Java: Add query for CSV framework coverage.

aschackmull · aschackmull · commit 4941d9b7bf97 · 2021-03-10T12:03:44.000+01:00
diff --git a/java/ql/src/meta/frameworks/Coverage.ql b/java/ql/src/meta/frameworks/Coverage.ql
@@ -0,0 +1,14 @@
+/**
+ * @name Framework coverage
+ * @description The number of API endpoints covered by CSV models sorted by
+ *              package and source-, sink-, and summary-kind.
+ * @kind metric
+ * @id java/meta/framework-coverage
+ */
+
+import java
+import semmle.code.java.dataflow.ExternalFlow
+
+from string package, string kind, string part, int n
+where modelCoverage(package, kind, part, n)
+select package, kind, part, n
diff --git a/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll b/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll
@@ -204,6 +204,29 @@ private predicate summaryModel(
   )
 }
 
+/**
+ * Holds if CSV framework coverage of `package` is `n` api endpoints of the
+ * kind `(kind, part)`.
+ */
+predicate modelCoverage(string package, string kind, string part, int n) {
+  part = "source" and
+  n =
+    strictcount(string type, boolean subtypes, string name, string signature, string ext,
+      string output | sourceModel(package, type, subtypes, name, signature, ext, output, kind))
+  or
+  part = "sink" and
+  n =
+    strictcount(string type, boolean subtypes, string name, string signature, string ext,
+      string input | sinkModel(package, type, subtypes, name, signature, ext, input, kind))
+  or
+  part = "summary" and
+  n =
+    strictcount(string type, boolean subtypes, string name, string signature, string ext,
+      string input, string output |
+      summaryModel(package, type, subtypes, name, signature, ext, input, output, kind)
+    )
+}
+
 /** Provides a query predicate to check the CSV data for validation errors. */
 module CsvValidation {
   /** Holds if some row in a CSV-based flow model appears to contain typos. */
