import java import semmle.code.java.dataflow.DataFlow import semmle.code.java.dataflow.ExternalFlow import semmle.code.java.dataflow.TaintTracking import TestUtilities.InlineExpectationsTest class SummaryModelTest extends SummaryModelCsv { override predicate row(string row) { row = [ //"package;type;overrides;name;signature;ext;inputspec;outputspec;kind", // This is temporarily modelled for the helper function newEnumerationWithElement, until the relevant package is modelled "org.apache.commons.collections4.iterators;IteratorEnumeration;true;IteratorEnumeration;;;Element of Argument[0];Element of Argument[-1];value", "generatedtest;Test;false;newRBWithMapValue;;;Argument[0];MapValue of ReturnValue;value", "generatedtest;Test;false;newRBWithMapKey;;;Argument[0];MapKey of ReturnValue;value" ] } } class ValueFlowConf extends DataFlow::Configuration { ValueFlowConf() { this = "qltest:valueFlowConf" } override predicate isSource(DataFlow::Node n) { n.asExpr().(MethodAccess).getMethod().hasName("source") } override predicate isSink(DataFlow::Node n) { n.asExpr().(Argument).getCall().getCallee().hasName("sink") } override int fieldFlowBranchLimit() { result = 1000 } } class TaintFlowConf extends TaintTracking::Configuration { TaintFlowConf() { this = "qltest:taintFlowConf" } override predicate isSource(DataFlow::Node n) { n.asExpr().(MethodAccess).getMethod().hasName("source") } override predicate isSink(DataFlow::Node n) { n.asExpr().(Argument).getCall().getCallee().hasName("sink") } override int fieldFlowBranchLimit() { result = 1000 } } class HasFlowTest extends InlineExpectationsTest { HasFlowTest() { this = "HasFlowTest" } override string getARelevantTag() { result = ["hasValueFlow", "hasTaintFlow"] } override predicate hasActualResult(Location location, string element, string tag, string value) { tag = "hasValueFlow" and exists(DataFlow::Node src, DataFlow::Node sink, ValueFlowConf conf | conf.hasFlow(src, sink) | sink.getLocation() = location and element = sink.toString() and value = "" ) or tag = "hasTaintFlow" and exists(DataFlow::Node src, DataFlow::Node sink, TaintFlowConf conf | conf.hasFlow(src, sink) and not any(ValueFlowConf c).hasFlow(src, sink) | sink.getLocation() = location and element = sink.toString() and value = "" ) } }