mirror of
https://github.com/github/codeql.git
synced 2025-12-17 01:03:14 +01:00
Java: Ensure that it is the callable for the model origin that carries the comment containing the model.
This commit is contained in:
@@ -2,47 +2,53 @@ import java
|
||||
|
||||
private signature module InlineMadTestLangSig {
|
||||
/**
|
||||
* Gets a relevant code comment, if any.
|
||||
* Gets a relevant code comment for `c`, if any.
|
||||
*/
|
||||
string getComment();
|
||||
string getComment(Callable c);
|
||||
}
|
||||
|
||||
signature module InlineMadTestConfigSig {
|
||||
/**
|
||||
* Gets the kind of the captured model.
|
||||
* Gets the kind of a captured model.
|
||||
*/
|
||||
string getKind();
|
||||
|
||||
/**
|
||||
* Gets a captured model, if any.
|
||||
* Gets a captured model for `c`, if any.
|
||||
*/
|
||||
string getCapturedModel();
|
||||
string getCapturedModel(Callable c);
|
||||
}
|
||||
|
||||
private module InlineMadTestImpl<InlineMadTestLangSig Lang, InlineMadTestConfigSig Input> {
|
||||
private string expects() {
|
||||
Lang::getComment().regexpCapture(" *(SPURIOUS-)?" + Input::getKind() + "=(.*)", 2) = result
|
||||
private string expects(Callable c) {
|
||||
Lang::getComment(c).regexpCapture(" *(SPURIOUS-)?" + Input::getKind() + "=(.*)", 2) = result
|
||||
}
|
||||
|
||||
query predicate unexpectedModel(string msg) {
|
||||
exists(string flow |
|
||||
flow = Input::getCapturedModel() and
|
||||
not flow = expects() and
|
||||
exists(Callable c, string flow |
|
||||
flow = Input::getCapturedModel(c) and
|
||||
not flow = expects(c) and
|
||||
msg = "Unexpected " + Input::getKind() + " found: " + flow
|
||||
)
|
||||
}
|
||||
|
||||
query predicate expectedModel(string msg) {
|
||||
exists(string e |
|
||||
e = expects() and
|
||||
not e = Input::getCapturedModel() and
|
||||
exists(Callable c, string e |
|
||||
e = expects(c) and
|
||||
not e = Input::getCapturedModel(c) and
|
||||
msg = "Expected " + Input::getKind() + " missing: " + e
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
private module InlineMadTestLang implements InlineMadTestLangSig {
|
||||
string getComment() { result = any(Javadoc doc).getChild(0).toString() }
|
||||
string getComment(Callable c) {
|
||||
exists(Javadoc doc |
|
||||
hasJavadoc(c, doc) and
|
||||
isNormalComment(doc) and
|
||||
result = doc.getChild(0).toString()
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
module InlineMadTest<InlineMadTestConfigSig Input> {
|
||||
|
||||
@@ -3,7 +3,7 @@ import utils.modelgenerator.internal.CaptureSummaryFlowQuery
|
||||
import TestUtilities.InlineMadTest
|
||||
|
||||
module InlineMadTestConfig implements InlineMadTestConfigSig {
|
||||
string getCapturedModel() { result = captureNoFlow(_) }
|
||||
string getCapturedModel(Callable c) { result = captureNoFlow(c) }
|
||||
|
||||
string getKind() { result = "neutral" }
|
||||
}
|
||||
|
||||
@@ -3,7 +3,7 @@ import utils.modelgenerator.internal.CaptureModels
|
||||
import TestUtilities.InlineMadTest
|
||||
|
||||
module InlineMadTestConfig implements InlineMadTestConfigSig {
|
||||
string getCapturedModel() { result = captureSink(_) }
|
||||
string getCapturedModel(Callable c) { result = captureSink(c) }
|
||||
|
||||
string getKind() { result = "sink" }
|
||||
}
|
||||
|
||||
@@ -3,7 +3,7 @@ import utils.modelgenerator.internal.CaptureModels
|
||||
import TestUtilities.InlineMadTest
|
||||
|
||||
module InlineMadTestConfig implements InlineMadTestConfigSig {
|
||||
string getCapturedModel() { result = captureSource(_) }
|
||||
string getCapturedModel(Callable c) { result = captureSource(c) }
|
||||
|
||||
string getKind() { result = "source" }
|
||||
}
|
||||
|
||||
@@ -3,7 +3,7 @@ import utils.modelgenerator.internal.CaptureSummaryFlowQuery
|
||||
import TestUtilities.InlineMadTest
|
||||
|
||||
module InlineMadTestConfig implements InlineMadTestConfigSig {
|
||||
string getCapturedModel() { result = captureFlow(_) }
|
||||
string getCapturedModel(Callable c) { result = captureFlow(c) }
|
||||
|
||||
string getKind() { result = "summary" }
|
||||
}
|
||||
|
||||
@@ -6,7 +6,6 @@ class MultipleImpl2 {
|
||||
// This is used to test that we only generate a summary model and
|
||||
// not neutral summary model for `IInterface.m`.
|
||||
public interface IInterface {
|
||||
// summary=p;MultipleImpl2$IInterface;true;m;(Object);;Argument[0];ReturnValue;taint;df-generated
|
||||
Object m(Object value);
|
||||
}
|
||||
|
||||
@@ -17,6 +16,7 @@ class MultipleImpl2 {
|
||||
}
|
||||
|
||||
public class Impl2 implements IInterface {
|
||||
// summary=p;MultipleImpl2$IInterface;true;m;(Object);;Argument[0];ReturnValue;taint;df-generated
|
||||
public Object m(Object value) {
|
||||
return value;
|
||||
}
|
||||
|
||||
@@ -5,12 +5,11 @@ import java.util.concurrent.Callable;
|
||||
public class MultipleImpls {
|
||||
|
||||
public static interface Strategy {
|
||||
// summary=p;MultipleImpls$Strategy;true;doSomething;(String);;Argument[0];Argument[this];taint;df-generated
|
||||
// summary=p;MultipleImpls$Strategy;true;doSomething;(String);;Argument[0];ReturnValue;taint;df-generated
|
||||
String doSomething(String value);
|
||||
}
|
||||
|
||||
public static class Strat1 implements Strategy {
|
||||
// summary=p;MultipleImpls$Strategy;true;doSomething;(String);;Argument[0];ReturnValue;taint;df-generated
|
||||
public String doSomething(String value) {
|
||||
return value;
|
||||
}
|
||||
@@ -28,6 +27,7 @@ public class MultipleImpls {
|
||||
public static class Strat2 implements Strategy {
|
||||
private String foo;
|
||||
|
||||
// summary=p;MultipleImpls$Strategy;true;doSomething;(String);;Argument[0];Argument[this];taint;df-generated
|
||||
public String doSomething(String value) {
|
||||
this.foo = value;
|
||||
return "none";
|
||||
|
||||
@@ -12,15 +12,12 @@ public class PrivateFlowViaPublicInterface {
|
||||
}
|
||||
|
||||
public static interface SPI {
|
||||
// summary=p;PrivateFlowViaPublicInterface$SPI;true;openStream;();;Argument[this];ReturnValue;taint;df-generated
|
||||
// sink=p;PrivateFlowViaPublicInterface$SPI;true;openStream;();;Argument[this];path-injection;df-generated
|
||||
OutputStream openStream() throws IOException;
|
||||
|
||||
// neutral=p;PrivateFlowViaPublicInterface$SPI;openStreamNone;();summary;df-generated
|
||||
default OutputStream openStreamNone() throws IOException {
|
||||
return null;
|
||||
}
|
||||
;
|
||||
}
|
||||
|
||||
private static final class PrivateImplWithSink implements SPI {
|
||||
@@ -31,6 +28,8 @@ public class PrivateFlowViaPublicInterface {
|
||||
this.file = file;
|
||||
}
|
||||
|
||||
// summary=p;PrivateFlowViaPublicInterface$SPI;true;openStream;();;Argument[this];ReturnValue;taint;df-generated
|
||||
// sink=p;PrivateFlowViaPublicInterface$SPI;true;openStream;();;Argument[this];path-injection;df-generated
|
||||
@Override
|
||||
public OutputStream openStream() throws IOException {
|
||||
return new FileOutputStream(file);
|
||||
@@ -46,6 +45,7 @@ public class PrivateFlowViaPublicInterface {
|
||||
return null;
|
||||
}
|
||||
|
||||
// neutral=p;PrivateFlowViaPublicInterface$SPI;openStreamNone;();summary;df-generated
|
||||
@Override
|
||||
public OutputStream openStreamNone() throws IOException {
|
||||
return new FileOutputStream(new RandomPojo().someFile);
|
||||
|
||||
@@ -3,7 +3,7 @@ import TestUtilities.InlineMadTest
|
||||
import utils.modelgenerator.internal.CaptureTypeBasedSummaryModels
|
||||
|
||||
module InlineMadTestConfig implements InlineMadTestConfigSig {
|
||||
string getCapturedModel() { result = captureFlow(_) }
|
||||
string getCapturedModel(Callable c) { result = captureFlow(c) }
|
||||
|
||||
string getKind() { result = "summary" }
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user