Merge pull request github#12228 from github/java/mad-decls-triage-request-2276

Java: Update MaD sink decls after triage

Author: atorralba

csharp/ql/lib/semmle/code/csharp/dataflow/FlowSummary.qll

@@ -137,6 +137,8 @@ private class RecordConstructorFlow extends SummarizedCallable {
       preservesValue = true
     )
   }
+
+  override predicate hasProvenance(string provenance) { provenance = "manual" }
 }
 
 class RequiredSummaryComponentStack = Impl::Public::RequiredSummaryComponentStack;

csharp/ql/lib/semmle/code/csharp/dataflow/internal/FlowSummaryImpl.qll

@@ -248,7 +248,9 @@ module Public {
     /**
      * Holds if all the summaries that apply to `this` are auto generated and not manually created.
      */
-    final predicate isAutoGenerated() { this.hasProvenance("generated") and not this.isManual() }
+    final predicate isAutoGenerated() {
+      this.hasProvenance(["generated", "ai-generated"]) and not this.isManual()
+    }
 
     /**
      * Holds if there exists a manual summary that applies to `this`.
@@ -268,7 +270,7 @@ module Public {
     /**
      * Holds if the neutral is auto generated.
      */
-    predicate isAutoGenerated() { neutralElement(this, "generated") }
+    predicate isAutoGenerated() { neutralElement(this, ["generated", "ai-generated"]) }
 
     /**
      * Holds if there exists a manual neutral that applies to `this`.
@@ -1202,11 +1204,11 @@ module Private {
     }
 
     private string renderProvenance(SummarizedCallable c) {
-      if c.isAutoGenerated() then result = "generated" else result = "manual"
+      if c.isManual() then result = "manual" else c.hasProvenance(result)
     }
 
     private string renderProvenanceNeutral(NeutralCallable c) {
-      if c.isAutoGenerated() then result = "generated" else result = "manual"
+      if c.isManual() then result = "manual" else c.hasProvenance(result)
     }
 
     /**

csharp/ql/lib/semmle/code/csharp/frameworks/EntityFramework.qll

@@ -86,6 +86,8 @@ module EntityFramework {
   abstract class EFSummarizedCallable extends SummarizedCallable {
     bindingset[this]
     EFSummarizedCallable() { any() }
+
+    override predicate hasProvenance(string provenance) { provenance = "manual" }
   }
 
   private class DbSetAddOrUpdateRequiredSummaryComponentStack extends RequiredSummaryComponentStack {

go/ql/lib/semmle/go/dataflow/internal/FlowSummaryImpl.qll

@@ -248,7 +248,9 @@ module Public {
     /**
      * Holds if all the summaries that apply to `this` are auto generated and not manually created.
      */
-    final predicate isAutoGenerated() { this.hasProvenance("generated") and not this.isManual() }
+    final predicate isAutoGenerated() {
+      this.hasProvenance(["generated", "ai-generated"]) and not this.isManual()
+    }
 
     /**
      * Holds if there exists a manual summary that applies to `this`.
@@ -268,7 +270,7 @@ module Public {
     /**
      * Holds if the neutral is auto generated.
      */
-    predicate isAutoGenerated() { neutralElement(this, "generated") }
+    predicate isAutoGenerated() { neutralElement(this, ["generated", "ai-generated"]) }
 
     /**
      * Holds if there exists a manual neutral that applies to `this`.
@@ -1202,11 +1204,11 @@ module Private {
     }
 
     private string renderProvenance(SummarizedCallable c) {
-      if c.isAutoGenerated() then result = "generated" else result = "manual"
+      if c.isManual() then result = "manual" else c.hasProvenance(result)
     }
 
     private string renderProvenanceNeutral(NeutralCallable c) {
-      if c.isAutoGenerated() then result = "generated" else result = "manual"
+      if c.isManual() then result = "manual" else c.hasProvenance(result)
     }
 
     /**

java/ql/lib/ext/java.lang.model.yml

@@ -3,6 +3,8 @@ extensions:
       pack: codeql/java-all
       extensible: sinkModel
     data:
+      - ["java.lang", "Module", True, "getResourceAsStream", "(String)", "", "Argument[0]", "read-file", "ai-generated"]
+# suggested label is not supported:      - ["java.lang", "ProcessBuilder", True, "ProcessBuilder", "(String[])", "", "Argument[0]", "command-injection", "ai-generated"]
       - ["java.lang", "String", False, "matches", "(String)", "", "Argument[0]", "regex-use[f-1]", "manual"]
       - ["java.lang", "String", False, "replaceAll", "(String,String)", "", "Argument[0]", "regex-use[-1]", "manual"]
       - ["java.lang", "String", False, "replaceFirst", "(String,String)", "", "Argument[0]", "regex-use[-1]", "manual"]

java/ql/lib/ext/org.apache.hadoop.hive.metastore.api.model.yml

@@ -0,0 +1,7 @@
+extensions:
+  - addsTo:
+      pack: codeql/java-all
+      extensible: sinkModel
+    data:
+      - ["org.apache.hadoop.hive.metastore.api", "DefaultConstraintsRequest", True, "DefaultConstraintsRequest", "(String,String,String)", "", "Argument[1]", "sql", "ai-generated"]
+

java/ql/lib/ext/org.apache.hadoop.hive.metastore.model.yml

@@ -0,0 +1,8 @@
+extensions:
+  - addsTo:
+      pack: codeql/java-all
+      extensible: sinkModel
+    data:
+      - ["org.apache.hadoop.hive.metastore", "ObjectStore", True, "updatePartitionColumnStatistics", "(ColumnStatistics,List,String,long)", "", "Argument[0]", "sql", "ai-generated"]
+      - ["org.apache.hadoop.hive.metastore", "ObjectStore", True, "updatePartitionColumnStatistics", "(ColumnStatistics,List)", "", "Argument[0]", "sql", "ai-generated"]
+

java/ql/lib/ext/org.apache.hive.hcatalog.templeton.model.yml

@@ -0,0 +1,7 @@
+extensions:
+  - addsTo:
+      pack: codeql/java-all
+      extensible: sinkModel
+    data:
+      - ["org.apache.hive.hcatalog.templeton", "HcatDelegator", True, "addOneColumn", "(String,String,String,ColumnDesc)", "", "Argument[3]", "sql", "ai-generated"]
+

java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll

@@ -67,9 +67,10 @@
  *    "taint" indicates a default additional taint step and "value" indicates a
  *    globally applicable value-preserving step.
  * 9. The `provenance` column is a tag to indicate the origin of the summary.
- *    There are two supported values: "generated" and "manual". "generated" means that
- *    the model has been emitted by the model generator tool and "manual" means
- *    that the model has been written by hand.
+ *    The supported values are: "manual", "generated" and "ai-generated". "manual"
+ *    means that the model has been written by hand, "generated" means that
+ *    the model has been emitted by the model generator tool and
+ *    "ai-generated" means that the model has been AI generated (ATM project).
  */
 
 import java
@@ -308,7 +309,7 @@ module ModelValidation {
       not ext.regexpMatch("|Annotated") and
       result = "Unrecognized extra API graph element \"" + ext + "\" in " + pred + " model."
       or
-      not provenance = ["manual", "generated"] and
+      not provenance = ["manual", "generated", "ai-generated"] and
       result = "Unrecognized provenance description \"" + provenance + "\" in " + pred + " model."
     )
   }

java/ql/lib/semmle/code/java/dataflow/internal/FlowSummaryImpl.qll

@@ -248,7 +248,9 @@ module Public {
     /**
      * Holds if all the summaries that apply to `this` are auto generated and not manually created.
      */
-    final predicate isAutoGenerated() { this.hasProvenance("generated") and not this.isManual() }
+    final predicate isAutoGenerated() {
+      this.hasProvenance(["generated", "ai-generated"]) and not this.isManual()
+    }
 
     /**
      * Holds if there exists a manual summary that applies to `this`.
@@ -268,7 +270,7 @@ module Public {
     /**
      * Holds if the neutral is auto generated.
      */
-    predicate isAutoGenerated() { neutralElement(this, "generated") }
+    predicate isAutoGenerated() { neutralElement(this, ["generated", "ai-generated"]) }
 
     /**
      * Holds if there exists a manual neutral that applies to `this`.
@@ -1202,11 +1204,11 @@ module Private {
     }
 
     private string renderProvenance(SummarizedCallable c) {
-      if c.isAutoGenerated() then result = "generated" else result = "manual"
+      if c.isManual() then result = "manual" else c.hasProvenance(result)
     }
 
     private string renderProvenanceNeutral(NeutralCallable c) {
-      if c.isAutoGenerated() then result = "generated" else result = "manual"
+      if c.isManual() then result = "manual" else c.hasProvenance(result)
     }
 
     /**