactories.ql

@@ -65,7 +65,7 @@ predicate query(MethodAccess m, Method def, int paramNo, string message, Element
     // an SSL factory, ...
     usesFactory(def, paramNo) and
     evidence = m.getArgument(paramNo) and
-    not evidence.(Expr).getType() instanceof SSLClass and
+    not evidence.(Expr).getType() instanceof SslClass and
     message = "has a non-SSL factory argument "
     or
     // ... or there is an overloaded method on the same type that does take a factory,

java/ql/src/Violations of Best Practice/Comments/CommentedCode.qll

@@ -107,8 +107,8 @@ class CommentedOutCode extends JavadocFirst {
   CommentedOutCode() {
     anyCount(this) > 0 and
     codeCount(this).(float) / anyCount(this).(float) > 0.5 and
-    not this instanceof JSNIComment and
-    not this instanceof OCNIComment
+    not this instanceof JsniComment and
+    not this instanceof OcniComment
   }
 
   /**

java/ql/src/experimental/Security/CWE/CWE-297/InsecureLdapEndpoint.ql

@@ -87,7 +87,7 @@ predicate isTestMethod(MethodAccess ma) {
 }
 
 /** Holds if `MethodAccess` ma disables SSL endpoint check. */
-predicate isInsecureSSLEndpoint(MethodAccess ma) {
+predicate isInsecureSslEndpoint(MethodAccess ma) {
   (
     ma.getMethod() instanceof SetSystemPropertyMethod and
     isPropertyDisableLdapEndpointId(ma.getArgument(0)) and
@@ -105,6 +105,6 @@ predicate isInsecureSSLEndpoint(MethodAccess ma) {
 
 from MethodAccess ma
 where
-  isInsecureSSLEndpoint(ma) and
+  isInsecureSslEndpoint(ma) and
   not isTestMethod(ma)
 select ma, "LDAPS configuration allows insecure endpoint identification"

java/ql/src/experimental/Security/CWE/CWE-327/SslLib.qll

@@ -27,7 +27,7 @@ class UnsafeTlsVersionConfig extends TaintTracking::Configuration {
 class SslContextGetInstanceSink extends DataFlow::ExprNode {
   SslContextGetInstanceSink() {
     exists(StaticMethodAccess ma, Method m | m = ma.getMethod() |
-      m.getDeclaringType() instanceof SSLContext and
+      m.getDeclaringType() instanceof SslContext and
       m.hasName("getInstance") and
       ma.getArgument(0) = asExpr()
     )
@@ -40,7 +40,7 @@ class SslContextGetInstanceSink extends DataFlow::ExprNode {
  */
 class CreateSslParametersSink extends DataFlow::ExprNode {
   CreateSslParametersSink() {
-    exists(ConstructorCall cc | cc.getConstructedType() instanceof SSLParameters |
+    exists(ConstructorCall cc | cc.getConstructedType() instanceof SslParameters |
       cc.getArgument(1) = asExpr()
     )
   }
@@ -53,7 +53,7 @@ class CreateSslParametersSink extends DataFlow::ExprNode {
 class SslParametersSetProtocolsSink extends DataFlow::ExprNode {
   SslParametersSetProtocolsSink() {
     exists(MethodAccess ma, Method m | m = ma.getMethod() |
-      m.getDeclaringType() instanceof SSLParameters and
+      m.getDeclaringType() instanceof SslParameters and
       m.hasName("setProtocols") and
       ma.getArgument(0) = asExpr()
     )
@@ -70,9 +70,9 @@ class SetEnabledProtocolsSink extends DataFlow::ExprNode {
       m = ma.getMethod() and type = m.getDeclaringType()
     |
       (
-        type instanceof SSLSocket or
-        type instanceof SSLServerSocket or
-        type instanceof SSLEngine
+        type instanceof SslSocket or
+        type instanceof SslServerSocket or
+        type instanceof SslEngine
       ) and
       m.hasName("setEnabledProtocols") and
       ma.getArgument(0) = asExpr()
@@ -94,6 +94,6 @@ class UnsafeTlsVersion extends StringLiteral {
   }
 }
 
-class SSLServerSocket extends RefType {
-  SSLServerSocket() { hasQualifiedName("javax.net.ssl", "SSLServerSocket") }
+class SslServerSocket extends RefType {
+  SslServerSocket() { hasQualifiedName("javax.net.ssl", "SSLServerSocket") }
 }

java/ql/src/experimental/Security/CWE/CWE-522/InsecureLdapAuth.ql

@@ -125,7 +125,7 @@ predicate isBasicAuthEnv(MethodAccess ma) {
 /**
  * Holds if `ma` sets `java.naming.security.protocol` (also known as `Context.SECURITY_PROTOCOL`) to `ssl` in some `Hashtable`.
  */
-predicate isSSLEnv(MethodAccess ma) {
+predicate isSslEnv(MethodAccess ma) {
   hasFieldValueEnv(ma, "java.naming.security.protocol", "ssl") or
   hasFieldNameEnv(ma, "SECURITY_PROTOCOL", "ssl")
 }
@@ -182,13 +182,13 @@ class BasicAuthFlowConfig extends DataFlow::Configuration {
 /**
  * A taint-tracking configuration for `ssl` configuration in LDAP authentication.
  */
-class SSLFlowConfig extends DataFlow::Configuration {
-  SSLFlowConfig() { this = "InsecureLdapAuth:SSLFlowConfig" }
+class SslFlowConfig extends DataFlow::Configuration {
+  SslFlowConfig() { this = "InsecureLdapAuth:SSLFlowConfig" }
 
   /** Source of `ssl` configuration. */
   override predicate isSource(DataFlow::Node src) {
     exists(MethodAccess ma |
-      isSSLEnv(ma) and ma.getQualifier() = src.(PostUpdateNode).getPreUpdateNode().asExpr()
+      isSslEnv(ma) and ma.getQualifier() = src.(PostUpdateNode).getPreUpdateNode().asExpr()
     )
   }
 
@@ -205,6 +205,6 @@ from DataFlow::PathNode source, DataFlow::PathNode sink, InsecureUrlFlowConfig c
 where
   config.hasFlowPath(source, sink) and
   exists(BasicAuthFlowConfig bc | bc.hasFlowTo(sink.getNode())) and
-  not exists(SSLFlowConfig sc | sc.hasFlowTo(sink.getNode()))
+  not exists(SslFlowConfig sc | sc.hasFlowTo(sink.getNode()))
 select sink.getNode(), source, sink, "Insecure LDAP authentication from $@.", source.getNode(),
   "LDAP connection string"

java/ql/src/experimental/Security/CWE/CWE-552/UnsafeUrlForward.ql

@@ -25,7 +25,7 @@ class UnsafeUrlForwardFlowConfig extends TaintTracking::Configuration {
     source instanceof RemoteFlowSource and
     not exists(MethodAccess ma, Method m | ma.getMethod() = m |
       (
-        m instanceof HttpServletRequestGetRequestURIMethod or
+        m instanceof HttpServletRequestGetRequestUriMethod or
         m instanceof HttpServletRequestGetRequestUrlMethod or
         m instanceof HttpServletRequestGetPathMethod
       ) and

java/ql/src/experimental/Security/CWE/CWE-611/XXELib.qll

@@ -73,7 +73,7 @@ class SafeValidator extends VarAccess {
   SafeValidator() {
     exists(Variable v | v = this.getVariable() |
       exists(ValidatorConfig config | config.getQualifier() = v.getAnAccess() |
-        config.disables(configAccessExternalDTD())
+        config.disables(configAccessExternalDtd())
       ) and
       exists(ValidatorConfig config | config.getQualifier() = v.getAnAccess() |
         config.disables(configAccessExternalSchema())