Merge pull request #2205 from rneatherway/java/hamcrest-nullness

Java: Respect Hamcrest assertThat(X, notNullValue())

java/ql/src/semmle/code/java/dataflow/Nullness.qll

@@ -143,11 +143,21 @@ private ControlFlowNode varDereference(SsaVariable v, VarAccess va) {
  * subsequent use, either by dereferencing it or by an assertion.
  */
 private ControlFlowNode ensureNotNull(SsaVariable v) {
-  result = varDereference(v, _) or
-  result.(AssertStmt).getExpr() = nullGuard(v, true, false) or
-  exists(AssertTrueMethod m | result = m.getACheck(nullGuard(v, true, false))) or
-  exists(AssertFalseMethod m | result = m.getACheck(nullGuard(v, false, false))) or
+  result = varDereference(v, _)
+  or
+  result.(AssertStmt).getExpr() = nullGuard(v, true, false)
+  or
+  exists(AssertTrueMethod m | result = m.getACheck(nullGuard(v, true, false)))
+  or
+  exists(AssertFalseMethod m | result = m.getACheck(nullGuard(v, false, false)))
+  or
   exists(AssertNotNullMethod m | result = m.getACheck(v.getAUse()))
+  or
+  exists(AssertThatMethod m, MethodAccess ma |
+    result = m.getACheck(v.getAUse()) and ma.getControlFlowNode() = result
+  |
+    ma.getAnArgument().(MethodAccess).getMethod().getName() = "notNullValue"
+  )
 }
 
 /**

java/ql/src/semmle/code/java/frameworks/Assertions.qll

@@ -11,7 +11,8 @@ newtype AssertKind =
   AssertKindTrue() or
   AssertKindFalse() or
   AssertKindNotNull() or
-  AssertKindFail()
+  AssertKindFail() or
+  AssertKindThat()
 
 private predicate assertionMethod(Method m, AssertKind kind) {
   exists(RefType junit |
@@ -27,6 +28,13 @@ private predicate assertionMethod(Method m, AssertKind kind) {
     m.hasName("fail") and kind = AssertKindFail()
   )
   or
+  exists(RefType hamcrest |
+    m.getDeclaringType() = hamcrest and
+    hamcrest.hasQualifiedName("org.hamcrest", "MatcherAssert")
+  |
+    m.hasName("assertThat") and kind = AssertKindThat()
+  )
+  or
   exists(RefType objects |
     m.getDeclaringType() = objects and
     objects.hasQualifiedName("java.util", "Objects")
@@ -82,6 +90,14 @@ class AssertFailMethod extends AssertionMethod {
   AssertFailMethod() { assertionMethod(this, AssertKindFail()) }
 }
 
+/**
+ * A method that asserts that its first argument has a property
+ * given by its second argument.
+ */
+class AssertThatMethod extends AssertionMethod {
+  AssertThatMethod() { assertionMethod(this, AssertKindThat()) }
+}
+
 /** A trivially failing assertion. That is, `assert false` or its equivalents. */
 predicate assertFail(BasicBlock bb, ControlFlowNode n) {
   bb = n.getBasicBlock() and