-
Notifications
You must be signed in to change notification settings - Fork 1.8k
Java: Convert existing Commons Lang models to CSV #5372
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Java: Convert existing Commons Lang models to CSV #5372
Conversation
override predicate row(string row) { | ||
row = | ||
[ | ||
"org.apache.commons.lang3.text;StrBuilder;false;StrBuilder;(java.lang.String);;Argument;ReturnValue;taint", |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Constructors should use Argument[-1]
instead of ReturnValue
to represent the constructed value. That way extending classes will also get proper flow through calls to super
, which isn't an expression and therefore doesn't work with ReturnValue
. The fact that ReturnValue
currently mostly works is essentially a bug that will be fixed soon.
The adjustment for constructors should be an easy fix, so I think we should at least include that. Switching from |
All instances are replaced with a specific Argument or range.
@aschackmull both conversions applied (and rebased on latest |
4640935
to
eaa2d4d
Compare
This also adds tests for ArrayUtils and amends the existing models, which weren't quite right. Some void-returning methods were dropped, some additional parameters that can incorporate taint were added, and the stringifying methods were dropped on grounds that we don't usually consider toString taint-propagating AFAIK (though particular queries may differ in this respect)