Java: Share argument indexing logic

tausbn · Stephan Brandauer · commit 11ab7e2e7108 · 2023-05-25T14:16:23.000+02:00
Adds a utility predicate for turning integer indices into the desired string representation.
diff --git a/java/ql/src/Telemetry/AutomodelApplicationModeCharacteristics.qll b/java/ql/src/Telemetry/AutomodelApplicationModeCharacteristics.qll
@@ -77,10 +77,12 @@ module ApplicationCandidatesImpl implements SharedCharacteristics::CandidateSig
     (
       exists(Call c, int argIdx |
         e.asExpr() = c.getArgument(argIdx) and
-        input = "Argument[" + argIdx + "]"
+        input = AutomodelSharedUtil::getArgumentForIndex(argIdx)
       )
       or
-      exists(Call c | e.asExpr() = c.getQualifier() and input = "Argument[this]")
+      exists(Call c |
+        e.asExpr() = c.getQualifier() and input = AutomodelSharedUtil::getArgumentForIndex(-1)
+      )
     )
   }
 
@@ -148,10 +150,11 @@ class ApplicationModeMetadataExtractor extends string {
     exists(Call call, Callable callable, int argIdx |
       call.getCallee() = callable and
       (
-        e.asExpr() = call.getArgument(argIdx) and input = "Argument[" + argIdx + "]"
+        e.asExpr() = call.getArgument(argIdx)
         or
-        e.asExpr() = call.getQualifier() and argIdx = -1 and input = "Argument[this]"
+        e.asExpr() = call.getQualifier() and argIdx = -1
       ) and
+      input = AutomodelSharedUtil::getArgumentForIndex(argIdx) and
       package = callable.getDeclaringType().getPackage().getName() and
       type = callable.getDeclaringType().getErasure().(RefType).nestedName() and
       subtypes = this.considerSubtypes(callable) and
@@ -231,7 +234,7 @@ private class NotAModelApiParameter extends CharacteristicsImpl::UninterestingTo
         exists(int argIdx | exists(api.getParameter(argIdx)) |
           argIdx = -1 and e.asExpr() = c.getQualifier()
           or
-          argIdx >= 0 and e.asExpr() = c.getArgument(argIdx)
+          e.asExpr() = c.getArgument(argIdx)
         )
       )
     )
diff --git a/java/ql/src/Telemetry/AutomodelFrameworkModeCharacteristics.qll b/java/ql/src/Telemetry/AutomodelFrameworkModeCharacteristics.qll
@@ -70,7 +70,7 @@ module FrameworkCandidatesImpl implements SharedCharacteristics::CandidateSig {
     signature = ExternalFlow::paramsString(getCallable(e)) and
     ext = "" and
     exists(int paramIdx | e.isParameterOf(_, paramIdx) |
-      if paramIdx = -1 then input = "Argument[this]" else input = "Argument[" + paramIdx + "]"
+      input = AutomodelSharedUtil::getArgumentForIndex(paramIdx)
     )
   }
 
@@ -134,7 +134,7 @@ class FrameworkModeMetadataExtractor extends string {
   ) {
     exists(Callable callable, int paramIdx |
       e.asParameter() = callable.getParameter(paramIdx) and
-      (if paramIdx = -1 then input = "Argument[this]" else input = "Argument[" + paramIdx + "]") and
+      input = AutomodelSharedUtil::getArgumentForIndex(paramIdx) and
       package = callable.getDeclaringType().getPackage().getName() and
       type = callable.getDeclaringType().getErasure().(RefType).nestedName() and
       subtypes = this.considerSubtypes(callable) and
diff --git a/java/ql/src/Telemetry/AutomodelSharedUtil.qll b/java/ql/src/Telemetry/AutomodelSharedUtil.qll
@@ -49,3 +49,11 @@ predicate isKnownKind(
   humanReadableKind = "command injection" and
   type instanceof AutomodelEndpointTypes::CommandInjectionSinkType
 }
+
+/** Gets the argument name for the argument with the index `index`. */
+bindingset[index]
+string getArgumentForIndex(int index) {
+  index = -1 and result = "Argument[this]"
+  or
+  index >= 0 and result = "Argument[" + index + "]"
+}

Original file line number	Diff line number	Diff line change
`@@ -77,10 +77,12 @@ module ApplicationCandidatesImpl implements SharedCharacteristics::CandidateSig`
`77`	`77`	`(`
`78`	`78`	`exists(Call c, int argIdx \|`
`79`	`79`	`e.asExpr() = c.getArgument(argIdx) and`
`80`		`- input = "Argument[" + argIdx + "]"`
	`80`	`+ input = AutomodelSharedUtil::getArgumentForIndex(argIdx)`
`81`	`81`	`)`
`82`	`82`	`or`
`83`		`- exists(Call c \| e.asExpr() = c.getQualifier() and input = "Argument[this]")`
	`83`	`+ exists(Call c \|`
	`84`	`+ e.asExpr() = c.getQualifier() and input = AutomodelSharedUtil::getArgumentForIndex(-1)`
	`85`	`+ )`
`84`	`86`	`)`
`85`	`87`	`}`
`86`	`88`
`@@ -148,10 +150,11 @@ class ApplicationModeMetadataExtractor extends string {`
`148`	`150`	`exists(Call call, Callable callable, int argIdx \|`
`149`	`151`	`call.getCallee() = callable and`
`150`	`152`	`(`
`151`		`- e.asExpr() = call.getArgument(argIdx) and input = "Argument[" + argIdx + "]"`
	`153`	`+ e.asExpr() = call.getArgument(argIdx)`
`152`	`154`	`or`
`153`		`- e.asExpr() = call.getQualifier() and argIdx = -1 and input = "Argument[this]"`
	`155`	`+ e.asExpr() = call.getQualifier() and argIdx = -1`
`154`	`156`	`) and`
	`157`	`+ input = AutomodelSharedUtil::getArgumentForIndex(argIdx) and`
`155`	`158`	`package = callable.getDeclaringType().getPackage().getName() and`
`156`	`159`	`type = callable.getDeclaringType().getErasure().(RefType).nestedName() and`
`157`	`160`	`subtypes = this.considerSubtypes(callable) and`
`@@ -231,7 +234,7 @@ private class NotAModelApiParameter extends CharacteristicsImpl::UninterestingTo`
`231`	`234`	`exists(int argIdx \| exists(api.getParameter(argIdx)) \|`
`232`	`235`	`argIdx = -1 and e.asExpr() = c.getQualifier()`
`233`	`236`	`or`
`234`		`- argIdx >= 0 and e.asExpr() = c.getArgument(argIdx)`
	`237`	`+ e.asExpr() = c.getArgument(argIdx)`
`235`	`238`	`)`
`236`	`239`	`)`
`237`	`240`	`)`