The Wayback Machine - https://web.archive.org/web/20221128090340/https://github.com/github/codeql/pull/11389
Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Java: Add JDK sinks #11389

Draft
wants to merge 6 commits into
base: main
Choose a base branch
from
Draft

Java: Add JDK sinks #11389

wants to merge 6 commits into from
+192 −7

Conversation

tamasvajk
Copy link
Contributor

@tamasvajk tamasvajk commented Nov 23, 2022

No description provided.

@github-actions github-actions bot added the Java label Nov 23, 2022
@tamasvajk tamasvajk mentioned this pull request Nov 24, 2022
Closed
@github-actions
Copy link
Contributor

github-actions bot commented Nov 24, 2022

⚠️ The head of this PR and the base branch were compared for differences in the framework coverage reports. The generated reports are available in the artifacts of this workflow run. The differences will be picked up by the nightly job after the PR gets merged.

Click to show differences in coverage

java

Generated file changes for java

  • Changes to framework-coverage-java.rst:
-    Java Standard Library,``java.*``,3,591,130,28,,,7,,,10
+    Java Standard Library,``java.*``,3,591,147,28,,,7,,,27
-    Java extensions,"``javax.*``, ``jakarta.*``",63,609,32,,,4,,1,1,2
+    Java extensions,"``javax.*``, ``jakarta.*``",63,609,102,,,4,,3,1,33
-    Totals,,217,8434,1530,129,6,10,107,33,1,86
+    Totals,,217,8434,1617,129,6,10,107,35,1,134
  • Changes to framework-coverage-java.csv:
+ java.applet,6,,,,,,,,,,,,,,,,6,,,,,,,,,,,,,,,,,,,,,,,
- java.net,10,3,7,,,,,,,,,,,,,,10,,,,,,,,,,,,,,,,,,,,,3,7,
+ java.net,12,3,7,,,,,,,,,,,,,,12,,,,,,,,,,,,,,,,,,,,,3,7,
+ java.rmi,9,,,,,,,,,,,,,,,,9,,,,,,,,,,,,,,,,,,,,,,,
+ javax.imageio,1,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,
+ javax.management.loading,11,,,,,,,,,,,,,,,,11,,,,,,,,,,,,,,,,,,,,,,,
- javax.management.remote,2,,,,,,,,,,,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+ javax.management.remote,14,,,,,,,,,,,2,,,,,12,,,,,,,,,,,,,,,,,,,,,,,
- javax.naming,7,,,,,,,,,,,6,1,,,,,,,,,,,,,,,,,,,,,,,,,,,
+ javax.naming,45,,,,,,,,,,,42,3,,,,,,,,,,,,,,,,,,,,,,,,,,,
+ javax.sound.midi,4,,,,,,,,,,,,,,,,4,,,,,,,,,,,,,,,,,,,,,,,
+ javax.sound.sampled,2,,,,,,,,,,,,,,,,2,,,,,,,,,,,,,,,,,,,,,,,
+ javax.sql.rowset.spi,1,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+ javax.xml.stream,1,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,
@github-actions
Copy link
Contributor

github-actions bot commented Nov 24, 2022

⚠️ The head of this PR and the base branch were compared for differences in the framework coverage reports. The generated reports are available in the artifacts of this workflow run. The differences will be picked up by the nightly job after the PR gets merged.

Click to show differences in coverage

java

Generated file changes for java

  • Changes to framework-coverage-java.rst:
-    Java Standard Library,``java.*``,3,591,130,28,,,7,,,10
+    Java Standard Library,``java.*``,3,591,147,28,,,7,,,27
-    Java extensions,"``javax.*``, ``jakarta.*``",63,609,32,,,4,,1,1,2
+    Java extensions,"``javax.*``, ``jakarta.*``",63,609,102,,,4,,3,1,33
-    Totals,,217,8434,1530,129,6,10,107,33,1,86
+    Totals,,217,8434,1617,129,6,10,107,35,1,134
  • Changes to framework-coverage-java.csv:
+ java.applet,6,,,,,,,,,,,,,,,,6,,,,,,,,,,,,,,,,,,,,,,,
- java.net,10,3,7,,,,,,,,,,,,,,10,,,,,,,,,,,,,,,,,,,,,3,7,
+ java.net,12,3,7,,,,,,,,,,,,,,12,,,,,,,,,,,,,,,,,,,,,3,7,
+ java.rmi,9,,,,,,,,,,,,,,,,9,,,,,,,,,,,,,,,,,,,,,,,
+ javax.imageio,1,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,
+ javax.management.loading,11,,,,,,,,,,,,,,,,11,,,,,,,,,,,,,,,,,,,,,,,
- javax.management.remote,2,,,,,,,,,,,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+ javax.management.remote,14,,,,,,,,,,,2,,,,,12,,,,,,,,,,,,,,,,,,,,,,,
- javax.naming,7,,,,,,,,,,,6,1,,,,,,,,,,,,,,,,,,,,,,,,,,,
+ javax.naming,45,,,,,,,,,,,42,3,,,,,,,,,,,,,,,,,,,,,,,,,,,
+ javax.sound.midi,4,,,,,,,,,,,,,,,,4,,,,,,,,,,,,,,,,,,,,,,,
+ javax.sound.sampled,2,,,,,,,,,,,,,,,,2,,,,,,,,,,,,,,,,,,,,,,,
+ javax.sql.rowset.spi,1,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+ javax.xml.stream,1,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,
github-code-scanning[bot]
github-code-scanning bot found potential problems Nov 24, 2022
View changes
java/ql/src/utils/model-generator/SinkFlows.ql
Spec::isRelevantSinkKind(kind) and
kind = sink.toString() and
api = source.getNode().getEnclosingCallable()
select source.getNode(), source, sink, "$@", source.getNode(),

Check warning

Code scanning / CodeQL

Alert message style violation Warning

Don't repeat the alert location as a link.
java/ql/src/utils/model-generator/SinkFlows.ql
Spec::isRelevantSinkKind(kind) and
kind = sink.toString() and
api = source.getNode().getEnclosingCallable()
select source.getNode(), source, sink, "$@", source.getNode(),

Check warning

Code scanning / CodeQL

Alert message style violation Warning

Alert message should end with a full stop.
tamasvajk
tamasvajk commented Nov 24, 2022
View changes
java/ql/src/utils/model-generator/SinkFlows.ql
* @name Capture sink models.
* @description Finds public methods that act as sinks as they flow into a known sink.
* @kind path-problem
* @id java/utils/model-generator/sink-models
* @tags model-generator
Copy link
Contributor Author

@tamasvajk tamasvajk Nov 24, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These metadata were not changed from the capture sink query.
@github-actions
Copy link
Contributor

github-actions bot commented Nov 24, 2022

⚠️ The head of this PR and the base branch were compared for differences in the framework coverage reports. The generated reports are available in the artifacts of this workflow run. The differences will be picked up by the nightly job after the PR gets merged.

Click to show differences in coverage

java

Generated file changes for java

  • Changes to framework-coverage-java.rst:
-    Java Standard Library,``java.*``,3,591,130,28,,,7,,,10
+    Java Standard Library,``java.*``,3,591,147,28,,,7,,,27
-    Java extensions,"``javax.*``, ``jakarta.*``",63,609,32,,,4,,1,1,2
+    Java extensions,"``javax.*``, ``jakarta.*``",63,609,102,,,4,,3,1,33
-    Totals,,217,8434,1530,129,6,10,107,33,1,86
+    Totals,,217,8434,1617,129,6,10,107,35,1,134
  • Changes to framework-coverage-java.csv:
+ java.applet,6,,,,,,,,,,,,,,,,6,,,,,,,,,,,,,,,,,,,,,,,
- java.net,10,3,7,,,,,,,,,,,,,,10,,,,,,,,,,,,,,,,,,,,,3,7,
+ java.net,12,3,7,,,,,,,,,,,,,,12,,,,,,,,,,,,,,,,,,,,,3,7,
+ java.rmi,9,,,,,,,,,,,,,,,,9,,,,,,,,,,,,,,,,,,,,,,,
+ javax.imageio,1,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,
+ javax.management.loading,11,,,,,,,,,,,,,,,,11,,,,,,,,,,,,,,,,,,,,,,,
- javax.management.remote,2,,,,,,,,,,,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+ javax.management.remote,14,,,,,,,,,,,2,,,,,12,,,,,,,,,,,,,,,,,,,,,,,
- javax.naming,7,,,,,,,,,,,6,1,,,,,,,,,,,,,,,,,,,,,,,,,,,
+ javax.naming,45,,,,,,,,,,,42,3,,,,,,,,,,,,,,,,,,,,,,,,,,,
+ javax.sound.midi,4,,,,,,,,,,,,,,,,4,,,,,,,,,,,,,,,,,,,,,,,
+ javax.sound.sampled,2,,,,,,,,,,,,,,,,2,,,,,,,,,,,,,,,,,,,,,,,
+ javax.sql.rowset.spi,1,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+ javax.xml.stream,1,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,
@github-actions
Copy link
Contributor

github-actions bot commented Nov 24, 2022

⚠️ The head of this PR and the base branch were compared for differences in the framework coverage reports. The generated reports are available in the artifacts of this workflow run. The differences will be picked up by the nightly job after the PR gets merged.

Click to show differences in coverage

java

Generated file changes for java

  • Changes to framework-coverage-java.rst:
-    Java Standard Library,``java.*``,3,591,130,28,,,7,,,10
+    Java Standard Library,``java.*``,3,591,147,28,,,7,,,27
-    Java extensions,"``javax.*``, ``jakarta.*``",63,609,32,,,4,,1,1,2
+    Java extensions,"``javax.*``, ``jakarta.*``",63,609,102,,,4,,3,1,33
-    Totals,,217,8434,1530,129,6,10,107,33,1,86
+    Totals,,217,8434,1617,129,6,10,107,35,1,134
  • Changes to framework-coverage-java.csv:
+ java.applet,6,,,,,,,,,,,,,,,,6,,,,,,,,,,,,,,,,,,,,,,,
- java.net,10,3,7,,,,,,,,,,,,,,10,,,,,,,,,,,,,,,,,,,,,3,7,
+ java.net,12,3,7,,,,,,,,,,,,,,12,,,,,,,,,,,,,,,,,,,,,3,7,
+ java.rmi,9,,,,,,,,,,,,,,,,9,,,,,,,,,,,,,,,,,,,,,,,
+ javax.imageio,1,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,
+ javax.management.loading,11,,,,,,,,,,,,,,,,11,,,,,,,,,,,,,,,,,,,,,,,
- javax.management.remote,2,,,,,,,,,,,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+ javax.management.remote,14,,,,,,,,,,,2,,,,,12,,,,,,,,,,,,,,,,,,,,,,,
- javax.naming,7,,,,,,,,,,,6,1,,,,,,,,,,,,,,,,,,,,,,,,,,,
+ javax.naming,45,,,,,,,,,,,42,3,,,,,,,,,,,,,,,,,,,,,,,,,,,
+ javax.sound.midi,4,,,,,,,,,,,,,,,,4,,,,,,,,,,,,,,,,,,,,,,,
+ javax.sound.sampled,2,,,,,,,,,,,,,,,,2,,,,,,,,,,,,,,,,,,,,,,,
+ javax.sql.rowset.spi,1,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+ javax.xml.stream,1,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Java
1 participant
@tamasvajk