Java: Rewrite InlineFlowTest as a parameterized module

Author: jketema

java/ql/src/utils/flowtestcasegenerator/testHeader.qlfrag

@@ -1,2 +1,3 @@
 import java
 import TestUtilities.InlineFlowTest
+import DefaultFlowTest

java/ql/test/TestUtilities/InlineFlowTest.qll

@@ -5,6 +5,7 @@
  * ```ql
  * import java
  * import TestUtilities.InlineFlowTest
+ * import DefaultFlowTest
  * ```
  *
  * To declare expectations, you can use the $hasTaintFlow or $hasValueFlow comments within the test source files.
@@ -18,22 +19,18 @@
  *
  * 	public void test() {
  * 		Object s = source();
- * 		sink(s); //$hasValueFlow
+ * 		sink(s); // $ hasValueFlow
  * 		String t = "foo" + taint();
- * 		sink(t); //$hasTaintFlow
+ * 		sink(t); // $ hasTaintFlow
  * 	}
  *
  * }
  * ```
  *
- * If you're not interested in a specific flow type, you can disable either value or taint flow expectations as follows:
- * ```ql
- * class HasFlowTest extends InlineFlowTest {
- *   override DataFlow::Configuration getTaintFlowConfig() { none() }
- *
- *   override DataFlow::Configuration getValueFlowConfig() { none() }
- * }
- * ```
+ * If you are only interested in value flow, then instead of importing `DefaultFlowTest`, you can import
+ * `ValueFlowTest<DefaultFlowConfig>`. Similarly, if you are only interested in taint flow, then instead of
+ * importing `DefaultFlowTest`, you can import `TaintFlowTest<DefaultFlowConfig>`. In both cases
+ * `DefaultFlowConfig` can be replaced by another implementation of `DataFlow::ConfigSig`.
  *
  * If you need more fine-grained tuning, consider implementing a test using `InlineExpectationsTest`.
  */
@@ -43,57 +40,69 @@ import semmle.code.java.dataflow.ExternalFlow
 import semmle.code.java.dataflow.TaintTracking
 import TestUtilities.InlineExpectationsTest
 
-private predicate defaultSource(DataFlow::Node src) {
-  src.asExpr().(MethodAccess).getMethod().getName() = ["source", "taint"]
+private predicate defaultSource(DataFlow::Node source) {
+  source.asExpr().(MethodAccess).getMethod().getName() = ["source", "taint"]
+}
+
+private predicate defaultSink(DataFlow::Node sink) {
+  exists(MethodAccess ma | ma.getMethod().hasName("sink") | sink.asExpr() = ma.getAnArgument())
 }
 
 module DefaultFlowConfig implements DataFlow::ConfigSig {
-  predicate isSource(DataFlow::Node n) { defaultSource(n) }
+  predicate isSource(DataFlow::Node source) { defaultSource(source) }
 
-  predicate isSink(DataFlow::Node n) {
-    exists(MethodAccess ma | ma.getMethod().hasName("sink") | n.asExpr() = ma.getAnArgument())
-  }
+  predicate isSink(DataFlow::Node sink) { defaultSink(sink) }
 
   int fieldFlowBranchLimit() { result = 1000 }
 }
 
-private module DefaultValueFlow = DataFlow::Global<DefaultFlowConfig>;
+private module NoFlowConfig implements DataFlow::ConfigSig {
+  predicate isSource(DataFlow::Node source) { none() }
 
-private module DefaultTaintFlow = TaintTracking::Global<DefaultFlowConfig>;
+  predicate isSink(DataFlow::Node sink) { none() }
+}
 
 private string getSourceArgString(DataFlow::Node src) {
   defaultSource(src) and
   src.asExpr().(MethodAccess).getAnArgument().(StringLiteral).getValue() = result
 }
 
-class InlineFlowTest extends InlineExpectationsTest {
-  InlineFlowTest() { this = "HasFlowTest" }
-
-  override string getARelevantTag() { result = ["hasValueFlow", "hasTaintFlow"] }
-
-  override predicate hasActualResult(Location location, string element, string tag, string value) {
-    tag = "hasValueFlow" and
-    exists(DataFlow::Node src, DataFlow::Node sink | this.hasValueFlow(src, sink) |
-      sink.getLocation() = location and
-      element = sink.toString() and
-      if exists(getSourceArgString(src)) then value = getSourceArgString(src) else value = ""
-    )
-    or
-    tag = "hasTaintFlow" and
-    exists(DataFlow::Node src, DataFlow::Node sink |
-      this.hasTaintFlow(src, sink) and not this.hasValueFlow(src, sink)
-    |
-      sink.getLocation() = location and
-      element = sink.toString() and
-      if exists(getSourceArgString(src)) then value = getSourceArgString(src) else value = ""
-    )
-  }
+module FlowTest<DataFlow::ConfigSig ValueFlowConfig, DataFlow::ConfigSig TaintFlowConfig> {
+  module ValueFlow = DataFlow::Global<ValueFlowConfig>;
 
-  predicate hasValueFlow(DataFlow::Node src, DataFlow::Node sink) {
-    DefaultValueFlow::flow(src, sink)
-  }
+  module TaintFlow = TaintTracking::Global<TaintFlowConfig>;
+
+  private module InlineTest implements TestSig {
+    string getARelevantTag() { result = ["hasValueFlow", "hasTaintFlow"] }
 
-  predicate hasTaintFlow(DataFlow::Node src, DataFlow::Node sink) {
-    DefaultTaintFlow::flow(src, sink)
+    predicate hasActualResult(Location location, string element, string tag, string value) {
+      tag = "hasValueFlow" and
+      exists(DataFlow::Node src, DataFlow::Node sink | ValueFlow::flow(src, sink) |
+        sink.getLocation() = location and
+        element = sink.toString() and
+        if exists(getSourceArgString(src)) then value = getSourceArgString(src) else value = ""
+      )
+      or
+      tag = "hasTaintFlow" and
+      exists(DataFlow::Node src, DataFlow::Node sink |
+        TaintFlow::flow(src, sink) and not ValueFlow::flow(src, sink)
+      |
+        sink.getLocation() = location and
+        element = sink.toString() and
+        if exists(getSourceArgString(src)) then value = getSourceArgString(src) else value = ""
+      )
+    }
   }
+
+  import MakeTest<InlineTest>
+}
+
+module DefaultFlowTest = FlowTest<DefaultFlowConfig, DefaultFlowConfig>;
+
+module ValueFlowTest<DataFlow::ConfigSig ValueFlowConfig> {
+  import FlowTest<ValueFlowConfig, NoFlowConfig>
+}
+
+module TaintFlowTest<DataFlow::ConfigSig TaintFlowConfig> {
+  import FlowTest<NoFlowConfig, TaintFlowConfig>
 }

java/ql/test/ext/TestModels/test.expected

@@ -0,0 +1,2 @@
+failures
+testFailures

java/ql/test/ext/TestModels/test.ql

@@ -1,2 +1,3 @@
 import java
 import TestUtilities.InlineFlowTest
+import DefaultFlowTest

java/ql/test/kotlin/library-tests/dataflow/summaries/test.expected

@@ -1,3 +1,5 @@
+failures
+testFailures
 | test.kt:28:14:28:21 | getSecond(...) | Unexpected result: hasTaintFlow=a |
 | test.kt:35:14:35:27 | component1(...) | Unexpected result: hasTaintFlow=d |
 | test.kt:41:14:41:22 | getSecond(...) | Unexpected result: hasTaintFlow=e |

java/ql/test/kotlin/library-tests/dataflow/summaries/test.ql

@@ -1,2 +1,3 @@
 import java
 import TestUtilities.InlineFlowTest
+import DefaultFlowTest

java/ql/test/library-tests/dataflow/callctx/test.expected

@@ -0,0 +1,2 @@
+failures
+testFailures

java/ql/test/library-tests/dataflow/callctx/test.ql

@@ -1,2 +1,3 @@
 import java
 import TestUtilities.InlineFlowTest
+import DefaultFlowTest

java/ql/test/library-tests/dataflow/collections/containerflow.expected

@@ -0,0 +1,2 @@
+failures
+testFailures

java/ql/test/library-tests/dataflow/collections/containerflow.ql

@@ -1,3 +1,4 @@
 import java
 import semmle.code.java.dataflow.DataFlow
 import TestUtilities.InlineFlowTest
+import DefaultFlowTest