Merge pull request #11572 from jcogs33/jcogs33/model-top-jdk-apis

Java: model top 100 JDK APIs
2025-12-17 01:03:14 +01:00 · 2022-12-20 09:13:53 -05:00
parent 073e9bc52f dc0bad3dc5
commit c9258effb6
26 changed files with 328 additions and 2 deletions
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/FlowSummaryImpl.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/FlowSummaryImpl.qll
@@ -260,6 +260,12 @@ module Public {
     *  Holds if the neutral is auto generated.
     */
    predicate isAutoGenerated() { neutralElement(this, true) }
+
+    /**
+     * Holds if the neutral has the given provenance where `true` is
+     * `generated` and `false` is `manual`.
+     */
+    predicate hasProvenance(boolean generated) { neutralElement(this, generated) }
  }
 }

--- a/go/ql/lib/semmle/go/dataflow/internal/FlowSummaryImpl.qll
+++ b/go/ql/lib/semmle/go/dataflow/internal/FlowSummaryImpl.qll
@@ -260,6 +260,12 @@ module Public {
     *  Holds if the neutral is auto generated.
     */
    predicate isAutoGenerated() { neutralElement(this, true) }
+
+    /**
+     * Holds if the neutral has the given provenance where `true` is
+     * `generated` and `false` is `manual`.
+     */
+    predicate hasProvenance(boolean generated) { neutralElement(this, generated) }
  }
 }

--- a/java/ql/lib/change-notes/2022-12-16-add-top-jdk-models.md
+++ b/java/ql/lib/change-notes/2022-12-16-add-top-jdk-models.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Added more dataflow models for frequently-used JDK APIs.
--- a/java/ql/lib/ext/java.lang.model.yml
+++ b/java/ql/lib/ext/java.lang.model.yml
@@ -37,12 +37,17 @@ extensions:
      - ["java.lang", "CharSequence", True, "charAt", "", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
      - ["java.lang", "CharSequence", True, "subSequence", "", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
      - ["java.lang", "CharSequence", True, "toString", "", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
+      - ["java.lang", "IllegalArgumentException", False, "IllegalArgumentException", "(String)", "", "Argument[0]", "Argument[-1].SyntheticField[java.lang.Throwable.message]", "value", "manual"]
+      - ["java.lang", "IllegalStateException", False, "IllegalStateException", "(String)", "", "Argument[0]", "Argument[-1].SyntheticField[java.lang.Throwable.message]", "value", "manual"]
+      - ["java.lang", "Integer", False, "parseInt", "(String)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
      - ["java.lang", "Iterable", True, "forEach", "(Consumer)", "", "Argument[-1].Element", "Argument[0].Parameter[0]", "value", "manual"]
      - ["java.lang", "Iterable", True, "iterator", "()", "", "Argument[-1].Element", "ReturnValue.Element", "value", "manual"]
      - ["java.lang", "Iterable", True, "spliterator", "()", "", "Argument[-1].Element", "ReturnValue.Element", "value", "manual"]
      - ["java.lang", "Object", True, "clone", "", "", "Argument[-1].Element", "ReturnValue.Element", "value", "manual"]
      - ["java.lang", "Object", True, "clone", "", "", "Argument[-1].MapKey", "ReturnValue.MapKey", "value", "manual"]
      - ["java.lang", "Object", True, "clone", "", "", "Argument[-1].MapValue", "ReturnValue.MapValue", "value", "manual"]
+      - ["java.lang", "RuntimeException", False, "RuntimeException", "(String)", "", "Argument[0]", "Argument[-1].SyntheticField[java.lang.Throwable.message]", "value", "manual"]
+      - ["java.lang", "RuntimeException", False, "RuntimeException", "(Throwable)", "", "Argument[0]", "Argument[-1].SyntheticField[java.lang.Throwable.cause]", "value", "manual"]
      - ["java.lang", "String", False, "String", "", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
      - ["java.lang", "String", False, "concat", "(String)", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
      - ["java.lang", "String", False, "concat", "(String)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
@@ -82,7 +87,34 @@ extensions:
      - ["java.lang", "String", False, "valueOf", "(char)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
      - ["java.lang", "String", False, "valueOf", "(char[])", "", "Argument[0]", "ReturnValue", "taint", "manual"]
      - ["java.lang", "String", False, "valueOf", "(char[],int,int)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
+      - ["java.lang", "String", False, "valueOf", "(int)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
      - ["java.lang", "StringBuffer", True, "StringBuffer", "(CharSequence)", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
      - ["java.lang", "StringBuffer", True, "StringBuffer", "(String)", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
      - ["java.lang", "StringBuilder", True, "StringBuilder", "", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
      - ["java.lang", "System", False, "arraycopy", "", "", "Argument[0]", "Argument[2]", "taint", "manual"]
+      - ["java.lang", "Throwable", False, "Throwable", "(Throwable)", "", "Argument[0]", "Argument[-1].SyntheticField[java.lang.Throwable.cause]", "value", "manual"]
+      - ["java.lang", "Throwable", False, "getCause", "()", "", "Argument[-1].SyntheticField[java.lang.Throwable.cause]", "ReturnValue", "value", "manual"]
+      - ["java.lang", "Throwable", False, "getMessage", "()", "", "Argument[-1].SyntheticField[java.lang.Throwable.message]", "ReturnValue", "value", "manual"]
+
+  - addsTo:
+      pack: codeql/java-all
+      extensible: neutralModel
+    data:
+      - ["java.lang", "Class", "getName", "()", "manual"]
+      - ["java.lang", "Class", "getSimpleName", "()", "manual"]
+      - ["java.lang", "Enum", "Enum", "(String,int)", "manual"]
+      - ["java.lang", "Enum", "equals", "(Object)", "manual"]
+      - ["java.lang", "Enum", "name", "()", "manual"]
+      - ["java.lang", "Enum", "toString", "()", "manual"]
+      - ["java.lang", "Object", "equals", "(Object)", "manual"]
+      - ["java.lang", "Object", "getClass", "()", "manual"]
+      - ["java.lang", "Object", "hashCode", "()", "manual"]
+      - ["java.lang", "Object", "toString", "()", "manual"]
+      - ["java.lang", "String", "contains", "(CharSequence)", "manual"]
+      - ["java.lang", "String", "equals", "(Object)", "manual"]
+      - ["java.lang", "String", "equalsIgnoreCase", "(String)", "manual"]
+      - ["java.lang", "String", "hashCode", "()", "manual"]
+      - ["java.lang", "String", "isEmpty", "()", "manual"]
+      - ["java.lang", "String", "length", "()", "manual"]
+      - ["java.lang", "String", "startsWith", "(String)", "manual"]
+      - ["java.lang", "System", "currentTimeMillis", "()", "manual"]
--- a/java/ql/lib/ext/java.math.model.yml
+++ b/java/ql/lib/ext/java.math.model.yml
@@ -0,0 +1,6 @@
+extensions:
+  - addsTo:
+      pack: codeql/java-all
+      extensible: summaryModel
+    data:
+      - ["java.math", "BigDecimal", False, "BigDecimal", "(String)", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
--- a/java/ql/lib/ext/java.sql.model.yml
+++ b/java/ql/lib/ext/java.sql.model.yml
@@ -14,3 +14,9 @@ extensions:
      - ["java.sql", "Statement", True, "executeLargeUpdate", "", "", "Argument[0]", "sql", "manual"]
      - ["java.sql", "Statement", True, "executeQuery", "", "", "Argument[0]", "sql", "manual"]
      - ["java.sql", "Statement", True, "executeUpdate", "", "", "Argument[0]", "sql", "manual"]
+
+  - addsTo:
+      pack: codeql/java-all
+      extensible: summaryModel
+    data:
+      - ["java.sql", "ResultSet", True, "getString", "(String)", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
--- a/java/ql/lib/ext/java.util.model.yml
+++ b/java/ql/lib/ext/java.util.model.yml
@@ -355,3 +355,26 @@ extensions:
      - ["java.util", "Vector", True, "setElementAt", "(Object,int)", "", "Argument[0]", "Argument[-1].Element", "value", "manual"]
      - ["java.util", "WeakHashMap", False, "WeakHashMap", "(Map)", "", "Argument[0].MapKey", "Argument[-1].MapKey", "value", "manual"]
      - ["java.util", "WeakHashMap", False, "WeakHashMap", "(Map)", "", "Argument[0].MapValue", "Argument[-1].MapValue", "value", "manual"]
+
+  - addsTo:
+      pack: codeql/java-all
+      extensible: neutralModel
+    data:
+      - ["java.util", "Collections", "emptyList", "()", "manual"]
+      - ["java.util", "Collection", "size", "()", "manual"]
+      - ["java.util", "Iterator", "hasNext", "()", "manual"]
+      - ["java.util", "List", "contains", "(Object)", "manual"]
+      - ["java.util", "List", "isEmpty", "()", "manual"]
+      - ["java.util", "List", "size", "()", "manual"]
+      - ["java.util", "Map", "containsKey", "(Object)", "manual"]
+      - ["java.util", "Map", "isEmpty", "()", "manual"]
+      - ["java.util", "Map", "size", "()", "manual"]
+      - ["java.util", "Objects", "equals", "(Object,Object)", "manual"]
+      - ["java.util", "Objects", "hash", "(Object[])", "manual"]
+      - ["java.util", "Optional", "empty", "()", "manual"]
+      - ["java.util", "Optional", "isPresent", "()", "manual"]
+      - ["java.util", "Set", "contains", "(Object)", "manual"]
+      - ["java.util", "Set", "isEmpty", "()", "manual"]
+      - ["java.util", "Set", "size", "()", "manual"]
+      - ["java.util", "UUID", "randomUUID", "()", "manual"]
+      - ["java.util", "UUID", "toString", "()", "manual"]
--- a/java/ql/lib/ext/java.util.stream.model.yml
+++ b/java/ql/lib/ext/java.util.stream.model.yml
@@ -87,3 +87,9 @@ extensions:
      - ["java.util.stream", "Stream", True, "takeWhile", "(Predicate)", "", "Argument[-1].Element", "ReturnValue.Element", "value", "manual"]
      - ["java.util.stream", "Stream", True, "toArray", "", "", "Argument[-1].Element", "ReturnValue.ArrayElement", "value", "manual"]
      - ["java.util.stream", "Stream", True, "toList", "()", "", "Argument[-1].Element", "ReturnValue.Element", "value", "manual"]
+
+  - addsTo:
+      pack: codeql/java-all
+      extensible: neutralModel
+    data:
+      - ["java.util.stream", "Collectors", "toList", "()", "manual"]
--- a/java/ql/lib/semmle/code/java/dataflow/internal/FlowSummaryImpl.qll
+++ b/java/ql/lib/semmle/code/java/dataflow/internal/FlowSummaryImpl.qll
@@ -260,6 +260,12 @@ module Public {
     *  Holds if the neutral is auto generated.
     */
    predicate isAutoGenerated() { neutralElement(this, true) }
+
+    /**
+     * Holds if the neutral has the given provenance where `true` is
+     * `generated` and `false` is `manual`.
+     */
+    predicate hasProvenance(boolean generated) { neutralElement(this, generated) }
  }
 }

--- a/java/ql/test/experimental/query-tests/security/CWE-400/ThreadResourceAbuse.expected
+++ b/java/ql/test/experimental/query-tests/security/CWE-400/ThreadResourceAbuse.expected
@@ -12,8 +12,14 @@ edges
 | ThreadResourceAbuse.java:71:15:71:17 | parameter this [waitTime] : Number | ThreadResourceAbuse.java:74:18:74:25 | this <.field> [waitTime] : Number |
 | ThreadResourceAbuse.java:74:18:74:25 | this <.field> [waitTime] : Number | ThreadResourceAbuse.java:74:18:74:25 | waitTime |
 | ThreadResourceAbuse.java:141:27:141:43 | getValue(...) : String | ThreadResourceAbuse.java:144:34:144:42 | delayTime |
+| ThreadResourceAbuse.java:172:19:172:50 | getHeader(...) : String | ThreadResourceAbuse.java:173:37:173:42 | header : String |
 | ThreadResourceAbuse.java:172:19:172:50 | getHeader(...) : String | ThreadResourceAbuse.java:176:17:176:26 | retryAfter |
+| ThreadResourceAbuse.java:173:20:173:43 | parseInt(...) : Number | ThreadResourceAbuse.java:176:17:176:26 | retryAfter |
+| ThreadResourceAbuse.java:173:37:173:42 | header : String | ThreadResourceAbuse.java:173:20:173:43 | parseInt(...) : Number |
+| ThreadResourceAbuse.java:206:28:206:56 | getParameter(...) : String | ThreadResourceAbuse.java:207:39:207:52 | uploadDelayStr : String |
 | ThreadResourceAbuse.java:206:28:206:56 | getParameter(...) : String | ThreadResourceAbuse.java:209:49:209:59 | uploadDelay : Number |
+| ThreadResourceAbuse.java:207:22:207:53 | parseInt(...) : Number | ThreadResourceAbuse.java:209:49:209:59 | uploadDelay : Number |
+| ThreadResourceAbuse.java:207:39:207:52 | uploadDelayStr : String | ThreadResourceAbuse.java:207:22:207:53 | parseInt(...) : Number |
 | ThreadResourceAbuse.java:209:30:209:87 | new UploadListener(...) [slowUploads] : Number | UploadListener.java:28:14:28:19 | parameter this [slowUploads] : Number |
 | ThreadResourceAbuse.java:209:49:209:59 | uploadDelay : Number | ThreadResourceAbuse.java:209:30:209:87 | new UploadListener(...) [slowUploads] : Number |
 | ThreadResourceAbuse.java:209:49:209:59 | uploadDelay : Number | UploadListener.java:15:24:15:44 | sleepMilliseconds : Number |
@@ -42,8 +48,12 @@ nodes
 | ThreadResourceAbuse.java:141:27:141:43 | getValue(...) : String | semmle.label | getValue(...) : String |
 | ThreadResourceAbuse.java:144:34:144:42 | delayTime | semmle.label | delayTime |
 | ThreadResourceAbuse.java:172:19:172:50 | getHeader(...) : String | semmle.label | getHeader(...) : String |
+| ThreadResourceAbuse.java:173:20:173:43 | parseInt(...) : Number | semmle.label | parseInt(...) : Number |
+| ThreadResourceAbuse.java:173:37:173:42 | header : String | semmle.label | header : String |
 | ThreadResourceAbuse.java:176:17:176:26 | retryAfter | semmle.label | retryAfter |
 | ThreadResourceAbuse.java:206:28:206:56 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| ThreadResourceAbuse.java:207:22:207:53 | parseInt(...) : Number | semmle.label | parseInt(...) : Number |
+| ThreadResourceAbuse.java:207:39:207:52 | uploadDelayStr : String | semmle.label | uploadDelayStr : String |
 | ThreadResourceAbuse.java:209:30:209:87 | new UploadListener(...) [slowUploads] : Number | semmle.label | new UploadListener(...) [slowUploads] : Number |
 | ThreadResourceAbuse.java:209:49:209:59 | uploadDelay : Number | semmle.label | uploadDelay : Number |
 | UploadListener.java:15:24:15:44 | sleepMilliseconds : Number | semmle.label | sleepMilliseconds : Number |
--- a/java/ql/test/experimental/query-tests/security/CWE-755/NFEAndroidDoS.expected
+++ b/java/ql/test/experimental/query-tests/security/CWE-755/NFEAndroidDoS.expected
@@ -3,8 +3,12 @@ edges
 | NFEAndroidDoS.java:13:24:13:61 | getStringExtra(...) : Object | NFEAndroidDoS.java:14:21:14:51 | parseDouble(...) |
 | NFEAndroidDoS.java:22:21:22:31 | getIntent(...) : Intent | NFEAndroidDoS.java:22:21:22:55 | getStringExtra(...) : Object |
 | NFEAndroidDoS.java:22:21:22:55 | getStringExtra(...) : Object | NFEAndroidDoS.java:23:15:23:40 | parseInt(...) |
+| NFEAndroidDoS.java:22:21:22:55 | getStringExtra(...) : Object | NFEAndroidDoS.java:23:32:23:39 | widthStr : Object |
+| NFEAndroidDoS.java:23:32:23:39 | widthStr : Object | NFEAndroidDoS.java:23:15:23:40 | parseInt(...) |
 | NFEAndroidDoS.java:25:22:25:32 | getIntent(...) : Intent | NFEAndroidDoS.java:25:22:25:57 | getStringExtra(...) : Object |
 | NFEAndroidDoS.java:25:22:25:57 | getStringExtra(...) : Object | NFEAndroidDoS.java:26:16:26:42 | parseInt(...) |
+| NFEAndroidDoS.java:25:22:25:57 | getStringExtra(...) : Object | NFEAndroidDoS.java:26:33:26:41 | heightStr : Object |
+| NFEAndroidDoS.java:26:33:26:41 | heightStr : Object | NFEAndroidDoS.java:26:16:26:42 | parseInt(...) |
 | NFEAndroidDoS.java:43:24:43:34 | getIntent(...) : Intent | NFEAndroidDoS.java:43:24:43:61 | getStringExtra(...) : Object |
 | NFEAndroidDoS.java:43:24:43:61 | getStringExtra(...) : Object | NFEAndroidDoS.java:44:21:44:43 | new Double(...) |
 | NFEAndroidDoS.java:43:24:43:61 | getStringExtra(...) : Object | NFEAndroidDoS.java:47:21:47:47 | valueOf(...) |
@@ -15,9 +19,11 @@ nodes
 | NFEAndroidDoS.java:22:21:22:31 | getIntent(...) : Intent | semmle.label | getIntent(...) : Intent |
 | NFEAndroidDoS.java:22:21:22:55 | getStringExtra(...) : Object | semmle.label | getStringExtra(...) : Object |
 | NFEAndroidDoS.java:23:15:23:40 | parseInt(...) | semmle.label | parseInt(...) |
+| NFEAndroidDoS.java:23:32:23:39 | widthStr : Object | semmle.label | widthStr : Object |
 | NFEAndroidDoS.java:25:22:25:32 | getIntent(...) : Intent | semmle.label | getIntent(...) : Intent |
 | NFEAndroidDoS.java:25:22:25:57 | getStringExtra(...) : Object | semmle.label | getStringExtra(...) : Object |
 | NFEAndroidDoS.java:26:16:26:42 | parseInt(...) | semmle.label | parseInt(...) |
+| NFEAndroidDoS.java:26:33:26:41 | heightStr : Object | semmle.label | heightStr : Object |
 | NFEAndroidDoS.java:43:24:43:34 | getIntent(...) : Intent | semmle.label | getIntent(...) : Intent |
 | NFEAndroidDoS.java:43:24:43:61 | getStringExtra(...) : Object | semmle.label | getStringExtra(...) : Object |
 | NFEAndroidDoS.java:44:21:44:43 | new Double(...) | semmle.label | new Double(...) |
--- a/java/ql/test/ext/TestModels/Test.java
+++ b/java/ql/test/ext/TestModels/Test.java
@@ -0,0 +1,45 @@
+import java.math.BigDecimal;
+import java.sql.ResultSet;
+
+public class Test {
+
+    void sink(Object o) { }
+
+    Object source() { return null; }
+
+    public void test() throws Exception {
+
+        Exception e1 = new RuntimeException((String)source());
+        sink((String)e1.getMessage()); // $hasValueFlow
+
+        Exception e2 = new RuntimeException((Throwable)source());
+        sink((Throwable)e2.getCause()); // $hasValueFlow
+
+        Exception e3 = new IllegalArgumentException((String)source());
+        sink((String)e3.getMessage()); // $hasValueFlow
+
+        Exception e4 = new IllegalStateException((String)source());
+        sink((String)e4.getMessage()); // $hasValueFlow
+
+        Throwable t = new Throwable((Throwable)source());
+        sink((Throwable)t.getCause()); // $hasValueFlow
+
+        Integer x = (Integer)source();
+        int y = x;
+        sink(String.valueOf(y)); // $hasTaintFlow
+
+        String s1 = (String)source();
+        sink(Integer.parseInt(s1)); // $hasTaintFlow
+
+        String s2 = (String)source();
+        int i = 0;
+        sink(s2.charAt(i)); // $hasTaintFlow
+
+        String s3 = (String)source();
+        sink(new BigDecimal(s3)); // $hasTaintFlow
+
+        ResultSet rs = (ResultSet)source();
+        sink(rs.getString("")); // $hasTaintFlow
+
+    }
+}
--- a/java/ql/test/ext/TestModels/test.expected
+++ b/java/ql/test/ext/TestModels/test.expected
--- a/java/ql/test/ext/TestModels/test.ql
+++ b/java/ql/test/ext/TestModels/test.ql
@@ -0,0 +1,2 @@
+import java
+import TestUtilities.InlineFlowTest
--- a/java/ql/test/ext/TopJdkApis/TopJdkApis.qll
+++ b/java/ql/test/ext/TopJdkApis/TopJdkApis.qll
@@ -0,0 +1,97 @@
+/** Provides classes and predicates for working with Top JDK APIs. */
+
+import java
+private import semmle.code.java.dataflow.FlowSummary
+private import semmle.code.java.dataflow.internal.FlowSummaryImpl as FlowSummaryImpl
+private import semmle.code.java.dataflow.ExternalFlow
+
+/** Holds if the given API name is a top JDK API. */
+predicate topJdkApiName(string apiName) {
+  apiName in [
+      // top 100 JDK APIs
+      "java.lang.StringBuilder#append(String)", "java.util.List#get(int)",
+      "java.util.List#add(Object)", "java.util.Map#put(Object,Object)",
+      "java.lang.String#equals(Object)", "java.util.Map#get(Object)", "java.util.List#size()",
+      "java.util.Collection#stream()", "java.lang.Object#getClass()",
+      "java.util.stream.Stream#collect(Collector)", "java.util.Objects#equals(Object,Object)",
+      "java.lang.String#format(String,Object[])", "java.util.stream.Stream#map(Function)",
+      "java.lang.Throwable#getMessage()", "java.util.Arrays#asList(Object[])",
+      "java.lang.String#equalsIgnoreCase(String)", "java.util.List#isEmpty()",
+      "java.util.Set#add(Object)", "java.util.HashMap#put(Object,Object)",
+      "java.util.stream.Collectors#toList()", "java.lang.StringBuilder#append(char)",
+      "java.util.stream.Stream#filter(Predicate)", "java.lang.String#length()",
+      "java.lang.Enum#name()", "java.lang.Object#toString()", "java.util.Optional#get()",
+      "java.lang.StringBuilder#toString()",
+      "java.lang.IllegalArgumentException#IllegalArgumentException(String)",
+      "java.lang.Class#getName()", "java.lang.Enum#Enum(String,int)",
+      "java.io.PrintWriter#write(String)", "java.util.Entry#getValue()", "java.util.Entry#getKey()",
+      "java.util.Iterator#next()", "java.lang.Object#hashCode()",
+      "java.util.Optional#orElse(Object)", "java.lang.StringBuffer#append(String)",
+      "java.util.Collections#singletonList(Object)", "java.lang.Iterable#forEach(Consumer)",
+      "java.util.Optional#of(Object)", "java.lang.String#contains(CharSequence)",
+      "java.util.ArrayList#add(Object)", "java.util.Optional#ofNullable(Object)",
+      "java.util.Collections#emptyList()", "java.math.BigDecimal#BigDecimal(String)",
+      "java.lang.System#currentTimeMillis()", "java.lang.Object#equals(Object)",
+      "java.util.Map#containsKey(Object)", "java.util.Optional#isPresent()",
+      "java.lang.String#trim()", "java.util.List#addAll(Collection)",
+      "java.util.Set#contains(Object)", "java.util.Optional#map(Function)",
+      "java.util.Map#entrySet()", "java.util.Optional#empty()",
+      "java.lang.Integer#parseInt(String)", "java.lang.String#startsWith(String)",
+      "java.lang.IllegalStateException#IllegalStateException(String)",
+      "java.lang.Enum#equals(Object)", "java.util.Iterator#hasNext()",
+      "java.util.List#contains(Object)", "java.lang.String#substring(int,int)",
+      "java.util.List#of(Object)", "java.util.Objects#hash(Object[])",
+      "java.lang.RuntimeException#RuntimeException(String)", "java.lang.String#isEmpty()",
+      "java.lang.String#replace(CharSequence,CharSequence)", "java.util.Set#size()",
+      "java.io.File#File(String)", "java.lang.StringBuilder#append(Object)",
+      "java.lang.String#split(String)", "java.util.Map#values()", "java.util.UUID#randomUUID()",
+      "java.util.ArrayList#ArrayList(Collection)", "java.util.Map#keySet()",
+      "java.sql.ResultSet#getString(String)", "java.lang.String#hashCode()",
+      "java.lang.Throwable#Throwable(Throwable)", "java.util.HashMap#get(Object)",
+      "java.lang.Class#getSimpleName()", "java.util.Set#isEmpty()", "java.util.Map#size()",
+      "java.lang.String#substring(int)", "java.util.Map#remove(Object)",
+      "java.lang.Throwable#printStackTrace()", "java.util.stream.Stream#findFirst()",
+      "java.util.Optional#ifPresent(Consumer)", "java.lang.String#valueOf(Object)",
+      "java.lang.String#toLowerCase()", "java.util.UUID#toString()",
+      "java.lang.StringBuilder#append(int)", "java.util.Objects#requireNonNull(Object,String)",
+      "java.nio.file.Path#resolve(String)", "java.lang.Enum#toString()",
+      "java.lang.RuntimeException#RuntimeException(Throwable)", "java.util.Collection#size()",
+      "java.lang.String#charAt(int)", "java.util.stream.Stream#forEach(Consumer)",
+      "java.util.Map#isEmpty()", "java.lang.String#valueOf(int)"
+    ]
+}
+
+/** Holds if `c` has the MaD-formatted name `apiName`. */
+predicate hasApiName(Callable c, string apiName) {
+  apiName =
+    c.getDeclaringType().getPackage() + "." + c.getDeclaringType().getSourceDeclaration() + "#" +
+      c.getName() + paramsString(c)
+}
+
+/** A top JDK API. */
+class TopJdkApi extends SummarizedCallableBase {
+  TopJdkApi() {
+    exists(string apiName |
+      hasApiName(this.asCallable(), apiName) and
+      topJdkApiName(apiName)
+    )
+  }
+
+  /** Holds if this API has a manual summary model. */
+  private predicate hasManualSummary() { this.(SummarizedCallable).hasProvenance(false) }
+
+  /** Holds if this API has a manual neutral model. */
+  private predicate hasManualNeutral() {
+    this.(FlowSummaryImpl::Public::NeutralCallable).hasProvenance(false)
+  }
+
+  /** Holds if this API has a manual MaD model. */
+  predicate hasManualMadModel() { this.hasManualSummary() or this.hasManualNeutral() }
+  /*
+   * Note: the following top-100 APIs are not modeled with MaD:
+   * java.util.stream.Stream#collect(Collector) : handled separately on a case-by-case basis as it is too complex for MaD
+   * java.lang.String#valueOf(Object) : also a complex case; an alias for `Object.toString`, except the dispatch is hidden
+   * java.lang.Throwable#printStackTrace() : should probably not be a general step, but there might be specialised queries that care
+   */
+
+  }
--- a/java/ql/test/ext/TopJdkApis/TopJdkApisTest.expected
+++ b/java/ql/test/ext/TopJdkApis/TopJdkApisTest.expected
@@ -0,0 +1,3 @@
+| java.lang.String#valueOf(Object) | no manual model |
+| java.lang.Throwable#printStackTrace() | no manual model |
+| java.util.stream.Stream#collect(Collector) | no manual model |
--- a/java/ql/test/ext/TopJdkApis/TopJdkApisTest.java
+++ b/java/ql/test/ext/TopJdkApis/TopJdkApisTest.java
@@ -0,0 +1,14 @@
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.Objects;
+import java.util.UUID;
+import java.util.stream.Collectors;
+import java.util.Map;
+import java.util.HashMap;
+import java.math.BigDecimal;
+import java.sql.ResultSet;
+import java.lang.System;
+import java.lang.IllegalStateException;
+
+public class TopJdkApisTest { }
--- a/java/ql/test/ext/TopJdkApis/TopJdkApisTest.ql
+++ b/java/ql/test/ext/TopJdkApis/TopJdkApisTest.ql
@@ -0,0 +1,17 @@
+import java
+import TopJdkApis
+
+from string apiName, string message
+where
+  // top jdk api names for which there is no callable
+  topJdkApiName(apiName) and
+  not hasApiName(_, apiName) and
+  message = "no callable"
+  or
+  // top jdk api names for which there isn't a manual model
+  exists(TopJdkApi topApi |
+    not topApi.hasManualMadModel() and
+    hasApiName(topApi.asCallable(), apiName) and
+    message = "no manual model"
+  )
+select apiName, message order by apiName
--- a/java/ql/test/query-tests/Telemetry/UnsupportedExternalAPIs/Test.java
+++ b/java/ql/test/query-tests/Telemetry/UnsupportedExternalAPIs/Test.java
@@ -13,7 +13,7 @@ class ExternalApiUsage {

 		Duration d = java.time.Duration.ofMillis(1000); // not supported

-		long l = "foo".length(); // not interesting
+		long l = "foo".length(); // supported as a neutral model

 		AtomicReference<String> ref = new AtomicReference<>(); // not supported
 		ref.set("foo");
--- a/java/ql/test/query-tests/Telemetry/UnsupportedExternalAPIs/UnsupportedExternalAPIs.expected
+++ b/java/ql/test/query-tests/Telemetry/UnsupportedExternalAPIs/UnsupportedExternalAPIs.expected
@@ -1,4 +1,3 @@
 | java.lang.Class#isAssignableFrom(Class) | 1 |
-| java.lang.String#length() | 1 |
 | java.time.Duration#ofMillis(long) | 1 |
 | java.util.concurrent.atomic.AtomicReference#set(Object) | 1 |
--- a/java/ql/test/query-tests/security/CWE-129/semmle/tests/ImproperValidationOfArrayConstructionLocal.expected
+++ b/java/ql/test/query-tests/security/CWE-129/semmle/tests/ImproperValidationOfArrayConstructionLocal.expected
@@ -1,10 +1,14 @@
 edges
 | Test.java:76:27:76:60 | getProperty(...) : String | Test.java:78:37:78:48 | userProperty : String |
+| Test.java:78:20:78:56 | parseInt(...) : Number | Test.java:80:31:80:34 | size |
+| Test.java:78:20:78:56 | parseInt(...) : Number | Test.java:86:34:86:37 | size |
 | Test.java:78:37:78:48 | userProperty : String | Test.java:78:37:78:55 | trim(...) : String |
+| Test.java:78:37:78:55 | trim(...) : String | Test.java:78:20:78:56 | parseInt(...) : Number |
 | Test.java:78:37:78:55 | trim(...) : String | Test.java:80:31:80:34 | size |
 | Test.java:78:37:78:55 | trim(...) : String | Test.java:86:34:86:37 | size |
 nodes
 | Test.java:76:27:76:60 | getProperty(...) : String | semmle.label | getProperty(...) : String |
+| Test.java:78:20:78:56 | parseInt(...) : Number | semmle.label | parseInt(...) : Number |
 | Test.java:78:37:78:48 | userProperty : String | semmle.label | userProperty : String |
 | Test.java:78:37:78:55 | trim(...) : String | semmle.label | trim(...) : String |
 | Test.java:80:31:80:34 | size | semmle.label | size |
--- a/java/ql/test/query-tests/security/CWE-129/semmle/tests/ImproperValidationOfArrayIndexLocal.expected
+++ b/java/ql/test/query-tests/security/CWE-129/semmle/tests/ImproperValidationOfArrayIndexLocal.expected
@@ -1,9 +1,12 @@
 edges
 | Test.java:14:27:14:60 | getProperty(...) : String | Test.java:16:38:16:49 | userProperty : String |
+| Test.java:16:21:16:57 | parseInt(...) : Number | Test.java:19:34:19:38 | index |
 | Test.java:16:38:16:49 | userProperty : String | Test.java:16:38:16:56 | trim(...) : String |
+| Test.java:16:38:16:56 | trim(...) : String | Test.java:16:21:16:57 | parseInt(...) : Number |
 | Test.java:16:38:16:56 | trim(...) : String | Test.java:19:34:19:38 | index |
 nodes
 | Test.java:14:27:14:60 | getProperty(...) : String | semmle.label | getProperty(...) : String |
+| Test.java:16:21:16:57 | parseInt(...) : Number | semmle.label | parseInt(...) : Number |
 | Test.java:16:38:16:49 | userProperty : String | semmle.label | userProperty : String |
 | Test.java:16:38:16:56 | trim(...) : String | semmle.label | trim(...) : String |
 | Test.java:19:34:19:38 | index | semmle.label | index |
--- a/java/ql/test/query-tests/security/CWE-190/semmle/tests/ArithmeticTaintedLocal.expected
+++ b/java/ql/test/query-tests/security/CWE-190/semmle/tests/ArithmeticTaintedLocal.expected
@@ -11,8 +11,19 @@ edges
 | ArithmeticTainted.java:19:26:19:39 | readerBuffered : BufferedReader | ArithmeticTainted.java:19:26:19:50 | readLine(...) : String |
 | ArithmeticTainted.java:19:26:19:50 | readLine(...) : String | ArithmeticTainted.java:21:29:21:40 | stringNumber : String |
 | ArithmeticTainted.java:19:26:19:50 | readLine(...) : String | ArithmeticTainted.java:21:29:21:40 | stringNumber : String |
+| ArithmeticTainted.java:21:12:21:48 | parseInt(...) : Number | ArithmeticTainted.java:32:17:32:20 | data |
+| ArithmeticTainted.java:21:12:21:48 | parseInt(...) : Number | ArithmeticTainted.java:40:17:40:20 | data |
+| ArithmeticTainted.java:21:12:21:48 | parseInt(...) : Number | ArithmeticTainted.java:50:17:50:20 | data |
+| ArithmeticTainted.java:21:12:21:48 | parseInt(...) : Number | ArithmeticTainted.java:64:20:64:23 | data : Number |
+| ArithmeticTainted.java:21:12:21:48 | parseInt(...) : Number | ArithmeticTainted.java:95:37:95:40 | data |
+| ArithmeticTainted.java:21:12:21:48 | parseInt(...) : Number | ArithmeticTainted.java:118:9:118:12 | data : Number |
+| ArithmeticTainted.java:21:12:21:48 | parseInt(...) : Number | ArithmeticTainted.java:119:10:119:13 | data : Number |
+| ArithmeticTainted.java:21:12:21:48 | parseInt(...) : Number | ArithmeticTainted.java:120:10:120:13 | data : Number |
+| ArithmeticTainted.java:21:12:21:48 | parseInt(...) : Number | ArithmeticTainted.java:121:10:121:13 | data : Number |
 | ArithmeticTainted.java:21:29:21:40 | stringNumber : String | ArithmeticTainted.java:21:29:21:47 | trim(...) : String |
 | ArithmeticTainted.java:21:29:21:40 | stringNumber : String | ArithmeticTainted.java:21:29:21:47 | trim(...) : String |
+| ArithmeticTainted.java:21:29:21:47 | trim(...) : String | ArithmeticTainted.java:21:12:21:48 | parseInt(...) : Number |
+| ArithmeticTainted.java:21:29:21:47 | trim(...) : String | ArithmeticTainted.java:21:12:21:48 | parseInt(...) : Number |
 | ArithmeticTainted.java:21:29:21:47 | trim(...) : String | ArithmeticTainted.java:32:17:32:20 | data |
 | ArithmeticTainted.java:21:29:21:47 | trim(...) : String | ArithmeticTainted.java:40:17:40:20 | data |
 | ArithmeticTainted.java:21:29:21:47 | trim(...) : String | ArithmeticTainted.java:50:17:50:20 | data |
@@ -53,6 +64,8 @@ nodes
 | ArithmeticTainted.java:19:26:19:39 | readerBuffered : BufferedReader | semmle.label | readerBuffered : BufferedReader |
 | ArithmeticTainted.java:19:26:19:50 | readLine(...) : String | semmle.label | readLine(...) : String |
 | ArithmeticTainted.java:19:26:19:50 | readLine(...) : String | semmle.label | readLine(...) : String |
+| ArithmeticTainted.java:21:12:21:48 | parseInt(...) : Number | semmle.label | parseInt(...) : Number |
+| ArithmeticTainted.java:21:12:21:48 | parseInt(...) : Number | semmle.label | parseInt(...) : Number |
 | ArithmeticTainted.java:21:29:21:40 | stringNumber : String | semmle.label | stringNumber : String |
 | ArithmeticTainted.java:21:29:21:40 | stringNumber : String | semmle.label | stringNumber : String |
 | ArithmeticTainted.java:21:29:21:47 | trim(...) : String | semmle.label | trim(...) : String |
--- a/python/ql/lib/semmle/python/dataflow/new/internal/FlowSummaryImpl.qll
+++ b/python/ql/lib/semmle/python/dataflow/new/internal/FlowSummaryImpl.qll
@@ -260,6 +260,12 @@ module Public {
     *  Holds if the neutral is auto generated.
     */
    predicate isAutoGenerated() { neutralElement(this, true) }
+
+    /**
+     * Holds if the neutral has the given provenance where `true` is
+     * `generated` and `false` is `manual`.
+     */
+    predicate hasProvenance(boolean generated) { neutralElement(this, generated) }
  }
 }

--- a/ruby/ql/lib/codeql/ruby/dataflow/internal/FlowSummaryImpl.qll
+++ b/ruby/ql/lib/codeql/ruby/dataflow/internal/FlowSummaryImpl.qll
@@ -260,6 +260,12 @@ module Public {
     *  Holds if the neutral is auto generated.
     */
    predicate isAutoGenerated() { neutralElement(this, true) }
+
+    /**
+     * Holds if the neutral has the given provenance where `true` is
+     * `generated` and `false` is `manual`.
+     */
+    predicate hasProvenance(boolean generated) { neutralElement(this, generated) }
  }
 }

--- a/swift/ql/lib/codeql/swift/dataflow/internal/FlowSummaryImpl.qll
+++ b/swift/ql/lib/codeql/swift/dataflow/internal/FlowSummaryImpl.qll
@@ -260,6 +260,12 @@ module Public {
     *  Holds if the neutral is auto generated.
     */
    predicate isAutoGenerated() { neutralElement(this, true) }
+
+    /**
+     * Holds if the neutral has the given provenance where `true` is
+     * `generated` and `false` is `manual`.
+     */
+    predicate hasProvenance(boolean generated) { neutralElement(this, generated) }
  }
 }