From 6d10b1582fbb3c6107c7cb0947c2963748ef97ea Mon Sep 17 00:00:00 2001 From: MarkLee131 Date: Tue, 21 Apr 2026 19:45:13 +0800 Subject: [PATCH] Java: update regression-test expectations for path-injection[read] The sink-model generator and the experimental java/file-path-injection query now observe the new path-injection[read] sub-kind for the FileInputStream and Files.copy source-argument models. - CWE-073 FilePathInjection.expected: refresh the models table for the renamed kind on FileInputStream(File); alerts unchanged. - modelgenerator Sinks.java: update the inline sink annotation for copyFileToDirectory(Path,Path,CopyOption[]) Argument[0] to the new path-injection[read] sub-kind, mirroring the library change. --- .../query-tests/security/CWE-073/FilePathInjection.expected | 2 +- java/ql/test/utils/modelgenerator/dataflow/p/Sinks.java | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/java/ql/test/experimental/query-tests/security/CWE-073/FilePathInjection.expected b/java/ql/test/experimental/query-tests/security/CWE-073/FilePathInjection.expected index 9ddb2082948..5752ac764df 100644 --- a/java/ql/test/experimental/query-tests/security/CWE-073/FilePathInjection.expected +++ b/java/ql/test/experimental/query-tests/security/CWE-073/FilePathInjection.expected @@ -10,7 +10,7 @@ edges | FilePathInjection.java:217:19:217:22 | file : File | FilePathInjection.java:177:50:177:58 | file : File | provenance | | models | 1 | Sink: java.io; File; true; exists; (); ; Argument[this]; path-injection; manual | -| 2 | Sink: java.io; FileInputStream; true; FileInputStream; (File); ; Argument[0]; path-injection; ai-manual | +| 2 | Sink: java.io; FileInputStream; true; FileInputStream; (File); ; Argument[0]; path-injection[read]; ai-manual | | 3 | Sink: java.io; FileOutputStream; false; FileOutputStream; ; ; Argument[0]; path-injection; manual | | 4 | Source: com.jfinal.core; Controller; true; getPara; ; ; ReturnValue; remote; manual | | 5 | Source: javax.servlet; ServletRequest; false; getParameter; (String); ; ReturnValue; remote; manual | diff --git a/java/ql/test/utils/modelgenerator/dataflow/p/Sinks.java b/java/ql/test/utils/modelgenerator/dataflow/p/Sinks.java index d9a0d9324f3..13c84954ca0 100644 --- a/java/ql/test/utils/modelgenerator/dataflow/p/Sinks.java +++ b/java/ql/test/utils/modelgenerator/dataflow/p/Sinks.java @@ -33,7 +33,7 @@ public class Sinks { return null; } - // sink=p;Sinks;true;copyFileToDirectory;(Path,Path,CopyOption[]);;Argument[0];path-injection;df-generated + // sink=p;Sinks;true;copyFileToDirectory;(Path,Path,CopyOption[]);;Argument[0];path-injection[read];df-generated // sink=p;Sinks;true;copyFileToDirectory;(Path,Path,CopyOption[]);;Argument[1];path-injection;df-generated // neutral=p;Sinks;copyFileToDirectory;(Path,Path,CopyOption[]);summary;df-generated public Path copyFileToDirectory(