Java: update to only find 'finalize' calls and add 'super.finalize' exclusion

Author: Jami Cogswell

java/ql/src/Violations of Best Practice/Undesirable Calls/DoNotUseFinalize.md

@@ -0,0 +1,27 @@
+## Overview
+
+Calling `finalize` in application code may cause inconsistent program state or unpredicatable behavior.
+
+## Recommendation
+
+Avoid calling `finalize` in application code. Allow the JVM to determine a garbage collection schedule instead.
+
+## Example
+
+```java
+public class Test {
+    void f() throws Throwable {
+        this.finalize(); // NON_COMPLIANT
+    }
+}
+
+```
+
+# Implementation Notes
+
+This rule is focused on the use of existing `finalize` invocations rather than attempts to write a custom implementation.
+
+## References
+
+- Carnegie Mellon University, SEI CERT Oracle Coding Standard for Java: [MET12-J. Do not use finalizers](https://wiki.sei.cmu.edu/confluence/display/java/MET12-J.+Do+not+use+finalizers).
+- Common Weakness Enumeration: [CWE-586](https://cwe.mitre.org/data/definitions/586).

java/ql/src/Violations of Best Practice/Undesirable Calls/DoNotUseFinalize.ql

@@ -0,0 +1,27 @@
+/**
+ * @id java/do-not-use-finalize
+ * @name Do not use `finalize`
+ * @description Calling `finalize` in application code may cause
+ *              inconsistent program state or unpredicatable behavior.
+ * @kind problem
+ * @precision high
+ * @problem.severity error
+ * @tags correctness
+ *       external/cwe/cwe-586
+ */
+
+import java
+
+from MethodCall mc, Method m
+where
+  mc.getMethod() = m and
+  m.hasName("finalize") and
+  // The Java documentation for `finalize` states: "If a subclass overrides
+  // `finalize` it must invoke the superclass finalizer explicitly". Therefore,
+  // we do not alert on `super.finalize` calls that occur within a callable
+  // that overrides `finalize`.
+  not exists(Callable caller, FinalizeMethod fm | caller = mc.getCaller() |
+    caller.(Method).overrides(fm) and
+    mc.getQualifier() instanceof SuperAccess
+  )
+select mc, "Call to 'finalize'."

java/ql/src/Violations of Best Practice/Undesirable Calls/DoNotUseFinalizers.md

@@ -0,0 +1 @@
+| Test.java:3:9:3:23 | finalize(...) | Call to 'finalize'. |

java/ql/src/Violations of Best Practice/Undesirable Calls/DoNotUseFinalizers.ql

@@ -0,0 +1 @@
+Violations of Best Practice/Undesirable Calls/DoNotUseFinalize.ql

java/ql/test/query-tests/DoNotUseFinalize/DoNotUseFinalize.expected

@@ -0,0 +1,9 @@
+public class Test {
+    void f() throws Throwable {
+        this.finalize(); // NON_COMPLIANT
+    }
+
+    void f1() throws Throwable {
+        f(); // COMPLIANT
+    }
+}