Java: Initial CSV model generator#6664
Conversation
bmuskalla
force-pushed
the
bmuskalla/modelGenerator
branch
3 times, most recently
from
e7c63ad to
96e085f
Compare
bmuskalla
force-pushed
the
bmuskalla/modelGenerator
branch
from
96e085f to
48521e6
Compare
javaGenerated file changes for java
- Java Standard Library,``java.*``,3,426,30,13,,,7,,,10
+ Java Standard Library,``java.*``,3,427,30,13,,,7,,,10
- Totals,,143,5137,408,13,6,10,107,33,1,66
+ Totals,,143,5138,408,13,6,10,107,33,1,66
- java.lang,,,50,,,,,,,,,,,,,,,,,,,,,41,9
+ java.lang,,,51,,,,,,,,,,,,,,,,,,,,,42,9 |
bmuskalla
force-pushed
the
bmuskalla/modelGenerator
branch
from
48521e6 to
0c6c082
Compare
Click to show differences in coveragejavaGenerated file changes for java
- Java Standard Library,``java.*``,3,506,30,13,,,7,,,10
+ Java Standard Library,``java.*``,3,507,30,13,,,7,,,10
- Totals,,143,5257,408,13,6,10,107,33,1,66
+ Totals,,143,5258,408,13,6,10,107,33,1,66
- java.lang,,,50,,,,,,,,,,,,,,,,,,,,,41,9
+ java.lang,,,51,,,,,,,,,,,,,,,,,,,,,42,9 |
|
@hvitved @aschackmull It would be great to get some eyes on this. The queries themselves should be in a state we can discuss and I'll hold of further refinements until we have agreement on the general direction of them, as discussed. There is also 1 remaining TODO (which is causing the build to fail) around how to best access the models kind - once we're happy with that, I can re-sync the files and get the build to pass. |
bmuskalla
changed the title
| source instanceof DataFlow::InstanceParameterNode | ||
| } | ||
|
|
||
| override predicate isSink(DataFlow::Node sink) { sink instanceof ReturnNodeExt } |
There was a problem hiding this comment.
Let's add and not sink.(ReturnNode).asExpr().(ThisAccess).isOwnInstanceAccess().
There was a problem hiding this comment.
That's not enough unfortunately. That misses the case when a return statements expression is a call to a fluent api itself (e.g. Joiner#merge(Joiner)
return add(...)
I've tried to move the predicates below into the configuration to restrict the nodes we look at. Let me know if you think there is a better way to handle this.
Click to show differences in coveragejavaGenerated file changes for java
- Java Standard Library,``java.*``,3,523,30,13,,,7,,,10
+ Java Standard Library,``java.*``,3,524,30,13,,,7,,,10
- Totals,,175,5368,431,13,6,10,107,33,1,66
+ Totals,,175,5369,431,13,6,10,107,33,1,66
- java.lang,,,51,,,,,,,,,,,,,,,,,,,,,,41,10
+ java.lang,,,52,,,,,,,,,,,,,,,,,,,,,,42,10 |
Click to show differences in coveragejavaGenerated file changes for java
- Java Standard Library,``java.*``,3,523,30,13,,,7,,,10
+ Java Standard Library,``java.*``,3,524,30,13,,,7,,,10
- Totals,,175,5368,431,13,6,10,107,33,1,66
+ Totals,,175,5369,431,13,6,10,107,33,1,66
- java.lang,,,51,,,,,,,,,,,,,,,,,,,,,,41,10
+ java.lang,,,52,,,,,,,,,,,,,,,,,,,,,,42,10 |
Click to show differences in coveragejavaGenerated file changes for java
- Java Standard Library,``java.*``,3,523,30,13,,,7,,,10
+ Java Standard Library,``java.*``,3,524,30,13,,,7,,,10
- Totals,,175,5368,431,13,6,10,107,33,1,66
+ Totals,,175,5369,431,13,6,10,107,33,1,66
- java.lang,,,51,,,,,,,,,,,,,,,,,,,,,,41,10
+ java.lang,,,52,,,,,,,,,,,,,,,,,,,,,,42,10 |
|
🥳 |
2 participants
Adds ability to generate flow summaries in CSV format given an existing library.
It supports detecting sinks/sources via propagation (so only existing sinks exposed through a new external API).
Usage is either:
The resulting
.qllCSV model written tocodeql/java/ql/lib/semmle/code/java/frameworks/generated/<shortname>.qllExamples (Guava, various Apache Commons projects)
Alternatively, you can run any of the queries directly:
CaptureSummaryModels.qlCaptureSinkModels.qlCaptureSourceModels.qlSome initial stats (model as data rows)
Footnotes
Counting only
java.APIs ↩ ↩2