/** Holds if a source model exists for the given parameters. */

predicate additionalSourceModel(

string package, string type, boolean subtypes, string name, string signature, string ext,

string output, string kind, string provenance, string model

) {

exists(QlBuiltins::ExtensionId madId |

any(ActiveExperimentalModelsInternal q)

.sourceModel(package, type, subtypes, name, signature, ext, output, kind, provenance,

madId) and

model = "MaD:" + madId.toString()

)

}

/** Holds if a sink model exists for the given parameters. */

predicate additionalSinkModel(

string package, string type, boolean subtypes, string name, string signature, string ext,

string input, string kind, string provenance, string model

) {

exists(QlBuiltins::ExtensionId madId |

any(ActiveExperimentalModelsInternal q)

.sinkModel(package, type, subtypes, name, signature, ext, input, kind, provenance, madId) and

model = "MaD:" + madId.toString()

)

}

/** Holds if a summary model exists for the given parameters. */

predicate additionalSummaryModel(

string package, string type, boolean subtypes, string name, string signature, string ext,

string input, string output, string kind, string provenance, string model

) {

exists(QlBuiltins::ExtensionId madId |

any(ActiveExperimentalModelsInternal q)

.summaryModel(package, type, subtypes, name, signature, ext, input, output, kind,

provenance, madId) and

model = "MaD:" + madId.toString()

)

}

bindingset[this]

ActiveExperimentalModelsInternal() { any() }

/**

predicate sourceModel(

string package, string type, boolean subtypes, string name, string signature, string ext,

string output, string kind, string provenance, QlBuiltins::ExtensionId madId

) {

Extensions::experimentalSourceModel(package, type, subtypes, name, signature, ext, output, kind,

provenance, this, madId)

}

/**

predicate sinkModel(

string package, string type, boolean subtypes, string name, string signature, string ext,

string input, string kind, string provenance, QlBuiltins::ExtensionId madId

) {

Extensions::experimentalSinkModel(package, type, subtypes, name, signature, ext, input, kind,

provenance, this, madId)

}

/**

predicate summaryModel(

string package, string type, boolean subtypes, string name, string signature, string ext,

string input, string output, string kind, string provenance, QlBuiltins::ExtensionId madId

) {

Extensions::experimentalSummaryModel(package, type, subtypes, name, signature, ext, input,

output, kind, provenance, this, madId)

}

MaD::interpretModelForTest(madId, model)

or

exists(

string package, string type, boolean subtypes, string name, string signature, string ext,

string output, string kind, string provenance

|

Extensions::experimentalSourceModel(package, type, subtypes, name, signature, ext, output, kind,

provenance, _, madId)

|

model =

"Source: " + package + "; " + type + "; " + subtypes + "; " + name + "; " + signature + "; " +

ext + "; " + output + "; " + kind + "; " + provenance

)

or

exists(

string package, string type, boolean subtypes, string name, string signature, string ext,

string input, string kind, string provenance

|

Extensions::experimentalSinkModel(package, type, subtypes, name, signature, ext, input, kind,

provenance, _, madId)

|

model =

"Sink: " + package + "; " + type + "; " + subtypes + "; " + name + "; " + signature + "; " +

ext + "; " + input + "; " + kind + "; " + provenance

)

or

exists(

string package, string type, boolean subtypes, string name, string signature, string ext,

string input, string output, string kind, string provenance

|

Extensions::experimentalSummaryModel(package, type, subtypes, name, signature, ext, input,

output, kind, provenance, _, madId)

|

model =

"Summary: " + package + "; " + type + "; " + subtypes + "; " + name + "; " + signature + "; " +

ext + "; " + input + "; " + output + "; " + kind + "; " + provenance

)

private import codeql.dataflow.internal.AccessPathSyntax as AccessPathSyntax

private predicate getRelevantAccessPath(string path) {

summaryModel(_, _, _, _, _, _, path, _, _, _, _) or

summaryModel(_, _, _, _, _, _, _, path, _, _, _) or

sinkModel(_, _, _, _, _, _, path, _, _, _) or

sourceModel(_, _, _, _, _, _, path, _, _, _) or

barrierModel(_, _, _, _, _, _, path, _, _, _) or

barrierGuardModel(_, _, _, _, _, _, path, _, _, _, _)

}

private module MkAccessPath = AccessPathSyntax::AccessPath<getRelevantAccessPath/1>;

class AccessPath = MkAccessPath::AccessPath;

class AccessPathToken = MkAccessPath::AccessPathToken;

private string getInvalidModelInput() {

exists(string pred, AccessPath input, AccessPathToken part |

sinkModel(_, _, _, _, _, _, input, _, _, _) and pred = "sink"

or

barrierGuardModel(_, _, _, _, _, _, input, _, _, _, _) and pred = "barrier guard"

or

summaryModel(_, _, _, _, _, _, input, _, _, _, _) and pred = "summary"

|

(

invalidSpecComponent(input, part) and

not part = "" and

not (part = "Argument" and pred = "sink") and

not parseArg(part, _) and

not part.getName() = "Field"

or

part = input.getToken(0) and

parseParam(part, _)

or

invalidIndexComponent(input, part)

) and

result = "Unrecognized input specification \"" + part + "\" in " + pred + " model."

)

}

private string getInvalidModelOutput() {

exists(string pred, AccessPath output, AccessPathToken part |

sourceModel(_, _, _, _, _, _, output, _, _, _) and pred = "source"

or

barrierModel(_, _, _, _, _, _, output, _, _, _) and pred = "barrier"

or

summaryModel(_, _, _, _, _, _, _, output, _, _, _) and pred = "summary"

|

(

invalidSpecComponent(output, part) and

not part = "" and

not (part = ["Argument", "Parameter"] and pred = "source") and

not part.getName() = "Field"

or

invalidIndexComponent(output, part)

) and

result = "Unrecognized output specification \"" + part + "\" in " + pred + " model."

)

}

private module KindValConfig implements SharedModelVal::KindValidationConfigSig {

predicate summaryKind(string kind) { summaryModel(_, _, _, _, _, _, _, _, kind, _, _) }

predicate sinkKind(string kind) {

sinkModel(_, _, _, _, _, _, _, kind, _, _)

or

barrierModel(_, _, _, _, _, _, _, kind, _, _)

or

barrierGuardModel(_, _, _, _, _, _, _, _, kind, _, _)

}

predicate sourceKind(string kind) { sourceModel(_, _, _, _, _, _, _, kind, _, _) }

predicate neutralKind(string kind) { neutralModel(_, _, _, _, kind, _) }

}

private module KindVal = SharedModelVal::KindValidation<KindValConfig>;

private string getInvalidModelSignature() {

exists(

string pred, string package, string type, string name, string signature, string ext,

string provenance

|

sourceModel(package, type, _, name, signature, ext, _, _, provenance, _) and pred = "source"

or

sinkModel(package, type, _, name, signature, ext, _, _, provenance, _) and pred = "sink"

or

barrierModel(package, type, _, name, signature, ext, _, _, provenance, _) and pred = "barrier"

or

barrierGuardModel(package, type, _, name, signature, ext, _, _, _, provenance, _) and

pred = "barrier guard"

or

summaryModel(package, type, _, name, signature, ext, _, _, _, provenance, _) and

pred = "summary"

or

neutralModel(package, type, name, signature, _, provenance) and

ext = "" and

pred = "neutral"

|

not package.regexpMatch("[a-zA-Z0-9_\\.]*") and

result = "Dubious package \"" + package + "\" in " + pred + " model."

or

not type.regexpMatch("[a-zA-Z0-9_\\$<>]+") and

result = "Dubious type \"" + type + "\" in " + pred + " model."

or

not name.regexpMatch("[a-zA-Z0-9_\\-]*") and

result = "Dubious name \"" + name + "\" in " + pred + " model."

or

not signature.regexpMatch("|\\([a-zA-Z0-9_\\.\\$<>,\\[\\]]*\\)") and

result = "Dubious signature \"" + signature + "\" in " + pred + " model."

or

not ext.regexpMatch("|Annotated") and

result = "Unrecognized extra API graph element \"" + ext + "\" in " + pred + " model."

or

invalidProvenance(provenance) and

result = "Unrecognized provenance description \"" + provenance + "\" in " + pred + " model."

)

or

exists(string acceptingValue |

barrierGuardModel(_, _, _, _, _, _, _, acceptingValue, _, _, _) and

invalidAcceptingValue(acceptingValue) and

result =

"Unrecognized accepting value description \"" + acceptingValue +

"\" in barrier guard model."

)

}

private string getIncorrectConstructorSummaryOutput() {

exists(string namespace, string type, string name, string output |

summaryModel(namespace, type, _, name, _, _, _, output, _, _, _)

|

type = name and

output.matches("ReturnValue%") and

result =

"Constructor model for " + namespace + "." + type +

" should use `Argument[this]` in the output, not `ReturnValue`."

)

}

/** Holds if some row in a MaD flow model appears to contain typos. */

query predicate invalidModelRow(string msg) {

msg =

[

getInvalidModelSignature(), getInvalidModelInput(), getInvalidModelOutput(),

getIncorrectConstructorSummaryOutput(), KindVal::getInvalidModelKind()

]

}

string package, string type, boolean subtypes, string name, string signature, string ext

) {

sourceModel(package, type, subtypes, name, signature, ext, _, _, _, _)

or

sinkModel(package, type, subtypes, name, signature, ext, _, _, _, _)

or

barrierModel(package, type, subtypes, name, signature, ext, _, _, _, _)

or

barrierGuardModel(package, type, subtypes, name, signature, ext, _, _, _, _, _)

or

summaryModel(package, type, subtypes, name, signature, ext, _, _, _, _, _)

or

neutralModel(package, type, name, signature, _, _) and ext = "" and subtypes = true

not t instanceof RefType and result = t.toString()

or

not t.(Array).getElementType() instanceof NestedType and result = t.(RefType).getNestedName()

or

result =

t.(Array).getElementType().(NestedType).getEnclosingType().getNestedName() + "$" + t.getName()

not t instanceof RefType and result = t.toString()

or

result = t.(RefType).getQualifiedName()

or

exists(Array a, Type c | a = t and c = a.getElementType() |

not c instanceof RefType and result = t.toString()

or

exists(string pkgName | pkgName = c.(RefType).getPackage().getName() |

if pkgName = "" then result = getNestedName(a) else result = pkgName + "." + getNestedName(a)

)

)

result =

"(" + concat(int i | | getQualifiedName(c.getParameterType(i).getErasure()), "," order by i) +

")"

string package, string type, boolean subtypes, string name, string signature, boolean isExact

) {

elementSpec(package, type, subtypes, name, signature, _) and

(

exists(Member m |

(

result = m and isExact = true

or

subtypes = true and result.(SrcMethod).overridesOrInstantiates+(m) and isExact = false

) and

m.hasQualifiedName(package, type, name)

|

signature = ""

or

paramsStringQualified(m) = signature

or

paramsString(m) = signature

)

or

exists(RefType t |

t.hasQualifiedName(package, type) and

isExact = false and

(if subtypes = true then result.(SrcRefType).getASourceSupertype*() = t else result = t) and

name = "" and

signature = ""

)

)

string package, string type, boolean subtypes, string name, string signature, string ext,

boolean isExact

) {

elementSpec(package, type, subtypes, name, signature, ext) and

exists(Element e, boolean isExact0 |

e = interpretElement0(package, type, subtypes, name, signature, isExact0)

|

ext = "" and result = e and isExact = isExact0

or

ext = "Annotated" and result.(Annotatable).getAnAnnotation().getType() = e and isExact = false

)

exists(

string fieldRegex, string qualifiedName, string package, string className, string fieldName

|

c.getName() = "Field" and

qualifiedName = c.getAnArgument() and

fieldRegex = "^(.*)\\.([^.]+)\\.([^.]+)$" and

package = qualifiedName.regexpCapture(fieldRegex, 1) and

className = qualifiedName.regexpCapture(fieldRegex, 2) and

fieldName = qualifiedName.regexpCapture(fieldRegex, 3) and

f.getField().hasQualifiedName(package, className, fieldName)

)

SyntheticField() { parseSynthField(_, this) }

/**

Type getType() { result instanceof TypeObject }

parseField(component, content)

or

parseSynthField(component, content.(SyntheticFieldContent).getField())

or

component = "ArrayElement" and content instanceof ArrayContent

or

component = "Element" and content instanceof CollectionContent

or

component = "MapKey" and content instanceof MapKeyContent

or

component = "MapValue" and content instanceof MapValueContent

/**

cached

predicate sourceNode(Node node, string kind, string model) {

exists(SourceSinkInterpretationInput::InterpretNode n |

isSourceNode(n, kind, model) and n.asNode() = node

)

}

/**

cached

predicate sinkNode(Node node, string kind, string model) {

exists(SourceSinkInterpretationInput::InterpretNode n |

isSinkNode(n, kind, model) and n.asNode() = node

)

}

private newtype TKindModelPair =

TMkPair(string kind, string model) { isBarrierGuardNode(_, _, kind, model) }

private GuardValue convertAcceptingValue(AcceptingValue av) {

av.isTrue() and result.asBooleanValue() = true

or

av.isFalse() and result.asBooleanValue() = false

or

av.isNoException() and result.getDualValue().isThrowsException()

or

av.isZero() and result.asIntValue() = 0

or

av.isNotZero() and result.getDualValue().asIntValue() = 0

or

av.isNull() and result.isNullValue()

or

av.isNotNull() and result.isNonNullValue()

}

private predicate barrierGuardChecks(Guard g, Expr e, GuardValue gv, TKindModelPair kmp) {

exists(

SourceSinkInterpretationInput::InterpretNode n, AcceptingValue acceptingValue, string kind,

string model

|

isBarrierGuardNode(n, acceptingValue, kind, model) and

n.asNode().asExpr() = e and

kmp = TMkPair(kind, model) and

gv = convertAcceptingValue(acceptingValue)

|

g.(Call).getAnArgument() = e or g.(MethodCall).getQualifier() = e

)

}

/**

cached

predicate barrierNode(Node node, string kind, string model) {

exists(SourceSinkInterpretationInput::InterpretNode n |

isBarrierNode(n, kind, model) and n.asNode() = node

)

or

ParameterizedBarrierGuard<TKindModelPair, barrierGuardChecks/4>::getABarrierNode(TMkPair(kind,

model)) = node

}

string input_;

string output_;

string kind;

Provenance p_;

boolean isExact_;

string model_;

SummarizedCallableAdapter() { summaryElement(this, input_, output_, kind, p_, model_, isExact_) }

override predicate propagatesFlow(

string input, string output, boolean preservesValue, Provenance p, boolean isExact, string model

) {

input = input_ and

output = output_ and

(if kind = "value" then preservesValue = true else preservesValue = false) and

p = p_ and

isExact = isExact_ and

model = model_

}