hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-24 04:36:35 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #11691 from michaelnebel/renameextensibles

Browse Source 
C#/Java: Rename externalflow extensible predicates
This commit is contained in:
Michael Nebel
2022-12-15 11:05:22 +01:00
committed by GitHub
parent 33955ee4ab 12c1ebd81c
commit a67e02df21
287 changed files with 508 additions and 483 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
java/ql/integration-tests/all-platforms/kotlin/annotation-id-consistency/ext/test.model.yml
View File

@@ -1,5 +1,5 @@
extensions:
- addsTo:
pack: integrationtest-annotation-id-consistency
extensible: extNegativeSummaryModel
extensible: neutralModel
data: []

6
java/ql/integration-tests/all-platforms/kotlin/default-parameter-mad-flow/ext/test.model.yml
View File

@@ -1,7 +1,7 @@
extensions:
- addsTo:
pack: integrationtest-default-parameter-mad-flow
extensible: extSummaryModel
extensible: summaryModel
data:
- ["", "ConstructorWithDefaults", True, "ConstructorWithDefaults", "(int,int)", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
- ["", "LibKt", True, "topLevelWithDefaults", "(int,int)", "", "Argument[0]", "ReturnValue", "value", "manual"]
@@ -12,14 +12,14 @@ extensions:
- ["", "LibClass", True, "multiParameterExtensionTest", "(int,int,int,int)", "", "Argument[0, 1]", "ReturnValue", "value", "manual"]
- addsTo:
pack: integrationtest-default-parameter-mad-flow
extensible: extSourceModel
extensible: sourceModel
data:
- ["", "LibKt", True, "topLevelArgSource", "(SomeToken,int)", "", "Argument[0]", "kotlinMadFlowTest", "manual"]
- ["", "LibKt", True, "extensionArgSource", "(String,SomeToken,int)", "", "Argument[1]", "kotlinMadFlowTest", "manual"]
- ["", "SourceClass", True, "memberArgSource", "(SomeToken,int)", "", "Argument[0]", "kotlinMadFlowTest", "manual"]
- addsTo:
pack: integrationtest-default-parameter-mad-flow
extensible: extSinkModel
extensible: sinkModel
data:
- ["", "SinkClass", True, "SinkClass", "(int,int)", "", "Argument[0]", "kotlinMadFlowTest", "manual"]
- ["", "LibKt", True, "topLevelSink", "(int,int)", "", "Argument[0]", "kotlinMadFlowTest", "manual"]

4
java/ql/lib/ext/android.app.model.yml
View File

@@ -1,7 +1,7 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSinkModel
extensible: sinkModel
data:
- ["android.app", "Activity", True, "bindService", "", "", "Argument[0]", "intent-start", "manual"]
- ["android.app", "Activity", True, "bindServiceAsUser", "", "", "Argument[0]", "intent-start", "manual"]
@@ -40,7 +40,7 @@ extensions:
- ["android.app", "PendingIntent", False, "send", "(Context,int,Intent,OnFinished,Handler,String,Bundle)", "", "Argument[2]", "pending-intent-sent", "manual"]
- addsTo:
pack: codeql/java-all
extensible: extSummaryModel
extensible: summaryModel
data:
- ["android.app", "Notification$Action", True, "Action", "(int,CharSequence,PendingIntent)", "", "Argument[2]", "Argument[-1]", "taint", "manual"]
- ["android.app", "Notification$Action", True, "getExtras", "", "", "Argument[-1].SyntheticField[android.content.Intent.extras]", "ReturnValue", "value", "manual"]

6
java/ql/lib/ext/android.content.model.yml
View File

@@ -1,7 +1,7 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSourceModel
extensible: sourceModel
data:
# ContentInterface models are here for backwards compatibility (it was removed in API 28)
- ["android.content", "ContentInterface", True, "call", "(String,String,String,Bundle)", "", "Parameter[0..3]", "contentprovider", "manual"]
@@ -37,7 +37,7 @@ extensions:
- ["android.content", "Context", True, "getExternalFilesDirs", "(String)", "", "ReturnValue", "android-external-storage-dir", "manual"]
- addsTo:
pack: codeql/java-all
extensible: extSinkModel
extensible: sinkModel
data:
- ["android.content", "ContentProvider", True, "delete", "(Uri,String,String[])", "", "Argument[1]", "sql", "manual"]
- ["android.content", "ContentProvider", True, "query", "(Uri,String[],String,String[],String)", "", "Argument[2]", "sql", "manual"]
@@ -65,7 +65,7 @@ extensions:
- ["android.content", "Context", True, "startServiceAsUser", "", "", "Argument[0]", "intent-start", "manual"]
- addsTo:
pack: codeql/java-all
extensible: extSummaryModel
extensible: summaryModel
data:
- ["android.content", "ComponentName", False, "ComponentName", "(Context,Class)", "", "Argument[1]", "Argument[-1]", "taint", "manual"]
- ["android.content", "ComponentName", False, "ComponentName", "(Context,String)", "", "Argument[1]", "Argument[-1]", "taint", "manual"]

4
java/ql/lib/ext/android.database.model.yml
View File

@@ -1,7 +1,7 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSinkModel
extensible: sinkModel
data:
- ["android.database", "DatabaseUtils", False, "blobFileDescriptorForQuery", "(SQLiteDatabase,String,String[])", "", "Argument[1]", "sql", "manual"]
- ["android.database", "DatabaseUtils", False, "createDbFromSqlStatements", "(Context,String,int,String)", "", "Argument[3]", "sql", "manual"]
@@ -12,7 +12,7 @@ extensions:
- ["android.database", "DatabaseUtils", False, "stringForQuery", "(SQLiteDatabase,String,String[])", "", "Argument[1]", "sql", "manual"]
- addsTo:
pack: codeql/java-all
extensible: extSummaryModel
extensible: summaryModel
data:
- ["android.database", "Cursor", True, "copyStringToBuffer", "", "", "Argument[-1]", "Argument[1]", "taint", "manual"]
- ["android.database", "Cursor", True, "getBlob", "", "", "Argument[-1]", "ReturnValue", "taint", "manual"]

4
java/ql/lib/ext/android.database.sqlite.model.yml
View File

@@ -1,7 +1,7 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSinkModel
extensible: sinkModel
data:
- ["android.database.sqlite", "SQLiteDatabase", False, "compileStatement", "(String)", "", "Argument[0]", "sql", "manual"]
- ["android.database.sqlite", "SQLiteDatabase", False, "delete", "(String,String,String[])", "", "Argument[0..1]", "sql", "manual"]
@@ -57,7 +57,7 @@ extensions:
- ["android.database.sqlite", "SQLiteQueryBuilder", True, "update", "(SQLiteDatabase,ContentValues,String,String[])", "", "Argument[2]", "sql", "manual"]
- addsTo:
pack: codeql/java-all
extensible: extSummaryModel
extensible: summaryModel
data:
- ["android.database.sqlite", "SQLiteQueryBuilder", True, "appendColumns", "(StringBuilder,String[])", "", "Argument[1].ArrayElement", "Argument[0]", "taint", "manual"]
- ["android.database.sqlite", "SQLiteQueryBuilder", True, "appendWhere", "(CharSequence)", "", "Argument[0]", "Argument[-1]", "taint", "manual"]

2
java/ql/lib/ext/android.net.model.yml
View File

@@ -1,7 +1,7 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSummaryModel
extensible: summaryModel
data:
- ["android.net", "Uri", True, "buildUpon", "", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
- ["android.net", "Uri", False, "decode", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]

4
java/ql/lib/ext/android.os.model.yml
View File

@@ -1,13 +1,13 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSourceModel
extensible: sourceModel
data:
- ["android.os", "Environment", False, "getExternalStorageDirectory", "()", "", "ReturnValue", "android-external-storage-dir", "manual"]
- ["android.os", "Environment", False, "getExternalStoragePublicDirectory", "(String)", "", "ReturnValue", "android-external-storage-dir", "manual"]
- addsTo:
pack: codeql/java-all
extensible: extSummaryModel
extensible: summaryModel
data:
- ["android.os", "BaseBundle", True, "get", "(String)", "", "Argument[-1].MapValue", "ReturnValue", "value", "manual"]
- ["android.os", "BaseBundle", True, "getString", "(String)", "", "Argument[-1].MapValue", "ReturnValue", "value", "manual"]

2
java/ql/lib/ext/android.support.v4.app.model.yml
View File

@@ -1,7 +1,7 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSinkModel
extensible: sinkModel
data:
- ["android.support.v4.app", "FragmentTransaction", True, "add", "(Class,Bundle,String)", "", "Argument[0]", "fragment-injection", "manual"]
- ["android.support.v4.app", "FragmentTransaction", True, "add", "(Fragment,String)", "", "Argument[0]", "fragment-injection", "manual"]

4
java/ql/lib/ext/android.util.model.yml
View File

@@ -1,7 +1,7 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSourceModel
extensible: sourceModel
data:
- ["android.util", "AttributeSet", False, "getAttributeBooleanValue", "", "", "ReturnValue", "remote", "manual"]
- ["android.util", "AttributeSet", False, "getAttributeCount", "", "", "ReturnValue", "remote", "manual"]
@@ -21,7 +21,7 @@ extensions:
- ["android.util", "AttributeSet", False, "getStyleAttribute", "", "", "ReturnValue", "remote", "manual"]
- addsTo:
pack: codeql/java-all
extensible: extSinkModel
extensible: sinkModel
data:
- ["android.util", "Log", True, "d", "", "", "Argument[1]", "logging", "manual"]
- ["android.util", "Log", True, "e", "", "", "Argument[1]", "logging", "manual"]

4
java/ql/lib/ext/android.webkit.model.yml
View File

@@ -1,13 +1,13 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSourceModel
extensible: sourceModel
data:
- ["android.webkit", "WebView", False, "getOriginalUrl", "()", "", "ReturnValue", "remote", "manual"]
- ["android.webkit", "WebView", False, "getUrl", "()", "", "ReturnValue", "remote", "manual"]
- addsTo:
pack: codeql/java-all
extensible: extSinkModel
extensible: sinkModel
data:
# Models representing methods susceptible to XSS attacks.
- ["android.webkit", "WebView", False, "evaluateJavascript", "", "", "Argument[0]", "xss", "manual"]

4
java/ql/lib/ext/android.widget.model.yml
View File

@@ -1,11 +1,11 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSourceModel
extensible: sourceModel
data:
- ["android.widget", "EditText", True, "getText", "", "", "ReturnValue", "android-widget", "manual"]
- addsTo:
pack: codeql/java-all
extensible: extSummaryModel
extensible: summaryModel
data:
- ["android.widget", "EditText", True, "getText", "", "", "Argument[-1]", "ReturnValue", "taint", "manual"]

4
java/ql/lib/ext/androidx.core.app.model.yml
View File

@@ -1,7 +1,7 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSinkModel
extensible: sinkModel
data:
- ["androidx.core.app", "AlarmManagerCompat", True, "setAlarmClock", "", "", "Argument[2..3]", "pending-intent-sent", "manual"]
- ["androidx.core.app", "AlarmManagerCompat", True, "setAndAllowWhileIdle", "", "", "Argument[3]", "pending-intent-sent", "manual"]
@@ -11,7 +11,7 @@ extensions:
- ["androidx.core.app", "NotificationManagerCompat", True, "notify", "(int,Notification)", "", "Argument[1]", "pending-intent-sent", "manual"]
- addsTo:
pack: codeql/java-all
extensible: extSummaryModel
extensible: summaryModel
data:
- ["androidx.core.app", "NotificationCompat$Action", True, "Action", "(IconCompat,CharSequence,PendingIntent)", "", "Argument[2]", "Argument[-1]", "taint", "manual"]
- ["androidx.core.app", "NotificationCompat$Action", True, "Action", "(int,CharSequence,PendingIntent)", "", "Argument[2]", "Argument[-1]", "taint", "manual"]

2
java/ql/lib/ext/androidx.fragment.app.model.yml
View File

@@ -1,7 +1,7 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSinkModel
extensible: sinkModel
data:
- ["androidx.fragment.app", "FragmentTransaction", True, "add", "(Class,Bundle,String)", "", "Argument[0]", "fragment-injection", "manual"]
- ["androidx.fragment.app", "FragmentTransaction", True, "add", "(Fragment,String)", "", "Argument[0]", "fragment-injection", "manual"]

2
java/ql/lib/ext/androidx.slice.builders.model.yml
View File

@@ -1,7 +1,7 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSummaryModel
extensible: summaryModel
data:
- ["androidx.slice.builders", "ListBuilder", True, "addAction", "", "", "Argument[-1]", "ReturnValue", "value", "manual"]
- ["androidx.slice.builders", "ListBuilder", True, "addAction", "", "", "Argument[0].SyntheticField[androidx.slice.Slice.action]", "Argument[-1].SyntheticField[androidx.slice.Slice.action]", "taint", "manual"]

4
java/ql/lib/ext/androidx.slice.model.yml
View File

@@ -1,7 +1,7 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSourceModel
extensible: sourceModel
data:
- ["androidx.slice", "SliceProvider", True, "onBindSlice", "", "", "Parameter[0]", "contentprovider", "manual"]
- ["androidx.slice", "SliceProvider", True, "onCreatePermissionRequest", "", "", "Parameter[0]", "contentprovider", "manual"]
@@ -10,7 +10,7 @@ extensions:
- ["androidx.slice", "SliceProvider", True, "onSliceUnpinned", "", "", "Parameter[0]", "contentprovider", "manual"]
- addsTo:
pack: codeql/java-all
extensible: extSinkModel
extensible: sinkModel
data:
- ["androidx.slice", "SliceProvider", True, "onBindSlice", "", "", "ReturnValue", "pending-intent-sent", "manual"]
- ["androidx.slice", "SliceProvider", True, "onCreatePermissionRequest", "", "", "ReturnValue", "pending-intent-sent", "manual"]

2
java/ql/lib/ext/cn.hutool.core.codec.model.yml
View File

@@ -1,6 +1,6 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSummaryModel
extensible: summaryModel
data:
- ["cn.hutool.core.codec", "Base64", True, "decode", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]

2
java/ql/lib/ext/com.esotericsoftware.kryo.io.model.yml
View File

@@ -1,6 +1,6 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSummaryModel
extensible: summaryModel
data:
- ["com.esotericsoftware.kryo.io", "Input", False, "Input", "", "", "Argument[0]", "Argument[-1]", "taint", "manual"]

2
java/ql/lib/ext/com.esotericsoftware.kryo5.io.model.yml
View File

@@ -1,6 +1,6 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSummaryModel
extensible: summaryModel
data:
- ["com.esotericsoftware.kryo5.io", "Input", False, "Input", "", "", "Argument[0]", "Argument[-1]", "taint", "manual"]

2
java/ql/lib/ext/com.fasterxml.jackson.core.model.yml
View File

@@ -1,6 +1,6 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSummaryModel
extensible: summaryModel
data:
- ["com.fasterxml.jackson.core", "JsonFactory", False, "createParser", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]

2
java/ql/lib/ext/com.fasterxml.jackson.databind.model.yml
View File

@@ -1,7 +1,7 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSummaryModel
extensible: summaryModel
data:
- ["com.fasterxml.jackson.databind", "ObjectMapper", True, "convertValue", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
- ["com.fasterxml.jackson.databind", "ObjectMapper", False, "createParser", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]

4
java/ql/lib/ext/com.google.common.base.model.yml
View File

@@ -1,7 +1,7 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSinkModel
extensible: sinkModel
data:
- ["com.google.common.base", "Splitter", False, "onPattern", "(String)", "", "Argument[0]", "regex-use[]", "manual"]
- ["com.google.common.base", "Splitter", False, "split", "(CharSequence)", "", "Argument[-1]", "regex-use[0]", "manual"]
@@ -9,7 +9,7 @@ extensions:
- ["com.google.common.base", "Splitter$MapSplitter", False, "split", "(CharSequence)", "", "Argument[-1]", "regex-use[0]", "manual"]
- addsTo:
pack: codeql/java-all
extensible: extSummaryModel
extensible: summaryModel
data:
- ["com.google.common.base", "Ascii", False, "toLowerCase", "(CharSequence)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
- ["com.google.common.base", "Ascii", False, "toLowerCase", "(String)", "", "Argument[0]", "ReturnValue", "taint", "manual"]

2
java/ql/lib/ext/com.google.common.cache.model.yml
View File

@@ -1,7 +1,7 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSummaryModel
extensible: summaryModel
data:
- ["com.google.common.cache", "Cache", True, "asMap", "()", "", "Argument[-1].MapKey", "ReturnValue.MapKey", "value", "manual"]
- ["com.google.common.cache", "Cache", True, "asMap", "()", "", "Argument[-1].MapValue", "ReturnValue.MapValue", "value", "manual"]

2
java/ql/lib/ext/com.google.common.collect.model.yml
View File

@@ -1,7 +1,7 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSummaryModel
extensible: summaryModel
data:
# Methods depending on lambda flow are not currently modeled
# Methods depending on stronger aliasing properties than we support are also not modeled.

2
java/ql/lib/ext/com.google.common.flogger.model.yml
View File

@@ -1,7 +1,7 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSinkModel
extensible: sinkModel
data:
- ["com.google.common.flogger", "LoggingApi", True, "log", "", "", "Argument[0]", "logging", "manual"]
- ["com.google.common.flogger", "LoggingApi", True, "log", "(String,Object)", "", "Argument[1]", "logging", "manual"]

4
java/ql/lib/ext/com.google.common.io.model.yml
View File

@@ -1,7 +1,7 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSinkModel
extensible: sinkModel
data:
- ["com.google.common.io", "Resources", False, "asByteSource", "(URL)", "", "Argument[0]", "url-open-stream", "manual"]
- ["com.google.common.io", "Resources", False, "asCharSource", "(URL,Charset)", "", "Argument[0]", "url-open-stream", "manual"]
@@ -11,7 +11,7 @@ extensions:
- ["com.google.common.io", "Resources", False, "toString", "(URL,Charset)", "", "Argument[0]", "url-open-stream", "manual"]
- addsTo:
pack: codeql/java-all
extensible: extSummaryModel
extensible: summaryModel
data:
- ["com.google.common.io", "BaseEncoding", True, "decode", "(CharSequence)", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
- ["com.google.common.io", "BaseEncoding", True, "decode", "(CharSequence)", "", "Argument[0]", "ReturnValue", "taint", "manual"]

2
java/ql/lib/ext/com.hubspot.jinjava.model.yml
View File

@@ -1,7 +1,7 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSinkModel
extensible: sinkModel
data:
- ["com.hubspot.jinjava", "Jinjava", True, "render", "", "", "Argument[0]", "ssti", "manual"]
- ["com.hubspot.jinjava", "Jinjava", True, "renderForResult", "", "", "Argument[0]", "ssti", "manual"]

2
java/ql/lib/ext/com.mitchellbosecke.pebble.model.yml
View File

@@ -1,7 +1,7 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSinkModel
extensible: sinkModel
data:
- ["com.mitchellbosecke.pebble", "PebbleEngine", True, "getLiteralTemplate", "", "", "Argument[0]", "ssti", "manual"]
- ["com.mitchellbosecke.pebble", "PebbleEngine", True, "getTemplate", "", "", "Argument[0]", "ssti", "manual"]

2
java/ql/lib/ext/com.opensymphony.xwork2.ognl.model.yml
View File

@@ -1,7 +1,7 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSinkModel
extensible: sinkModel
data:
- ["com.opensymphony.xwork2.ognl", "OgnlUtil", False, "callMethod", "", "", "Argument[0]", "ognl-injection", "manual"]
- ["com.opensymphony.xwork2.ognl", "OgnlUtil", False, "getValue", "", "", "Argument[0]", "ognl-injection", "manual"]

4
java/ql/lib/ext/com.rabbitmq.client.impl.model.yml
View File

@@ -1,14 +1,14 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSourceModel
extensible: sourceModel
data:
- ["com.rabbitmq.client.impl", "Frame", True, "getInputStream", "()", "", "ReturnValue", "remote", "manual"]
- ["com.rabbitmq.client.impl", "Frame", True, "getPayload", "()", "", "ReturnValue", "remote", "manual"]
- ["com.rabbitmq.client.impl", "FrameHandler", True, "readFrame", "()", "", "ReturnValue", "remote", "manual"]
- addsTo:
pack: codeql/java-all
extensible: extSummaryModel
extensible: summaryModel
data:
- ["com.rabbitmq.client.impl", "Frame", False, "fromBodyFragment", "(int,byte[],int,int)", "", "Argument[1]", "ReturnValue", "taint", "manual"]
- ["com.rabbitmq.client.impl", "Frame", False, "readFrom", "(DataInputStream)", "", "Argument[0]", "ReturnValue", "taint", "manual"]

4
java/ql/lib/ext/com.rabbitmq.client.model.yml
View File

@@ -1,7 +1,7 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSourceModel
extensible: sourceModel
data:
- ["com.rabbitmq.client", "Command", True, "getContentBody", "()", "", "ReturnValue", "remote", "manual"]
- ["com.rabbitmq.client", "Command", True, "getContentHeader", "()", "", "ReturnValue", "remote", "manual"]
@@ -23,7 +23,7 @@ extensions:
- ["com.rabbitmq.client", "StringRpcServer", True, "handleStringCall", "", "", "Parameter[0]", "remote", "manual"]
- addsTo:
pack: codeql/java-all
extensible: extSummaryModel
extensible: summaryModel
data:
- ["com.rabbitmq.client", "GetResponse", True, "GetResponse", "", "", "Argument[2]", "Argument[-1]", "taint", "manual"]
- ["com.rabbitmq.client", "GetResponse", True, "getBody", "()", "", "Argument[-1]", "ReturnValue", "taint", "manual"]

2
java/ql/lib/ext/com.unboundid.ldap.sdk.model.yml
View File

@@ -1,7 +1,7 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSinkModel
extensible: sinkModel
data:
- ["com.unboundid.ldap.sdk", "LDAPConnection", False, "asyncSearch", "", "", "Argument[0]", "ldap", "manual"]
- ["com.unboundid.ldap.sdk", "LDAPConnection", False, "search", "(ReadOnlySearchRequest)", "", "Argument[0]", "ldap", "manual"]

2
java/ql/lib/ext/com.zaxxer.hikari.model.yml
View File

@@ -1,7 +1,7 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSinkModel
extensible: sinkModel
data:
- ["com.zaxxer.hikari", "HikariConfig", False, "HikariConfig", "(Properties)", "", "Argument[0]", "jdbc-url", "manual"]
- ["com.zaxxer.hikari", "HikariConfig", False, "setJdbcUrl", "(String)", "", "Argument[0]", "jdbc-url", "manual"]

8
java/ql/lib/ext/dummy.model.yml
View File

@@ -2,17 +2,17 @@ extensions:
# Make sure that the extensible model predicates are at least defined as empty.
- addsTo:
pack: codeql/java-all
extensible: extSourceModel
extensible: sourceModel
data: []
- addsTo:
pack: codeql/java-all
extensible: extSinkModel
extensible: sinkModel
data: []
- addsTo:
pack: codeql/java-all
extensible: extSummaryModel
extensible: summaryModel
data: []
- addsTo:
pack: codeql/java-all
extensible: extNeutralModel
extensible: neutralModel
data: []

2
java/ql/lib/ext/experimental/android.webkit.model.yml
View File

@@ -1,6 +1,6 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extExperimentalSummaryModel
extensible: experimentalSummaryModel
data:
- ["android.webkit", "WebResourceRequest", False, "getUrl", "", "", "Argument[-1]", "ReturnValue", "taint", "manual", "android-web-resource-response"]

2
java/ql/lib/ext/experimental/com.auth0.jwt.interfaces.model.yml
View File

@@ -1,7 +1,7 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extExperimentalSummaryModel
extensible: experimentalSummaryModel
data:
- ["com.auth0.jwt.interfaces", "Verification", True, "acceptExpiresAt", "", "", "Argument[-1]", "ReturnValue", "value", "manual", "hardcoded-jwt-key"]
- ["com.auth0.jwt.interfaces", "Verification", True, "acceptIssuedAt", "", "", "Argument[-1]", "ReturnValue", "value", "manual", "hardcoded-jwt-key"]

2
java/ql/lib/ext/experimental/com.jfinal.core.model.yml
View File

@@ -1,7 +1,7 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extExperimentalSourceModel
extensible: experimentalSourceModel
data:
- ["com.jfinal.core", "Controller", True, "get", "", "", "ReturnValue", "remote", "manual", "file-path-injection"]
- ["com.jfinal.core", "Controller", True, "getBoolean", "", "", "ReturnValue", "remote", "manual", "file-path-injection"]

6
java/ql/lib/ext/experimental/dummy.model.yml
View File

@@ -3,13 +3,13 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extExperimentalSourceModel
extensible: experimentalSourceModel
data: []
- addsTo:
pack: codeql/java-all
extensible: extExperimentalSinkModel
extensible: experimentalSinkModel
data: []
- addsTo:
pack: codeql/java-all
extensible: extExperimentalSummaryModel
extensible: experimentalSummaryModel
data: []

2
java/ql/lib/ext/experimental/io.undertow.server.handlers.resource.model.yml
View File

@@ -1,7 +1,7 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extExperimentalSummaryModel
extensible: experimentalSummaryModel
data:
- ["io.undertow.server.handlers.resource", "Resource", True, "getFile", "", "", "Argument[-1]", "ReturnValue", "taint", "manual", "unsafe-url-forward"]
- ["io.undertow.server.handlers.resource", "Resource", True, "getFilePath", "", "", "Argument[-1]", "ReturnValue", "taint", "manual", "unsafe-url-forward"]

2
java/ql/lib/ext/experimental/jakarta.servlet.http.model.yml
View File

@@ -1,6 +1,6 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extExperimentalSourceModel
extensible: experimentalSourceModel
data:
- ["jakarta.servlet.http", "HttpServletRequest", True, "getServletPath", "", "", "ReturnValue", "remote", "manual", "unsafe-url-forward"]

2
java/ql/lib/ext/experimental/java.io.model.yml
View File

@@ -1,6 +1,6 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extExperimentalSummaryModel
extensible: experimentalSummaryModel
data:
- ["java.io", "FileInputStream", True, "FileInputStream", "", "", "Argument[0]", "Argument[-1]", "taint", "manual", "android-web-resource-response"]

4
java/ql/lib/ext/experimental/java.lang.model.yml
View File

@@ -1,12 +1,12 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extExperimentalSinkModel
extensible: experimentalSinkModel
data:
- ["java.lang", "Thread", True, "sleep", "", "", "Argument[0]", "thread-pause", "manual", "thread-resource-abuse"]
- addsTo:
pack: codeql/java-all
extensible: extExperimentalSummaryModel
extensible: experimentalSummaryModel
data:
- ["java.lang", "Math", False, "max", "", "", "Argument[0..1]", "ReturnValue", "value", "manual", "thread-resource-abuse"]
- ["java.lang", "Math", False, "min", "", "", "Argument[0..1]", "ReturnValue", "value", "manual", "thread-resource-abuse"]

2
java/ql/lib/ext/experimental/java.nio.file.model.yml
View File

@@ -1,7 +1,7 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extExperimentalSummaryModel
extensible: experimentalSummaryModel
data:
- ["java.nio.file", "Path", True, "normalize", "", "", "Argument[-1]", "ReturnValue", "taint", "manual", "unsafe-url-forward"]
- ["java.nio.file", "Path", True, "resolve", "", "", "Argument[-1..0]", "ReturnValue", "taint", "manual", "unsafe-url-forward"]

2
java/ql/lib/ext/experimental/java.util.concurrent.model.yml
View File

@@ -1,7 +1,7 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extExperimentalSinkModel
extensible: experimentalSinkModel
data:
- ["java.util.concurrent", "TimeUnit", True, "sleep", "", "", "Argument[0]", "thread-pause", "manual", "thread-resource-abuse"]
- ["java.util.concurrent", "TimeUnit", True, "sleep", "", "", "Argument[0]", "thread-pause", "manual", "unsafe-url-forward"]

4
java/ql/lib/ext/experimental/javax.servlet.http.model.yml
View File

@@ -1,12 +1,12 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extExperimentalSourceModel
extensible: experimentalSourceModel
data:
- ["javax.servlet.http", "HttpServletRequest", True, "getServletPath", "", "", "ReturnValue", "remote", "manual", "unsafe-url-forward"]
- addsTo:
pack: codeql/java-all
extensible: extExperimentalSourceModel
extensible: experimentalSourceModel
data:
- ["javax.servlet.http", "HttpServletRequest", False, "getPathInfo", "()", "", "ReturnValue", "uri-path", "manual", "permissive-dot-regex-query"]
- ["javax.servlet.http", "HttpServletRequest", False, "getPathTranslated", "()", "", "ReturnValue", "uri-path", "manual", "permissive-dot-regex-query"]

2
java/ql/lib/ext/experimental/org.apache.logging.log4j.message.model.yml
View File

@@ -1,7 +1,7 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extExperimentalSummaryModel
extensible: experimentalSummaryModel
data:
- ["org.apache.logging.log4j.message", "MapMessage", True, "put", "", "", "Argument[1]", "Argument[-1]", "taint", "manual", "log4j-injection"]
- ["org.apache.logging.log4j.message", "MapMessage", True, "putAll", "", "", "Argument[0].MapValue", "Argument[-1]", "taint", "manual", "log4j-injection"]

2
java/ql/lib/ext/experimental/org.apache.logging.log4j.model.yml
View File

@@ -1,7 +1,7 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extExperimentalSinkModel
extensible: experimentalSinkModel
data:
- ["org.apache.logging.log4j", "CloseableThreadContext", False, "put", "", "", "Argument[1]", "log4j", "manual", "log4j-injection"]
- ["org.apache.logging.log4j", "CloseableThreadContext", False, "putAll", "", "", "Argument[0]", "log4j", "manual", "log4j-injection"]

4
java/ql/lib/ext/experimental/org.springframework.core.io.model.yml
View File

@@ -1,7 +1,7 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extExperimentalSinkModel
extensible: experimentalSinkModel
data:
- ["org.springframework.core.io", "ClassPathResource", True, "getFilename", "", "", "Argument[-1]", "get-resource", "manual", "unsafe-url-forward"]
- ["org.springframework.core.io", "ClassPathResource", True, "getPath", "", "", "Argument[-1]", "get-resource", "manual", "unsafe-url-forward"]
@@ -9,7 +9,7 @@ extensions:
- ["org.springframework.core.io", "ClassPathResource", True, "resolveURL", "", "", "Argument[-1]", "get-resource", "manual", "unsafe-url-forward"]
- addsTo:
pack: codeql/java-all
extensible: extExperimentalSummaryModel
extensible: experimentalSummaryModel
data:
- ["org.springframework.core.io", "ClassPathResource", False, "ClassPathResource", "", "", "Argument[0]", "Argument[-1]", "taint", "manual", "unsafe-url-forward"]
- ["org.springframework.core.io", "Resource", True, "createRelative", "", "", "Argument[0]", "ReturnValue", "taint", "manual", "unsafe-url-forward"]

2
java/ql/lib/ext/flexjson.model.yml
View File

@@ -1,6 +1,6 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSummaryModel
extensible: summaryModel
data:
- ["flexjson", "JSONDeserializer", True, "use", "", "", "Argument[-1]", "ReturnValue", "value", "manual"]

2
java/ql/lib/ext/freemarker.cache.model.yml
View File

@@ -1,6 +1,6 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSinkModel
extensible: sinkModel
data:
- ["freemarker.cache", "StringTemplateLoader", True, "putTemplate", "", "", "Argument[1]", "ssti", "manual"]

2
java/ql/lib/ext/freemarker.template.model.yml
View File

@@ -1,7 +1,7 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSinkModel
extensible: sinkModel
data:
- ["freemarker.template", "Template", True, "Template", "(String,Reader)", "", "Argument[1]", "ssti", "manual"]
- ["freemarker.template", "Template", True, "Template", "(String,Reader,Configuration)", "", "Argument[1]", "ssti", "manual"]

6
java/ql/lib/ext/generated/kotlinstdlib.model.yml
View File

@@ -4,7 +4,7 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSinkModel
extensible: sinkModel
data:
- ["kotlin.io", "FilesKt", false, "appendBytes", "(File,byte[])", "", "Argument[0]", "create-file", "generated"]
- ["kotlin.io", "FilesKt", false, "appendText", "(File,String,Charset)", "", "Argument[0]", "create-file", "generated"]
@@ -22,7 +22,7 @@ extensions:
- addsTo:
pack: codeql/java-all
extensible: extSummaryModel
extensible: summaryModel
data:
- ["kotlin.collections", "AbstractCollection", true, "toString", "()", "", "Argument[-1]", "ReturnValue", "taint", "generated"]
- ["kotlin.collections", "ArrayDeque", false, "ArrayDeque", "(Collection)", "", "Argument[0].Element", "Argument[-1]", "taint", "generated"]
@@ -1861,7 +1861,7 @@ extensions:
- addsTo:
pack: codeql/java-all
extensible: extNeutralModel
extensible: neutralModel
data:
- ["kotlin.annotation", "AnnotationRetention", "valueOf", "(String)", "generated"]
- ["kotlin.annotation", "AnnotationRetention", "values", "()", "generated"]

6
java/ql/lib/ext/generated/org.apache.commons.io.model.yml
View File

@@ -4,7 +4,7 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSinkModel
extensible: sinkModel
data:
- ["org.apache.commons.io.file", "PathFilter", true, "accept", "(Path,BasicFileAttributes)", "", "Argument[0]", "create-file", "generated"]
- ["org.apache.commons.io.file", "PathUtils", false, "copyFile", "(URL,Path,CopyOption[])", "", "Argument[0]", "open-url", "generated"]
@@ -116,7 +116,7 @@ extensions:
- addsTo:
pack: codeql/java-all
extensible: extSummaryModel
extensible: summaryModel
data:
- ["org.apache.commons.io.charset", "CharsetDecoders", true, "toCharsetDecoder", "(CharsetDecoder)", "", "Argument[0]", "ReturnValue", "taint", "generated"]
- ["org.apache.commons.io.charset", "CharsetEncoders", true, "toCharsetEncoder", "(CharsetEncoder)", "", "Argument[0]", "ReturnValue", "taint", "generated"]
@@ -676,7 +676,7 @@ extensions:
- addsTo:
pack: codeql/java-all
extensible: extNeutralModel
extensible: neutralModel
data:
- ["org.apache.commons.io.charset", "CharsetDecoders", "CharsetDecoders", "()", "generated"]
- ["org.apache.commons.io.charset", "CharsetEncoders", "CharsetEncoders", "()", "generated"]

2
java/ql/lib/ext/groovy.lang.model.yml
View File

@@ -1,7 +1,7 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSinkModel
extensible: sinkModel
data:
- ["groovy.lang", "GroovyClassLoader", False, "parseClass", "(GroovyCodeSource)", "", "Argument[0]", "groovy", "manual"]
- ["groovy.lang", "GroovyClassLoader", False, "parseClass", "(GroovyCodeSource,boolean)", "", "Argument[0]", "groovy", "manual"]

2
java/ql/lib/ext/groovy.util.model.yml
View File

@@ -1,7 +1,7 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSinkModel
extensible: sinkModel
data:
- ["groovy.util", "Eval", False, "me", "(String)", "", "Argument[0]", "groovy", "manual"]
- ["groovy.util", "Eval", False, "me", "(String,Object,String)", "", "Argument[2]", "groovy", "manual"]

4
java/ql/lib/ext/jakarta.faces.context.model.yml
View File

@@ -1,7 +1,7 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSourceModel
extensible: sourceModel
data:
- ["jakarta.faces.context", "ExternalContext", True, "getRequestCookieMap", "()", "", "ReturnValue", "remote", "manual"]
- ["jakarta.faces.context", "ExternalContext", True, "getRequestHeaderMap", "()", "", "ReturnValue", "remote", "manual"]
@@ -12,7 +12,7 @@ extensions:
- ["jakarta.faces.context", "ExternalContext", True, "getRequestPathInfo", "()", "", "ReturnValue", "remote", "manual"]
- addsTo:
pack: codeql/java-all
extensible: extSinkModel
extensible: sinkModel
data:
- ["jakarta.faces.context", "ResponseStream", True, "write", "", "", "Argument[0]", "xss", "manual"]
- ["jakarta.faces.context", "ResponseWriter", True, "write", "", "", "Argument[0]", "xss", "manual"]

2
java/ql/lib/ext/jakarta.json.model.yml
View File

@@ -1,7 +1,7 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSummaryModel
extensible: summaryModel
data:
- ["jakarta.json", "Json", False, "createArrayBuilder", "(Collection)", "", "Argument[0].Element", "ReturnValue", "taint", "manual"]
- ["jakarta.json", "Json", False, "createArrayBuilder", "(JsonArray)", "", "Argument[0]", "ReturnValue", "taint", "manual"]

2
java/ql/lib/ext/jakarta.json.stream.model.yml
View File

@@ -1,6 +1,6 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSummaryModel
extensible: summaryModel
data:
- ["jakarta.json.stream", "JsonParserFactory", False, "createParser", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]

2
java/ql/lib/ext/jakarta.ws.rs.client.model.yml
View File

@@ -1,6 +1,6 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSinkModel
extensible: sinkModel
data:
- ["jakarta.ws.rs.client", "Client", True, "target", "", "", "Argument[0]", "open-url", "manual"]

2
java/ql/lib/ext/jakarta.ws.rs.container.model.yml
View File

@@ -1,7 +1,7 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSourceModel
extensible: sourceModel
data:
- ["jakarta.ws.rs.container", "ContainerRequestContext", True, "getAcceptableLanguages", "", "", "ReturnValue", "remote", "manual"]
- ["jakarta.ws.rs.container", "ContainerRequestContext", True, "getAcceptableMediaTypes", "", "", "ReturnValue", "remote", "manual"]

4
java/ql/lib/ext/jakarta.ws.rs.core.model.yml
View File

@@ -1,13 +1,13 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSinkModel
extensible: sinkModel
data:
- ["jakarta.ws.rs.core", "Response", True, "seeOther", "", "", "Argument[0]", "url-redirect", "manual"]
- ["jakarta.ws.rs.core", "Response", True, "temporaryRedirect", "", "", "Argument[0]", "url-redirect", "manual"]
- addsTo:
pack: codeql/java-all
extensible: extSummaryModel
extensible: summaryModel
data:
- ["jakarta.ws.rs.core", "AbstractMultivaluedMap", False, "AbstractMultivaluedMap", "", "", "Argument[0].MapKey", "Argument[-1].MapKey", "value", "manual"]
- ["jakarta.ws.rs.core", "AbstractMultivaluedMap", False, "AbstractMultivaluedMap", "", "", "Argument[0].MapValue", "Argument[-1].MapValue", "value", "manual"]

2
java/ql/lib/ext/java.beans.model.yml
View File

@@ -1,6 +1,6 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSummaryModel
extensible: summaryModel
data:
- ["java.beans", "XMLDecoder", False, "XMLDecoder", "", "", "Argument[0]", "Argument[-1]", "taint", "manual"]

4
java/ql/lib/ext/java.io.model.yml
View File

@@ -1,7 +1,7 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSinkModel
extensible: sinkModel
data:
- ["java.io", "FileOutputStream", False, "FileOutputStream", "", "", "Argument[0]", "create-file", "manual"]
- ["java.io", "FileOutputStream", False, "write", "", "", "Argument[0]", "write-file", "manual"]
@@ -42,7 +42,7 @@ extensions:
- ["java.io", "Writer", True, "write", "", "", "Argument[0]", "write-file", "manual"]
- addsTo:
pack: codeql/java-all
extensible: extSummaryModel
extensible: summaryModel
data:
- ["java.io", "BufferedInputStream", False, "BufferedInputStream", "", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
- ["java.io", "BufferedReader", False, "BufferedReader", "", "", "Argument[0]", "Argument[-1]", "taint", "manual"]

4
java/ql/lib/ext/java.lang.model.yml
View File

@@ -1,7 +1,7 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSinkModel
extensible: sinkModel
data:
- ["java.lang", "String", False, "matches", "(String)", "", "Argument[0]", "regex-use[f-1]", "manual"]
- ["java.lang", "String", False, "replaceAll", "(String,String)", "", "Argument[0]", "regex-use[-1]", "manual"]
@@ -18,7 +18,7 @@ extensions:
- ["java.lang", "System$Logger", True, "log", "(Level,String,Throwable)", "", "Argument[1]", "logging", "manual"]
- addsTo:
pack: codeql/java-all
extensible: extSummaryModel
extensible: summaryModel
data:
- ["java.lang", "AbstractStringBuilder", True, "AbstractStringBuilder", "(String)", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
- ["java.lang", "AbstractStringBuilder", True, "append", "", "", "Argument[-1]", "ReturnValue", "value", "manual"]

4
java/ql/lib/ext/java.net.http.model.yml
View File

@@ -1,12 +1,12 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSourceModel
extensible: sourceModel
data:
- ["java.net.http", "WebSocket$Listener", True, "onText", "(WebSocket,CharSequence,boolean)", "", "Parameter[1]", "remote", "manual"]
- addsTo:
pack: codeql/java-all
extensible: extSinkModel
extensible: sinkModel
data:
- ["java.net.http", "HttpRequest", False, "newBuilder", "", "", "Argument[0]", "open-url", "manual"]
- ["java.net.http", "HttpRequest$Builder", False, "uri", "", "", "Argument[0]", "open-url", "manual"]

6
java/ql/lib/ext/java.net.model.yml
View File

@@ -1,13 +1,13 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSourceModel
extensible: sourceModel
data:
- ["java.net", "Socket", False, "getInputStream", "()", "", "ReturnValue", "remote", "manual"]
- ["java.net", "URLConnection", False, "getInputStream", "()", "", "ReturnValue", "remote", "manual"]
- addsTo:
pack: codeql/java-all
extensible: extSinkModel
extensible: sinkModel
data:
- ["java.net", "URL", False, "openConnection", "", "", "Argument[-1]", "open-url", "manual"]
- ["java.net", "URL", False, "openStream", "", "", "Argument[-1]", "open-url", "manual"]
@@ -19,7 +19,7 @@ extensions:
- ["java.net", "URLClassLoader", False, "newInstance", "", "", "Argument[0]", "open-url", "manual"]
- addsTo:
pack: codeql/java-all
extensible: extSummaryModel
extensible: summaryModel
data:
- ["java.net", "URI", False, "URI", "(String)", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
- ["java.net", "URI", False, "create", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]

2
java/ql/lib/ext/java.nio.channels.model.yml
View File

@@ -1,7 +1,7 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSummaryModel
extensible: summaryModel
data:
- ["java.nio.channels", "Channels", False, "newChannel", "(InputStream)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
- ["java.nio.channels", "ReadableByteChannel", True, "read", "(ByteBuffer)", "", "Argument[-1]", "Argument[0]", "taint", "manual"]

4
java/ql/lib/ext/java.nio.file.model.yml
View File

@@ -1,7 +1,7 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSinkModel
extensible: sinkModel
data:
- ["java.nio.file", "Files", False, "copy", "", "", "Argument[1]", "create-file", "manual"]
- ["java.nio.file", "Files", False, "createDirectories", "", "", "Argument[0]", "create-file", "manual"]
@@ -20,7 +20,7 @@ extensions:
- ["java.nio.file", "Files", False, "writeString", "", "", "Argument[1]", "write-file", "manual"]
- addsTo:
pack: codeql/java-all
extensible: extSummaryModel
extensible: summaryModel
data:
- ["java.nio.file", "FileSystem", True, "getPath", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
- ["java.nio.file", "FileSystem", True, "getRootDirectories", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]

2
java/ql/lib/ext/java.nio.model.yml
View File

@@ -1,7 +1,7 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSummaryModel
extensible: summaryModel
data:
- ["java.nio", "ByteBuffer", False, "array", "()", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
- ["java.nio", "ByteBuffer", False, "get", "", "", "Argument[-1]", "ReturnValue", "taint", "manual"]

2
java/ql/lib/ext/java.sql.model.yml
View File

@@ -1,7 +1,7 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSinkModel
extensible: sinkModel
data:
- ["java.sql", "Connection", True, "prepareCall", "", "", "Argument[0]", "sql", "manual"]
- ["java.sql", "Connection", True, "prepareStatement", "", "", "Argument[0]", "sql", "manual"]

2
java/ql/lib/ext/java.util.concurrent.model.yml
View File

@@ -1,7 +1,7 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSummaryModel
extensible: summaryModel
data:
- ["java.util.concurrent", "BlockingDeque", True, "offerFirst", "(Object,long,TimeUnit)", "", "Argument[0]", "Argument[-1].Element", "value", "manual"]
- ["java.util.concurrent", "BlockingDeque", True, "offerLast", "(Object,long,TimeUnit)", "", "Argument[0]", "Argument[-1].Element", "value", "manual"]

2
java/ql/lib/ext/java.util.function.model.yml
View File

@@ -1,6 +1,6 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSinkModel
extensible: sinkModel
data:
- ["java.util.function", "Predicate", False, "test", "(Object)", "", "Argument[-1]", "regex-use[0]", "manual"]

4
java/ql/lib/ext/java.util.logging.model.yml
View File

@@ -1,7 +1,7 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSinkModel
extensible: sinkModel
data:
- ["java.util.logging", "Logger", True, "config", "", "", "Argument[0]", "logging", "manual"]
- ["java.util.logging", "Logger", True, "entering", "(String,String)", "", "Argument[0..1]", "logging", "manual"]
@@ -39,6 +39,6 @@ extensions:
- ["java.util.logging", "Logger", True, "warning", "", "", "Argument[0]", "logging", "manual"]
- addsTo:
pack: codeql/java-all
extensible: extSummaryModel
extensible: summaryModel
data:
- ["java.util.logging", "LogRecord", False, "LogRecord", "", "", "Argument[1]", "Argument[-1]", "taint", "manual"]

2
java/ql/lib/ext/java.util.model.yml
View File

@@ -1,7 +1,7 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSummaryModel
extensible: summaryModel
data:
- ["java.util", "AbstractMap$SimpleEntry", False, "SimpleEntry", "(Entry)", "", "Argument[0].MapKey", "Argument[-1].MapKey", "value", "manual"]
- ["java.util", "AbstractMap$SimpleEntry", False, "SimpleEntry", "(Entry)", "", "Argument[0].MapValue", "Argument[-1].MapValue", "value", "manual"]

4
java/ql/lib/ext/java.util.regex.model.yml
View File

@@ -1,7 +1,7 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSinkModel
extensible: sinkModel
data:
- ["java.util.regex", "Matcher", False, "matches", "()", "", "Argument[-1]", "regex-use[f]", "manual"]
- ["java.util.regex", "Pattern", False, "asMatchPredicate", "()", "", "Argument[-1]", "regex-use[f]", "manual"]
@@ -14,7 +14,7 @@ extensions:
- ["java.util.regex", "Pattern", False, "splitAsStream", "(CharSequence)", "", "Argument[-1]", "regex-use[0]", "manual"]
- addsTo:
pack: codeql/java-all
extensible: extSummaryModel
extensible: summaryModel
data:
- ["java.util.regex", "Matcher", False, "group", "", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
- ["java.util.regex", "Matcher", False, "replaceAll", "", "", "Argument[-1]", "ReturnValue", "taint", "manual"]

2
java/ql/lib/ext/java.util.stream.model.yml
View File

@@ -1,7 +1,7 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSummaryModel
extensible: summaryModel
data:
- ["java.util.stream", "BaseStream", True, "iterator", "()", "", "Argument[-1].Element", "ReturnValue.Element", "value", "manual"]
- ["java.util.stream", "BaseStream", True, "onClose", "(Runnable)", "", "Argument[-1].Element", "ReturnValue.Element", "value", "manual"]

2
java/ql/lib/ext/java.util.zip.model.yml
View File

@@ -1,7 +1,7 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSummaryModel
extensible: summaryModel
data:
- ["java.util.zip", "GZIPInputStream", False, "GZIPInputStream", "", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
- ["java.util.zip", "ZipInputStream", False, "ZipInputStream", "", "", "Argument[0]", "Argument[-1]", "taint", "manual"]

4
java/ql/lib/ext/javax.faces.context.model.yml
View File

@@ -1,7 +1,7 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSourceModel
extensible: sourceModel
data:
- ["javax.faces.context", "ExternalContext", True, "getRequestCookieMap", "()", "", "ReturnValue", "remote", "manual"]
- ["javax.faces.context", "ExternalContext", True, "getRequestHeaderMap", "()", "", "ReturnValue", "remote", "manual"]
@@ -12,7 +12,7 @@ extensions:
- ["javax.faces.context", "ExternalContext", True, "getRequestPathInfo", "()", "", "ReturnValue", "remote", "manual"]
- addsTo:
pack: codeql/java-all
extensible: extSinkModel
extensible: sinkModel
data:
- ["javax.faces.context", "ResponseStream", True, "write", "", "", "Argument[0]", "xss", "manual"]
- ["javax.faces.context", "ResponseWriter", True, "write", "", "", "Argument[0]", "xss", "manual"]

4
java/ql/lib/ext/javax.jms.model.yml
View File

@@ -6,7 +6,7 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSourceModel
extensible: sourceModel
data:
- ["javax.jms", "JMSConsumer", True, "receive", "", "", "ReturnValue", "remote", "manual"]
- ["javax.jms", "JMSConsumer", True, "receiveBody", "", "", "ReturnValue", "remote", "manual"]
@@ -19,7 +19,7 @@ extensions:
- ["javax.jms", "TopicRequestor", True, "request", "(Message)", "", "ReturnValue", "remote", "manual"]
- addsTo:
pack: codeql/java-all
extensible: extSummaryModel
extensible: summaryModel
data:
- ["javax.jms", "BytesMessage", True, "readBoolean", "()", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
- ["javax.jms", "BytesMessage", True, "readByte", "()", "", "Argument[-1]", "ReturnValue", "taint", "manual"]

2
java/ql/lib/ext/javax.json.model.yml
View File

@@ -1,7 +1,7 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSummaryModel
extensible: summaryModel
data:
- ["javax.json", "Json", False, "createArrayBuilder", "(Collection)", "", "Argument[0].Element", "ReturnValue", "taint", "manual"]
- ["javax.json", "Json", False, "createArrayBuilder", "(JsonArray)", "", "Argument[0]", "ReturnValue", "taint", "manual"]

2
java/ql/lib/ext/javax.json.stream.model.yml
View File

@@ -1,6 +1,6 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSummaryModel
extensible: summaryModel
data:
- ["javax.json.stream", "JsonParserFactory", False, "createParser", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]

2
java/ql/lib/ext/javax.management.remote.model.yml
View File

@@ -1,7 +1,7 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSinkModel
extensible: sinkModel
data:
- ["javax.management.remote", "JMXConnector", True, "connect", "", "", "Argument[-1]", "jndi-injection", "manual"]
- ["javax.management.remote", "JMXConnectorFactory", False, "connect", "", "", "Argument[0]", "jndi-injection", "manual"]

2
java/ql/lib/ext/javax.naming.directory.model.yml
View File

@@ -1,6 +1,6 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSinkModel
extensible: sinkModel
data:
- ["javax.naming.directory", "DirContext", True, "search", "", "", "Argument[0..1]", "ldap", "manual"]

2
java/ql/lib/ext/javax.naming.model.yml
View File

@@ -1,7 +1,7 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSinkModel
extensible: sinkModel
data:
- ["javax.naming", "Context", True, "list", "", "", "Argument[0]", "jndi-injection", "manual"]
- ["javax.naming", "Context", True, "listBindings", "", "", "Argument[0]", "jndi-injection", "manual"]

2
java/ql/lib/ext/javax.net.ssl.model.yml
View File

@@ -1,7 +1,7 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSinkModel
extensible: sinkModel
data:
- ["javax.net.ssl", "HttpsURLConnection", True, "setDefaultHostnameVerifier", "", "", "Argument[0]", "set-hostname-verifier", "manual"]
- ["javax.net.ssl", "HttpsURLConnection", True, "setHostnameVerifier", "", "", "Argument[0]", "set-hostname-verifier", "manual"]

2
java/ql/lib/ext/javax.script.model.yml
View File

@@ -1,6 +1,6 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSinkModel
extensible: sinkModel
data:
- ["javax.script", "CompiledScript", False, "eval", "", "", "Argument[-1]", "mvel", "manual"]

6
java/ql/lib/ext/javax.servlet.http.model.yml
View File

@@ -1,7 +1,7 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSourceModel
extensible: sourceModel
data:
- ["javax.servlet.http", "Cookie", False, "getComment", "()", "", "ReturnValue", "remote", "manual"]
- ["javax.servlet.http", "Cookie", False, "getName", "()", "", "ReturnValue", "remote", "manual"]
@@ -20,7 +20,7 @@ extensions:
- ["javax.servlet.http", "HttpServletRequest", False, "getRequestURL", "()", "", "ReturnValue", "remote", "manual"]
- addsTo:
pack: codeql/java-all
extensible: extSinkModel
extensible: sinkModel
data:
- ["javax.servlet.http", "HttpServletResponse", False, "addCookie", "", "", "Argument[0]", "header-splitting", "manual"]
- ["javax.servlet.http", "HttpServletResponse", False, "addHeader", "", "", "Argument[0..1]", "header-splitting", "manual"]
@@ -28,7 +28,7 @@ extensions:
- ["javax.servlet.http", "HttpServletResponse", False, "setHeader", "", "", "Argument[0..1]", "header-splitting", "manual"]
- addsTo:
pack: codeql/java-all
extensible: extSummaryModel
extensible: summaryModel
data:
- ["javax.servlet.http", "Cookie", False, "Cookie", "", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
- ["javax.servlet.http", "Cookie", False, "Cookie", "", "", "Argument[1]", "Argument[-1]", "taint", "manual"]

2
java/ql/lib/ext/javax.servlet.model.yml
View File

@@ -1,7 +1,7 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSourceModel
extensible: sourceModel
data:
- ["javax.servlet", "ServletRequest", False, "getInputStream", "()", "", "ReturnValue", "remote", "manual"]
- ["javax.servlet", "ServletRequest", False, "getParameter", "(String)", "", "ReturnValue", "remote", "manual"]

4
java/ql/lib/ext/javax.validation.model.yml
View File

@@ -1,11 +1,11 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSourceModel
extensible: sourceModel
data:
- ["javax.validation", "ConstraintValidator", True, "isValid", "", "", "Parameter[0]", "remote", "manual"]
- addsTo:
pack: codeql/java-all
extensible: extSinkModel
extensible: sinkModel
data:
- ["javax.validation", "ConstraintValidatorContext", True, "buildConstraintViolationWithTemplate", "", "", "Argument[0]", "bean-validation", "manual"]

2
java/ql/lib/ext/javax.ws.rs.client.model.yml
View File

@@ -1,6 +1,6 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSinkModel
extensible: sinkModel
data:
- ["javax.ws.rs.client", "Client", True, "target", "", "", "Argument[0]", "open-url", "manual"]

2
java/ql/lib/ext/javax.ws.rs.container.model.yml
View File

@@ -1,7 +1,7 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSourceModel
extensible: sourceModel
data:
- ["javax.ws.rs.container", "ContainerRequestContext", True, "getAcceptableLanguages", "", "", "ReturnValue", "remote", "manual"]
- ["javax.ws.rs.container", "ContainerRequestContext", True, "getAcceptableMediaTypes", "", "", "ReturnValue", "remote", "manual"]

4
java/ql/lib/ext/javax.ws.rs.core.model.yml
View File

@@ -1,14 +1,14 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSinkModel
extensible: sinkModel
data:
- ["javax.ws.rs.core", "Response", True, "seeOther", "", "", "Argument[0]", "url-redirect", "manual"]
- ["javax.ws.rs.core", "Response", True, "temporaryRedirect", "", "", "Argument[0]", "url-redirect", "manual"]
- ["javax.ws.rs.core", "ResponseBuilder", False, "header", "", "", "Argument[1]", "header-splitting", "manual"]
- addsTo:
pack: codeql/java-all
extensible: extSummaryModel
extensible: summaryModel
data:
- ["javax.ws.rs.core", "AbstractMultivaluedMap", False, "AbstractMultivaluedMap", "", "", "Argument[0].MapKey", "Argument[-1].MapKey", "value", "manual"]
- ["javax.ws.rs.core", "AbstractMultivaluedMap", False, "AbstractMultivaluedMap", "", "", "Argument[0].MapValue", "Argument[-1].MapValue", "value", "manual"]

2
java/ql/lib/ext/javax.xml.transform.model.yml
View File

@@ -1,6 +1,6 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSinkModel
extensible: sinkModel
data:
- ["javax.xml.transform", "Transformer", False, "transform", "", "", "Argument[-1]", "xslt", "manual"]

2
java/ql/lib/ext/javax.xml.transform.sax.model.yml
View File

@@ -1,7 +1,7 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSummaryModel
extensible: summaryModel
data:
- ["javax.xml.transform.sax", "SAXSource", False, "SAXSource", "(InputSource)", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
- ["javax.xml.transform.sax", "SAXSource", False, "SAXSource", "(XMLReader,InputSource)", "", "Argument[1]", "Argument[-1]", "taint", "manual"]

2
java/ql/lib/ext/javax.xml.transform.stream.model.yml
View File

@@ -1,7 +1,7 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSummaryModel
extensible: summaryModel
data:
- ["javax.xml.transform.stream", "StreamSource", False, "StreamSource", "", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
- ["javax.xml.transform.stream", "StreamSource", False, "getInputStream", "", "", "Argument[-1]", "ReturnValue", "taint", "manual"]

2
java/ql/lib/ext/javax.xml.xpath.model.yml
View File

@@ -1,7 +1,7 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSinkModel
extensible: sinkModel
data:
- ["javax.xml.xpath", "XPath", True, "compile", "", "", "Argument[0]", "xpath", "manual"]
- ["javax.xml.xpath", "XPath", True, "evaluate", "", "", "Argument[0]", "xpath", "manual"]

2
java/ql/lib/ext/jodd.json.model.yml
View File

@@ -7,7 +7,7 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSummaryModel
extensible: summaryModel
data:
- ["jodd.json", "JsonParser", False, "allowAllClasses", "", "", "Argument[-1]", "ReturnValue", "value", "manual"]
- ["jodd.json", "JsonParser", False, "allowClass", "", "", "Argument[-1]", "ReturnValue", "value", "manual"]

2
java/ql/lib/ext/kotlin.collections.model.yml
View File

@@ -1,6 +1,6 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSummaryModel
extensible: summaryModel
data:
- ["kotlin.collections", "ArraysKt", False, "withIndex", "(Object[])", "", "Argument[0].ArrayElement", "ReturnValue", "taint", "manual"]

2
java/ql/lib/ext/kotlin.jvm.internal.model.yml
View File

@@ -1,6 +1,6 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSummaryModel
extensible: summaryModel
data:
- ["kotlin.jvm.internal", "ArrayIteratorKt", False, "iterator", "(Object[])", "", "Argument[0].ArrayElement", "ReturnValue.Element", "value", "manual"]

2
java/ql/lib/ext/net.sf.saxon.s9api.model.yml
View File

@@ -1,7 +1,7 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: extSinkModel
extensible: sinkModel
data:
- ["net.sf.saxon.s9api", "Xslt30Transformer", False, "applyTemplates", "", "", "Argument[-1]", "xslt", "manual"]
- ["net.sf.saxon.s9api", "Xslt30Transformer", False, "callFunction", "", "", "Argument[-1]", "xslt", "manual"]

Some files were not shown because too many files have changed in this diff Show More