[Java] Can't match imported annotations

[nightwatchcyber]

Describe the bug
Matching stops working in Java when "import" is used

To Reproduce
https://semgrep.dev/RrPN

Expected behavior
Matching should work even if import statements exist

Screenshots
If applicable, add screenshots to help explain your problem.

Environment
semgrev.dev and MacOS

[nightwatchcyber]

This is based of the example by @minusworld, theirs works:
https://sgrep.live/yjx

Mine doesn't:
https://semgrep.dev/RrPN

Only difference is the import statement

[nightwatchcyber]

screenshots attached

[nightwatchcyber]

Using full package name doesn't help either:
@org.springframework.web.bind.annotation.RequestMapping(method=$M)

[ievans]

Thanks for the great bug report, @nightwatchcyber. Cc @aryx who I suspect has the most context here

[aryx]

There's 2 bugs here. First, annotations with qualified names are not correctly represented in the generic AST
so @Foo.bar.whatever is actually the same as @xxx.yyy (not good). Second, if the pattern does not contain a qualified name (e.g., @foo), we should still allow it to match imported name (E.g., import x.y.Foo; @foo ).

[nbrahms]

cf. https://semgrep.dev/jxwN/, which should be a working test case even if we don't change the fqdn resolution behavior (the latter seems more like a design decision we should revisit than a clear-cut bug, @aryx ?).

[nbrahms]

Here's the AST of the code annotation:

                          "NamedAttr": [
                            "()",
                            [
                              "RequestMapping",
                              "()"
                            ],
                            {
                              "id_const_literal": {
                                "ref@": null
                              },
                              "id_resolved": {
                                "ref@": {
                                  "some": [
                                    {
                                      "ImportedEntity": [
                                        [
                                          "org",
                                          "()"
                                        ],
                                        [
                                          "springframework",
                                          "()"
                                        ],
                                        [
                                          "web",
                                          "()"
                                        ],
                                        [
                                          "bind",
                                          "()"
                                        ],
                                        [
                                          "annotation",
                                          "()"
                                        ],
                                        [
                                          "RequestMapping",
                                          "()"
                                        ]
                                      ]
                                    },
                                    1
                                  ]
                                }
                              },
                              "id_type": {
                                "ref@": null
                              }
                            },
                            [
                              {
                                "ArgKwd": [
                                  [
                                    "method",
                                    "()"
                                  ],
                                  {
                                    "DotAccess": [
                                      {
                                        "Id": [
                                          [
                                            "RequestMethod",
                                            "()"
                                          ],
                                          {
                                            "id_const_literal": {
                                              "ref@": null
                                            },
                                            "id_resolved": {
                                              "ref@": null
                                            },
                                            "id_type": {
                                              "ref@": null
                                            }
                                          }
                                        ]
                                      },
                                      "()",
                                      {
                                        "FId": [
                                          "GET",
                                          "()"
                                        ]
                                      }
                                    ]
                                  }
                                ]
                              }
                            ]
                          ]
                        },

but the pattern annotation is parsed as:

            {
              "OtherAttribute": [
                "OA_AnnotJavaOther",
                [
                  {
                    "Tk": "()"
                  }
                ]
              ]
            },

[aryx]

Yep, I'm almost done fixing it.