Java: Deprecate the content of NumericCastTaintedLocalQuery, remove the local query variant and update the non-local query variant.

java/ql/lib/semmle/code/java/security/NumericCastTaintedQuery.qll

@@ -113,7 +113,7 @@ module NumericCastFlow = TaintTracking::Global<NumericCastFlowConfig>;
  * A taint-tracking configuration for reasoning about local user input that is
  * used in a numeric cast.
  */
-module NumericCastLocalFlowConfig implements DataFlow::ConfigSig {
+deprecated module NumericCastLocalFlowConfig implements DataFlow::ConfigSig {
   predicate isSource(DataFlow::Node src) { src instanceof LocalUserInput }
 
   predicate isSink(DataFlow::Node sink) {
@@ -134,6 +134,8 @@ module NumericCastLocalFlowConfig implements DataFlow::ConfigSig {
 }
 
 /**
+ * DEPRECATED: Use `NumericCastFlow` instead and configure threat model sources to include `local`.
+ *
  * Taint-tracking flow for local user input that is used in a numeric cast.
  */
-module NumericCastLocalFlow = TaintTracking::Global<NumericCastLocalFlowConfig>;
+deprecated module NumericCastLocalFlow = TaintTracking::Global<NumericCastLocalFlowConfig>;

java/ql/src/Security/CWE/CWE-681/NumericCastTaintedLocal.qhelp

@@ -1,5 +0,0 @@
-<!DOCTYPE qhelp PUBLIC
-  "-//Semmle//qhelp//EN"
-  "qhelp.dtd">
-<qhelp>
-<include src="NumericCastTainted.qhelp" /></qhelp>

java/ql/src/Security/CWE/CWE-681/NumericCastTaintedLocal.ql

@@ -1,29 +0,0 @@
-/**
- * @name Local-user-controlled data in numeric cast
- * @description Casting user-controlled numeric data to a narrower type without validation
- *              can cause unexpected truncation.
- * @kind path-problem
- * @problem.severity recommendation
- * @security-severity 9.0
- * @precision medium
- * @id java/tainted-numeric-cast-local
- * @tags security
- *       external/cwe/cwe-197
- *       external/cwe/cwe-681
- */
-
-import java
-import semmle.code.java.security.NumericCastTaintedQuery
-import NumericCastLocalFlow::PathGraph
-
-from
-  NumericCastLocalFlow::PathNode source, NumericCastLocalFlow::PathNode sink,
-  NumericNarrowingCastExpr exp, VarAccess tainted
-where
-  exp.getExpr() = tainted and
-  sink.getNode().asExpr() = tainted and
-  NumericCastLocalFlow::flowPath(source, sink) and
-  not exists(RightShiftOp e | e.getShiftedVariable() = tainted.getVariable())
-select exp, source, sink,
-  "This cast to a narrower type depends on a $@, potentially causing truncation.", source.getNode(),
-  "user-provided value"

java/ql/test/query-tests/security/CWE-681/semmle/tests/NumericCastTainted.ext.yml

@@ -0,0 +1,6 @@
+extensions:
+  - addsTo:
+      pack: codeql/threat-models
+      extensible: threatModelConfiguration
+    data:
+      - ["local", true, 0]

java/ql/test/query-tests/security/CWE-681/semmle/tests/NumericCastTainted.qlref

@@ -0,0 +1 @@
+Security/CWE/CWE-681/NumericCastTainted.ql

java/ql/test/query-tests/security/CWE-681/semmle/tests/NumericCastTaintedLocal.qlref

@@ -1 +0,0 @@
-Security/CWE/CWE-681/NumericCastTaintedLocal.ql