Add some tests; improve buffer models

java/ql/test/library-tests/frameworks/netty/manual/Test.java

@@ -0,0 +1,31 @@
+import io.netty.channel.*;
+import io.netty.buffer.ByteBuf;
+// import io.netty.handler.codec.*;
+// import io.netty.handler.codec.http.*;
+
+class Test {
+    static <T> T source() { return null; }
+    static void sink(Object s) {}
+
+    class A extends ChannelInboundHandlerAdapter {
+        public void channelRead(ChannelHandlerContext ctx, Object msg) {
+            sink(msg); // $hasTaintFlow
+        }
+    }
+
+    class B extends ChannelInboundHandlerAdapter {
+        public void channelRead(ChannelHandlerContext ctx, Object msg) {
+            ByteBuf bb = (ByteBuf) msg;
+            byte[] data = new byte[1024];
+            bb.readBytes(data);
+            sink(data); // $hasTaintFlow
+        }
+    }
+
+    void test(ByteBuf bb, byte[] x) {
+        byte[] src = source();
+        bb.readBytes(x).setLong(3, 4).readerIndex(2).writeBytes(src).skipBytes(2);
+        sink(bb); // $ hasTaintFlow
+        sink(x);
+    }
+}

java/ql/test/library-tests/frameworks/netty/manual/options

@@ -0,0 +1 @@
+//semmle-extractor-options: --javac-args -cp ${testdir}/../../../../stubs/netty-4.1.x

java/ql/test/library-tests/frameworks/netty/manual/test.ql

@@ -0,0 +1,11 @@
+import java
+import semmle.code.java.dataflow.FlowSources
+import TestUtilities.InlineFlowTest
+
+class Conf extends DefaultTaintFlowConf {
+  override predicate isSource(DataFlow::Node node) {
+    super.isSource(node)
+    or
+    node instanceof RemoteFlowSource
+  }
+}