Privacy markers and fixed imports

2026-04-30 19:26:02 +02:00 · 2023-04-28 07:51:07 -04:00
parent 3100e98513
commit 5f3c8fef3f
36 changed files with 72 additions and 59 deletions
--- a/java/ql/lib/semmle/code/java/security/ArithmeticTaintedLocalQuery.qll
+++ b/java/ql/lib/semmle/code/java/security/ArithmeticTaintedLocalQuery.qll
@@ -1,8 +1,8 @@
 /** Provides taint-tracking configurations to reason about arithmetic using local-user-controlled data. */

 import java
-import semmle.code.java.dataflow.FlowSources
-import semmle.code.java.security.ArithmeticCommon
+private import semmle.code.java.dataflow.FlowSources
+private import semmle.code.java.security.ArithmeticCommon

 /**
 * A taint-tracking configuration to reason about arithmetic overflow using local-user-controlled data.
--- a/java/ql/lib/semmle/code/java/security/ArithmeticUncontrolledQuery.qll
+++ b/java/ql/lib/semmle/code/java/security/ArithmeticUncontrolledQuery.qll
@@ -1,7 +1,7 @@
 /** Provides taint-tracking configuration to reason about arithmetic with uncontrolled values. */

 import java
-import semmle.code.java.dataflow.TaintTracking
+private import semmle.code.java.dataflow.TaintTracking
 private import semmle.code.java.security.RandomQuery
 private import semmle.code.java.security.SecurityTests
 private import semmle.code.java.security.ArithmeticCommon
--- a/java/ql/lib/semmle/code/java/security/ArithmeticWithExtremeValuesQuery.qll
+++ b/java/ql/lib/semmle/code/java/security/ArithmeticWithExtremeValuesQuery.qll
@@ -1,8 +1,8 @@
 /** Provides predicates and classes for reasoning about arithmetic with extreme values. */

 import java
-import semmle.code.java.dataflow.DataFlow
-import ArithmeticCommon
+private import semmle.code.java.dataflow.DataFlow
+private import semmle.code.java.security.ArithmeticCommon

 /**
 * A field representing an extreme value.
@@ -14,12 +14,12 @@ abstract class ExtremeValueField extends Field {
 }

 /** A field representing the minimum value of a primitive type. */
-class MinValueField extends ExtremeValueField {
+private class MinValueField extends ExtremeValueField {
  MinValueField() { this.getName() = "MIN_VALUE" }
 }

 /** A field representing the maximum value of a primitive type. */
-class MaxValueField extends ExtremeValueField {
+private class MaxValueField extends ExtremeValueField {
  MaxValueField() { this.getName() = "MAX_VALUE" }
 }

--- a/java/ql/lib/semmle/code/java/security/BrokenCryptoAlgorithmQuery.qll
+++ b/java/ql/lib/semmle/code/java/security/BrokenCryptoAlgorithmQuery.qll
@@ -1,8 +1,8 @@
 /** Provides to taint-tracking configuration to reason about the use of broken or risky cryptographic algorithms. */

 import java
-import semmle.code.java.security.Encryption
-import semmle.code.java.dataflow.TaintTracking
+private import semmle.code.java.security.Encryption
+private import semmle.code.java.dataflow.TaintTracking

 private class ShortStringLiteral extends StringLiteral {
  ShortStringLiteral() { this.getValue().length() < 100 }
--- a/java/ql/lib/semmle/code/java/security/ExecTaintedLocalQuery.qll
+++ b/java/ql/lib/semmle/code/java/security/ExecTaintedLocalQuery.qll
@@ -6,7 +6,7 @@ private import semmle.code.java.security.ExternalProcess
 private import semmle.code.java.security.CommandArguments

 /** A taint-tracking configuration to reason about use of externally controlled strings to make command line commands. */
-module LocalUserInputToArgumentToExecFlowConfig implements DataFlow::ConfigSig {
+module ExecTaintedLocalConfig implements DataFlow::ConfigSig {
  predicate isSource(DataFlow::Node src) { src instanceof LocalUserInput }

  predicate isSink(DataFlow::Node sink) { sink.asExpr() instanceof ArgumentToExec }
@@ -23,5 +23,4 @@ module LocalUserInputToArgumentToExecFlowConfig implements DataFlow::ConfigSig {
 /**
 * Taint-tracking flow for use of externally controlled strings to make command line commands.
 */
-module LocalUserInputToArgumentToExecFlow =
-  TaintTracking::Global<LocalUserInputToArgumentToExecFlowConfig>;
+module ExecTaintedLocalFlow = TaintTracking::Global<ExecTaintedLocalConfig>;
--- a/java/ql/lib/semmle/code/java/security/ExternallyControlledFormatStringLocalQuery.qll
+++ b/java/ql/lib/semmle/code/java/security/ExternallyControlledFormatStringLocalQuery.qll
@@ -1,8 +1,8 @@
 /** Provides a taint-tracking configuration to reason about externally-controlled format strings from local sources. */

 import java
-import semmle.code.java.dataflow.FlowSources
-import semmle.code.java.StringFormat
+private import semmle.code.java.dataflow.FlowSources
+private import semmle.code.java.StringFormat

 /** A taint-tracking configuration to reason about externally-controlled format strings from local sources. */
 module ExternallyControlledFormatStringLocalConfig implements DataFlow::ConfigSig {
--- a/java/ql/lib/semmle/code/java/security/ImproperValidationOfArrayConstructionCodeSpecifiedQuery.qll
+++ b/java/ql/lib/semmle/code/java/security/ImproperValidationOfArrayConstructionCodeSpecifiedQuery.qll
@@ -1,8 +1,8 @@
 /** Provides a dataflow configuration to reason about improper validation of code-specified size used for array construction. */

 import java
-import semmle.code.java.security.internal.ArraySizing
-import semmle.code.java.dataflow.TaintTracking
+private import semmle.code.java.security.internal.ArraySizing
+private import semmle.code.java.dataflow.TaintTracking

 /**
 * A dataflow configuration to reason about improper validation of code-specified size used for array construction.
--- a/java/ql/lib/semmle/code/java/security/ImproperValidationOfArrayConstructionLocalQuery.qll
+++ b/java/ql/lib/semmle/code/java/security/ImproperValidationOfArrayConstructionLocalQuery.qll
@@ -1,8 +1,8 @@
 /** Provides a taint-tracking configuration to reason about improper validation of local user-provided size used for array construction. */

 import java
-import semmle.code.java.security.internal.ArraySizing
-import semmle.code.java.dataflow.FlowSources
+private import semmle.code.java.security.internal.ArraySizing
+private import semmle.code.java.dataflow.FlowSources

 /**
 * A taint-tracking configuration to reason about improper validation of local user-provided size used for array construction.
--- a/java/ql/lib/semmle/code/java/security/ImproperValidationOfArrayConstructionQuery.qll
+++ b/java/ql/lib/semmle/code/java/security/ImproperValidationOfArrayConstructionQuery.qll
@@ -1,13 +1,13 @@
 /** Provides a taint-tracking configuration to reason about improper validation of user-provided size used for array construction. */

 import java
-import semmle.code.java.security.internal.ArraySizing
-import semmle.code.java.dataflow.FlowSources
+private import semmle.code.java.security.internal.ArraySizing
+private import semmle.code.java.dataflow.FlowSources

 /**
 * A taint-tracking configuration to reason about improper validation of user-provided size used for array construction.
 */
-private module ImproperValidationOfArrayConstructionConfig implements DataFlow::ConfigSig {
+module ImproperValidationOfArrayConstructionConfig implements DataFlow::ConfigSig {
  predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }

  predicate isSink(DataFlow::Node sink) {
--- a/java/ql/lib/semmle/code/java/security/ImproperValidationOfArrayIndexCodeSpecifiedQuery.qll
+++ b/java/ql/lib/semmle/code/java/security/ImproperValidationOfArrayIndexCodeSpecifiedQuery.qll
@@ -1,9 +1,9 @@
 /** Provides a dataflow configuration to reason about improper validation of code-specified array index. */

 import java
-import semmle.code.java.security.internal.ArraySizing
-import semmle.code.java.security.internal.BoundingChecks
-import semmle.code.java.dataflow.TaintTracking
+private import semmle.code.java.security.internal.ArraySizing
+private import semmle.code.java.security.internal.BoundingChecks
+private import semmle.code.java.dataflow.DataFlow

 /**
 * A dataflow configuration to reason about improper validation of code-specified array index.
--- a/java/ql/lib/semmle/code/java/security/ImproperValidationOfArrayIndexLocalQuery.qll
+++ b/java/ql/lib/semmle/code/java/security/ImproperValidationOfArrayIndexLocalQuery.qll
@@ -1,8 +1,8 @@
 /** Provides a taint-tracking configuration to reason about improper validation of local user-provided array index. */

 import java
-import semmle.code.java.security.internal.ArraySizing
-import semmle.code.java.dataflow.FlowSources
+private import semmle.code.java.security.internal.ArraySizing
+private import semmle.code.java.dataflow.FlowSources

 /**
 * A taint-tracking configuration to reason about improper validation of local user-provided array index.
--- a/java/ql/lib/semmle/code/java/security/ImproperValidationOfArrayIndexQuery.qll
+++ b/java/ql/lib/semmle/code/java/security/ImproperValidationOfArrayIndexQuery.qll
@@ -1,8 +1,8 @@
 /** Provides a taint-tracking configuration to reason about improper validation of user-provided array index. */

 import java
-import semmle.code.java.security.internal.ArraySizing
-import semmle.code.java.dataflow.FlowSources
+private import semmle.code.java.security.internal.ArraySizing
+private import semmle.code.java.dataflow.FlowSources

 /**
 * A taint-tracking configuration to reason about improper validation of user-provided array index.
--- a/java/ql/lib/semmle/code/java/security/InsecureCookieQuery.qll
+++ b/java/ql/lib/semmle/code/java/security/InsecureCookieQuery.qll
@@ -1,7 +1,7 @@
 /** Provides a dataflow configuration to reason about the failure to use secure cookies. */

 import java
-import semmle.code.java.dataflow.DataFlow
+private import semmle.code.java.dataflow.DataFlow
 private import semmle.code.java.frameworks.Servlets

 private predicate isSafeSecureCookieSetting(Expr e) {
--- a/java/ql/lib/semmle/code/java/security/NumericCastTaintedQuery.qll
+++ b/java/ql/lib/semmle/code/java/security/NumericCastTaintedQuery.qll
@@ -1,11 +1,11 @@
 /** Provides classes to reason about possible truncation from casting of a user-provided value. */

 import java
-import semmle.code.java.arithmetic.Overflow
-import semmle.code.java.dataflow.SSA
-import semmle.code.java.controlflow.Guards
-import semmle.code.java.dataflow.RangeAnalysis
-import semmle.code.java.dataflow.FlowSources
+private import semmle.code.java.arithmetic.Overflow
+private import semmle.code.java.dataflow.SSA
+private import semmle.code.java.controlflow.Guards
+private import semmle.code.java.dataflow.RangeAnalysis
+private import semmle.code.java.dataflow.FlowSources

 /**
 * A `CastExpr` that is a narrowing cast.
@@ -37,7 +37,7 @@ class RightShiftOp extends Expr {
  }

  /**
-   * Gets the expression that is shifted.
+   * Gets the variable that is shifted.
   */
  Variable getShiftedVariable() {
    this.getLhs() = result.getAnAccess() or
--- a/java/ql/lib/semmle/code/java/security/ResponseSplittingLocalQuery.qll
+++ b/java/ql/lib/semmle/code/java/security/ResponseSplittingLocalQuery.qll
@@ -1,8 +1,8 @@
 /** Provides a taint-tracking configuration to reason about response splitting vulnerabilities from local user input. */

 import java
-import semmle.code.java.dataflow.FlowSources
-import semmle.code.java.security.ResponseSplitting
+private import semmle.code.java.dataflow.FlowSources
+private import semmle.code.java.security.ResponseSplitting

 /**
 * A taint-tracking configuration to reason about response splitting vulnerabilities from local user input.
--- a/java/ql/lib/semmle/code/java/security/SqlConcatenatedQuery.qll
+++ b/java/ql/lib/semmle/code/java/security/SqlConcatenatedQuery.qll
@@ -1,7 +1,7 @@
 /** Provides classes and modules to reason about SqlInjection vulnerabilities from string concatentation. */

 import java
-import semmle.code.java.dataflow.TaintTracking
+private import semmle.code.java.dataflow.TaintTracking
 private import semmle.code.java.security.SqlConcatenatedLib
 private import semmle.code.java.security.SqlInjectionQuery

--- a/java/ql/lib/semmle/code/java/security/SqlTaintedLocalQuery.qll
+++ b/java/ql/lib/semmle/code/java/security/SqlTaintedLocalQuery.qll
@@ -3,9 +3,9 @@
 * that is used in a SQL query.
 */

-import semmle.code.java.Expr
-import semmle.code.java.dataflow.FlowSources
-import semmle.code.java.security.SqlInjectionQuery
+import java
+private import semmle.code.java.dataflow.FlowSources
+private import semmle.code.java.security.SqlInjectionQuery

 /**
 * A taint-tracking configuration for reasoning about local user input that is
--- a/java/ql/lib/semmle/code/java/security/StackTraceExposureQuery.qll
+++ b/java/ql/lib/semmle/code/java/security/StackTraceExposureQuery.qll
@@ -1,8 +1,8 @@
 /** Provides predicates to reason about exposure of stack-traces. */

 import java
-import semmle.code.java.dataflow.DataFlow
-import semmle.code.java.dataflow.TaintTracking
+private import semmle.code.java.dataflow.DataFlow
+private import semmle.code.java.dataflow.TaintTracking
 private import semmle.code.java.security.InformationLeak

 /**
--- a/java/ql/lib/semmle/code/java/security/TaintedPermissionsCheckQuery.qll
+++ b/java/ql/lib/semmle/code/java/security/TaintedPermissionsCheckQuery.qll
@@ -1,8 +1,8 @@
 /** Provides classes to reason about tainted permissions check vulnerabilities. */

 import java
-import semmle.code.java.dataflow.FlowSources
-import semmle.code.java.dataflow.TaintTracking
+private import semmle.code.java.dataflow.FlowSources
+private import semmle.code.java.dataflow.TaintTracking

 /**
 * The `org.apache.shiro.subject.Subject` class.
--- a/java/ql/lib/semmle/code/java/security/TempDirLocalInformationDisclosureQuery.qll
+++ b/java/ql/lib/semmle/code/java/security/TempDirLocalInformationDisclosureQuery.qll
@@ -1,7 +1,7 @@
 /** Provides classes to reason about local information disclosure in a temporary directory. */

 import java
-import semmle.code.java.dataflow.TaintTracking
+private import semmle.code.java.dataflow.TaintTracking
 private import semmle.code.java.os.OSCheck
 private import semmle.code.java.security.TempDirUtils

--- a/java/ql/lib/semmle/code/java/security/UrlRedirectLocalQuery.qll
+++ b/java/ql/lib/semmle/code/java/security/UrlRedirectLocalQuery.qll
@@ -1,8 +1,8 @@
 /** Provides a taint-tracking configuration to reason about URL redirection from local sources. */

 import java
-import semmle.code.java.dataflow.FlowSources
-import semmle.code.java.security.UrlRedirect
+private import semmle.code.java.dataflow.FlowSources
+private import semmle.code.java.security.UrlRedirect

 /**
 * A taint-tracking configuration to reason about URL redirection from local sources.
--- a/java/ql/lib/semmle/code/java/security/UrlRedirectQuery.qll
+++ b/java/ql/lib/semmle/code/java/security/UrlRedirectQuery.qll
@@ -1,8 +1,8 @@
 /** Provides a taint-tracking configuration for reasoning about URL redirections. */

 import java
-import semmle.code.java.dataflow.FlowSources
-import semmle.code.java.security.UrlRedirect
+private import semmle.code.java.dataflow.FlowSources
+private import semmle.code.java.security.UrlRedirect

 /**
 * A taint-tracking configuration for reasoning about URL redirections.
--- a/java/ql/lib/semmle/code/java/security/XPathInjectionQuery.qll
+++ b/java/ql/lib/semmle/code/java/security/XPathInjectionQuery.qll
@@ -1,8 +1,9 @@
 /** Provides taint-tracking flow to reason about XPath injection queries. */

-import semmle.code.java.dataflow.FlowSources
-import semmle.code.java.dataflow.TaintTracking
-import semmle.code.java.security.XPath
+import java
+private import semmle.code.java.dataflow.FlowSources
+private import semmle.code.java.dataflow.TaintTracking
+private import semmle.code.java.security.XPath

 /**
 * A taint-tracking configuration for reasoning about XPath injection vulnerabilities.
--- a/java/ql/lib/semmle/code/java/security/XssLocalQuery.qll
+++ b/java/ql/lib/semmle/code/java/security/XssLocalQuery.qll
@@ -1,9 +1,9 @@
 /** Provides a taint-tracking configuration to reason about cross-site scripting from a local source. */

 import java
-import semmle.code.java.dataflow.FlowSources
-import semmle.code.java.dataflow.TaintTracking
-import semmle.code.java.security.XSS
+private import semmle.code.java.dataflow.FlowSources
+private import semmle.code.java.dataflow.TaintTracking
+private import semmle.code.java.security.XSS

 /**
 * A taint-tracking configuration for reasoning about cross-site scripting vulnerabilities from a local source.
--- a/java/ql/lib/semmle/code/java/security/internal/ArraySizing.qll
+++ b/java/ql/lib/semmle/code/java/security/internal/ArraySizing.qll
@@ -1,9 +1,9 @@
 /** Provides predicates and classes to reason about the sizing and indexing of arrays. */

 import java
-import semmle.code.java.dataflow.DataFlow
-import semmle.code.java.dataflow.DefUse
-import semmle.code.java.security.RandomDataSource
+private import semmle.code.java.dataflow.DataFlow
+private import semmle.code.java.dataflow.DefUse
+private import semmle.code.java.security.RandomDataSource
 private import BoundingChecks

 /**
--- a/java/ql/src/Security/CWE/CWE-129/ImproperValidationOfArrayConstruction.ql
+++ b/java/ql/src/Security/CWE/CWE-129/ImproperValidationOfArrayConstruction.ql
@@ -11,6 +11,7 @@
 */

 import java
+import semmle.code.java.security.internal.ArraySizing
 import semmle.code.java.security.ImproperValidationOfArrayConstructionQuery
 import ImproperValidationOfArrayConstructionFlow::PathGraph

--- a/java/ql/src/Security/CWE/CWE-129/ImproperValidationOfArrayConstructionCodeSpecified.ql
+++ b/java/ql/src/Security/CWE/CWE-129/ImproperValidationOfArrayConstructionCodeSpecified.ql
@@ -12,6 +12,7 @@
 */

 import java
+import semmle.code.java.security.internal.ArraySizing
 import semmle.code.java.security.ImproperValidationOfArrayConstructionCodeSpecifiedQuery
 import BoundedFlowSourceFlow::PathGraph

--- a/java/ql/src/Security/CWE/CWE-129/ImproperValidationOfArrayConstructionLocal.ql
+++ b/java/ql/src/Security/CWE/CWE-129/ImproperValidationOfArrayConstructionLocal.ql
@@ -12,6 +12,7 @@
 */

 import java
+import semmle.code.java.security.internal.ArraySizing
 import semmle.code.java.security.ImproperValidationOfArrayConstructionLocalQuery
 import ImproperValidationOfArrayConstructionLocalFlow::PathGraph

--- a/java/ql/src/Security/CWE/CWE-129/ImproperValidationOfArrayIndex.ql
+++ b/java/ql/src/Security/CWE/CWE-129/ImproperValidationOfArrayIndex.ql
@@ -11,6 +11,7 @@
 */

 import java
+import semmle.code.java.security.internal.ArraySizing
 import semmle.code.java.security.ImproperValidationOfArrayIndexQuery
 import ImproperValidationOfArrayIndexFlow::PathGraph

--- a/java/ql/src/Security/CWE/CWE-129/ImproperValidationOfArrayIndexCodeSpecified.ql
+++ b/java/ql/src/Security/CWE/CWE-129/ImproperValidationOfArrayIndexCodeSpecified.ql
@@ -12,6 +12,8 @@
 */

 import java
+import semmle.code.java.security.internal.ArraySizing
+import semmle.code.java.security.internal.BoundingChecks
 import semmle.code.java.security.ImproperValidationOfArrayIndexCodeSpecifiedQuery
 import BoundedFlowSourceFlow::PathGraph

--- a/java/ql/src/Security/CWE/CWE-129/ImproperValidationOfArrayIndexLocal.ql
+++ b/java/ql/src/Security/CWE/CWE-129/ImproperValidationOfArrayIndexLocal.ql
@@ -12,6 +12,7 @@
 */

 import java
+import semmle.code.java.security.internal.ArraySizing
 import semmle.code.java.security.ImproperValidationOfArrayIndexLocalQuery
 import ImproperValidationOfArrayIndexLocalFlow::PathGraph

--- a/java/ql/src/Security/CWE/CWE-134/ExternallyControlledFormatStringLocal.ql
+++ b/java/ql/src/Security/CWE/CWE-134/ExternallyControlledFormatStringLocal.ql
@@ -11,6 +11,7 @@
 */

 import java
+import semmle.code.java.StringFormat
 import semmle.code.java.security.ExternallyControlledFormatStringLocalQuery
 import ExternallyControlledFormatStringLocalFlow::PathGraph

--- a/java/ql/src/Security/CWE/CWE-190/ArithmeticTaintedLocal.ql
+++ b/java/ql/src/Security/CWE/CWE-190/ArithmeticTaintedLocal.ql
@@ -13,6 +13,8 @@
 */

 import java
+import semmle.code.java.dataflow.DataFlow
+import semmle.code.java.security.ArithmeticCommon
 import semmle.code.java.security.ArithmeticTaintedLocalQuery

 module Flow =
--- a/java/ql/src/Security/CWE/CWE-209/StackTraceExposure.ql
+++ b/java/ql/src/Security/CWE/CWE-209/StackTraceExposure.ql
@@ -14,6 +14,7 @@
 */

 import java
+import semmle.code.java.dataflow.DataFlow
 import semmle.code.java.security.StackTraceExposureQuery

 from Expr externalExpr, Expr errorInformation
--- a/java/ql/src/Security/CWE/CWE-327/BrokenCryptoAlgorithm.ql
+++ b/java/ql/src/Security/CWE/CWE-327/BrokenCryptoAlgorithm.ql
@@ -12,6 +12,7 @@
 */

 import java
+import semmle.code.java.security.Encryption
 import semmle.code.java.security.BrokenCryptoAlgorithmQuery
 import InsecureCryptoFlow::PathGraph

--- a/java/ql/test/query-tests/security/CWE-643/XPathInjectionTest.ql
+++ b/java/ql/test/query-tests/security/CWE-643/XPathInjectionTest.ql
@@ -1,4 +1,5 @@
 import java
+import semmle.code.java.dataflow.DataFlow
 import semmle.code.java.security.XPathInjectionQuery
 import TestUtilities.InlineExpectationsTest