fix(analyzer, model): Fix a bunch of FN - #393
Draft
Saloed wants to merge 3 commits into
Draft
Conversation
A callable stored in a collection and invoked after being read back was never connected to its body, so taint flowing through it was lost. Two gates collided. Lambda callee resolution runs only in prescan: `tryExtractLambdaType` and `TypeInfoSequentFlowFunction.handle` both return unless the phase is Prescan, so the `TypeInfoAccessor` fact is produced at the allocation and consumed at the callsite only in that phase. But `handlePhase` discarded every config-derived rule during prescan, pass-through included -- and pass-through is the only model for `Collection#add` and `Iterator#next`. The type-info fact therefore could not cross the container, the receiver of the invocation carried no type info, and the lambda body was analyzed in neither phase. Pass-through rules describe how a value moves, not where taint starts or ends, so prescan needs them for the very thing it exists to do: find the callsites the full scan should look at. Sources, sinks and cleaners stay disabled, so prescan still carries no taint of its own. This also closes a second loss that only appears in the staged pipeline. With the lambda body unreachable in prescan its sink was never discovered, so `relevantRuleIds` carried no `TaintMethodSink` and `SemgrepRuleProvider` dropped the whole rule before the full scan. The unit harness cannot show this -- its rules have no serialized id -- so lifting the phase gates on type-info instead would turn the tests green while leaving the miss in place. Adds the DataFlowBench false-negative shapes as source/sink dataflow tests, each paired with a control that isolates its cause. The misses that remain are disabled with their measured cause recorded. Verified: core JVM 313 tests / 0 failures, java-querylang 207 / 0 failures. Not yet measured: prescan now does strictly more work and gets only 0.3x the IFDS timeout, and a larger prescan also widens `relevantRuleIds` and so the full scan. Needs an A/B on a real project before this is relied upon. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
A tainted primitive stored into a collection and read back lost its taint, because javac's implicit boxing had no model. `Integer.valueOf(int)` is an unresolved JDK callee with no pass-through rule, so the fact was dropped at the boxing call and every later step already saw a clean value -- the taint died before the collection was even reached. Boxing and unboxing are independent barriers: a value that is boxed and later read back crosses both, so modelling only `valueOf` still loses the taint at `intValue()`. Adds both directions for the eight wrapper types. `Character#charValue` already existed and is left alone. `overrides: false` keeps each rule on the wrapper that declares it. A receiver typed as `java.lang.Number` resolves its accessor to `Number#intValue` and is therefore not covered; that is deliberate, since an overriding rule there would also claim `BigDecimal`, `AtomicInteger` and every other `Number`. These are config rules, so they are only applied once prescan stops discarding pass-through -- see the preceding commit. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The boxing pass-through rules this test needs live in `model/`, which the scope-path check keeps in a separate pull request, so the test is enabled here rather than alongside them. It fails until those rules land. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Contributor
Author
Saloed
changed the title
misonijnik
changed the title
misonijnik
changed the title
misonijnik
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.