Java: switch Collectors.joining model from neutral to summary

Jami Cogswell · Jami Cogswell · commit 181a711f0450 · 2023-01-10T21:06:03.000-05:00
diff --git a/java/ql/lib/ext/java.util.stream.model.yml b/java/ql/lib/ext/java.util.stream.model.yml
@@ -9,6 +9,7 @@ extensions:
       - ["java.util.stream", "BaseStream", True, "sequential", "()", "", "Argument[-1].Element", "ReturnValue.Element", "value", "manual"]
       - ["java.util.stream", "BaseStream", True, "spliterator", "()", "", "Argument[-1].Element", "ReturnValue.Element", "value", "manual"]
       - ["java.util.stream", "BaseStream", True, "unordered", "()", "", "Argument[-1].Element", "ReturnValue.Element", "value", "manual"]
+      - ["java.util.stream", "Collectors", False, "joining", "(CharSequence)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
       - ["java.util.stream", "Stream", True, "allMatch", "(Predicate)", "", "Argument[-1].Element", "Argument[0].Parameter[0]", "value", "manual"]
       - ["java.util.stream", "Stream", True, "anyMatch", "(Predicate)", "", "Argument[-1].Element", "Argument[0].Parameter[0]", "value", "manual"]
       - ["java.util.stream", "Stream", True, "collect", "(Supplier,BiConsumer,BiConsumer)", "", "Argument[-1].Element", "Argument[1].Parameter[1]", "value", "manual"]
@@ -92,7 +93,6 @@ extensions:
       pack: codeql/java-all
       extensible: neutralModel
     data:
-      - ["java.util.stream", "Collectors", "joining", "(CharSequence)", "manual"]
       - ["java.util.stream", "Collectors", "toList", "()", "manual"]
       - ["java.util.stream", "Collectors", "toMap", "(Function,Function)", "manual"]
       - ["java.util.stream", "Collectors", "toSet", "()", "manual"]
diff --git a/java/ql/test/ext/TestModels/Test.java b/java/ql/test/ext/TestModels/Test.java
@@ -11,6 +11,7 @@
 import java.util.concurrent.atomic.AtomicReference;
 import java.util.function.Function;
 import java.util.function.Supplier;
+import java.util.stream.Collectors;
 
 public class Test {
 
@@ -128,6 +129,9 @@ public void test() throws Exception {
             AtomicReference ar = new AtomicReference(source());
             sink(ar.get());  // $hasValueFlow
 
+            // java.util.stream
+            sink(Collectors.joining((CharSequence)source())); // $hasTaintFlow
+
             // java.util.concurrent
             CountDownLatch cdl = new CountDownLatch((int)source());
             sink(cdl.getCount()); // $hasValueFlow
