extensions: - addsTo: pack: codeql/java-all extensible: neutralModel data: # summary neutrals - ["java.text", "Format", "format", "", "summary", "manual"] # similar issue as `Object.toString`; depends on the object being passed as the argument - ["java.text", "MessageFormat", "format", "", "summary", "manual"] # similar issue as `Object.toString`; depends on the object being passed as the argument # The below APIs have numeric flow and are currently being stored as neutral models. # These may be changed to summary models with kinds "value-numeric" and "taint-numeric" (or similar) in the future. - ["java.text", "DateFormat", "format", "(Date)", "summary", "manual"] # taint-numeric - ["java.text", "DateFormat", "parse", "(String)", "summary", "manual"] # taint-numeric - ["java.text", "SimpleDateFormat", "SimpleDateFormat", "(String)", "summary", "manual"] # taint-numeric # sink neutrals - ["java.text", "Collator", "compare", "", "sink", "hq-manual"] - ["java.text", "Collator", "equals", "", "sink", "hq-manual"] - ["java.text", "RuleBasedCollator", "compare", "", "sink", "hq-manual"]