Java: Cleanup threat model taxanomy to align with the EDR.

Author: michaelnebel

java/ql/lib/ext/threatmodels/threat-model-grouping.model.yml

@@ -6,18 +6,17 @@ extensions:
     data:
       # Default threat model
       - ["remote", "default"]
-      - ["uri-path", "default"]
-
-      # Android threat models
-      - ["android-external-storage-dir", "android"]
-      - ["contentprovider", "android"]
 
       # Remote threat models
       - ["request", "remote"]
       - ["response", "remote"]
 
       # Local threat models
       - ["database", "local"]
-      - ["cli", "local"]
+      - ["commandargs", "local"]
       - ["environment", "local"]
       - ["file", "local"]
+
+      # Android threat models
+      - ["android-external-storage-dir", "android"]
+      - ["contentprovider", "android"]

java/ql/lib/semmle/code/java/dataflow/FlowSources.qll

@@ -259,7 +259,7 @@ private class CliInput extends LocalUserInput {
     exists(Field f | this.asExpr() = f.getAnAccess() | f instanceof SystemIn)
   }
 
-  override string getThreatModel() { result = "cli" }
+  override string getThreatModel() { result = "commandargs" }
 }
 
 /**

java/ql/test/library-tests/dataflow/threat-models/Test.java

@@ -59,7 +59,7 @@ public void M4(Statement handle) throws Exception {
   }
 
   public void M5(Statement handle) throws Exception {
-    // Only a source if "cli" is a selected threat model.
+    // Only a source if "commandargs" is a selected threat model.
     byte[] data = new byte[1024];
     System.in.read(data);
 

java/ql/test/library-tests/dataflow/threat-models/threat-models-flowtest5.ext.yml

@@ -5,7 +5,7 @@ extensions:
       extensible: supportedThreatModels
     data:
       - ["environment"]
-      - ["cli"]
+      - ["commandargs"]
 
   - addsTo:
       pack: codeql/java-all

java/ql/test/library-tests/dataflow/threat-models/threat-models-flowtest5.ql

@@ -1,6 +1,6 @@
 /**
  * This is a dataflow test using the "default" threat model with the
- * addition of "environment" and "cli".
+ * addition of "environment" and "commandargs".
  */
 
 import Test

java/ql/test/library-tests/dataflow/threat-models/threat-models1.expected

@@ -2,4 +2,3 @@
 | remote |
 | request |
 | response |
-| uri-path |

java/ql/test/library-tests/dataflow/threat-models/threat-models2.expected

@@ -1,4 +1,4 @@
-| cli |
+| commandargs |
 | database |
 | default |
 | environment |
@@ -7,4 +7,3 @@
 | remote |
 | request |
 | response |
-| uri-path |