Skip to content

Commit 846c9d5

Browse files
pavgustpavgust
committed
Migrate Java code to separate QL repo.
1 parent d957c15 commit 846c9d5

File tree

2,319 files changed

+134386
-0
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

2,319 files changed

+134386
-0
lines changed

‎java/ql/src/.project

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<projectDescription>
3+
<name>semmlecode-queries</name>
4+
<comment></comment>
5+
<projects>
6+
</projects>
7+
<buildSpec>
8+
</buildSpec>
9+
<natures>
10+
<nature>com.semmle.plugin.qdt.core.qlnature</nature>
11+
</natures>
12+
</projectDescription>

‎java/ql/src/.qlpath

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
2+
<ns:qlpath xmlns:ns="https://semmle.com/schemas/qlpath">
3+
<dbscheme>/semmlecode-queries/config/semmlecode.dbscheme</dbscheme>
4+
<defaultImports><defaultImport>java</defaultImport></defaultImports>
5+
</ns:qlpath>

‎java/ql/src/.settings/org.eclipse.jdt.core.prefs

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
#Tue Nov 04 11:42:37 GMT 2008
2+
eclipse.preferences.version=1
3+
org.eclipse.jdt.core.compiler.codegen.targetPlatform=1.5
4+
org.eclipse.jdt.core.compiler.compliance=1.5
5+
org.eclipse.jdt.core.compiler.problem.assertIdentifier=error
6+
org.eclipse.jdt.core.compiler.problem.enumIdentifier=error
7+
org.eclipse.jdt.core.compiler.source=1.5

‎java/ql/src/.vs/VSWorkspaceSettings.json

+8
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
{
2+
"ql.projects" : {
3+
"." : {
4+
"dbScheme" : "config/semmlecode.dbscheme",
5+
"libraryPath" : []
6+
}
7+
}
8+
}

‎java/ql/src/Advisory/Declarations/MissingOverrideAnnotation.java

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
class Rectangle
2+
{
3+
private int w = 10, h = 10;
4+
public int getArea() {
5+
return w * h;
6+
}
7+
}
8+
9+
class Triangle extends Rectangle
10+
{
11+
@Override // Annotation of an overriding method
12+
public int getArea() {
13+
return super.getArea() / 2;
14+
}
15+
}

‎java/ql/src/Advisory/Declarations/MissingOverrideAnnotation.qhelp

+54
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
<!DOCTYPE qhelp PUBLIC
2+
"-//Semmle//qhelp//EN"
3+
"qhelp.dtd">
4+
<qhelp>
5+
6+
7+
<overview>
8+
<p>
9+
Java enables you to annotate methods that are intended to override a method in a superclass.
10+
Compilers are required to generate an error if such an annotated method does not override a method
11+
in a superclass, which provides increased protection from potential defects. An annotated method also
12+
improves code readability.
13+
</p>
14+
15+
</overview>
16+
<recommendation>
17+
18+
<p>
19+
Add an <code>@Override</code> annotation to a method that is intended to override a method in a
20+
superclass.
21+
</p>
22+
23+
</recommendation>
24+
<example>
25+
26+
<p>In the following example, <code>Triangle.getArea</code> overrides <code>Rectangle.getArea</code>,
27+
so it is annotated with <code>@Override</code>.</p>
28+
29+
<sample src="MissingOverrideAnnotation.java" />
30+
31+
</example>
32+
<references>
33+
34+
35+
<li>
36+
J. Bloch, <em>Effective Java (second edition)</em>, Item 36.
37+
Addison-Wesley, 2008.
38+
</li>
39+
<li>
40+
Help - Eclipse Platform:
41+
<a href="http://help.eclipse.org/indigo/index.jsp?topic=%2Forg.eclipse.jdt.doc.user%2Freference%2Fpreferences%2Fjava%2Fcompiler%2Fref-preferences-errors-warnings.htm">Java Compiler Errors/Warnings Preferences</a>.
42+
</li>
43+
<li>
44+
Java Platform, Standard Edition 6, API Specification:
45+
<a href="http://docs.oracle.com/javase/6/docs/api/java/lang/Override.html">Annotation Type Override</a>.
46+
</li>
47+
<li>
48+
The Java Tutorials:
49+
<a href="http://docs.oracle.com/javase/tutorial/java/annotations/predefined.html">Predefined Annotation Types</a>.
50+
</li>
51+
52+
53+
</references>
54+
</qhelp>

‎java/ql/src/Advisory/Declarations/MissingOverrideAnnotation.ql

+30
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
/**
2+
* @name Missing Override annotation
3+
* @description A method that overrides a method in a superclass but does not have an 'Override'
4+
* annotation cannot take advantage of compiler checks, and makes code less readable.
5+
* @kind problem
6+
* @problem.severity recommendation
7+
* @precision high
8+
* @id java/missing-override-annotation
9+
* @tags maintainability
10+
*/
11+
import java
12+
13+
class OverridingMethod extends Method {
14+
OverridingMethod() {
15+
exists(Method m | this.overrides(m))
16+
}
17+
18+
predicate isOverrideAnnotated() {
19+
this.getAnAnnotation() instanceof OverrideAnnotation
20+
}
21+
}
22+
23+
from OverridingMethod m, Method overridden
24+
where
25+
m.fromSource() and
26+
m.overrides(overridden) and
27+
not m.isOverrideAnnotated() and
28+
not exists(FunctionalExpr mref | mref.asMethod() = m)
29+
select m, "This method overrides $@; it is advisable to add an Override annotation.",
30+
overridden, overridden.getDeclaringType() + "." + overridden.getName()

‎java/ql/src/Advisory/Declarations/NonFinalImmutableField.qhelp

+35
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
<!DOCTYPE qhelp PUBLIC
2+
"-//Semmle//qhelp//EN"
3+
"qhelp.dtd">
4+
<qhelp>
5+
6+
7+
<overview>
8+
<p>A field of immutable type that is not declared <code>final</code>, but is assigned to only in a
9+
constructor or static initializer of its declaring type, may lead to defects and makes code less
10+
readable. This is because other parts of the code may be based on the assumption that the field has
11+
a constant value, and a later modification, which includes an assignment to the field, may
12+
invalidate this assumption.
13+
</p>
14+
15+
</overview>
16+
<recommendation>
17+
18+
<p>If a field of immutable type is assigned to only during class or instance initialization,
19+
you should usually declare it <code>final</code>. This forces the compiler to verify that the field
20+
value cannot be changed subsequently, which can help to avoid defects and increase code readability.
21+
</p>
22+
23+
</recommendation>
24+
<references>
25+
26+
27+
<li>
28+
Java Language Specification:
29+
<a href="http://docs.oracle.com/javase/specs/jls/se7/html/jls-4.html#jls-4.12.4">4.12.4 final Variables</a>,
30+
<a href="http://docs.oracle.com/javase/specs/jls/se7/html/jls-8.html#jls-8.3.1.2">8.3.1.2 final Fields</a>.
31+
</li>
32+
33+
34+
</references>
35+
</qhelp>

‎java/ql/src/Advisory/Declarations/NonFinalImmutableField.ql

+52
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
/**
2+
* @name Non-final immutable field
3+
* @description A field of immutable type that is assigned to only in a constructor or static
4+
* initializer of its declaring type, but is not declared 'final', may lead to defects
5+
* and makes code less readable.
6+
* @kind problem
7+
* @problem.severity recommendation
8+
* @precision medium
9+
* @id java/non-final-immutable-field
10+
* @tags reliability
11+
*/
12+
import java
13+
14+
class Initialization extends Callable {
15+
Initialization() {
16+
this instanceof Constructor or
17+
this instanceof InitializerMethod
18+
}
19+
}
20+
21+
/** A binary or unary assignment. */
22+
class AnyAssignment extends Expr {
23+
AnyAssignment() {
24+
this instanceof Assignment or
25+
this instanceof UnaryAssignExpr
26+
}
27+
28+
/** The expression modified by this assignment. */
29+
Expr getDest() {
30+
this.(Assignment).getDest() = result or
31+
this.(UnaryAssignExpr).getExpr() = result
32+
}
33+
}
34+
35+
class ImmutableField extends Field {
36+
ImmutableField() {
37+
this.fromSource() and
38+
not this instanceof EnumConstant and
39+
this.getType() instanceof ImmutableType and
40+
// The field is only assigned to in a constructor or static initializer of the type it is declared in.
41+
forall(FieldAccess fw, AnyAssignment ae |
42+
fw.getField().getSourceDeclaration() = this and
43+
fw = ae.getDest()
44+
| ae.getEnclosingCallable().getDeclaringType() = this.getDeclaringType() and
45+
ae.getEnclosingCallable() instanceof Initialization
46+
)
47+
}
48+
}
49+
50+
from ImmutableField f
51+
where not f.isFinal()
52+
select f, "This immutable field is not declared final but is only assigned to during initialization."

‎java/ql/src/Advisory/Declarations/NonPrivateField.qhelp

+38
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
<!DOCTYPE qhelp PUBLIC
2+
"-//Semmle//qhelp//EN"
3+
"qhelp.dtd">
4+
<qhelp>
5+
6+
7+
<overview>
8+
<p>A non-final or non-static field that is not declared <code>private</code>,
9+
but is not accessed outside of its declaring type, may decrease code maintainability. This is because
10+
a field that is accessible from outside the class that it is declared in tends to restrict the class
11+
to a particular implementation.
12+
</p>
13+
14+
</overview>
15+
<recommendation>
16+
17+
<p>In the spirit of encapsulation, it is generally advisable to choose the
18+
most restrictive access modifier (<code>private</code>) for a field, unless
19+
there is a good reason to increase its visibility.
20+
</p>
21+
22+
</recommendation>
23+
<references>
24+
25+
26+
<li>
27+
J. Bloch, <em>Effective Java (second edition)</em>,
28+
Item 13.
29+
Addison-Wesley, 2008.
30+
</li>
31+
<li>
32+
The Java Tutorials:
33+
<a href="http://docs.oracle.com/javase/tutorial/java/javaOO/accesscontrol.html">Controlling Access to Members of a Class</a>.
34+
</li>
35+
36+
37+
</references>
38+
</qhelp>

‎java/ql/src/Advisory/Declarations/NonPrivateField.ql

+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
/**
2+
* @name Non-private field
3+
* @description A non-constant field that is not declared 'private',
4+
* but is not accessed outside of its declaring type, may decrease code maintainability.
5+
* @kind problem
6+
* @problem.severity recommendation
7+
* @precision medium
8+
* @id java/non-private-field
9+
* @tags maintainability
10+
*/
11+
import java
12+
import semmle.code.java.JDKAnnotations
13+
14+
class NonConstantSourceField extends Field {
15+
NonConstantSourceField() {
16+
this.fromSource() and
17+
not (this.isFinal() and this.isStatic())
18+
}
19+
}
20+
21+
from NonConstantSourceField f
22+
where
23+
not f.isPrivate() and
24+
not exists(VarAccess va | va.getVariable() = f |
25+
va.getEnclosingCallable().getDeclaringType() != f.getDeclaringType()
26+
) and
27+
not f.getAnAnnotation() instanceof ReflectiveAccessAnnotation
28+
select f, "This non-private field is not accessed outside of its declaring type."

‎java/ql/src/Advisory/Deprecated Code/AvoidDeprecatedCallableAccess.qhelp

+47
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
<!DOCTYPE qhelp PUBLIC
2+
"-//Semmle//qhelp//EN"
3+
"qhelp.dtd">
4+
<qhelp>
5+
6+
7+
<overview>
8+
<p>
9+
A method (or constructor) can be marked as deprecated using either the <code>@Deprecated</code>
10+
annotation or the <code>@deprecated</code> Javadoc tag. Using a method that has been
11+
marked as deprecated is bad practice, typically for one or more of the following reasons:</p>
12+
13+
<ul>
14+
<li>The method is dangerous.</li>
15+
<li>There is a better alternative method.</li>
16+
<li>Methods that are marked as deprecated are often removed from future versions of an API. So using
17+
a deprecated method may cause extra maintenance effort when the API is upgraded.</li>
18+
</ul>
19+
20+
</overview>
21+
<recommendation>
22+
23+
<p>Avoid using a method that has been marked as deprecated. Follow any guidance that
24+
is provided with the <code>@deprecated</code> Javadoc tag, which should explain how to replace the
25+
call to the deprecated method.
26+
</p>
27+
28+
</recommendation>
29+
<references>
30+
31+
32+
<li>
33+
Help - Eclipse Platform:
34+
<a href="http://help.eclipse.org/indigo/index.jsp?topic=%2Forg.eclipse.jdt.doc.user%2Freference%2Fpreferences%2Fjava%2Fcompiler%2Fref-preferences-errors-warnings.htm">Java Compiler Errors/Warnings Preferences</a>.
35+
</li>
36+
<li>
37+
Java Platform, Standard Edition 6, API Specification:
38+
<a href="http://docs.oracle.com/javase/6/docs/api/java/lang/Deprecated.html">Annotation Type Deprecated</a>.
39+
</li>
40+
<li>
41+
Java SE Documentation:
42+
<a href="http://docs.oracle.com/javase/6/docs/technotes/guides/javadoc/deprecation/deprecation.html">How and When To Deprecate APIs</a>.
43+
</li>
44+
45+
46+
</references>
47+
</qhelp>

‎java/ql/src/Advisory/Deprecated Code/AvoidDeprecatedCallableAccess.ql

+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
/**
2+
* @name Deprecated method or constructor invocation
3+
* @description Using a method or constructor that has been marked as deprecated may be dangerous or
4+
* fail to take advantage of a better method or constructor.
5+
* @kind problem
6+
* @problem.severity recommendation
7+
* @precision high
8+
* @id java/deprecated-call
9+
* @tags maintainability
10+
* non-attributable
11+
* external/cwe/cwe-477
12+
*/
13+
import java
14+
15+
private
16+
predicate isDeprecatedCallable(Callable c) {
17+
c.getAnAnnotation() instanceof DeprecatedAnnotation or
18+
exists(c.getDoc().getJavadoc().getATag("@deprecated"))
19+
}
20+
21+
from Call ca, Callable c
22+
where
23+
ca.getCallee() = c and
24+
isDeprecatedCallable(c) and
25+
// Exclude deprecated calls from within deprecated code.
26+
not isDeprecatedCallable(ca.getCaller())
27+
select ca, "Invoking $@ should be avoided because it has been deprecated.",
28+
c, c.getDeclaringType() + "." + c.getName()

‎java/ql/src/Advisory/Documentation/ImpossibleJavadocThrows.java

+8
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
/**
2+
* Javadoc for method.
3+
*
4+
* @throws Exception if a problem occurs.
5+
*/
6+
public void noThrow() {
7+
System.out.println("This method does not throw.");
8+
}

0 commit comments

Comments
 (0)