Privacy markers and fixed imports

egregius313 · egregius313 · commit 5f3c8fef3fad · 2023-05-04T10:25:17.000-04:00
diff --git a/java/ql/lib/semmle/code/java/security/ArithmeticTaintedLocalQuery.qll b/java/ql/lib/semmle/code/java/security/ArithmeticTaintedLocalQuery.qll
@@ -1,8 +1,8 @@
 /** Provides taint-tracking configurations to reason about arithmetic using local-user-controlled data. */
 
 import java
-import semmle.code.java.dataflow.FlowSources
-import semmle.code.java.security.ArithmeticCommon
+private import semmle.code.java.dataflow.FlowSources
+private import semmle.code.java.security.ArithmeticCommon
 
 /**
  * A taint-tracking configuration to reason about arithmetic overflow using local-user-controlled data.
diff --git a/java/ql/lib/semmle/code/java/security/ArithmeticUncontrolledQuery.qll b/java/ql/lib/semmle/code/java/security/ArithmeticUncontrolledQuery.qll
@@ -1,7 +1,7 @@
 /** Provides taint-tracking configuration to reason about arithmetic with uncontrolled values. */
 
 import java
-import semmle.code.java.dataflow.TaintTracking
+private import semmle.code.java.dataflow.TaintTracking
 private import semmle.code.java.security.RandomQuery
 private import semmle.code.java.security.SecurityTests
 private import semmle.code.java.security.ArithmeticCommon
diff --git a/java/ql/lib/semmle/code/java/security/ArithmeticWithExtremeValuesQuery.qll b/java/ql/lib/semmle/code/java/security/ArithmeticWithExtremeValuesQuery.qll
@@ -1,8 +1,8 @@
 /** Provides predicates and classes for reasoning about arithmetic with extreme values. */
 
 import java
-import semmle.code.java.dataflow.DataFlow
-import ArithmeticCommon
+private import semmle.code.java.dataflow.DataFlow
+private import semmle.code.java.security.ArithmeticCommon
 
 /**
  * A field representing an extreme value.
@@ -14,12 +14,12 @@ abstract class ExtremeValueField extends Field {
 }
 
 /** A field representing the minimum value of a primitive type. */
-class MinValueField extends ExtremeValueField {
+private class MinValueField extends ExtremeValueField {
   MinValueField() { this.getName() = "MIN_VALUE" }
 }
 
 /** A field representing the maximum value of a primitive type. */
-class MaxValueField extends ExtremeValueField {
+private class MaxValueField extends ExtremeValueField {
   MaxValueField() { this.getName() = "MAX_VALUE" }
 }
 
diff --git a/java/ql/lib/semmle/code/java/security/BrokenCryptoAlgorithmQuery.qll b/java/ql/lib/semmle/code/java/security/BrokenCryptoAlgorithmQuery.qll
@@ -1,8 +1,8 @@
 /** Provides to taint-tracking configuration to reason about the use of broken or risky cryptographic algorithms. */
 
 import java
-import semmle.code.java.security.Encryption
-import semmle.code.java.dataflow.TaintTracking
+private import semmle.code.java.security.Encryption
+private import semmle.code.java.dataflow.TaintTracking
 
 private class ShortStringLiteral extends StringLiteral {
   ShortStringLiteral() { this.getValue().length() < 100 }
diff --git a/java/ql/lib/semmle/code/java/security/ExecTaintedLocalQuery.qll b/java/ql/lib/semmle/code/java/security/ExecTaintedLocalQuery.qll
@@ -6,7 +6,7 @@ private import semmle.code.java.security.ExternalProcess
 private import semmle.code.java.security.CommandArguments
 
 /** A taint-tracking configuration to reason about use of externally controlled strings to make command line commands. */
-module LocalUserInputToArgumentToExecFlowConfig implements DataFlow::ConfigSig {
+module ExecTaintedLocalConfig implements DataFlow::ConfigSig {
   predicate isSource(DataFlow::Node src) { src instanceof LocalUserInput }
 
   predicate isSink(DataFlow::Node sink) { sink.asExpr() instanceof ArgumentToExec }
@@ -23,5 +23,4 @@ module LocalUserInputToArgumentToExecFlowConfig implements DataFlow::ConfigSig {
 /**
  * Taint-tracking flow for use of externally controlled strings to make command line commands.
  */
-module LocalUserInputToArgumentToExecFlow =
-  TaintTracking::Global<LocalUserInputToArgumentToExecFlowConfig>;
+module ExecTaintedLocalFlow = TaintTracking::Global<ExecTaintedLocalConfig>;
diff --git a/java/ql/lib/semmle/code/java/security/ExternallyControlledFormatStringLocalQuery.qll b/java/ql/lib/semmle/code/java/security/ExternallyControlledFormatStringLocalQuery.qll
@@ -1,8 +1,8 @@
 /** Provides a taint-tracking configuration to reason about externally-controlled format strings from local sources. */
 
 import java
-import semmle.code.java.dataflow.FlowSources
-import semmle.code.java.StringFormat
+private import semmle.code.java.dataflow.FlowSources
+private import semmle.code.java.StringFormat
 
 /** A taint-tracking configuration to reason about externally-controlled format strings from local sources. */
 module ExternallyControlledFormatStringLocalConfig implements DataFlow::ConfigSig {
diff --git a/java/ql/lib/semmle/code/java/security/ImproperValidationOfArrayConstructionCodeSpecifiedQuery.qll b/java/ql/lib/semmle/code/java/security/ImproperValidationOfArrayConstructionCodeSpecifiedQuery.qll
@@ -1,8 +1,8 @@
 /** Provides a dataflow configuration to reason about improper validation of code-specified size used for array construction. */
 
 import java
-import semmle.code.java.security.internal.ArraySizing
-import semmle.code.java.dataflow.TaintTracking
+private import semmle.code.java.security.internal.ArraySizing
+private import semmle.code.java.dataflow.TaintTracking
 
 /**
  * A dataflow configuration to reason about improper validation of code-specified size used for array construction.
diff --git a/java/ql/lib/semmle/code/java/security/ImproperValidationOfArrayConstructionLocalQuery.qll b/java/ql/lib/semmle/code/java/security/ImproperValidationOfArrayConstructionLocalQuery.qll
@@ -1,8 +1,8 @@
 /** Provides a taint-tracking configuration to reason about improper validation of local user-provided size used for array construction. */
 
 import java
-import semmle.code.java.security.internal.ArraySizing
-import semmle.code.java.dataflow.FlowSources
+private import semmle.code.java.security.internal.ArraySizing
+private import semmle.code.java.dataflow.FlowSources
 
 /**
  * A taint-tracking configuration to reason about improper validation of local user-provided size used for array construction.
diff --git a/java/ql/lib/semmle/code/java/security/ImproperValidationOfArrayConstructionQuery.qll b/java/ql/lib/semmle/code/java/security/ImproperValidationOfArrayConstructionQuery.qll
@@ -1,13 +1,13 @@
 /** Provides a taint-tracking configuration to reason about improper validation of user-provided size used for array construction. */
 
 import java
-import semmle.code.java.security.internal.ArraySizing
-import semmle.code.java.dataflow.FlowSources
+private import semmle.code.java.security.internal.ArraySizing
+private import semmle.code.java.dataflow.FlowSources
 
 /**
  * A taint-tracking configuration to reason about improper validation of user-provided size used for array construction.
  */
-private module ImproperValidationOfArrayConstructionConfig implements DataFlow::ConfigSig {
+module ImproperValidationOfArrayConstructionConfig implements DataFlow::ConfigSig {
   predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
 
   predicate isSink(DataFlow::Node sink) {
diff --git a/java/ql/lib/semmle/code/java/security/ImproperValidationOfArrayIndexCodeSpecifiedQuery.qll b/java/ql/lib/semmle/code/java/security/ImproperValidationOfArrayIndexCodeSpecifiedQuery.qll
@@ -1,9 +1,9 @@
 /** Provides a dataflow configuration to reason about improper validation of code-specified array index. */
 
 import java
-import semmle.code.java.security.internal.ArraySizing
-import semmle.code.java.security.internal.BoundingChecks
-import semmle.code.java.dataflow.TaintTracking
+private import semmle.code.java.security.internal.ArraySizing
+private import semmle.code.java.security.internal.BoundingChecks
+private import semmle.code.java.dataflow.DataFlow
 
 /**
  * A dataflow configuration to reason about improper validation of code-specified array index.
diff --git a/java/ql/lib/semmle/code/java/security/ImproperValidationOfArrayIndexLocalQuery.qll b/java/ql/lib/semmle/code/java/security/ImproperValidationOfArrayIndexLocalQuery.qll
@@ -1,8 +1,8 @@
 /** Provides a taint-tracking configuration to reason about improper validation of local user-provided array index. */
 
 import java
-import semmle.code.java.security.internal.ArraySizing
-import semmle.code.java.dataflow.FlowSources
+private import semmle.code.java.security.internal.ArraySizing
+private import semmle.code.java.dataflow.FlowSources
 
 /**
  * A taint-tracking configuration to reason about improper validation of local user-provided array index.
diff --git a/java/ql/lib/semmle/code/java/security/ImproperValidationOfArrayIndexQuery.qll b/java/ql/lib/semmle/code/java/security/ImproperValidationOfArrayIndexQuery.qll
@@ -1,8 +1,8 @@
 /** Provides a taint-tracking configuration to reason about improper validation of user-provided array index. */
 
 import java
-import semmle.code.java.security.internal.ArraySizing
-import semmle.code.java.dataflow.FlowSources
+private import semmle.code.java.security.internal.ArraySizing
+private import semmle.code.java.dataflow.FlowSources
 
 /**
  * A taint-tracking configuration to reason about improper validation of user-provided array index.
diff --git a/java/ql/lib/semmle/code/java/security/InsecureCookieQuery.qll b/java/ql/lib/semmle/code/java/security/InsecureCookieQuery.qll
@@ -1,7 +1,7 @@
 /** Provides a dataflow configuration to reason about the failure to use secure cookies. */
 
 import java
-import semmle.code.java.dataflow.DataFlow
+private import semmle.code.java.dataflow.DataFlow
 private import semmle.code.java.frameworks.Servlets
 
 private predicate isSafeSecureCookieSetting(Expr e) {
diff --git a/java/ql/lib/semmle/code/java/security/NumericCastTaintedQuery.qll b/java/ql/lib/semmle/code/java/security/NumericCastTaintedQuery.qll
@@ -1,11 +1,11 @@
 /** Provides classes to reason about possible truncation from casting of a user-provided value. */
 
 import java
-import semmle.code.java.arithmetic.Overflow
-import semmle.code.java.dataflow.SSA
-import semmle.code.java.controlflow.Guards
-import semmle.code.java.dataflow.RangeAnalysis
-import semmle.code.java.dataflow.FlowSources
+private import semmle.code.java.arithmetic.Overflow
+private import semmle.code.java.dataflow.SSA
+private import semmle.code.java.controlflow.Guards
+private import semmle.code.java.dataflow.RangeAnalysis
+private import semmle.code.java.dataflow.FlowSources
 
 /**
  * A `CastExpr` that is a narrowing cast.
@@ -37,7 +37,7 @@ class RightShiftOp extends Expr {
   }
 
   /**
-   * Gets the expression that is shifted.
+   * Gets the variable that is shifted.
    */
   Variable getShiftedVariable() {
     this.getLhs() = result.getAnAccess() or
diff --git a/java/ql/lib/semmle/code/java/security/ResponseSplittingLocalQuery.qll b/java/ql/lib/semmle/code/java/security/ResponseSplittingLocalQuery.qll
@@ -1,8 +1,8 @@
 /** Provides a taint-tracking configuration to reason about response splitting vulnerabilities from local user input. */
 
 import java
-import semmle.code.java.dataflow.FlowSources
-import semmle.code.java.security.ResponseSplitting
+private import semmle.code.java.dataflow.FlowSources
+private import semmle.code.java.security.ResponseSplitting
 
 /**
  * A taint-tracking configuration to reason about response splitting vulnerabilities from local user input.
diff --git a/java/ql/lib/semmle/code/java/security/SqlConcatenatedQuery.qll b/java/ql/lib/semmle/code/java/security/SqlConcatenatedQuery.qll
@@ -1,7 +1,7 @@
 /** Provides classes and modules to reason about SqlInjection vulnerabilities from string concatentation. */
 
 import java
-import semmle.code.java.dataflow.TaintTracking
+private import semmle.code.java.dataflow.TaintTracking
 private import semmle.code.java.security.SqlConcatenatedLib
 private import semmle.code.java.security.SqlInjectionQuery
 
diff --git a/java/ql/lib/semmle/code/java/security/SqlTaintedLocalQuery.qll b/java/ql/lib/semmle/code/java/security/SqlTaintedLocalQuery.qll
@@ -3,9 +3,9 @@
  * that is used in a SQL query.
  */
 
-import semmle.code.java.Expr
-import semmle.code.java.dataflow.FlowSources
-import semmle.code.java.security.SqlInjectionQuery
+import java
+private import semmle.code.java.dataflow.FlowSources
+private import semmle.code.java.security.SqlInjectionQuery
 
 /**
  * A taint-tracking configuration for reasoning about local user input that is
diff --git a/java/ql/lib/semmle/code/java/security/StackTraceExposureQuery.qll b/java/ql/lib/semmle/code/java/security/StackTraceExposureQuery.qll
@@ -1,8 +1,8 @@
 /** Provides predicates to reason about exposure of stack-traces. */
 
 import java
-import semmle.code.java.dataflow.DataFlow
-import semmle.code.java.dataflow.TaintTracking
+private import semmle.code.java.dataflow.DataFlow
+private import semmle.code.java.dataflow.TaintTracking
 private import semmle.code.java.security.InformationLeak
 
 /**
diff --git a/java/ql/lib/semmle/code/java/security/TaintedPermissionsCheckQuery.qll b/java/ql/lib/semmle/code/java/security/TaintedPermissionsCheckQuery.qll
@@ -1,8 +1,8 @@
 /** Provides classes to reason about tainted permissions check vulnerabilities. */
 
 import java
-import semmle.code.java.dataflow.FlowSources
-import semmle.code.java.dataflow.TaintTracking
+private import semmle.code.java.dataflow.FlowSources
+private import semmle.code.java.dataflow.TaintTracking
 
 /**
  * The `org.apache.shiro.subject.Subject` class.
diff --git a/java/ql/lib/semmle/code/java/security/TempDirLocalInformationDisclosureQuery.qll b/java/ql/lib/semmle/code/java/security/TempDirLocalInformationDisclosureQuery.qll
@@ -1,7 +1,7 @@
 /** Provides classes to reason about local information disclosure in a temporary directory. */
 
 import java
-import semmle.code.java.dataflow.TaintTracking
+private import semmle.code.java.dataflow.TaintTracking
 private import semmle.code.java.os.OSCheck
 private import semmle.code.java.security.TempDirUtils
 
diff --git a/java/ql/lib/semmle/code/java/security/UrlRedirectLocalQuery.qll b/java/ql/lib/semmle/code/java/security/UrlRedirectLocalQuery.qll
@@ -1,8 +1,8 @@
 /** Provides a taint-tracking configuration to reason about URL redirection from local sources. */
 
 import java
-import semmle.code.java.dataflow.FlowSources
-import semmle.code.java.security.UrlRedirect
+private import semmle.code.java.dataflow.FlowSources
+private import semmle.code.java.security.UrlRedirect
 
 /**
  * A taint-tracking configuration to reason about URL redirection from local sources.
diff --git a/java/ql/lib/semmle/code/java/security/UrlRedirectQuery.qll b/java/ql/lib/semmle/code/java/security/UrlRedirectQuery.qll
@@ -1,8 +1,8 @@
 /** Provides a taint-tracking configuration for reasoning about URL redirections. */
 
 import java
-import semmle.code.java.dataflow.FlowSources
-import semmle.code.java.security.UrlRedirect
+private import semmle.code.java.dataflow.FlowSources
+private import semmle.code.java.security.UrlRedirect
 
 /**
  * A taint-tracking configuration for reasoning about URL redirections.
diff --git a/java/ql/lib/semmle/code/java/security/XPathInjectionQuery.qll b/java/ql/lib/semmle/code/java/security/XPathInjectionQuery.qll
@@ -1,8 +1,9 @@
 /** Provides taint-tracking flow to reason about XPath injection queries. */
 
-import semmle.code.java.dataflow.FlowSources
-import semmle.code.java.dataflow.TaintTracking
-import semmle.code.java.security.XPath
+import java
+private import semmle.code.java.dataflow.FlowSources
+private import semmle.code.java.dataflow.TaintTracking
+private import semmle.code.java.security.XPath
 
 /**
  * A taint-tracking configuration for reasoning about XPath injection vulnerabilities.
diff --git a/java/ql/lib/semmle/code/java/security/XssLocalQuery.qll b/java/ql/lib/semmle/code/java/security/XssLocalQuery.qll
@@ -1,9 +1,9 @@
 /** Provides a taint-tracking configuration to reason about cross-site scripting from a local source. */
 
 import java
-import semmle.code.java.dataflow.FlowSources
-import semmle.code.java.dataflow.TaintTracking
-import semmle.code.java.security.XSS
+private import semmle.code.java.dataflow.FlowSources
+private import semmle.code.java.dataflow.TaintTracking
+private import semmle.code.java.security.XSS
 
 /**
  * A taint-tracking configuration for reasoning about cross-site scripting vulnerabilities from a local source.
diff --git a/java/ql/lib/semmle/code/java/security/internal/ArraySizing.qll b/java/ql/lib/semmle/code/java/security/internal/ArraySizing.qll
@@ -1,9 +1,9 @@
 /** Provides predicates and classes to reason about the sizing and indexing of arrays. */
 
 import java
-import semmle.code.java.dataflow.DataFlow
-import semmle.code.java.dataflow.DefUse
-import semmle.code.java.security.RandomDataSource
+private import semmle.code.java.dataflow.DataFlow
+private import semmle.code.java.dataflow.DefUse
+private import semmle.code.java.security.RandomDataSource
 private import BoundingChecks
 
 /**
diff --git a/java/ql/src/Security/CWE/CWE-129/ImproperValidationOfArrayConstruction.ql b/java/ql/src/Security/CWE/CWE-129/ImproperValidationOfArrayConstruction.ql
@@ -11,6 +11,7 @@
  */
 
 import java
+import semmle.code.java.security.internal.ArraySizing
 import semmle.code.java.security.ImproperValidationOfArrayConstructionQuery
 import ImproperValidationOfArrayConstructionFlow::PathGraph
 
diff --git a/java/ql/src/Security/CWE/CWE-129/ImproperValidationOfArrayConstructionCodeSpecified.ql b/java/ql/src/Security/CWE/CWE-129/ImproperValidationOfArrayConstructionCodeSpecified.ql
@@ -12,6 +12,7 @@
  */
 
 import java
+import semmle.code.java.security.internal.ArraySizing
 import semmle.code.java.security.ImproperValidationOfArrayConstructionCodeSpecifiedQuery
 import BoundedFlowSourceFlow::PathGraph
 
diff --git a/java/ql/src/Security/CWE/CWE-129/ImproperValidationOfArrayConstructionLocal.ql b/java/ql/src/Security/CWE/CWE-129/ImproperValidationOfArrayConstructionLocal.ql
@@ -12,6 +12,7 @@
  */
 
 import java
+import semmle.code.java.security.internal.ArraySizing
 import semmle.code.java.security.ImproperValidationOfArrayConstructionLocalQuery
 import ImproperValidationOfArrayConstructionLocalFlow::PathGraph
 
diff --git a/java/ql/src/Security/CWE/CWE-129/ImproperValidationOfArrayIndex.ql b/java/ql/src/Security/CWE/CWE-129/ImproperValidationOfArrayIndex.ql
@@ -11,6 +11,7 @@
  */
 
 import java
+import semmle.code.java.security.internal.ArraySizing
 import semmle.code.java.security.ImproperValidationOfArrayIndexQuery
 import ImproperValidationOfArrayIndexFlow::PathGraph
 
diff --git a/java/ql/src/Security/CWE/CWE-129/ImproperValidationOfArrayIndexCodeSpecified.ql b/java/ql/src/Security/CWE/CWE-129/ImproperValidationOfArrayIndexCodeSpecified.ql
@@ -12,6 +12,8 @@
  */
 
 import java
+import semmle.code.java.security.internal.ArraySizing
+import semmle.code.java.security.internal.BoundingChecks
 import semmle.code.java.security.ImproperValidationOfArrayIndexCodeSpecifiedQuery
 import BoundedFlowSourceFlow::PathGraph
 
diff --git a/java/ql/src/Security/CWE/CWE-129/ImproperValidationOfArrayIndexLocal.ql b/java/ql/src/Security/CWE/CWE-129/ImproperValidationOfArrayIndexLocal.ql
@@ -12,6 +12,7 @@
  */
 
 import java
+import semmle.code.java.security.internal.ArraySizing
 import semmle.code.java.security.ImproperValidationOfArrayIndexLocalQuery
 import ImproperValidationOfArrayIndexLocalFlow::PathGraph
 
diff --git a/java/ql/src/Security/CWE/CWE-134/ExternallyControlledFormatStringLocal.ql b/java/ql/src/Security/CWE/CWE-134/ExternallyControlledFormatStringLocal.ql
@@ -11,6 +11,7 @@
  */
 
 import java
+import semmle.code.java.StringFormat
 import semmle.code.java.security.ExternallyControlledFormatStringLocalQuery
 import ExternallyControlledFormatStringLocalFlow::PathGraph
 
diff --git a/java/ql/src/Security/CWE/CWE-190/ArithmeticTaintedLocal.ql b/java/ql/src/Security/CWE/CWE-190/ArithmeticTaintedLocal.ql
@@ -13,6 +13,8 @@
  */
 
 import java
+import semmle.code.java.dataflow.DataFlow
+import semmle.code.java.security.ArithmeticCommon
 import semmle.code.java.security.ArithmeticTaintedLocalQuery
 
 module Flow =
diff --git a/java/ql/src/Security/CWE/CWE-209/StackTraceExposure.ql b/java/ql/src/Security/CWE/CWE-209/StackTraceExposure.ql
@@ -14,6 +14,7 @@
  */
 
 import java
+import semmle.code.java.dataflow.DataFlow
 import semmle.code.java.security.StackTraceExposureQuery
 
 from Expr externalExpr, Expr errorInformation
diff --git a/java/ql/src/Security/CWE/CWE-327/BrokenCryptoAlgorithm.ql b/java/ql/src/Security/CWE/CWE-327/BrokenCryptoAlgorithm.ql
@@ -12,6 +12,7 @@
  */
 
 import java
+import semmle.code.java.security.Encryption
 import semmle.code.java.security.BrokenCryptoAlgorithmQuery
 import InsecureCryptoFlow::PathGraph
 
diff --git a/java/ql/test/query-tests/security/CWE-643/XPathInjectionTest.ql b/java/ql/test/query-tests/security/CWE-643/XPathInjectionTest.ql
