docs: rename ql-training-rst > ql-training

docs/language/ql-training/query-examples/java/data-flow-java-1.ql

@@ -0,0 +1,11 @@
+import java
+
+class StringConcat extends AddExpr {
+  StringConcat() { getType() instanceof TypeString }
+}
+
+from MethodAccess ma
+where
+  ma.getMethod().getName().matches("sparql%Query") and
+  ma.getArgument(0) instanceof StringConcat
+select ma, "SPARQL query vulnerable to injection."

docs/language/ql-training/query-examples/java/data-flow-java-2.ql

@@ -0,0 +1,8 @@
+import java
+import semmle.code.java.dataflow.DataFlow::DataFlow
+
+from MethodAccess ma, StringConcat stringConcat
+where
+  ma.getMethod().getName().matches("sparql%Query") and
+  localFlow(exprNode(stringConcat), exprNode(ma.getArgument(0)))
+select ma, "SPARQL query vulnerable to injection."

docs/language/ql-training/query-examples/java/empty-if-java-class.ql

@@ -0,0 +1,12 @@
+import java
+
+class EmptyBlock extends Block {
+  EmptyBlock() {
+    this.getNumStmt() = 0
+  
+}
+
+from IfStmt ifstmt
+where ifstmt.getThen() instanceof
+      EmptyBlock
+select ifstmt

docs/language/ql-training/query-examples/java/empty-if-java-model.ql

@@ -0,0 +1,11 @@
+import java
+
+class EmptyBlock extends Block {
+  EmptyBlock() { this.getNumStmt() = 0 }
+}
+
+from IfStmt ifstmt
+where
+  ifstmt.getThen() instanceof EmptyBlock and
+  not exists(ifstmt.getElse())
+select ifstmt, "This if-statement is redundant."

docs/language/ql-training/query-examples/java/empty-if-java-predicate.ql

@@ -0,0 +1,9 @@
+import java
+
+predicate isEmpty(Block block) {
+  block.getNumStmt() = 0
+}
+
+from IfStmt ifstmt
+where isEmpty(ifstmt.getThen())
+select ifstmt

docs/language/ql-training/query-examples/java/empty-if-java.ql

@@ -0,0 +1,7 @@
+import java
+
+from IfStmt ifstmt, Block block
+where
+  block = ifstmt.getThen() and
+  block.getNumStmt() = 0
+select ifstmt, "This if-statement is redundant."

docs/language/ql-training/query-examples/java/global-data-flow-java-1.ql

@@ -0,0 +1,14 @@
+import java
+import semmle.code.java.dataflow.TaintTracking
+
+class TaintedOGNLConfig extends TaintTracking::Configuration {
+  TaintedOGNLConfig() { this = "TaintedOGNLConfig" }
+  override predicate isSource(DataFlow::Node source) { /* TBD */ }
+  override predicate isSink(DataFlow::Node sink) { /* TBD */ }
+}
+
+from TaintedOGNLConfig cfg, DataFlow::Node source, DataFlow::Node sink
+where cfg.hasFlow(source, sink)
+select source,
+       "This untrusted input is evaluated as an OGNL expression $@.",
+       sink, "here"

docs/language/ql-training/query-examples/java/query-injection-java-1.ql

@@ -0,0 +1,7 @@
+import java
+
+from Method m, MethodAccess ma
+where
+  m.getName().matches("sparql%Query") and
+  ma.getMethod() = m
+select ma, m

docs/language/ql-training/query-examples/java/query-injection-java-2.ql

@@ -0,0 +1,8 @@
+import java
+
+from Method m, MethodAccess ma
+where
+  m.getName().matches("sparql%Query") and
+  ma.getMethod() = m and
+  isStringConcat(ma.getArgument(0))
+select ma, m

docs/language/ql-training/query-examples/java/query-injection-java-3.ql

@@ -0,0 +1,12 @@
+import java
+
+predicate isStringConcat(AddExpr ae) {
+  ae.getType() instanceof TypeString
+}
+
+from Method m, MethodAccess ma
+where
+  m.getName().matches("sparql%Query") and
+  ma.getMethod() = m and
+  isStringConcat(ma.getArgument(0))
+select ma, "SPARQL query vulnerable to injection."