test(flow): cover Java FLOWS_TO edges (#714)

[vitali87]

What

Adds e2e coverage proving Java FLOWS_TO (data-flow / taint edges) works: an env read reaching a print emits resource -> resource, a tainted local passed to a first-party method emits a caller -> callee ARG edge, and a method returning a tainted value emits a callee -> caller RETURN edge (resolved cross-method through the shared #712 fixpoint).

Why no production code changed

The lean non-Python flow walk (FlowProcessor._process_lean_flow / _flat_flow_walk) already dispatches for any language with an IO sink table and a LanguageDescriptor. Java gained both in #750 (io READS_FROM/WRITES_TO), and the shared call_name reconstruction for Java method_invocation (no function field) plus variable_declarator / assignment_expression binding cover the flow shapes with no new code. This PR pins that behavior against regression.

Tests (test_java_flow_e2e.py)

• test_java_env_flows_to_stdout — System.getenv local carried to System.out.println: ENV -> STDOUT
• test_java_direct_env_argument_flows_to_stdout — env read nested directly in the print call
• test_java_tainted_value_arg_edge_to_callee — tainted local passed to a sibling method (ARG edge)
• test_java_return_taint_edge — method returning a tainted value (RETURN edge to its caller)
• test_java_reassignment_kills_taint — overwriting the tainted local with a clean literal kills the flow
• test_java_untainted_local_no_flow — a plain local emits no resource flow

Scope

Java uses the flat source-order walk (not in _HOISTED_DECL_LANGS), matching Go's initial FLOWS_TO increment (#747). Path-sensitivity for the flat-walk languages (Go and Java) remains a separate follow-up.

[vitali87]

@greptile review

[gemini-code-assist]

Code Review

This pull request introduces a new integration test suite, test_java_flow_e2e.py, to verify Java data flow tracking, including environment variables flowing to stdout, argument passing, return values, and taint killing via reassignment. It also bumps the package version in uv.lock. The reviewer suggested a performance optimization to cache the results of load_parsers() at the module level instead of reloading parsers and queries for every test case, which would speed up the integration test suite.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[greptile-apps]

Greptile Summary

This PR adds Java integration coverage for FLOWS_TO behavior. The main changes are:

• Java env-to-stdout resource flow tests for local and direct env reads.
• Cross-method argument and return taint edge tests.
• Negative coverage for reassignment-killed taint and untainted locals.
• Editable package version bump in uv.lock.

Confidence Score: 5/5

Safe to merge with minimal risk.

The changes are focused on integration tests and a lockfile version bump, and they follow the existing flow test harness patterns.

No files require special attention.

T-Rex Logs

What T-Rex did

• T-Rex ran the Java flow pytest command, loading dependencies and attempting a build, but the run exited with code 1 due to a missing cmake for pymgclient.
• T-Rex executed uv lock --check and confirmed the lock state with a successful exit code of 0.
• T-Rex captured the environment and tool/runtime availability to support the environment-blocker conclusion.

_{Ran code and verified through T-Rex}

Important Files Changed

Filename	Overview
codebase_rag/tests/integration/test_java_flow_e2e.py	Adds Java integration coverage for resource, argument, return, reassignment, and untainted FLOWS_TO behavior using the existing Memgraph end-to-end harness.
uv.lock	Updates the editable project package version from 0.0.340 to 0.0.341.

Sequence Diagram

%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
participant Test as Java flow e2e test
participant Builder as _build()
participant Updater as GraphUpdater
participant Graph as Memgraph
Test->>Builder: write App.java fixture
Builder->>Updater: run with IO capture
Updater->>Graph: persist FLOWS_TO edges
Test->>Graph: query FLOWS_TO rows
Graph-->>Test: resource / ARG / RETURN edges
Test->>Test: assert expected Java flow behavior

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
participant Test as Java flow e2e test
participant Builder as _build()
participant Updater as GraphUpdater
participant Graph as Memgraph
Test->>Builder: write App.java fixture
Builder->>Updater: run with IO capture
Updater->>Graph: persist FLOWS_TO edges
Test->>Graph: query FLOWS_TO rows
Graph-->>Test: resource / ARG / RETURN edges
Test->>Test: assert expected Java flow behavior

Loading

_{Reviews (1): Last reviewed commit: "test(flow): cover Java FLOWS_TO edges (#..." | Re-trigger Greptile}

[greptile-apps]

Greptile Summary

This PR adds Java end-to-end coverage for FLOWS_TO behavior. The main changes are:

• New integration tests for Java env-to-stdout resource flows.
• Coverage for Java tainted argument and return flow edges.
• Negative coverage for reassignment-killed taint and untainted locals.
• Lockfile package version alignment with project metadata.

Confidence Score: 5/5

Safe to merge with minimal risk.

The changes are test-only plus lockfile version alignment, and no functional issues were identified.

No files require special attention.

T-Rex Logs

What T-Rex did

• The sandbox blocker state was inspected using the tool-availability log.
• The end-to-end command and the cmake/setup failure were captured in the pytest-run log.
• The ruff static check was attempted but could not run due to ruff being unavailable under uv run --no-sync, as shown in the ruff-check log.
• The collection step attempted but failed before collection because loguru was unavailable in the recreated no-sync venv, per the collect-only log.
• A lightweight static test summary was executed, listing six test names, as captured in the static-test-summary log.

_{Ran code and verified through T-Rex}

Important Files Changed

Filename	Overview
codebase_rag/tests/integration/test_java_flow_e2e.py	Adds Java integration coverage for ENV-to-STDOUT resource flows, ARG flow, RETURN flow, and negative taint cases without issues found.
uv.lock	Updates the editable package version lock entry to match the project version, with no dependency graph changes.

Sequence Diagram

%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
  participant Test as Java flow test
  participant Builder as _build helper
  participant Updater as GraphUpdater
  participant Graph as Memgraph

  Test->>Builder: provide Java snippet
  Builder->>Updater: run with IO capture
  Updater->>Graph: write FLOWS_TO edges
  Test->>Graph: query FLOWS_TO relationships
  Graph-->>Test: resource / ARG / RETURN flow rows
  Test->>Test: assert expected Java flow behavior

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
  participant Test as Java flow test
  participant Builder as _build helper
  participant Updater as GraphUpdater
  participant Graph as Memgraph

  Test->>Builder: provide Java snippet
  Builder->>Updater: run with IO capture
  Updater->>Graph: write FLOWS_TO edges
  Test->>Graph: query FLOWS_TO relationships
  Graph-->>Test: resource / ARG / RETURN flow rows
  Test->>Test: assert expected Java flow behavior

Loading

_{Reviews (2): Last reviewed commit: "test(flow): cover Java FLOWS_TO edges (#..." | Re-trigger Greptile}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud