From 539859497b47f468dfb94fdfec74a2cdc23debf6 Mon Sep 17 00:00:00 2001
From: Chris Smowton <smowton@github.com>
Date: Mon, 12 Jul 2021 17:39:51 +0100
Subject: [PATCH] Add models of JsonMergePatch, JsonPatchBuilder and
 JsonPointer

---
 .../semmle/code/java/frameworks/JavaxJson.qll | 25 +++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/java/ql/src/semmle/code/java/frameworks/JavaxJson.qll b/java/ql/src/semmle/code/java/frameworks/JavaxJson.qll
index d5ddf9f6f6c..cc1b9ccf9f7 100644
--- a/java/ql/src/semmle/code/java/frameworks/JavaxJson.qll
+++ b/java/ql/src/semmle/code/java/frameworks/JavaxJson.qll
@@ -19,7 +19,10 @@ private class FlowSummaries extends SummaryModelCsv {
           "Json;false;createObjectBuilder;(Map);;MapKey of Argument[0];ReturnValue;taint",
           "Json;false;createObjectBuilder;(Map);;MapValue of Argument[0];ReturnValue;taint",
           "Json;false;createPatch;;;Argument[0];ReturnValue;taint",
+          "Json;false;createPatchBuilder;;;Argument[0];ReturnValue;taint",
+          "Json;false;createPointer;;;Argument[0];ReturnValue;taint",
           "Json;false;createReader;;;Argument[0];ReturnValue;taint",
+          "Json;false;createValue;;;Argument[0];ReturnValue;taint",
           "Json;false;createWriter;;;Argument[0];ReturnValue;taint",
           "JsonArray;false;getBoolean;;;Argument[-1];ReturnValue;taint",
           "JsonArray;false;getBoolean;;;Argument[1];ReturnValue;value",
@@ -61,6 +64,9 @@ private class FlowSummaries extends SummaryModelCsv {
           "JsonArrayBuilder;false;set;;;Argument[1];Argument[-1];taint",
           "JsonArrayBuilder;false;set;;;Argument[-1];ReturnValue;value",
           "JsonArrayBuilder;false;setNull;;;Argument[-1];ReturnValue;value",
+          "JsonMergePatch;false;apply;;;Argument[-1];ReturnValue;taint",
+          "JsonMergePatch;false;apply;;;Argument[0];ReturnValue;taint",
+          "JsonMergePatch;false;toJsonValue;;;Argument[-1];ReturnValue;taint",
           "JsonNumber;false;bigDecimalValue;;;Argument[-1];ReturnValue;taint",
           "JsonNumber;false;bigIntegerValue;;;Argument[-1];ReturnValue;taint",
           "JsonNumber;false;bigIntegerValueExact;;;Argument[-1];ReturnValue;taint",
@@ -91,6 +97,25 @@ private class FlowSummaries extends SummaryModelCsv {
           "JsonPatch;false;apply;;;Argument[-1];ReturnValue;taint",
           "JsonPatch;false;apply;;;Argument[0];ReturnValue;taint",
           "JsonPatch;false;toJsonArray;;;Argument[-1];ReturnValue;taint",
+          "JsonPatchBuilder;false;add;;;Argument[0..1];ReturnValue;taint",
+          "JsonPatchBuilder;false;add;;;Argument[-1];ReturnValue;value",
+          "JsonPatchBuilder;false;build;;;Argument[-1];ReturnValue;taint",
+          "JsonPatchBuilder;false;copy;;;Argument[0..1];ReturnValue;taint",
+          "JsonPatchBuilder;false;copy;;;Argument[-1];ReturnValue;value",
+          "JsonPatchBuilder;false;move;;;Argument[0..1];ReturnValue;taint",
+          "JsonPatchBuilder;false;move;;;Argument[-1];ReturnValue;value",
+          "JsonPatchBuilder;false;remove;;;Argument[0];ReturnValue;taint",
+          "JsonPatchBuilder;false;remove;;;Argument[-1];ReturnValue;value",
+          "JsonPatchBuilder;false;replace;;;Argument[0..1];ReturnValue;taint",
+          "JsonPatchBuilder;false;replace;;;Argument[-1];ReturnValue;value",
+          "JsonPatchBuilder;false;test;;;Argument[0..1];ReturnValue;taint",
+          "JsonPatchBuilder;false;test;;;Argument[-1];ReturnValue;value",
+          "JsonPointer;false;add;;;Argument[-1];ReturnValue;taint",
+          "JsonPointer;false;add;;;Argument[0..1];ReturnValue;taint",
+          "JsonPointer;false;getValue;;;Argument[0];ReturnValue;taint",
+          "JsonPointer;false;remove;;;Argument[0];ReturnValue;taint",
+          "JsonPointer;false;replace;;;Argument[0..1];ReturnValue;taint",
+          "JsonPointer;false;toString;;;Argument[-1];ReturnValue;taint",
           "JsonReader;false;read;;;Argument[-1];ReturnValue;taint",
           "JsonReader;false;readArray;;;Argument[-1];ReturnValue;taint",
           "JsonReader;false;readObject;;;Argument[-1];ReturnValue;taint",