Java: Automodel application mode: include candidates that are useful for regression testing

java/ql/src/Telemetry/AutomodelApplicationModeExtractCandidates.ql

@@ -55,7 +55,7 @@ private Endpoint getSampleForSignature(
 from
   Endpoint endpoint, string message, ApplicationModeMetadataExtractor meta, DollarAtString package,
   DollarAtString type, DollarAtString subtypes, DollarAtString name, DollarAtString signature,
-  DollarAtString input, DollarAtString isVarargsArray
+  DollarAtString input, DollarAtString isVarargsArray, DollarAtString alreadyAiModeled
 where
   not exists(CharacteristicsImpl::UninterestingToModelCharacteristic u |
     u.appliesToEndpoint(endpoint)
@@ -67,20 +67,25 @@ where
   // label it as a sink for one of the sink types of query B, for which it's already a known sink. This would result in
   // overlap between our detected sinks and the pre-existing modeling. We assume that, if a sink has already been
   // modeled in a MaD model, then it doesn't belong to any additional sink types, and we don't need to reexamine it.
-  not CharacteristicsImpl::isSink(endpoint, _, _) and
+  (
+    not CharacteristicsImpl::isSink(endpoint, _, _) and alreadyAiModeled = "false"
+    or
+    CharacteristicsImpl::isSink(endpoint, _, any(string s | s.matches("%ai-%"))) and
+    alreadyAiModeled = "true"
+  ) and
   meta.hasMetadata(endpoint, package, type, subtypes, name, signature, input, isVarargsArray) and
   includeAutomodelCandidate(package, type, name, signature) and
   // The message is the concatenation of all sink types for which this endpoint is known neither to be a sink nor to be
   // a non-sink, and we surface only endpoints that have at least one such sink type.
   message =
     strictconcat(AutomodelEndpointTypes::SinkType sinkType |
-      not CharacteristicsImpl::isKnownSink(endpoint, sinkType) and
+      not CharacteristicsImpl::isKnownSink(endpoint, sinkType, _) and
       CharacteristicsImpl::isSinkCandidate(endpoint, sinkType)
     |
       sinkType, ", "
     )
 select endpoint.asNode(),
-  message + "\nrelated locations: $@." + "\nmetadata: $@, $@, $@, $@, $@, $@, $@.", //
+  message + "\nrelated locations: $@." + "\nmetadata: $@, $@, $@, $@, $@, $@, $@, $@.", //
   CharacteristicsImpl::getRelatedLocationOrCandidate(endpoint, CallContext()), "CallContext", //
   package, "package", //
   type, "type", //
@@ -88,4 +93,5 @@ select endpoint.asNode(),
   name, "name", // method name
   signature, "signature", //
   input, "input", //
-  isVarargsArray, "isVarargsArray"
+  isVarargsArray, "isVarargsArray", //
+  alreadyAiModeled, "alreadyAiModeled"

java/ql/src/Telemetry/AutomodelApplicationModeExtractPositiveExamples.ql

@@ -22,7 +22,7 @@ where
   not erroneousEndpoints(endpoint, _, _, _, _, false) and
   meta.hasMetadata(endpoint, package, type, subtypes, name, signature, input, isVarargsArray) and
   // Extract positive examples of sinks belonging to the existing ATM query configurations.
-  CharacteristicsImpl::isKnownSink(endpoint, sinkType) and
+  CharacteristicsImpl::isKnownSink(endpoint, sinkType, _) and
   exists(CharacteristicsImpl::getRelatedLocationOrCandidate(endpoint, CallContext()))
 select endpoint.asNode(),
   sinkType + "\nrelated locations: $@." + "\nmetadata: $@, $@, $@, $@, $@, $@, $@.", //

java/ql/src/Telemetry/AutomodelSharedCharacteristics.qll

@@ -94,14 +94,15 @@ module SharedCharacteristics<CandidateSig Candidate> {
   /**
    * Holds if `sink` is a known sink of type `endpointType`.
    */
-  predicate isKnownSink(Candidate::Endpoint sink, Candidate::EndpointType endpointType) {
+  predicate isKnownSink(
+    Candidate::Endpoint sink, Candidate::EndpointType endpointType,
+    EndpointCharacteristic characteristic
+  ) {
     // If the list of characteristics includes positive indicators with maximal confidence for this class, then it's a
     // known sink for the class.
     not endpointType instanceof Candidate::NegativeEndpointType and
-    exists(EndpointCharacteristic characteristic |
-      characteristic.appliesToEndpoint(sink) and
-      characteristic.hasImplications(endpointType, true, maximalConfidence())
-    )
+    characteristic.appliesToEndpoint(sink) and
+    characteristic.hasImplications(endpointType, true, maximalConfidence())
   }
 
   /**
@@ -275,15 +276,17 @@ module SharedCharacteristics<CandidateSig Candidate> {
     private class KnownSinkCharacteristic extends SinkCharacteristic {
       string madKind;
       Candidate::EndpointType endpointType;
+      string provenance;
 
       KnownSinkCharacteristic() {
         Candidate::isKnownKind(madKind, endpointType) and
         // bind "this" to a unique string differing from that of the SinkType classes
-        this = madKind + "-characteristic"
+        this = madKind + "_" + provenance + "_characteristic" and
+        Candidate::isSink(_, madKind, provenance)
       }
 
       override predicate appliesToEndpoint(Candidate::Endpoint e) {
-        Candidate::isSink(e, madKind, _)
+        Candidate::isSink(e, madKind, provenance)
       }
 
       override Candidate::EndpointType getSinkType() { result = endpointType }