Java: Tests for Automodel Extraction Queries #13788
Open
+137
−3
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
kaeluka
changed the title
kaeluka
force-pushed
the
kaeluka/automodel-telemetry-testing
branch
from
c78c031
to
bee43b0
Compare
|
After merging #13747, this needed minor updates |
java/ql/test/query-tests/Telemetry/AutomodelApplicationModeExtractCandidates/Test.java
Outdated
Show resolved
Hide resolved
.../test/query-tests/Telemetry/AutomodelFrameworkModeExtractCandidates/java/nio/file/Files.java
Outdated
Show resolved
Hide resolved
|
following @adityasharad's comments, this has been restructured significantly. Before merging this, I'd like to squash these commits a bit. |
kaeluka
force-pushed
the
kaeluka/automodel-telemetry-testing
branch
from
2a00bec
to
64d38ef
Compare
kaeluka
force-pushed
the
kaeluka/automodel-telemetry-testing
branch
from
64d38ef
to
9c51f4d
Compare
| @@ -0,0 +1,2 @@ | |||
| | Test.java:16:3:16:11 | reference | command-injection, path-injection, request-forgery, sql-injection\nrelated locations: $@.\nmetadata: $@, $@, $@, $@, $@, $@. | Test.java:16:3:16:24 | set(...) | CallContext | file://java.util.concurrent.atomic:1:1:1:1 | java.util.concurrent.atomic | package | file://AtomicReference:1:1:1:1 | AtomicReference | type | file://false:1:1:1:1 | false | subtypes | file://set:1:1:1:1 | set | name | file://(String):1:1:1:1 | (String) | signature | file://Argument[this]:1:1:1:1 | Argument[this] | input | | |||
There was a problem hiding this comment.
The path components of these file:// URIs are interesting. I see they are a string representation of the code element. This is coming from our custom getURL / hasLocationInfo implementation for metadata right?
(I would like to clean this up but that's not in scope for this PR. Just want to understand what they are.)
There was a problem hiding this comment.
yes, that's exactly right :)
...-tests/Telemetry/AutomodelFrameworkModeExtraction/com/github/codeql/test/NonPublicClass.java
Show resolved
Hide resolved
...ery-tests/Telemetry/AutomodelFrameworkModeExtraction/com/github/codeql/test/PublicClass.java
Show resolved
Hide resolved
In PR #13823, we had rewritten the endpoints that are being considered for framework mode. We used to use `DataFlow::ParameterNode` as endpoints. However, `ParameterNode`s do not exist for the implicit `this` parameter; they also do not exist for bodiless interface-methods. In PR #13823, we forgot to model that `this` only exists for non-static methods and to only consider parameters that we have source code for.
…rface-method parameter extraction
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR adds some tests for the automodel extraction queries.
@adityasharadwill review this, but other reviewers are always welcome.java.io.Fileimplemented in the test suite. I find this much easier than the suggested implementation. I was hoping this would work, and I'm glad it does.How to review/Questions for the reviewers:
The reason why this only tests some of our queries (only the extraction queries; the queries share most of the implementations behind the scenes) is to manage the maintenance overhead of the test suites. LMK if you disagree with that and would like to see more test suites.