Merge pull request #6138 from owen-mc/java/model/apache-commons-collections

Model Apache commons collections MapUtils class and keyvalue package

Author: owen-mc

java/change-notes/2021-06-25-apache-collections-maputils-keyvalue.md

@@ -0,0 +1,2 @@
+lgtm,codescanning
+* Added models for  the package `keyvalue` and the classes `KeyValue` and `MapUtils` from Apache Commons Collections. This may lead to more results from any query using data-flow analysis where a relevant path uses one of these container types.

java/documentation/library-coverage/frameworks.csv

@@ -2,9 +2,10 @@ Framework name,URL,Package prefixes
 Java Standard Library,,java.*
 Java extensions,,javax.*
 Google Guava,https://guava.dev/,com.google.common.*
+Apache Commons Collections,https://commons.apache.org/proper/commons-collections/,org.apache.commons.collections org.apache.commons.collections4
 Apache Commons IO,https://commons.apache.org/proper/commons-io/,org.apache.commons.io
 Apache Commons Lang,https://commons.apache.org/proper/commons-lang/,org.apache.commons.lang3
 Apache Commons Text,https://commons.apache.org/proper/commons-text/,org.apache.commons.text
 Apache HttpComponents,https://hc.apache.org/,org.apache.hc.core5.* org.apache.http
 Android,,android.*
-Spring,https://spring.io/,org.springframework.*
+Spring,https://spring.io/,org.springframework.*

java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll

@@ -78,6 +78,7 @@ private import FlowSummary
 private module Frameworks {
   private import internal.ContainerFlow
   private import semmle.code.java.frameworks.ApacheHttp
+  private import semmle.code.java.frameworks.apache.Collections
   private import semmle.code.java.frameworks.apache.Lang
   private import semmle.code.java.frameworks.guava.Guava
   private import semmle.code.java.frameworks.jackson.JacksonSerializability

java/ql/src/semmle/code/java/dataflow/NullGuards.qll

@@ -5,6 +5,7 @@
 import java
 import SSA
 private import semmle.code.java.controlflow.internal.GuardsLogic
+private import semmle.code.java.frameworks.apache.Collections
 private import RangeUtils
 private import IntegerGuards
 
@@ -144,11 +145,11 @@ predicate nullCheckMethod(Method m, boolean branch, boolean isnull) {
   branch = false and
   isnull = false
   or
-  (
-    m.getDeclaringType().hasQualifiedName("org.apache.commons.collections4", "CollectionUtils") or
-    m.getDeclaringType().hasQualifiedName("org.apache.commons.collections", "CollectionUtils")
-  ) and
-  m.hasName("isNotEmpty") and
+  m instanceof MethodApacheCollectionsIsEmpty and
+  branch = false and
+  isnull = false
+  or
+  m instanceof MethodApacheCollectionsIsNotEmpty and
   branch = true and
   isnull = false
   or