Fix neutral definition for CodeQL 2.13.3

In CodeQL 2.13.3, the definition of the neutralModel predicate has
changed to include the `kind`. This updates the definition of the
data extensions editor to match the new definition.

One caveat is that when selecting a `kind` other than `summary`, the
method will not be shown as supported. This is because a
`NeutralCallable` only calls into `neutralSummaryElement`. This matches
the previous behavior because setting the `kind` to `source` or `sink`
only says that the method is either not a source or not a sink, but not
both. Only `summary` fully models the method.

See: https://github.com/github/codeql/pull/12931
See: ff78ac98d2/java/ql/lib/semmle/code/java/dataflow/internal/FlowSummaryImpl.qll (L338)
See: ff78ac98d2/java/ql/lib/semmle/code/java/dataflow/internal/FlowSummaryImplSpecific.qll (L160)
This commit is contained in:
Koen Vlaswinkel
2023-06-01 14:59:47 +02:00
parent 2f61cfe693
commit 2b915b82e4

View File

@@ -116,13 +116,14 @@ export const extensiblePredicateDefinitions: Record<
neutral: {
extensiblePredicate: "neutralModel",
// extensible predicate neutralModel(
// string package, string type, string name, string signature, string provenance
// string package, string type, string name, string signature, string kind, string provenance
// );
generateMethodDefinition: (method) => [
method.externalApiUsage.packageName,
method.externalApiUsage.typeName,
method.externalApiUsage.methodName,
method.externalApiUsage.methodParameters,
method.modeledMethod.kind,
"manual",
],
readModeledMethod: (row) => ({
@@ -131,8 +132,9 @@ export const extensiblePredicateDefinitions: Record<
type: "neutral",
input: "",
output: "",
kind: "",
kind: row[4] as string,
},
}),
supportedKinds: ["summary", "source", "sink"],
},
};