Overlay: Add overlay annotations to Java & shared libraries

This commit is contained in:
Kasper Svendsen
2025-06-16 13:06:31 +02:00
parent 2218a981f6
commit c207cfdeb7
428 changed files with 966 additions and 0 deletions

View File

@@ -8,5 +8,7 @@
* the `RemoteFlowSource` and `AdditionalTaintStep` classes associated with the security queries
* to model frameworks that are not covered by the standard library.
*/
overlay[local?]
module;
import java

View File

@@ -1,6 +1,8 @@
/**
* Provides shared predicates related to contextual queries in the code viewer.
*/
overlay[local?]
module;
import semmle.files.FileSystem
private import codeql.util.FileSystem

View File

@@ -1,3 +1,5 @@
/** DEPRECATED: use `java.qll` instead. */
overlay[local?]
module;
import java

View File

@@ -2,6 +2,8 @@
* Provides classes and predicates related to jump-to-definition links
* in the code viewer.
*/
overlay[local?]
module;
import java
import IDEContextual

View File

@@ -1,3 +1,6 @@
overlay[local?]
module;
import java
import semmle.code.java.dataflow.DataFlow
import semmle.code.java.dataflow.TaintTracking

View File

@@ -1,3 +1,6 @@
overlay[local?]
module;
private import java as Language
private import semmle.code.java.security.InsecureRandomnessQuery
private import semmle.code.java.security.RandomQuery

View File

@@ -1,3 +1,6 @@
overlay[local?]
module;
import java
class ExternalData extends @externalDataElement {

View File

@@ -1,4 +1,6 @@
/** Provides all default Java QL imports. */
overlay[local?]
module;
import Customizations
import semmle.code.FileSystem

View File

@@ -1,4 +1,6 @@
/** Provides classes for working with files and folders. */
overlay[local?]
module;
import Location
private import codeql.util.FileSystem

View File

@@ -3,6 +3,8 @@
*
* Locations represent parts of files and are used to map elements to their source location.
*/
overlay[local?]
module;
import FileSystem
import semmle.code.java.Element

View File

@@ -1,6 +1,8 @@
/**
* Provides classes and predicates for working with SMAP files (see JSR-045).
*/
overlay[local?]
module;
import java

View File

@@ -1,3 +1,5 @@
/** Provides the `Unit` class. */
overlay[local?]
module;
import codeql.util.Unit

View File

@@ -2,6 +2,8 @@
* Provides classes and predicates for working with configuration files, such
* as Java `.properties` or `.ini` files.
*/
overlay[local?]
module;
import semmle.code.Location

View File

@@ -8,6 +8,8 @@
* Each annotation type has zero or more annotation elements that contain a
* name and possibly a value.
*/
overlay[local?]
module;
import Element
import Expr

View File

@@ -2,6 +2,8 @@
* Provides classes and predicates for reasoning about instances of
* `java.util.Collection` and their methods.
*/
overlay[local?]
module;
import java

View File

@@ -1,6 +1,8 @@
/**
* Provides a class representing individual compiler invocations that occurred during the build.
*/
overlay[local?]
module;
import semmle.code.FileSystem

View File

@@ -1,6 +1,8 @@
/**
* Provides classes and predicates for working with Java compilation units.
*/
overlay[local?]
module;
import Element
import Package

View File

@@ -1,6 +1,8 @@
/**
* Provides classes and predicates for representing completions.
*/
overlay[local?]
module;
/*
* A completion represents how a statement or expression terminates.

View File

@@ -1,3 +1,6 @@
overlay[local?]
module;
import java
/**

View File

@@ -1,6 +1,8 @@
/**
* Provdides a module to calculate constant integer and boolean values.
*/
overlay[local?]
module;
import java

View File

@@ -7,6 +7,8 @@
* statement, an expression, or an exit node for a callable, indicating that
* execution of the callable terminates.
*/
overlay[local?]
module;
/*
* The implementation is centered around the concept of a _completion_, which

View File

@@ -4,6 +4,8 @@
*
* See the Java Language Specification, Section 5, for details.
*/
overlay[local?]
module;
import java
import semmle.code.java.arithmetic.Overflow

View File

@@ -1,6 +1,8 @@
/**
* Provides utility predicates for representing dependencies between types.
*/
overlay[local?]
module;
import Type
import Generics

View File

@@ -1,6 +1,8 @@
/**
* This library provides utility predicates for representing the number of dependencies between types.
*/
overlay[local?]
module;
import Type
import Generics

View File

@@ -1,6 +1,8 @@
/**
* Provides classes representing warnings generated during compilation.
*/
overlay[local?]
module;
import java

View File

@@ -1,6 +1,8 @@
/**
* Provides a class that represents named elements in Java programs.
*/
overlay[local?]
module;
import CompilationUnit
import semmle.code.Location

View File

@@ -1,6 +1,8 @@
/**
* Provides classes and predicates for working with Java exceptions.
*/
overlay[local?]
module;
import Element
import Type

View File

@@ -1,6 +1,8 @@
/**
* Provides classes for working with Java expressions.
*/
overlay[local?]
module;
import java
private import semmle.code.java.frameworks.android.Compose

View File

@@ -1,6 +1,8 @@
/**
* Provides classes and predicates for working with the most common types of generated files.
*/
overlay[local?]
module;
import Type
private import semmle.code.java.frameworks.JavaxAnnotations

View File

@@ -30,6 +30,8 @@
*
* The terminology for generic methods is analogous.
*/
overlay[local?]
module;
import Type

View File

@@ -1,6 +1,8 @@
/**
* Provides classes and predicates for working with Java imports.
*/
overlay[local?]
module;
import semmle.code.Location
import CompilationUnit

View File

@@ -1,6 +1,8 @@
/**
* Provides classes and predicates for working with J2EE bean types.
*/
overlay[local?]
module;
import Type

View File

@@ -1,6 +1,8 @@
/**
* Provides classes and predicates for working with standard classes and methods from the JDK.
*/
overlay[local?]
module;
import Member
import semmle.code.java.security.ExternalProcess

View File

@@ -1,6 +1,8 @@
/**
* Provides classes that represent standard annotations from the JDK.
*/
overlay[local?]
module;
import java

View File

@@ -1,6 +1,8 @@
/**
* Provides classes and predicates for working with JMX bean types.
*/
overlay[local?]
module;
import Type

View File

@@ -1,6 +1,8 @@
/**
* Provides classes and predicates for working with Javadoc documentation.
*/
overlay[local?]
module;
import semmle.code.Location

View File

@@ -1,6 +1,8 @@
/**
* Provides classes and predicates for working with Kotlin types.
*/
overlay[local?]
module;
import java

View File

@@ -2,6 +2,8 @@
* Provides classes and predicates for reasoning about instances of
* `java.util.Map` and their methods.
*/
overlay[local?]
module;
import java
import Collections

View File

@@ -2,6 +2,8 @@
* Provides classes and predicates for working with members of Java classes and interfaces,
* that is, methods, constructors, fields and nested types.
*/
overlay[local?]
module;
import Element
import Type

View File

@@ -1,6 +1,8 @@
/**
* Provides classes and predicates for working with Java modifiers.
*/
overlay[local?]
module;
import Element

View File

@@ -1,6 +1,8 @@
/**
* Provides classes for working with Java modules.
*/
overlay[local?]
module;
import CompilationUnit

View File

@@ -1,4 +1,6 @@
/** Provides classes and predicates for reasoning about `java.lang.NumberFormatException`. */
overlay[local?]
module;
import java

View File

@@ -1,6 +1,8 @@
/**
* Provides classes and predicates for working with Java packages.
*/
overlay[local?]
module;
import Element
import Type

View File

@@ -2,6 +2,8 @@
* Provides pretty-printed representations of the AST, in particular top-level
* classes and interfaces.
*/
overlay[local?]
module;
import java

View File

@@ -5,6 +5,8 @@
* extend `PrintAstConfiguration` and override `shouldPrint` to hold for only the elements
* you wish to view the AST for.
*/
overlay[local?]
module;
import java
import semmle.code.java.regex.RegexTreeView as RegexTreeView

View File

@@ -1,6 +1,8 @@
/**
* Provides classes and predicates for working with Java Reflection.
*/
overlay[local?]
module;
import java
import JDKAnnotations

View File

@@ -1,6 +1,8 @@
/**
* Provides classes and predicates for working with Java Serialization.
*/
overlay[local?]
module;
import java
private import frameworks.jackson.JacksonSerializability

View File

@@ -1,6 +1,8 @@
/**
* Provides classes and predicates for working with Java statements.
*/
overlay[local?]
module;
import Expr
import metrics.MetricStmt

View File

@@ -1,6 +1,8 @@
/**
* Provides classes and predicates for reasoning about string formatting.
*/
overlay[local?]
module;
import java
import dataflow.DefUse

View File

@@ -9,6 +9,8 @@
* Classes and interfaces can also be local (`LocalClassOrInterface`, `LocalClass`) or anonymous (`AnonymousClass`).
* Enumerated types (`EnumType`) and records (`Record`) are special kinds of classes.
*/
overlay[local?]
module;
import Member
import Modifier
@@ -668,6 +670,7 @@ class RefType extends Type, Annotatable, Modifiable, @reftype {
*
* For the definition of the notion of *erasure* see JLS v8, section 4.6 (Type Erasure).
*/
overlay[caller]
pragma[inline]
RefType commonSubtype(RefType other) {
result.getASourceSupertype*() = erase(this) and
@@ -1257,6 +1260,7 @@ private Type erase(Type t) {
*
* For the definition of the notion of *erasure* see JLS v8, section 4.6 (Type Erasure).
*/
overlay[caller]
pragma[inline]
predicate haveIntersection(RefType t1, RefType t2) {
exists(RefType e1, RefType e2 | e1 = erase(t1) and e2 = erase(t2) |

View File

@@ -1,6 +1,8 @@
/**
* Provides classes and predicates for working with test classes and methods.
*/
overlay[local?]
module;
import Type
import Member

View File

@@ -1,6 +1,8 @@
/**
* Provides classes and predicates for working with Java variables and their declarations.
*/
overlay[local?]
module;
import Element

View File

@@ -1,3 +1,6 @@
overlay[local?]
module;
import java
/** A subclass of `PrimitiveType` with width-based ordering methods. */

View File

@@ -1,3 +1,6 @@
overlay[local?]
module;
import java
/**

View File

@@ -1,6 +1,8 @@
/**
* Provides classes and predicates for working with basic blocks in Java.
*/
overlay[local?]
module;
import java
import Dominance

View File

@@ -1,6 +1,8 @@
/**
* Provides classes and predicates for control-flow graph dominance.
*/
overlay[local?]
module;
import java
@@ -93,6 +95,7 @@ predicate iDominates(ControlFlowNode dominator, ControlFlowNode node) {
}
/** Holds if `dom` strictly dominates `node`. */
overlay[caller]
pragma[inline]
predicate strictlyDominates(ControlFlowNode dom, ControlFlowNode node) {
// This predicate is gigantic, so it must be inlined.
@@ -102,6 +105,7 @@ predicate strictlyDominates(ControlFlowNode dom, ControlFlowNode node) {
}
/** Holds if `dom` dominates `node`. (This is reflexive.) */
overlay[caller]
pragma[inline]
predicate dominates(ControlFlowNode dom, ControlFlowNode node) {
// This predicate is gigantic, so it must be inlined.
@@ -111,6 +115,7 @@ predicate dominates(ControlFlowNode dom, ControlFlowNode node) {
}
/** Holds if `dom` strictly post-dominates `node`. */
overlay[caller]
pragma[inline]
predicate strictlyPostDominates(ControlFlowNode dom, ControlFlowNode node) {
// This predicate is gigantic, so it must be inlined.
@@ -120,6 +125,7 @@ predicate strictlyPostDominates(ControlFlowNode dom, ControlFlowNode node) {
}
/** Holds if `dom` post-dominates `node`. (This is reflexive.) */
overlay[caller]
pragma[inline]
predicate postDominates(ControlFlowNode dom, ControlFlowNode node) {
// This predicate is gigantic, so it must be inlined.

View File

@@ -2,6 +2,8 @@
* Provides classes and predicates for reasoning about guards and the control
* flow elements controlled by those guards.
*/
overlay[local?]
module;
import java
private import semmle.code.java.controlflow.Dominance

View File

@@ -2,6 +2,8 @@
* This library provides predicates for reasoning about the set of all paths
* through a callable.
*/
overlay[local?]
module;
import java
import semmle.code.java.dispatch.VirtualDispatch

View File

@@ -1,6 +1,8 @@
/**
* Provides different types of control flow successor types.
*/
overlay[local?]
module;
import java
private import codeql.util.Boolean

View File

@@ -1,6 +1,8 @@
/**
* Provides classes and predicates for identifying unreachable blocks under a "closed-world" assumption.
*/
overlay[local?]
module;
import java
import semmle.code.java.controlflow.Guards

View File

@@ -2,6 +2,8 @@
* Provides predicates for working with the internal logic of the `Guards`
* library.
*/
overlay[local?]
module;
import java
import semmle.code.java.controlflow.Guards

View File

@@ -3,6 +3,8 @@
* `com.google.common.base.Preconditions` and
* `org.apache.commons.lang3.Validate`.
*/
overlay[local?]
module;
import java

View File

@@ -1,4 +1,6 @@
/** Provides utility predicates relating to switch cases. */
overlay[local?]
module;
import java

View File

@@ -1,3 +1,6 @@
overlay[local?]
module;
import java
import semmle.code.java.controlflow.UnreachableBlocks

View File

@@ -1,4 +1,6 @@
/** Provides classes representing various flow sinks for data flow / taint tracking. */
overlay[local?]
module;
private import semmle.code.java.dataflow.FlowSinks as FlowSinks

View File

@@ -1,4 +1,6 @@
/** Provides classes representing various flow sources for data flow / taint tracking. */
overlay[local?]
module;
private import semmle.code.java.dataflow.FlowSources as FlowSources

View File

@@ -1,6 +1,8 @@
/**
* Provides classes for representing abstract bounds for use in, for example, range analysis.
*/
overlay[local?]
module;
private import internal.rangeanalysis.BoundSpecific

View File

@@ -2,6 +2,8 @@
* Provides classes for performing local (intra-procedural) and
* global (inter-procedural) data flow analyses.
*/
overlay[local?]
module;
import java

View File

@@ -2,6 +2,8 @@
* Provides classes and predicates for def-use and use-use pairs. Built on top of the SSA library for
* maximal precision.
*/
overlay[local?]
module;
import java
private import SSA

View File

@@ -86,6 +86,8 @@
* This information is used in a heuristic for dataflow analysis to determine, if a
* model or source code should be used for determining flow.
*/
overlay[local?]
module;
import java
private import semmle.code.java.dataflow.DataFlow::DataFlow

View File

@@ -1,4 +1,6 @@
/** Provides classes representing various flow sinks for data flow / taint tracking. */
overlay[local?]
module;
private import java
private import semmle.code.java.dataflow.ExternalFlow

View File

@@ -1,6 +1,8 @@
/**
* Provides classes representing various flow sources for taint tracking.
*/
overlay[local?]
module;
import java
import semmle.code.java.dataflow.DataFlow

View File

@@ -1,6 +1,8 @@
/**
* Provides classes representing various flow steps for taint tracking.
*/
overlay[local?]
module;
private import java
private import semmle.code.java.dataflow.DataFlow

View File

@@ -1,6 +1,8 @@
/**
* Provides classes and predicates for defining flow summaries.
*/
overlay[local?]
module;
import java
private import internal.FlowSummaryImpl as Impl

View File

@@ -2,6 +2,8 @@
* Provides classes and predicates for reasoning about explicit and implicit
* instance accesses.
*/
overlay[local?]
module;
import java

View File

@@ -1,6 +1,8 @@
/**
* Provides classes and predicates for integer guards.
*/
overlay[local?]
module;
import java
private import SSA

View File

@@ -3,6 +3,8 @@
* an expression, `b` is a `Bound` (typically zero or the value of an SSA
* variable), and `v` is an integer in the range `[0 .. m-1]`.
*/
overlay[local?]
module;
private import internal.rangeanalysis.ModulusAnalysisSpecific::Private
private import Bound

View File

@@ -1,6 +1,8 @@
/**
* Provides classes and predicates for null guards.
*/
overlay[local?]
module;
import java
import SSA

View File

@@ -6,6 +6,8 @@
* hold, so results guarded by, for example, `assert x != null;` or
* `if (x == null) { assert false; }` are excluded.
*/
overlay[local?]
module;
/*
* Implementation details:

View File

@@ -8,6 +8,8 @@
* If an inferred bound relies directly on a condition, then this condition is
* reported as the reason for the bound.
*/
overlay[local?]
module;
/*
* This library tackles range analysis as a flow problem. Consider e.g.:

View File

@@ -1,6 +1,8 @@
/**
* Provides utility predicates for range analysis.
*/
overlay[local?]
module;
import java
private import SSA

View File

@@ -10,6 +10,8 @@
* of the field in case the field is not amenable to a non-trivial SSA
* representation.
*/
overlay[local?]
module;
import java
private import internal.SsaImpl

View File

@@ -5,5 +5,7 @@
* The analysis is implemented as an abstract interpretation over the
* three-valued domain `{negative, zero, positive}`.
*/
overlay[local?]
module;
import semmle.code.java.dataflow.internal.rangeanalysis.SignAnalysisCommon

View File

@@ -25,6 +25,8 @@
* String.format("%sfoo:%s", notSuffix, suffix4);
* ```
*/
overlay[local?]
module;
import java
private import semmle.code.java.dataflow.TaintTracking

View File

@@ -2,6 +2,8 @@
* Provides classes for performing local (intra-procedural) and
* global (inter-procedural) taint-tracking analyses.
*/
overlay[local?]
module;
import semmle.code.java.dataflow.DataFlow
import semmle.code.java.dataflow.internal.TaintTrackingUtil::StringBuilderVarModule

View File

@@ -7,6 +7,8 @@
* type has a subtype or if an inferred upper bound passed through at least one
* explicit or implicit cast that lost type information.
*/
overlay[local?]
module;
import java as J
private import semmle.code.java.dispatch.VirtualDispatch

View File

@@ -10,6 +10,8 @@
* This is a restricted version of SSA.qll that only handles `LocalScopeVariable`s
* in order to not depend on virtual dispatch.
*/
overlay[local?]
module;
import java
private import codeql.ssa.Ssa as SsaImplCommon

View File

@@ -1,3 +1,6 @@
overlay[local?]
module;
import java
import semmle.code.java.Collections
import semmle.code.java.Maps

View File

@@ -1,3 +1,6 @@
overlay[local?]
module;
private import java
private import DataFlowImplSpecific
private import codeql.dataflow.internal.ContentDataFlowImpl

View File

@@ -1,3 +1,6 @@
overlay[local?]
module;
private import java
private import DataFlowPrivate
private import DataFlowUtil
@@ -210,6 +213,7 @@ private module DispatchImpl {
}
/** Holds if arguments at position `apos` match parameters at position `ppos`. */
overlay[caller]
pragma[inline]
predicate parameterMatch(ParameterPosition ppos, ArgumentPosition apos) { ppos = apos }
}

View File

@@ -1,3 +1,6 @@
overlay[local?]
module;
private import DataFlowImplSpecific
private import codeql.dataflow.internal.DataFlowImpl
private import semmle.code.Location

View File

@@ -1,3 +1,6 @@
overlay[local?]
module;
private import DataFlowImplSpecific
private import semmle.code.Location
private import codeql.dataflow.internal.DataFlowImplCommon

View File

@@ -2,6 +2,8 @@
* Provides consistency queries for checking invariants in the language-specific
* data-flow classes and predicates.
*/
overlay[local?]
module;
private import java
private import DataFlowImplSpecific

View File

@@ -1,6 +1,8 @@
/**
* Provides Java-specific definitions for use in the data flow library.
*/
overlay[local?]
module;
private import semmle.code.Location
private import codeql.dataflow.DataFlow

View File

@@ -1,3 +1,6 @@
overlay[local?]
module;
private import java
private import semmle.code.java.dataflow.InstanceAccess
private import semmle.code.java.dataflow.ExternalFlow

View File

@@ -1,3 +1,6 @@
overlay[local?]
module;
private import java
private import DataFlowUtil
private import DataFlowImplCommon

View File

@@ -1,6 +1,8 @@
/**
* Basic definitions for use in the data flow library.
*/
overlay[local?]
module;
private import java
private import DataFlowPrivate
@@ -77,6 +79,7 @@ private module ThisFlow {
* Holds if data can flow from `node1` to `node2` in zero or more
* local (intra-procedural) steps.
*/
overlay[caller]
pragma[inline]
predicate localFlow(Node node1, Node node2) { node1 = node2 or localFlowStepPlus(node1, node2) }
@@ -86,6 +89,7 @@ private predicate localFlowStepPlus(Node node1, Node node2) = fastTC(localFlowSt
* Holds if data can flow from `e1` to `e2` in zero or more
* local (intra-procedural) steps.
*/
overlay[caller]
pragma[inline]
predicate localExprFlow(Expr e1, Expr e2) { localFlow(exprNode(e1), exprNode(e2)) }

View File

@@ -1,6 +1,8 @@
/**
* This module provides extensible predicates for defining MaD models.
*/
overlay[local?]
module;
/**
* Holds if a source model exists for the given parameters.

View File

@@ -1,6 +1,8 @@
/**
* Provides classes and predicates for defining flow summaries.
*/
overlay[local?]
module;
private import java
private import codeql.dataflow.internal.FlowSummaryImpl

View File

@@ -1,4 +1,6 @@
/** Provides classes and predicates for exclusions related to MaD models. */
overlay[local?]
module;
import java

Some files were not shown because too many files have changed in this diff Show More