diff --git a/README.md b/README.md index e9e95eb..1c7d2da 100644 --- a/README.md +++ b/README.md @@ -351,9 +351,10 @@ The [taint-modeling matrix](docs/modeling-matrix.md) is a separate tier that asks a separate question: not whether an engine can follow flow it can see, but whether it can be **told** things. Each language row is twenty-four benchmark-controlled modeling assertions, four per-adapter model encodings, and -one run per adapter against them: -[the Python taint-modeling matrix](docs/python-modeling.md) and -[the JavaScript taint-modeling matrix](docs/javascript-modeling.md). Modeling +one run per adapter against them. Wave M1's three rows are complete: +[the Python taint-modeling matrix](docs/python-modeling.md), +[the JavaScript taint-modeling matrix](docs/javascript-modeling.md), and +[the Java taint-modeling matrix](docs/java-modeling.md). Modeling cases are `score_tier: "modeling"`, are never in a core denominator, and are never averaged with a kernel score. diff --git a/adapters/bifrost/README.md b/adapters/bifrost/README.md index 6ea6a62..46fcdaf 100644 --- a/adapters/bifrost/README.md +++ b/adapters/bifrost/README.md @@ -614,3 +614,42 @@ invoked and retained verbatim with the document's own rationale. The declaration, not the propagation, is what the cell scores. See [the JavaScript modeling matrix](../../docs/javascript-modeling.md). + +## Java taint-modeling matrix + +Wave M1's last row, and the same shape as the two above. The +[modeling matrix](../../docs/modeling-matrix.md) gives this adapter **category S +alone** — declared sources and declared sinks, two of the twelve templates — +and the other five categories are `unsupported` for the standalone policy CLI, +decided from the template identity before the binary is invoked and retained +verbatim with the document's own rationale. + +- Artifact: `adapters/bifrost/policies/model-java.rqlp`. Two `:sources` entries + bound to `return-value`, two `:sinks` entries bound to + `(argument :index 0)`, and nothing for categories P, Z, O, E, or B. +- Load-bearing model: the policy sets `:call-modeling (call-modeling :unmodeled + require-model)`. The preregistration recorded the pinned CLI's *acceptance* of + that setting as one of two unverified facts behind Bifrost's category-P cell; + it is now confirmed by + [Amendment A5](../../docs/modeling-matrix.md#a5--2026-08-26-bifrost-v0106-accepts-unmodeled-require-model), + which moves no cell. The other obstacle — showing that a propagator or + transform section actually lowers — is untouched, so category P stays + `unsupported`. +- Invocation: + `cargo run -- run-bifrost-modeling --language java --bifrost `, writing + `reports/bifrost-java-modeling.json` with raw evidence under + `reports/raw/bifrost-java-modeling/`. +- Result on the pinned build: **all four scored assertions decided correctly** — + two `reached` positives, two `not-reached` negatives, no `inconclusive` and no + `runner-error`, with neither undeclared sibling (`Config.fetchLocal`, + `Audit.discard`) picked up. That is Python's row exactly, and it is the + difference between Java and JavaScript: the JavaScript slice's three + `inconclusive` cells are that language's engine incompleteness, not a modeling + property. Its configuration hash is + `921d2c8e531813bf7c9bb93fd6da710e62020f60f9caadc7ac0096c5c31121d9`. +- **Load-bearing verification.** Removing the `Config.fetchRemote` source entry + from a copy of the policy drops `model-declared-source-positive` from one + finding to zero + (`reports/raw/load-bearing-java-modeling/bifrost-declared-source-{with,without}-model.json`). + +See [the Java modeling matrix](../../docs/java-modeling.md). diff --git a/adapters/bifrost/policies/model-java.rqlp b/adapters/bifrost/policies/model-java.rqlp new file mode 100644 index 0000000..54524e3 --- /dev/null +++ b/adapters/bifrost/policies/model-java.rqlp @@ -0,0 +1,14 @@ +(policy + :schema-version 1 + :id "dataflowbench.taint.model-java" + :name "DataFlowBench Java taint-modeling matrix" + :message "A benchmark-declared model carried input to the declared sink" + :severity warning + :analysis (analysis :type taint :mode may + :call-modeling (call-modeling :unmodeled require-model) + :sources (endpoint-set :entries [ + (source :id input :display-name "benchmark input" :categories [input.user-controlled] :selector (rql :schema-version 1 (language java (call :callee (name "dfb_source")))) :bind return-value :labels [attacker-controlled]) + (source :id declared-source :display-name "Config.fetchRemote" :categories [input.user-controlled] :selector (rql :schema-version 1 (language java (call :callee (name "fetchRemote")))) :bind return-value :labels [attacker-controlled])]) + :sinks (endpoint-set :entries [ + (sink :id sink :display-name "benchmark sink" :categories [data.sensitive] :selector (rql :schema-version 1 (language java (call :callee (name "dfb_sink")))) :dangerous-operand (argument :index 0) :accepts [attacker-controlled]) + (sink :id declared-sink :display-name "Audit.record" :categories [data.sensitive] :selector (rql :schema-version 1 (language java (call :callee (name "record")))) :dangerous-operand (argument :index 0) :accepts [attacker-controlled])])) ) diff --git a/adapters/codeql/README.md b/adapters/codeql/README.md index fc51635..dcc4929 100644 --- a/adapters/codeql/README.md +++ b/adapters/codeql/README.md @@ -918,3 +918,46 @@ source even when both denote the same store, and comparing local sources linked nothing. See [the JavaScript modeling matrix](../../docs/javascript-modeling.md). + +## Java taint-modeling matrix + +Wave M1's last row. Same partition — **all six categories scored** — and the +same single `DataFlow::ConfigSig` carrying every declaration role, written in +Java's own vocabulary: `MethodCall` and `getArgument` where the JavaScript query +uses `DataFlow::CallNode`. + +- Artifact: `adapters/codeql/queries/JavaModeling.ql`. This is the one modeling + query that sits on the preregistration's *schematic* path rather than under a + `/queries/` subdirectory, and for the same reason the other two sit + off it: a modeling query must live inside its language's existing `qlpack`, + and Java's pack **is** the adapter root. `adapters/codeql/qlpack.yml` declares + `dataflowbench/codeql-java` with the `codeql/java-all` dependency, and + `queries/JavaKernel.ql` already lives beside it; there is no + `adapters/codeql/java/` pack, and a query placed under one would resolve + nothing. A test asserts that every modeling query resolves a `qlpack.yml` two + directories up. +- The database is built from a **traced `javac`**, exactly as the Java kernel + builds it — the Java extractor has no `--build-mode=none` — so the modeling + run differs from its kernel sibling only in which query it loads. +- Invocation: + `cargo run -- run-codeql-modeling --language java --codeql ` + (optionally `--codeql-packs `), writing + `reports/codeql-java-modeling.json` with raw SARIF under + `reports/raw/codeql-java-modeling/`. + +**Result on the pinned CLI: 24 of 24 assertions match** — twelve `reached` +positives and twelve `not-reached` negatives, no `inconclusive` and no +`runner-error`, across all six categories. That is the third clean sweep in +three languages, and it is what establishes that the twelve templates are +satisfiable as preregistered rather than badly posed. Its configuration hash is +`38acb5de67ed39a244c7eb8a9db755ddbcf197488051a5f1ec0d35b65fa30aee`. + +**Load-bearing verification** is the category-P probe in +`scripts/probe-java-modeling-load-bearing.sh`: the same database analyzed with +and without the five-line `Opaque.carry` propagator step returns one SARIF +result and then zero +(`reports/raw/load-bearing-java-modeling/codeql-opaque-propagator-{with,without}-model.sarif.json`). +CodeQL does not follow `Opaque.class.getMethod(…).invoke(…)` on its own — which, +on the same fixture, [Joern does](../joern/README.md#taint-modeling-matrix). + +See [the Java modeling matrix](../../docs/java-modeling.md). diff --git a/adapters/codeql/queries/JavaModeling.ql b/adapters/codeql/queries/JavaModeling.ql new file mode 100644 index 0000000..33b1b3b --- /dev/null +++ b/adapters/codeql/queries/JavaModeling.ql @@ -0,0 +1,177 @@ +/** + * @name DataFlowBench Java taint-modeling matrix + * @description Encodes the twelve benchmark-supplied model declarations of + * docs/modeling-matrix.md natively in CodeQL's data-flow + * configuration surface, for the Java modeling population. + * @kind path-problem + * @problem.severity warning + * @precision high + * @id dataflowbench/java-taint-modeling + * @tags security + */ + +import java +import semmle.code.java.dataflow.DataFlow +import semmle.code.java.dataflow.TaintTracking + +/** + * Entity identity, as the model declaration language defines it: a declaring + * type plus a member name. Binding is never by name shape and never by a + * substring, so `Audit.record` says nothing about `Audit.discard`. + */ +predicate modelCall(MethodCall call, string type, string member) { + call.getMethod().getDeclaringType().getName() = type and + call.getMethod().getName() = member +} + +/** The string constant a store call is keyed by. */ +predicate storeKey(MethodCall call, string key) { + call.getArgument(0).(CompileTimeConstantExpr).getStringValue() = key +} + +/** + * Whether two store calls address the same store identity. + * + * Template 11 binds the store to the type: `Store.put` and `Store.get` are + * static, so neither call carries an instance receiver — a static call's + * qualifier is the `TypeAccess`, never a variable. Template 12 binds it to the + * receiver instance, so the two calls must name the same variable. + */ +predicate sameStore(MethodCall put, MethodCall get) { + put.getQualifier().(VarAccess).getVariable() = get.getQualifier().(VarAccess).getVariable() + or + not put.getQualifier() instanceof VarAccess and not get.getQualifier() instanceof VarAccess +} + +module DataFlowBenchModelingConfig implements DataFlow::ConfigSig { + predicate isSource(DataFlow::Node source) { + // The benchmark's own canonical source. Every fixture that is not itself a + // declared-source assertion starts here. + exists(MethodCall call | + call.getMethod().getName() = "dfb_source" and + source.asExpr() = call + ) + or + // Template 1 — role `source`, entity `Config.fetchRemote`, out: return. + // The undeclared sibling `Config.fetchLocal` is deliberately absent. + exists(MethodCall call | + modelCall(call, "Config", "fetchRemote") and + source.asExpr() = call + ) + or + // Templates 9 and 10 — role `entry-point`, entities `Handler.onRequest` + // and `Handler.onDeclared`, in: 0 tainted on entry. Neither method is + // called from anywhere in its fixture; CodeQL's data flow does not require + // a source to be reachable from a call-graph root. The undeclared siblings + // `onIgnored` and `onUndeclared` are deliberately absent. + exists(Method handler | + handler.getDeclaringType().getName() = "Handler" and + handler.getName() = ["onRequest", "onDeclared"] and + source.asParameter() = handler.getParameter(0) + ) + } + + predicate isSink(DataFlow::Node sink) { + // The benchmark's own canonical sink. + exists(MethodCall call | + call.getMethod().getName() = "dfb_sink" and + sink.asExpr() = call.getArgument(0) + ) + or + // Template 2 — role `sink`, entity `Audit.record`, in: 0. The undeclared + // sibling `Audit.discard` is deliberately absent. + exists(MethodCall call | + modelCall(call, "Audit", "record") and + sink.asExpr() = call.getArgument(0) + ) + } + + predicate isBarrier(DataFlow::Node node) { + // Templates 5 and 6 — role `sanitizer`, entity `Clean.scrub`, in: 0. + // `Clean.sanitize` is a sibling with the same identity body and a name at + // least as sanitizer-shaped, and it is not declared. + exists(MethodCall call | + modelCall(call, "Clean", "scrub") and + node.asExpr() = call.getArgument(0) + ) + or + // The explicit no-flow declarations the model language allows where a tool + // has one: template 3's `Opaque.block` and template 7's `Bridge.hold`. + // Both bodies say flow — `hold`'s is the identity function — so without + // these clauses the query would report the body's semantics rather than + // the summary's, which is exactly the distinction category O exists to + // make observable. + exists(MethodCall call | + modelCall(call, "Opaque", "block") and + node.asExpr() = call.getArgument(0) + ) + or + exists(MethodCall call | + modelCall(call, "Bridge", "hold") and + node.asExpr() = call.getArgument(0) + ) + } + + predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) { + // Template 3 — role `propagator`, entity `Opaque.carry`, in: 0, out: return. + exists(MethodCall call | + modelCall(call, "Opaque", "carry") and + node1.asExpr() = call.getArgument(0) and + node2.asExpr() = call + ) + or + // Template 4 — role `propagator`, entity `Opaque.select`, in: 1, out: return. + // Positional fidelity is native: the step names argument 1 specifically, so + // taint at the undeclared position 0 never takes it. + exists(MethodCall call | + modelCall(call, "Opaque", "select") and + node1.asExpr() = call.getArgument(1) and + node2.asExpr() = call + ) + or + // Template 7 — role `summary`, entity `Bridge.pass`, in: 0, out: return. + exists(MethodCall call | + modelCall(call, "Bridge", "pass") and + node1.asExpr() = call.getArgument(0) and + node2.asExpr() = call + ) + or + // Template 8 — role `summary`, entity `Bridge.deposit`, in: 0, + // out: `1.payload`. The output position is a heap location, so the step + // lands on the reads of that field of that object rather than on a return + // value. `deposit`'s body writes nothing, so the field's contents come + // from this declaration or from nowhere, and the sibling field `spare` + // takes no step. + exists(MethodCall call, FieldRead read | + modelCall(call, "Bridge", "deposit") and + read.getField().getName() = "payload" and + read.getQualifier().(VarAccess).getVariable() = + call.getArgument(1).(VarAccess).getVariable() and + node1.asExpr() = call.getArgument(0) and + node2.asExpr() = read + ) + or + // Templates 11 and 12 — roles `store-write` and `store-read` sharing one + // store identity. `Store.put` binds in: 1 under key: 0; `Store.get` binds + // out: return under key: 0. The two close a roundtrip only when the key + // constants agree and the store identities agree, which is what the + // field-separation and object-separation negatives test. + exists(MethodCall put, MethodCall get, string key | + modelCall(put, "Store", "put") and + modelCall(get, "Store", "get") and + storeKey(put, key) and + storeKey(get, key) and + sameStore(put, get) and + node1.asExpr() = put.getArgument(1) and + node2.asExpr() = get + ) + } +} + +module DataFlowBenchModelingFlow = TaintTracking::Global; + +import DataFlowBenchModelingFlow::PathGraph + +from DataFlowBenchModelingFlow::PathNode source, DataFlowBenchModelingFlow::PathNode sink +where DataFlowBenchModelingFlow::flowPath(source, sink) +select sink.getNode(), source, sink, "A benchmark-declared model carried input to the declared sink." diff --git a/adapters/joern/README.md b/adapters/joern/README.md index 7ba0571..5da4089 100644 --- a/adapters/joern/README.md +++ b/adapters/joern/README.md @@ -965,3 +965,67 @@ name, so the category-B declaration cannot attach to it. Re-running the same declarations against an object-literal spelling in which the call *does* resolve and the semantics *are* found still produces zero flows, so the published outcome is the same either way. + +## Java modeling matrix + +`run-joern-modeling --language java` runs the same twenty-four cells for Java — +**sixteen scored and eight preregistered `unsupported`** — through the same +`modeling.sc` and the same `--param` surface documented above, with +`language=JAVASRC` and +`semanticsPath=adapters/joern/semantics/model-java.semantics`. Everything in the +Python section about the script, the selector shapes, and the parser's silent +failure modes applies unchanged; only the semantics file and the frontend +differ. + +**Result on the pinned distribution: 14 of 16 scored assertions match** — 6 +`reached` positives and 8 `not-reached` negatives, with no false positive, no +`inconclusive`, and no `runner-error`. Categories S, Z, and E are 4/4; category +B is 2/4, its two positives being false negatives. Its configuration hash is +`55282607023d6902aebe9e2e4199542f04b407229ac0ab04eab9b70dd4a6980f`. That is the +same shape as the Python and JavaScript rows, cell for cell. + +**Load-bearing verification, on category Z:** removing the +`"dataflowbench.taint.Clean.scrub:java.lang.String(java.lang.String)"` +`NilSemantics` entry turns `model-sanitizer-kill-negative` from 0 flows into 1, +the same demonstration the other two rows record +(`reports/raw/load-bearing-java-modeling/joern-sanitizer-kill-{with,without}-model.json`). + +### `javasrc2cpg` binds where `jssrc2cpg` cannot + +The JavaScript row records that `jssrc2cpg` gives a class-method call the method +full name ``, so its category-B declaration cannot attach at +all. Java has no such problem: `javasrc2cpg` spells the same entity +`dataflowbench.taint.Store.put:void(java.lang.String,java.lang.String)`, a +stable, file-independent full name, and the declaration binds cleanly. + +The two category-B positives are false negatives anyway. That is the point of +publishing both rows: taint deposited on the receiver by `put` does not survive +into a separate procedure's `get`, on this engine, whether or not the +declaration binds. The limitation the cell measures is the engine's, and Python, +JavaScript, and Java all reach it by different routes. + +### Amendment A4, extended: the reflective body is followed unaided here too + +`reports/raw/load-bearing-java-modeling/joern-opaque-propagator-unmodeled.json` +runs `model-opaque-propagator-positive` under the committed Java semantics file, +which after A2 declares nothing at all for category P, and records +`declared_semantic_count: 3` with `flow_count: 1`. The pinned engine follows +`Opaque.class.getMethod(target, String.class).invoke(null, value)` on its own, +through `Method.invoke`'s `Object[]` argument. + +[Amendment A4](../../docs/modeling-matrix.md#a4--2026-08-26-the-reflective-opaque-propagator-body-is-not-unfollowable-by-joerns-jssrc2cpg) +was measured on `jssrc2cpg` and withdrew the preregistration's claim as a +*general* one, leaving each language to stand on its own evidence. This is +Java's, on a different reflective construct, and it agrees; A4 carries it as a +dated addendum. No cell moves: A2 had already withdrawn Joern's category-P cells +for the stronger reason. + +**The Java semantics file carries no comments**, where Python's and +JavaScript's carry `#` ones. The pinned parser drops every declaration on a +blank line and on a `//` comment, and on this file a leading comment was +measured to produce the same empty parse, so the file is declarations only and +its commentary lives in [the Java modeling matrix](../../docs/java-modeling.md). +`modeling.sc` raises on an empty parse, so a silent drop is a `runner-error` +rather than a scored cell decided by a missing model. + +See [the Java modeling matrix](../../docs/java-modeling.md). diff --git a/adapters/joern/semantics/model-java.semantics b/adapters/joern/semantics/model-java.semantics new file mode 100644 index 0000000..ad80c53 --- /dev/null +++ b/adapters/joern/semantics/model-java.semantics @@ -0,0 +1,3 @@ +"dataflowbench.taint.Clean.scrub:java.lang.String(java.lang.String)" +"dataflowbench.taint.Store.put:void(java.lang.String,java.lang.String)" 2 -> 0 +"dataflowbench.taint.Store.get:java.lang.String(java.lang.String)" 0 -> -1 diff --git a/adapters/semgrep/README.md b/adapters/semgrep/README.md index bfa8f69..f9a9e09 100644 --- a/adapters/semgrep/README.md +++ b/adapters/semgrep/README.md @@ -714,3 +714,41 @@ Ten of the twenty-four cells are scored. Semgrep binds the entity by name either way. See [the JavaScript modeling matrix](../../docs/javascript-modeling.md). + +## Java taint-modeling matrix + +Wave M1's last row, on the same amended partition: **three of six categories** +scored — S, Z, and E — with category Z scored by one of its two templates, +because template 6 is `unsupported` activation under +[Amendment A3](../../docs/modeling-matrix.md#a3--2026-08-26-semgreps-sanitizer-selectivity-cell-is-undecidable-by-construction). +Ten of the twenty-four cells are scored. + +- Artifact: `adapters/semgrep/rules/model-java.yaml`, `languages: [java]`. It + declares `pattern-sources`, `pattern-sinks`, and `pattern-sanitizers` and + carries no `pattern-propagators`, no summary, and no persistence boundary. + The entry-point sources are `void onRequest($T $P) { ... }` with + `focus-metavariable: $P`, which is how Java spells `Handler.onRequest`. +- It is excluded from the kernel configuration hash by the same + `model-*.yaml` rule as the other two, so landing this row does not move the + eleven-file kernel hash `865d0bd2…`. +- Load-bearing model: `options: taint_assume_safe_functions: true`, enforced by + the runner and pinned by a test. +- Invocation: + `cargo run -- run-semgrep-modeling --language java --semgrep `, writing + `reports/semgrep-java-modeling.json` with raw evidence under + `reports/raw/semgrep-java-modeling/`. +- Result on the pinned CE binary under the amended partition: **all 10 scored + assertions decided correctly** — five `reached` positives and five + `not-reached` negatives, no false positive, no false negative, no + `inconclusive` and no `runner-error`. That is the third clean sweep in three + languages. Its configuration hash is + `d25d4a4058ae7bd67131d38d05d0579a642ad1841071f965719dd8cea7efd59e`. +- Amendment A3's cell reproduces on Java independently of the Python evidence it + was made on, and the crossed four-run probe behind that reading is retained in + [the Java modeling matrix](../../docs/java-modeling.md#retained-pre-amendment-observations). + Nothing was tuned to recover the cell. +- **Load-bearing verification.** Removing the `Audit.record` sink pattern from a + copy of the rule drops `model-declared-sink-positive` from one finding to zero + (`reports/raw/load-bearing-java-modeling/semgrep-declared-sink-{with,without}-model.json`). + +See [the Java modeling matrix](../../docs/java-modeling.md). diff --git a/adapters/semgrep/rules/model-java.yaml b/adapters/semgrep/rules/model-java.yaml new file mode 100644 index 0000000..1b4a7cb --- /dev/null +++ b/adapters/semgrep/rules/model-java.yaml @@ -0,0 +1,58 @@ +# Benchmark-controlled Semgrep CE taint rule: the DataFlowBench Java +# taint-modeling matrix. +# +# Unlike the kernel rules this file carries no runner-substituted placeholder. +# A modeling assertion is scored on whether the engine activates the +# benchmark's *declarations*, so the declarations are written out literally, +# once, for the whole population — the single per-language artifact +# docs/modeling-matrix.md's equivalence contract requires. +# +# Only the three categories the preregistered partition awards Semgrep CE are +# declared here. Categories P (propagators), O (summaries), and B (persistence) +# are `unsupported` for this adapter by that partition, and the artifact for an +# unsupported category must not declare it — the partition decides those cells +# without the tool, so declaring them anyway would smuggle a scored cell past a +# capability decision made before the run. +# +# `taint_assume_safe_functions: true` is the load-bearing-model requirement. +# Without it the pinned CE engine carries taint from any tainted argument to a +# call's result, and every category-Z cell would be decided by that default +# rather than by the `Clean.scrub` declaration. +rules: + - id: dfb-model-java + languages: [java] + severity: WARNING + message: a benchmark-declared model carried input to the declared sink + mode: taint + options: + taint_assume_safe_functions: true + pattern-sources: + # The benchmark's own canonical source. + - pattern: dfb_source(...) + # Template 1 — role `source`, entity `Config.fetchRemote`, out: return. + # The undeclared sibling `Config.fetchLocal` is deliberately absent. + - pattern: Config.fetchRemote(...) + # Templates 9 and 10 — role `entry-point`, entities `Handler.onRequest` + # and `Handler.onDeclared`, in: 0 tainted on entry. The handler is never + # called from the fixture; the declaration is what makes its parameter a + # root. The undeclared siblings `onIgnored` and `onUndeclared` are + # deliberately absent. + - patterns: + - pattern: | + void onRequest($T $P) { ... } + - focus-metavariable: $P + - patterns: + - pattern: | + void onDeclared($T $P) { ... } + - focus-metavariable: $P + pattern-sinks: + # The benchmark's own canonical sink. + - pattern: dfb_sink(...) + # Template 2 — role `sink`, entity `Audit.record`, in: 0. The undeclared + # sibling `Audit.discard` is deliberately absent. + - pattern: Audit.record(...) + pattern-sanitizers: + # Templates 5 and 6 — role `sanitizer`, entity `Clean.scrub`, in: 0. + # `Clean.sanitize` is a sibling with the same identity body and a name at + # least as sanitizer-shaped, and it is not declared. + - pattern: Clean.scrub(...) diff --git a/cases/taint/java/model-declared-sink-negative/ModelDeclaredSinkNegative.java b/cases/taint/java/model-declared-sink-negative/ModelDeclaredSinkNegative.java new file mode 100644 index 0000000..74d03a7 --- /dev/null +++ b/cases/taint/java/model-declared-sink-negative/ModelDeclaredSinkNegative.java @@ -0,0 +1,18 @@ +package dataflowbench.taint; + +final class Audit { + static void record(String value) { } // DFB-SINK: model-declared-sink-sink + + static void discard(String value) { } +} + +final class ModelDeclaredSinkNegative { + static String dfb_source() { // DFB-SOURCE: model-declared-sink-input + return "t"; + } + + static void run() { + Audit.discard(dfb_source()); + Audit.record("clean"); + } +} diff --git a/cases/taint/java/model-declared-sink-negative/case.json b/cases/taint/java/model-declared-sink-negative/case.json new file mode 100644 index 0000000..27d0bc1 --- /dev/null +++ b/cases/taint/java/model-declared-sink-negative/case.json @@ -0,0 +1,64 @@ +{ + "schema_version": 2, + "id": "dfb-taint-java-model-declared-sink-negative", + "template_id": "dfb-template-model-declared-sink", + "polarity": "negative", + "negative_mechanism": "unrelated-value", + "score_tier": "modeling", + "track": "taint", + "language": "java", + "semantic_dimensions": [ + "local-flow" + ], + "feature_tags": [ + "modeled-external", + "interprocedural-one-hop" + ], + "model_profile": "benchmark-controlled", + "fixture_files": [ + "ModelDeclaredSinkNegative.java" + ], + "source_anchors": [ + { + "marker": "DFB-SOURCE: model-declared-sink-input", + "file": "ModelDeclaredSinkNegative.java", + "line_hint": 10 + } + ], + "sink_anchors": [ + { + "marker": "DFB-SINK: model-declared-sink-sink", + "file": "ModelDeclaredSinkNegative.java", + "line_hint": 4 + } + ], + "expected_flows": [], + "expected_nonflows": [ + { + "source": "DFB-SOURCE: model-declared-sink-input", + "sink": "DFB-SINK: model-declared-sink-sink" + } + ], + "witness_checkpoints": [], + "expected_analysis_capability": { + "kind": "declared-sink-activation" + }, + "execution_budget": { + "wall_clock_seconds": 60, + "peak_memory_mb": 512 + }, + "fixture_provenance": { + "kind": "authored", + "origin": "DataFlowBench", + "revision": "m3-modeling-java", + "license": "MIT" + }, + "tool_model_references": { + "bifrost": { + "policy": "adapters/bifrost/policies/model-java.rqlp" + }, + "codeql": { + "query": "adapters/codeql/queries/JavaModeling.ql" + } + } +} diff --git a/cases/taint/java/model-declared-sink-positive/ModelDeclaredSinkPositive.java b/cases/taint/java/model-declared-sink-positive/ModelDeclaredSinkPositive.java new file mode 100644 index 0000000..4924a37 --- /dev/null +++ b/cases/taint/java/model-declared-sink-positive/ModelDeclaredSinkPositive.java @@ -0,0 +1,18 @@ +package dataflowbench.taint; + +final class Audit { + static void record(String value) { } // DFB-SINK: model-declared-sink-sink + + static void discard(String value) { } +} + +final class ModelDeclaredSinkPositive { + static String dfb_source() { // DFB-SOURCE: model-declared-sink-input + return "t"; + } + + static void run() { + Audit.record(dfb_source()); + Audit.discard("clean"); + } +} diff --git a/cases/taint/java/model-declared-sink-positive/case.json b/cases/taint/java/model-declared-sink-positive/case.json new file mode 100644 index 0000000..f03d5d7 --- /dev/null +++ b/cases/taint/java/model-declared-sink-positive/case.json @@ -0,0 +1,63 @@ +{ + "schema_version": 2, + "id": "dfb-taint-java-model-declared-sink-positive", + "template_id": "dfb-template-model-declared-sink", + "polarity": "positive", + "score_tier": "modeling", + "track": "taint", + "language": "java", + "semantic_dimensions": [ + "local-flow" + ], + "feature_tags": [ + "modeled-external", + "interprocedural-one-hop" + ], + "model_profile": "benchmark-controlled", + "fixture_files": [ + "ModelDeclaredSinkPositive.java" + ], + "source_anchors": [ + { + "marker": "DFB-SOURCE: model-declared-sink-input", + "file": "ModelDeclaredSinkPositive.java", + "line_hint": 10 + } + ], + "sink_anchors": [ + { + "marker": "DFB-SINK: model-declared-sink-sink", + "file": "ModelDeclaredSinkPositive.java", + "line_hint": 4 + } + ], + "expected_flows": [ + { + "source": "DFB-SOURCE: model-declared-sink-input", + "sink": "DFB-SINK: model-declared-sink-sink" + } + ], + "expected_nonflows": [], + "witness_checkpoints": [], + "expected_analysis_capability": { + "kind": "declared-sink-activation" + }, + "execution_budget": { + "wall_clock_seconds": 60, + "peak_memory_mb": 512 + }, + "fixture_provenance": { + "kind": "authored", + "origin": "DataFlowBench", + "revision": "m3-modeling-java", + "license": "MIT" + }, + "tool_model_references": { + "bifrost": { + "policy": "adapters/bifrost/policies/model-java.rqlp" + }, + "codeql": { + "query": "adapters/codeql/queries/JavaModeling.ql" + } + } +} diff --git a/cases/taint/java/model-declared-source-negative/ModelDeclaredSourceNegative.java b/cases/taint/java/model-declared-source-negative/ModelDeclaredSourceNegative.java new file mode 100644 index 0000000..6904c20 --- /dev/null +++ b/cases/taint/java/model-declared-source-negative/ModelDeclaredSourceNegative.java @@ -0,0 +1,19 @@ +package dataflowbench.taint; + +final class Config { + static String fetchRemote() { // DFB-SOURCE: model-declared-source-input + return "r"; + } + + static String fetchLocal() { + return "l"; + } +} + +final class ModelDeclaredSourceNegative { + static void dfb_sink(String value) { } // DFB-SINK: model-declared-source-sink + + static void run() { + dfb_sink(Config.fetchLocal()); + } +} diff --git a/cases/taint/java/model-declared-source-negative/case.json b/cases/taint/java/model-declared-source-negative/case.json new file mode 100644 index 0000000..b6258c3 --- /dev/null +++ b/cases/taint/java/model-declared-source-negative/case.json @@ -0,0 +1,64 @@ +{ + "schema_version": 2, + "id": "dfb-taint-java-model-declared-source-negative", + "template_id": "dfb-template-model-declared-source", + "polarity": "negative", + "negative_mechanism": "unrelated-value", + "score_tier": "modeling", + "track": "taint", + "language": "java", + "semantic_dimensions": [ + "local-flow" + ], + "feature_tags": [ + "modeled-external", + "interprocedural-one-hop" + ], + "model_profile": "benchmark-controlled", + "fixture_files": [ + "ModelDeclaredSourceNegative.java" + ], + "source_anchors": [ + { + "marker": "DFB-SOURCE: model-declared-source-input", + "file": "ModelDeclaredSourceNegative.java", + "line_hint": 4 + } + ], + "sink_anchors": [ + { + "marker": "DFB-SINK: model-declared-source-sink", + "file": "ModelDeclaredSourceNegative.java", + "line_hint": 14 + } + ], + "expected_flows": [], + "expected_nonflows": [ + { + "source": "DFB-SOURCE: model-declared-source-input", + "sink": "DFB-SINK: model-declared-source-sink" + } + ], + "witness_checkpoints": [], + "expected_analysis_capability": { + "kind": "declared-source-activation" + }, + "execution_budget": { + "wall_clock_seconds": 60, + "peak_memory_mb": 512 + }, + "fixture_provenance": { + "kind": "authored", + "origin": "DataFlowBench", + "revision": "m3-modeling-java", + "license": "MIT" + }, + "tool_model_references": { + "bifrost": { + "policy": "adapters/bifrost/policies/model-java.rqlp" + }, + "codeql": { + "query": "adapters/codeql/queries/JavaModeling.ql" + } + } +} diff --git a/cases/taint/java/model-declared-source-positive/ModelDeclaredSourcePositive.java b/cases/taint/java/model-declared-source-positive/ModelDeclaredSourcePositive.java new file mode 100644 index 0000000..6c6e160 --- /dev/null +++ b/cases/taint/java/model-declared-source-positive/ModelDeclaredSourcePositive.java @@ -0,0 +1,19 @@ +package dataflowbench.taint; + +final class Config { + static String fetchRemote() { // DFB-SOURCE: model-declared-source-input + return "r"; + } + + static String fetchLocal() { + return "l"; + } +} + +final class ModelDeclaredSourcePositive { + static void dfb_sink(String value) { } // DFB-SINK: model-declared-source-sink + + static void run() { + dfb_sink(Config.fetchRemote()); + } +} diff --git a/cases/taint/java/model-declared-source-positive/case.json b/cases/taint/java/model-declared-source-positive/case.json new file mode 100644 index 0000000..671e4c6 --- /dev/null +++ b/cases/taint/java/model-declared-source-positive/case.json @@ -0,0 +1,63 @@ +{ + "schema_version": 2, + "id": "dfb-taint-java-model-declared-source-positive", + "template_id": "dfb-template-model-declared-source", + "polarity": "positive", + "score_tier": "modeling", + "track": "taint", + "language": "java", + "semantic_dimensions": [ + "local-flow" + ], + "feature_tags": [ + "modeled-external", + "interprocedural-one-hop" + ], + "model_profile": "benchmark-controlled", + "fixture_files": [ + "ModelDeclaredSourcePositive.java" + ], + "source_anchors": [ + { + "marker": "DFB-SOURCE: model-declared-source-input", + "file": "ModelDeclaredSourcePositive.java", + "line_hint": 4 + } + ], + "sink_anchors": [ + { + "marker": "DFB-SINK: model-declared-source-sink", + "file": "ModelDeclaredSourcePositive.java", + "line_hint": 14 + } + ], + "expected_flows": [ + { + "source": "DFB-SOURCE: model-declared-source-input", + "sink": "DFB-SINK: model-declared-source-sink" + } + ], + "expected_nonflows": [], + "witness_checkpoints": [], + "expected_analysis_capability": { + "kind": "declared-source-activation" + }, + "execution_budget": { + "wall_clock_seconds": 60, + "peak_memory_mb": 512 + }, + "fixture_provenance": { + "kind": "authored", + "origin": "DataFlowBench", + "revision": "m3-modeling-java", + "license": "MIT" + }, + "tool_model_references": { + "bifrost": { + "policy": "adapters/bifrost/policies/model-java.rqlp" + }, + "codeql": { + "query": "adapters/codeql/queries/JavaModeling.ql" + } + } +} diff --git a/cases/taint/java/model-entrypoint-parameter-negative/Handler.java b/cases/taint/java/model-entrypoint-parameter-negative/Handler.java new file mode 100644 index 0000000..f40bb1c --- /dev/null +++ b/cases/taint/java/model-entrypoint-parameter-negative/Handler.java @@ -0,0 +1,13 @@ +package dataflowbench.taint; + +final class Handler { + static void dfb_sink(String value) { } // DFB-SINK: model-entrypoint-parameter-sink + + void onRequest(String input) { // DFB-SOURCE: model-entrypoint-parameter-input + dfb_sink("clean"); + } + + void onIgnored(String input) { + dfb_sink(input); + } +} diff --git a/cases/taint/java/model-entrypoint-parameter-negative/case.json b/cases/taint/java/model-entrypoint-parameter-negative/case.json new file mode 100644 index 0000000..6d5c12e --- /dev/null +++ b/cases/taint/java/model-entrypoint-parameter-negative/case.json @@ -0,0 +1,64 @@ +{ + "schema_version": 2, + "id": "dfb-taint-java-model-entrypoint-parameter-negative", + "template_id": "dfb-template-model-entrypoint-parameter", + "polarity": "negative", + "negative_mechanism": "call-context-separation", + "score_tier": "modeling", + "track": "taint", + "language": "java", + "semantic_dimensions": [ + "external-summary" + ], + "feature_tags": [ + "modeled-external", + "summary-required" + ], + "model_profile": "benchmark-controlled", + "fixture_files": [ + "Handler.java" + ], + "source_anchors": [ + { + "marker": "DFB-SOURCE: model-entrypoint-parameter-input", + "file": "Handler.java", + "line_hint": 6 + } + ], + "sink_anchors": [ + { + "marker": "DFB-SINK: model-entrypoint-parameter-sink", + "file": "Handler.java", + "line_hint": 4 + } + ], + "expected_flows": [], + "expected_nonflows": [ + { + "source": "DFB-SOURCE: model-entrypoint-parameter-input", + "sink": "DFB-SINK: model-entrypoint-parameter-sink" + } + ], + "witness_checkpoints": [], + "expected_analysis_capability": { + "kind": "entry-point-root-activation" + }, + "execution_budget": { + "wall_clock_seconds": 60, + "peak_memory_mb": 512 + }, + "fixture_provenance": { + "kind": "authored", + "origin": "DataFlowBench", + "revision": "m3-modeling-java", + "license": "MIT" + }, + "tool_model_references": { + "bifrost": { + "policy": "adapters/bifrost/policies/model-java.rqlp" + }, + "codeql": { + "query": "adapters/codeql/queries/JavaModeling.ql" + } + } +} diff --git a/cases/taint/java/model-entrypoint-parameter-positive/Handler.java b/cases/taint/java/model-entrypoint-parameter-positive/Handler.java new file mode 100644 index 0000000..6cd6e24 --- /dev/null +++ b/cases/taint/java/model-entrypoint-parameter-positive/Handler.java @@ -0,0 +1,13 @@ +package dataflowbench.taint; + +final class Handler { + static void dfb_sink(String value) { } // DFB-SINK: model-entrypoint-parameter-sink + + void onRequest(String input) { // DFB-SOURCE: model-entrypoint-parameter-input + dfb_sink(input); + } + + void onIgnored(String input) { + dfb_sink("clean"); + } +} diff --git a/cases/taint/java/model-entrypoint-parameter-positive/case.json b/cases/taint/java/model-entrypoint-parameter-positive/case.json new file mode 100644 index 0000000..e0072cf --- /dev/null +++ b/cases/taint/java/model-entrypoint-parameter-positive/case.json @@ -0,0 +1,63 @@ +{ + "schema_version": 2, + "id": "dfb-taint-java-model-entrypoint-parameter-positive", + "template_id": "dfb-template-model-entrypoint-parameter", + "polarity": "positive", + "score_tier": "modeling", + "track": "taint", + "language": "java", + "semantic_dimensions": [ + "external-summary" + ], + "feature_tags": [ + "modeled-external", + "summary-required" + ], + "model_profile": "benchmark-controlled", + "fixture_files": [ + "Handler.java" + ], + "source_anchors": [ + { + "marker": "DFB-SOURCE: model-entrypoint-parameter-input", + "file": "Handler.java", + "line_hint": 6 + } + ], + "sink_anchors": [ + { + "marker": "DFB-SINK: model-entrypoint-parameter-sink", + "file": "Handler.java", + "line_hint": 4 + } + ], + "expected_flows": [ + { + "source": "DFB-SOURCE: model-entrypoint-parameter-input", + "sink": "DFB-SINK: model-entrypoint-parameter-sink" + } + ], + "expected_nonflows": [], + "witness_checkpoints": [], + "expected_analysis_capability": { + "kind": "entry-point-root-activation" + }, + "execution_budget": { + "wall_clock_seconds": 60, + "peak_memory_mb": 512 + }, + "fixture_provenance": { + "kind": "authored", + "origin": "DataFlowBench", + "revision": "m3-modeling-java", + "license": "MIT" + }, + "tool_model_references": { + "bifrost": { + "policy": "adapters/bifrost/policies/model-java.rqlp" + }, + "codeql": { + "query": "adapters/codeql/queries/JavaModeling.ql" + } + } +} diff --git a/cases/taint/java/model-entrypoint-selectivity-negative/Handler.java b/cases/taint/java/model-entrypoint-selectivity-negative/Handler.java new file mode 100644 index 0000000..fbada90 --- /dev/null +++ b/cases/taint/java/model-entrypoint-selectivity-negative/Handler.java @@ -0,0 +1,13 @@ +package dataflowbench.taint; + +final class Handler { + static void dfb_sink(String value) { } // DFB-SINK: model-entrypoint-selectivity-sink + + void onDeclared(String input) { // DFB-SOURCE: model-entrypoint-selectivity-input + dfb_sink("clean"); + } + + void onUndeclared(String input) { + dfb_sink(input); + } +} diff --git a/cases/taint/java/model-entrypoint-selectivity-negative/case.json b/cases/taint/java/model-entrypoint-selectivity-negative/case.json new file mode 100644 index 0000000..a08a3f7 --- /dev/null +++ b/cases/taint/java/model-entrypoint-selectivity-negative/case.json @@ -0,0 +1,64 @@ +{ + "schema_version": 2, + "id": "dfb-taint-java-model-entrypoint-selectivity-negative", + "template_id": "dfb-template-model-entrypoint-selectivity", + "polarity": "negative", + "negative_mechanism": "call-context-separation", + "score_tier": "modeling", + "track": "taint", + "language": "java", + "semantic_dimensions": [ + "external-summary" + ], + "feature_tags": [ + "modeled-external", + "summary-required" + ], + "model_profile": "benchmark-controlled", + "fixture_files": [ + "Handler.java" + ], + "source_anchors": [ + { + "marker": "DFB-SOURCE: model-entrypoint-selectivity-input", + "file": "Handler.java", + "line_hint": 6 + } + ], + "sink_anchors": [ + { + "marker": "DFB-SINK: model-entrypoint-selectivity-sink", + "file": "Handler.java", + "line_hint": 4 + } + ], + "expected_flows": [], + "expected_nonflows": [ + { + "source": "DFB-SOURCE: model-entrypoint-selectivity-input", + "sink": "DFB-SINK: model-entrypoint-selectivity-sink" + } + ], + "witness_checkpoints": [], + "expected_analysis_capability": { + "kind": "entry-point-identity-binding" + }, + "execution_budget": { + "wall_clock_seconds": 60, + "peak_memory_mb": 512 + }, + "fixture_provenance": { + "kind": "authored", + "origin": "DataFlowBench", + "revision": "m3-modeling-java", + "license": "MIT" + }, + "tool_model_references": { + "bifrost": { + "policy": "adapters/bifrost/policies/model-java.rqlp" + }, + "codeql": { + "query": "adapters/codeql/queries/JavaModeling.ql" + } + } +} diff --git a/cases/taint/java/model-entrypoint-selectivity-positive/Handler.java b/cases/taint/java/model-entrypoint-selectivity-positive/Handler.java new file mode 100644 index 0000000..2b27b54 --- /dev/null +++ b/cases/taint/java/model-entrypoint-selectivity-positive/Handler.java @@ -0,0 +1,13 @@ +package dataflowbench.taint; + +final class Handler { + static void dfb_sink(String value) { } // DFB-SINK: model-entrypoint-selectivity-sink + + void onDeclared(String input) { // DFB-SOURCE: model-entrypoint-selectivity-input + dfb_sink(input); + } + + void onUndeclared(String input) { + dfb_sink("clean"); + } +} diff --git a/cases/taint/java/model-entrypoint-selectivity-positive/case.json b/cases/taint/java/model-entrypoint-selectivity-positive/case.json new file mode 100644 index 0000000..017bd8d --- /dev/null +++ b/cases/taint/java/model-entrypoint-selectivity-positive/case.json @@ -0,0 +1,63 @@ +{ + "schema_version": 2, + "id": "dfb-taint-java-model-entrypoint-selectivity-positive", + "template_id": "dfb-template-model-entrypoint-selectivity", + "polarity": "positive", + "score_tier": "modeling", + "track": "taint", + "language": "java", + "semantic_dimensions": [ + "external-summary" + ], + "feature_tags": [ + "modeled-external", + "summary-required" + ], + "model_profile": "benchmark-controlled", + "fixture_files": [ + "Handler.java" + ], + "source_anchors": [ + { + "marker": "DFB-SOURCE: model-entrypoint-selectivity-input", + "file": "Handler.java", + "line_hint": 6 + } + ], + "sink_anchors": [ + { + "marker": "DFB-SINK: model-entrypoint-selectivity-sink", + "file": "Handler.java", + "line_hint": 4 + } + ], + "expected_flows": [ + { + "source": "DFB-SOURCE: model-entrypoint-selectivity-input", + "sink": "DFB-SINK: model-entrypoint-selectivity-sink" + } + ], + "expected_nonflows": [], + "witness_checkpoints": [], + "expected_analysis_capability": { + "kind": "entry-point-identity-binding" + }, + "execution_budget": { + "wall_clock_seconds": 60, + "peak_memory_mb": 512 + }, + "fixture_provenance": { + "kind": "authored", + "origin": "DataFlowBench", + "revision": "m3-modeling-java", + "license": "MIT" + }, + "tool_model_references": { + "bifrost": { + "policy": "adapters/bifrost/policies/model-java.rqlp" + }, + "codeql": { + "query": "adapters/codeql/queries/JavaModeling.ql" + } + } +} diff --git a/cases/taint/java/model-opaque-propagator-negative/ModelOpaquePropagatorNegative.java b/cases/taint/java/model-opaque-propagator-negative/ModelOpaquePropagatorNegative.java new file mode 100644 index 0000000..d3e374f --- /dev/null +++ b/cases/taint/java/model-opaque-propagator-negative/ModelOpaquePropagatorNegative.java @@ -0,0 +1,39 @@ +package dataflowbench.taint; + +final class Opaque { + public static String identity(String value) { + return value; + } + + static String carry(String value) { + String target = "identity"; + try { + return (String) Opaque.class.getMethod(target, String.class) + .invoke(null, value); + } catch (ReflectiveOperationException error) { + return ""; + } + } + + static String block(String value) { + String target = "identity"; + try { + return (String) Opaque.class.getMethod(target, String.class) + .invoke(null, value); + } catch (ReflectiveOperationException error) { + return ""; + } + } +} + +final class ModelOpaquePropagatorNegative { + static String dfb_source() { // DFB-SOURCE: model-opaque-propagator-input + return "t"; + } + + static void dfb_sink(String value) { } // DFB-SINK: model-opaque-propagator-sink + + static void run() { + dfb_sink(Opaque.block(dfb_source())); + } +} diff --git a/cases/taint/java/model-opaque-propagator-negative/case.json b/cases/taint/java/model-opaque-propagator-negative/case.json new file mode 100644 index 0000000..5f96628 --- /dev/null +++ b/cases/taint/java/model-opaque-propagator-negative/case.json @@ -0,0 +1,64 @@ +{ + "schema_version": 2, + "id": "dfb-taint-java-model-opaque-propagator-negative", + "template_id": "dfb-template-model-opaque-propagator", + "polarity": "negative", + "negative_mechanism": "call-context-separation", + "score_tier": "modeling", + "track": "taint", + "language": "java", + "semantic_dimensions": [ + "interprocedural-flow" + ], + "feature_tags": [ + "modeled-external", + "summary-required" + ], + "model_profile": "benchmark-controlled", + "fixture_files": [ + "ModelOpaquePropagatorNegative.java" + ], + "source_anchors": [ + { + "marker": "DFB-SOURCE: model-opaque-propagator-input", + "file": "ModelOpaquePropagatorNegative.java", + "line_hint": 30 + } + ], + "sink_anchors": [ + { + "marker": "DFB-SINK: model-opaque-propagator-sink", + "file": "ModelOpaquePropagatorNegative.java", + "line_hint": 34 + } + ], + "expected_flows": [], + "expected_nonflows": [ + { + "source": "DFB-SOURCE: model-opaque-propagator-input", + "sink": "DFB-SINK: model-opaque-propagator-sink" + } + ], + "witness_checkpoints": [], + "expected_analysis_capability": { + "kind": "opaque-propagator-activation" + }, + "execution_budget": { + "wall_clock_seconds": 60, + "peak_memory_mb": 512 + }, + "fixture_provenance": { + "kind": "authored", + "origin": "DataFlowBench", + "revision": "m3-modeling-java", + "license": "MIT" + }, + "tool_model_references": { + "bifrost": { + "policy": "adapters/bifrost/policies/model-java.rqlp" + }, + "codeql": { + "query": "adapters/codeql/queries/JavaModeling.ql" + } + } +} diff --git a/cases/taint/java/model-opaque-propagator-positive/ModelOpaquePropagatorPositive.java b/cases/taint/java/model-opaque-propagator-positive/ModelOpaquePropagatorPositive.java new file mode 100644 index 0000000..8691407 --- /dev/null +++ b/cases/taint/java/model-opaque-propagator-positive/ModelOpaquePropagatorPositive.java @@ -0,0 +1,39 @@ +package dataflowbench.taint; + +final class Opaque { + public static String identity(String value) { + return value; + } + + static String carry(String value) { + String target = "identity"; + try { + return (String) Opaque.class.getMethod(target, String.class) + .invoke(null, value); + } catch (ReflectiveOperationException error) { + return ""; + } + } + + static String block(String value) { + String target = "identity"; + try { + return (String) Opaque.class.getMethod(target, String.class) + .invoke(null, value); + } catch (ReflectiveOperationException error) { + return ""; + } + } +} + +final class ModelOpaquePropagatorPositive { + static String dfb_source() { // DFB-SOURCE: model-opaque-propagator-input + return "t"; + } + + static void dfb_sink(String value) { } // DFB-SINK: model-opaque-propagator-sink + + static void run() { + dfb_sink(Opaque.carry(dfb_source())); + } +} diff --git a/cases/taint/java/model-opaque-propagator-positive/case.json b/cases/taint/java/model-opaque-propagator-positive/case.json new file mode 100644 index 0000000..b667524 --- /dev/null +++ b/cases/taint/java/model-opaque-propagator-positive/case.json @@ -0,0 +1,63 @@ +{ + "schema_version": 2, + "id": "dfb-taint-java-model-opaque-propagator-positive", + "template_id": "dfb-template-model-opaque-propagator", + "polarity": "positive", + "score_tier": "modeling", + "track": "taint", + "language": "java", + "semantic_dimensions": [ + "interprocedural-flow" + ], + "feature_tags": [ + "modeled-external", + "summary-required" + ], + "model_profile": "benchmark-controlled", + "fixture_files": [ + "ModelOpaquePropagatorPositive.java" + ], + "source_anchors": [ + { + "marker": "DFB-SOURCE: model-opaque-propagator-input", + "file": "ModelOpaquePropagatorPositive.java", + "line_hint": 30 + } + ], + "sink_anchors": [ + { + "marker": "DFB-SINK: model-opaque-propagator-sink", + "file": "ModelOpaquePropagatorPositive.java", + "line_hint": 34 + } + ], + "expected_flows": [ + { + "source": "DFB-SOURCE: model-opaque-propagator-input", + "sink": "DFB-SINK: model-opaque-propagator-sink" + } + ], + "expected_nonflows": [], + "witness_checkpoints": [], + "expected_analysis_capability": { + "kind": "opaque-propagator-activation" + }, + "execution_budget": { + "wall_clock_seconds": 60, + "peak_memory_mb": 512 + }, + "fixture_provenance": { + "kind": "authored", + "origin": "DataFlowBench", + "revision": "m3-modeling-java", + "license": "MIT" + }, + "tool_model_references": { + "bifrost": { + "policy": "adapters/bifrost/policies/model-java.rqlp" + }, + "codeql": { + "query": "adapters/codeql/queries/JavaModeling.ql" + } + } +} diff --git a/cases/taint/java/model-propagator-position-negative/ModelPropagatorPositionNegative.java b/cases/taint/java/model-propagator-position-negative/ModelPropagatorPositionNegative.java new file mode 100644 index 0000000..26764c5 --- /dev/null +++ b/cases/taint/java/model-propagator-position-negative/ModelPropagatorPositionNegative.java @@ -0,0 +1,29 @@ +package dataflowbench.taint; + +final class Opaque { + public static String identity(String value) { + return value; + } + + static String select(String first, String second) { + String target = "identity"; + try { + return (String) Opaque.class.getMethod(target, String.class) + .invoke(null, second); + } catch (ReflectiveOperationException error) { + return ""; + } + } +} + +final class ModelPropagatorPositionNegative { + static String dfb_source() { // DFB-SOURCE: model-propagator-position-input + return "t"; + } + + static void dfb_sink(String value) { } // DFB-SINK: model-propagator-position-sink + + static void run() { + dfb_sink(Opaque.select(dfb_source(), "clean")); + } +} diff --git a/cases/taint/java/model-propagator-position-negative/case.json b/cases/taint/java/model-propagator-position-negative/case.json new file mode 100644 index 0000000..1026b10 --- /dev/null +++ b/cases/taint/java/model-propagator-position-negative/case.json @@ -0,0 +1,64 @@ +{ + "schema_version": 2, + "id": "dfb-taint-java-model-propagator-position-negative", + "template_id": "dfb-template-model-propagator-position", + "polarity": "negative", + "negative_mechanism": "call-context-separation", + "score_tier": "modeling", + "track": "taint", + "language": "java", + "semantic_dimensions": [ + "interprocedural-flow" + ], + "feature_tags": [ + "modeled-external", + "summary-required" + ], + "model_profile": "benchmark-controlled", + "fixture_files": [ + "ModelPropagatorPositionNegative.java" + ], + "source_anchors": [ + { + "marker": "DFB-SOURCE: model-propagator-position-input", + "file": "ModelPropagatorPositionNegative.java", + "line_hint": 20 + } + ], + "sink_anchors": [ + { + "marker": "DFB-SINK: model-propagator-position-sink", + "file": "ModelPropagatorPositionNegative.java", + "line_hint": 24 + } + ], + "expected_flows": [], + "expected_nonflows": [ + { + "source": "DFB-SOURCE: model-propagator-position-input", + "sink": "DFB-SINK: model-propagator-position-sink" + } + ], + "witness_checkpoints": [], + "expected_analysis_capability": { + "kind": "positional-propagator-activation" + }, + "execution_budget": { + "wall_clock_seconds": 60, + "peak_memory_mb": 512 + }, + "fixture_provenance": { + "kind": "authored", + "origin": "DataFlowBench", + "revision": "m3-modeling-java", + "license": "MIT" + }, + "tool_model_references": { + "bifrost": { + "policy": "adapters/bifrost/policies/model-java.rqlp" + }, + "codeql": { + "query": "adapters/codeql/queries/JavaModeling.ql" + } + } +} diff --git a/cases/taint/java/model-propagator-position-positive/ModelPropagatorPositionPositive.java b/cases/taint/java/model-propagator-position-positive/ModelPropagatorPositionPositive.java new file mode 100644 index 0000000..fbfe2dc --- /dev/null +++ b/cases/taint/java/model-propagator-position-positive/ModelPropagatorPositionPositive.java @@ -0,0 +1,29 @@ +package dataflowbench.taint; + +final class Opaque { + public static String identity(String value) { + return value; + } + + static String select(String first, String second) { + String target = "identity"; + try { + return (String) Opaque.class.getMethod(target, String.class) + .invoke(null, second); + } catch (ReflectiveOperationException error) { + return ""; + } + } +} + +final class ModelPropagatorPositionPositive { + static String dfb_source() { // DFB-SOURCE: model-propagator-position-input + return "t"; + } + + static void dfb_sink(String value) { } // DFB-SINK: model-propagator-position-sink + + static void run() { + dfb_sink(Opaque.select("clean", dfb_source())); + } +} diff --git a/cases/taint/java/model-propagator-position-positive/case.json b/cases/taint/java/model-propagator-position-positive/case.json new file mode 100644 index 0000000..48a4215 --- /dev/null +++ b/cases/taint/java/model-propagator-position-positive/case.json @@ -0,0 +1,63 @@ +{ + "schema_version": 2, + "id": "dfb-taint-java-model-propagator-position-positive", + "template_id": "dfb-template-model-propagator-position", + "polarity": "positive", + "score_tier": "modeling", + "track": "taint", + "language": "java", + "semantic_dimensions": [ + "interprocedural-flow" + ], + "feature_tags": [ + "modeled-external", + "summary-required" + ], + "model_profile": "benchmark-controlled", + "fixture_files": [ + "ModelPropagatorPositionPositive.java" + ], + "source_anchors": [ + { + "marker": "DFB-SOURCE: model-propagator-position-input", + "file": "ModelPropagatorPositionPositive.java", + "line_hint": 20 + } + ], + "sink_anchors": [ + { + "marker": "DFB-SINK: model-propagator-position-sink", + "file": "ModelPropagatorPositionPositive.java", + "line_hint": 24 + } + ], + "expected_flows": [ + { + "source": "DFB-SOURCE: model-propagator-position-input", + "sink": "DFB-SINK: model-propagator-position-sink" + } + ], + "expected_nonflows": [], + "witness_checkpoints": [], + "expected_analysis_capability": { + "kind": "positional-propagator-activation" + }, + "execution_budget": { + "wall_clock_seconds": 60, + "peak_memory_mb": 512 + }, + "fixture_provenance": { + "kind": "authored", + "origin": "DataFlowBench", + "revision": "m3-modeling-java", + "license": "MIT" + }, + "tool_model_references": { + "bifrost": { + "policy": "adapters/bifrost/policies/model-java.rqlp" + }, + "codeql": { + "query": "adapters/codeql/queries/JavaModeling.ql" + } + } +} diff --git a/cases/taint/java/model-sanitizer-kill-negative/ModelSanitizerKillNegative.java b/cases/taint/java/model-sanitizer-kill-negative/ModelSanitizerKillNegative.java new file mode 100644 index 0000000..5ed6793 --- /dev/null +++ b/cases/taint/java/model-sanitizer-kill-negative/ModelSanitizerKillNegative.java @@ -0,0 +1,19 @@ +package dataflowbench.taint; + +final class Clean { + static String scrub(String value) { + return value; + } +} + +final class ModelSanitizerKillNegative { + static String dfb_source() { // DFB-SOURCE: model-sanitizer-kill-input + return "t"; + } + + static void dfb_sink(String value) { } // DFB-SINK: model-sanitizer-kill-sink + + static void run() { + dfb_sink(Clean.scrub(dfb_source())); + } +} diff --git a/cases/taint/java/model-sanitizer-kill-negative/case.json b/cases/taint/java/model-sanitizer-kill-negative/case.json new file mode 100644 index 0000000..2154404 --- /dev/null +++ b/cases/taint/java/model-sanitizer-kill-negative/case.json @@ -0,0 +1,64 @@ +{ + "schema_version": 2, + "id": "dfb-taint-java-model-sanitizer-kill-negative", + "template_id": "dfb-template-model-sanitizer-kill", + "polarity": "negative", + "negative_mechanism": "sanitizer", + "score_tier": "modeling", + "track": "taint", + "language": "java", + "semantic_dimensions": [ + "sanitizer" + ], + "feature_tags": [ + "modeled-external", + "sanitized" + ], + "model_profile": "benchmark-controlled", + "fixture_files": [ + "ModelSanitizerKillNegative.java" + ], + "source_anchors": [ + { + "marker": "DFB-SOURCE: model-sanitizer-kill-input", + "file": "ModelSanitizerKillNegative.java", + "line_hint": 10 + } + ], + "sink_anchors": [ + { + "marker": "DFB-SINK: model-sanitizer-kill-sink", + "file": "ModelSanitizerKillNegative.java", + "line_hint": 14 + } + ], + "expected_flows": [], + "expected_nonflows": [ + { + "source": "DFB-SOURCE: model-sanitizer-kill-input", + "sink": "DFB-SINK: model-sanitizer-kill-sink" + } + ], + "witness_checkpoints": [], + "expected_analysis_capability": { + "kind": "declared-sanitizer-activation" + }, + "execution_budget": { + "wall_clock_seconds": 60, + "peak_memory_mb": 512 + }, + "fixture_provenance": { + "kind": "authored", + "origin": "DataFlowBench", + "revision": "m3-modeling-java", + "license": "MIT" + }, + "tool_model_references": { + "bifrost": { + "policy": "adapters/bifrost/policies/model-java.rqlp" + }, + "codeql": { + "query": "adapters/codeql/queries/JavaModeling.ql" + } + } +} diff --git a/cases/taint/java/model-sanitizer-kill-positive/ModelSanitizerKillPositive.java b/cases/taint/java/model-sanitizer-kill-positive/ModelSanitizerKillPositive.java new file mode 100644 index 0000000..f677538 --- /dev/null +++ b/cases/taint/java/model-sanitizer-kill-positive/ModelSanitizerKillPositive.java @@ -0,0 +1,19 @@ +package dataflowbench.taint; + +final class Clean { + static String scrub(String value) { + return value; + } +} + +final class ModelSanitizerKillPositive { + static String dfb_source() { // DFB-SOURCE: model-sanitizer-kill-input + return "t"; + } + + static void dfb_sink(String value) { } // DFB-SINK: model-sanitizer-kill-sink + + static void run() { + dfb_sink(dfb_source()); + } +} diff --git a/cases/taint/java/model-sanitizer-kill-positive/case.json b/cases/taint/java/model-sanitizer-kill-positive/case.json new file mode 100644 index 0000000..9484452 --- /dev/null +++ b/cases/taint/java/model-sanitizer-kill-positive/case.json @@ -0,0 +1,63 @@ +{ + "schema_version": 2, + "id": "dfb-taint-java-model-sanitizer-kill-positive", + "template_id": "dfb-template-model-sanitizer-kill", + "polarity": "positive", + "score_tier": "modeling", + "track": "taint", + "language": "java", + "semantic_dimensions": [ + "sanitizer" + ], + "feature_tags": [ + "modeled-external", + "sanitized" + ], + "model_profile": "benchmark-controlled", + "fixture_files": [ + "ModelSanitizerKillPositive.java" + ], + "source_anchors": [ + { + "marker": "DFB-SOURCE: model-sanitizer-kill-input", + "file": "ModelSanitizerKillPositive.java", + "line_hint": 10 + } + ], + "sink_anchors": [ + { + "marker": "DFB-SINK: model-sanitizer-kill-sink", + "file": "ModelSanitizerKillPositive.java", + "line_hint": 14 + } + ], + "expected_flows": [ + { + "source": "DFB-SOURCE: model-sanitizer-kill-input", + "sink": "DFB-SINK: model-sanitizer-kill-sink" + } + ], + "expected_nonflows": [], + "witness_checkpoints": [], + "expected_analysis_capability": { + "kind": "declared-sanitizer-activation" + }, + "execution_budget": { + "wall_clock_seconds": 60, + "peak_memory_mb": 512 + }, + "fixture_provenance": { + "kind": "authored", + "origin": "DataFlowBench", + "revision": "m3-modeling-java", + "license": "MIT" + }, + "tool_model_references": { + "bifrost": { + "policy": "adapters/bifrost/policies/model-java.rqlp" + }, + "codeql": { + "query": "adapters/codeql/queries/JavaModeling.ql" + } + } +} diff --git a/cases/taint/java/model-sanitizer-selectivity-negative/ModelSanitizerSelectivityNegative.java b/cases/taint/java/model-sanitizer-selectivity-negative/ModelSanitizerSelectivityNegative.java new file mode 100644 index 0000000..742538e --- /dev/null +++ b/cases/taint/java/model-sanitizer-selectivity-negative/ModelSanitizerSelectivityNegative.java @@ -0,0 +1,23 @@ +package dataflowbench.taint; + +final class Clean { + static String scrub(String value) { + return value; + } + + static String sanitize(String value) { + return value; + } +} + +final class ModelSanitizerSelectivityNegative { + static String dfb_source() { // DFB-SOURCE: model-sanitizer-selectivity-input + return "t"; + } + + static void dfb_sink(String value) { } // DFB-SINK: model-sanitizer-selectivity-sink + + static void run() { + dfb_sink(Clean.scrub(dfb_source())); + } +} diff --git a/cases/taint/java/model-sanitizer-selectivity-negative/case.json b/cases/taint/java/model-sanitizer-selectivity-negative/case.json new file mode 100644 index 0000000..726c47b --- /dev/null +++ b/cases/taint/java/model-sanitizer-selectivity-negative/case.json @@ -0,0 +1,64 @@ +{ + "schema_version": 2, + "id": "dfb-taint-java-model-sanitizer-selectivity-negative", + "template_id": "dfb-template-model-sanitizer-selectivity", + "polarity": "negative", + "negative_mechanism": "sanitizer", + "score_tier": "modeling", + "track": "taint", + "language": "java", + "semantic_dimensions": [ + "sanitizer" + ], + "feature_tags": [ + "modeled-external", + "sanitized" + ], + "model_profile": "benchmark-controlled", + "fixture_files": [ + "ModelSanitizerSelectivityNegative.java" + ], + "source_anchors": [ + { + "marker": "DFB-SOURCE: model-sanitizer-selectivity-input", + "file": "ModelSanitizerSelectivityNegative.java", + "line_hint": 14 + } + ], + "sink_anchors": [ + { + "marker": "DFB-SINK: model-sanitizer-selectivity-sink", + "file": "ModelSanitizerSelectivityNegative.java", + "line_hint": 18 + } + ], + "expected_flows": [], + "expected_nonflows": [ + { + "source": "DFB-SOURCE: model-sanitizer-selectivity-input", + "sink": "DFB-SINK: model-sanitizer-selectivity-sink" + } + ], + "witness_checkpoints": [], + "expected_analysis_capability": { + "kind": "sanitizer-identity-binding" + }, + "execution_budget": { + "wall_clock_seconds": 60, + "peak_memory_mb": 512 + }, + "fixture_provenance": { + "kind": "authored", + "origin": "DataFlowBench", + "revision": "m3-modeling-java", + "license": "MIT" + }, + "tool_model_references": { + "bifrost": { + "policy": "adapters/bifrost/policies/model-java.rqlp" + }, + "codeql": { + "query": "adapters/codeql/queries/JavaModeling.ql" + } + } +} diff --git a/cases/taint/java/model-sanitizer-selectivity-positive/ModelSanitizerSelectivityPositive.java b/cases/taint/java/model-sanitizer-selectivity-positive/ModelSanitizerSelectivityPositive.java new file mode 100644 index 0000000..a9bf0bb --- /dev/null +++ b/cases/taint/java/model-sanitizer-selectivity-positive/ModelSanitizerSelectivityPositive.java @@ -0,0 +1,23 @@ +package dataflowbench.taint; + +final class Clean { + static String scrub(String value) { + return value; + } + + static String sanitize(String value) { + return value; + } +} + +final class ModelSanitizerSelectivityPositive { + static String dfb_source() { // DFB-SOURCE: model-sanitizer-selectivity-input + return "t"; + } + + static void dfb_sink(String value) { } // DFB-SINK: model-sanitizer-selectivity-sink + + static void run() { + dfb_sink(Clean.sanitize(dfb_source())); + } +} diff --git a/cases/taint/java/model-sanitizer-selectivity-positive/case.json b/cases/taint/java/model-sanitizer-selectivity-positive/case.json new file mode 100644 index 0000000..7f71ced --- /dev/null +++ b/cases/taint/java/model-sanitizer-selectivity-positive/case.json @@ -0,0 +1,63 @@ +{ + "schema_version": 2, + "id": "dfb-taint-java-model-sanitizer-selectivity-positive", + "template_id": "dfb-template-model-sanitizer-selectivity", + "polarity": "positive", + "score_tier": "modeling", + "track": "taint", + "language": "java", + "semantic_dimensions": [ + "sanitizer" + ], + "feature_tags": [ + "modeled-external", + "sanitized" + ], + "model_profile": "benchmark-controlled", + "fixture_files": [ + "ModelSanitizerSelectivityPositive.java" + ], + "source_anchors": [ + { + "marker": "DFB-SOURCE: model-sanitizer-selectivity-input", + "file": "ModelSanitizerSelectivityPositive.java", + "line_hint": 14 + } + ], + "sink_anchors": [ + { + "marker": "DFB-SINK: model-sanitizer-selectivity-sink", + "file": "ModelSanitizerSelectivityPositive.java", + "line_hint": 18 + } + ], + "expected_flows": [ + { + "source": "DFB-SOURCE: model-sanitizer-selectivity-input", + "sink": "DFB-SINK: model-sanitizer-selectivity-sink" + } + ], + "expected_nonflows": [], + "witness_checkpoints": [], + "expected_analysis_capability": { + "kind": "sanitizer-identity-binding" + }, + "execution_budget": { + "wall_clock_seconds": 60, + "peak_memory_mb": 512 + }, + "fixture_provenance": { + "kind": "authored", + "origin": "DataFlowBench", + "revision": "m3-modeling-java", + "license": "MIT" + }, + "tool_model_references": { + "bifrost": { + "policy": "adapters/bifrost/policies/model-java.rqlp" + }, + "codeql": { + "query": "adapters/codeql/queries/JavaModeling.ql" + } + } +} diff --git a/cases/taint/java/model-store-roundtrip-negative/ModelStoreRoundtripNegative.java b/cases/taint/java/model-store-roundtrip-negative/ModelStoreRoundtripNegative.java new file mode 100644 index 0000000..3bbdd78 --- /dev/null +++ b/cases/taint/java/model-store-roundtrip-negative/ModelStoreRoundtripNegative.java @@ -0,0 +1,25 @@ +package dataflowbench.taint; + +final class Store { + static void put(String key, String value) { } + + static String get(String key) { + return ""; + } +} + +final class ModelStoreRoundtripNegative { + static String dfb_source() { // DFB-SOURCE: model-store-roundtrip-input + return "t"; + } + + static void dfb_sink(String value) { } // DFB-SINK: model-store-roundtrip-sink + + static void writeSide() { + Store.put("a", dfb_source()); + } + + static void readSide() { + dfb_sink(Store.get("b")); + } +} diff --git a/cases/taint/java/model-store-roundtrip-negative/case.json b/cases/taint/java/model-store-roundtrip-negative/case.json new file mode 100644 index 0000000..6c797e4 --- /dev/null +++ b/cases/taint/java/model-store-roundtrip-negative/case.json @@ -0,0 +1,65 @@ +{ + "schema_version": 2, + "id": "dfb-taint-java-model-store-roundtrip-negative", + "template_id": "dfb-template-model-store-roundtrip", + "polarity": "negative", + "negative_mechanism": "field-separation", + "score_tier": "modeling", + "track": "taint", + "language": "java", + "semantic_dimensions": [ + "interprocedural-flow", + "heap-field-sensitivity" + ], + "feature_tags": [ + "modeled-external", + "heap-access-path" + ], + "model_profile": "benchmark-controlled", + "fixture_files": [ + "ModelStoreRoundtripNegative.java" + ], + "source_anchors": [ + { + "marker": "DFB-SOURCE: model-store-roundtrip-input", + "file": "ModelStoreRoundtripNegative.java", + "line_hint": 12 + } + ], + "sink_anchors": [ + { + "marker": "DFB-SINK: model-store-roundtrip-sink", + "file": "ModelStoreRoundtripNegative.java", + "line_hint": 16 + } + ], + "expected_flows": [], + "expected_nonflows": [ + { + "source": "DFB-SOURCE: model-store-roundtrip-input", + "sink": "DFB-SINK: model-store-roundtrip-sink" + } + ], + "witness_checkpoints": [], + "expected_analysis_capability": { + "kind": "persistence-boundary-activation" + }, + "execution_budget": { + "wall_clock_seconds": 60, + "peak_memory_mb": 512 + }, + "fixture_provenance": { + "kind": "authored", + "origin": "DataFlowBench", + "revision": "m3-modeling-java", + "license": "MIT" + }, + "tool_model_references": { + "bifrost": { + "policy": "adapters/bifrost/policies/model-java.rqlp" + }, + "codeql": { + "query": "adapters/codeql/queries/JavaModeling.ql" + } + } +} diff --git a/cases/taint/java/model-store-roundtrip-positive/ModelStoreRoundtripPositive.java b/cases/taint/java/model-store-roundtrip-positive/ModelStoreRoundtripPositive.java new file mode 100644 index 0000000..1954ca9 --- /dev/null +++ b/cases/taint/java/model-store-roundtrip-positive/ModelStoreRoundtripPositive.java @@ -0,0 +1,25 @@ +package dataflowbench.taint; + +final class Store { + static void put(String key, String value) { } + + static String get(String key) { + return ""; + } +} + +final class ModelStoreRoundtripPositive { + static String dfb_source() { // DFB-SOURCE: model-store-roundtrip-input + return "t"; + } + + static void dfb_sink(String value) { } // DFB-SINK: model-store-roundtrip-sink + + static void writeSide() { + Store.put("k", dfb_source()); + } + + static void readSide() { + dfb_sink(Store.get("k")); + } +} diff --git a/cases/taint/java/model-store-roundtrip-positive/case.json b/cases/taint/java/model-store-roundtrip-positive/case.json new file mode 100644 index 0000000..1d151e0 --- /dev/null +++ b/cases/taint/java/model-store-roundtrip-positive/case.json @@ -0,0 +1,64 @@ +{ + "schema_version": 2, + "id": "dfb-taint-java-model-store-roundtrip-positive", + "template_id": "dfb-template-model-store-roundtrip", + "polarity": "positive", + "score_tier": "modeling", + "track": "taint", + "language": "java", + "semantic_dimensions": [ + "interprocedural-flow", + "heap-field-sensitivity" + ], + "feature_tags": [ + "modeled-external", + "heap-access-path" + ], + "model_profile": "benchmark-controlled", + "fixture_files": [ + "ModelStoreRoundtripPositive.java" + ], + "source_anchors": [ + { + "marker": "DFB-SOURCE: model-store-roundtrip-input", + "file": "ModelStoreRoundtripPositive.java", + "line_hint": 12 + } + ], + "sink_anchors": [ + { + "marker": "DFB-SINK: model-store-roundtrip-sink", + "file": "ModelStoreRoundtripPositive.java", + "line_hint": 16 + } + ], + "expected_flows": [ + { + "source": "DFB-SOURCE: model-store-roundtrip-input", + "sink": "DFB-SINK: model-store-roundtrip-sink" + } + ], + "expected_nonflows": [], + "witness_checkpoints": [], + "expected_analysis_capability": { + "kind": "persistence-boundary-activation" + }, + "execution_budget": { + "wall_clock_seconds": 60, + "peak_memory_mb": 512 + }, + "fixture_provenance": { + "kind": "authored", + "origin": "DataFlowBench", + "revision": "m3-modeling-java", + "license": "MIT" + }, + "tool_model_references": { + "bifrost": { + "policy": "adapters/bifrost/policies/model-java.rqlp" + }, + "codeql": { + "query": "adapters/codeql/queries/JavaModeling.ql" + } + } +} diff --git a/cases/taint/java/model-store-separation-negative/ModelStoreSeparationNegative.java b/cases/taint/java/model-store-separation-negative/ModelStoreSeparationNegative.java new file mode 100644 index 0000000..af05d1b --- /dev/null +++ b/cases/taint/java/model-store-separation-negative/ModelStoreSeparationNegative.java @@ -0,0 +1,29 @@ +package dataflowbench.taint; + +final class Store { + void put(String key, String value) { } + + String get(String key) { + return ""; + } +} + +final class ModelStoreSeparationNegative { + static final Store alpha = new Store(); + + static final Store beta = new Store(); + + static String dfb_source() { // DFB-SOURCE: model-store-separation-input + return "t"; + } + + static void dfb_sink(String value) { } // DFB-SINK: model-store-separation-sink + + static void writeSide() { + alpha.put("k", dfb_source()); + } + + static void readSide() { + dfb_sink(beta.get("k")); + } +} diff --git a/cases/taint/java/model-store-separation-negative/case.json b/cases/taint/java/model-store-separation-negative/case.json new file mode 100644 index 0000000..9661891 --- /dev/null +++ b/cases/taint/java/model-store-separation-negative/case.json @@ -0,0 +1,65 @@ +{ + "schema_version": 2, + "id": "dfb-taint-java-model-store-separation-negative", + "template_id": "dfb-template-model-store-separation", + "polarity": "negative", + "negative_mechanism": "object-separation", + "score_tier": "modeling", + "track": "taint", + "language": "java", + "semantic_dimensions": [ + "interprocedural-flow", + "object-sensitivity" + ], + "feature_tags": [ + "modeled-external", + "heap-access-path" + ], + "model_profile": "benchmark-controlled", + "fixture_files": [ + "ModelStoreSeparationNegative.java" + ], + "source_anchors": [ + { + "marker": "DFB-SOURCE: model-store-separation-input", + "file": "ModelStoreSeparationNegative.java", + "line_hint": 16 + } + ], + "sink_anchors": [ + { + "marker": "DFB-SINK: model-store-separation-sink", + "file": "ModelStoreSeparationNegative.java", + "line_hint": 20 + } + ], + "expected_flows": [], + "expected_nonflows": [ + { + "source": "DFB-SOURCE: model-store-separation-input", + "sink": "DFB-SINK: model-store-separation-sink" + } + ], + "witness_checkpoints": [], + "expected_analysis_capability": { + "kind": "persistence-instance-binding" + }, + "execution_budget": { + "wall_clock_seconds": 60, + "peak_memory_mb": 512 + }, + "fixture_provenance": { + "kind": "authored", + "origin": "DataFlowBench", + "revision": "m3-modeling-java", + "license": "MIT" + }, + "tool_model_references": { + "bifrost": { + "policy": "adapters/bifrost/policies/model-java.rqlp" + }, + "codeql": { + "query": "adapters/codeql/queries/JavaModeling.ql" + } + } +} diff --git a/cases/taint/java/model-store-separation-positive/ModelStoreSeparationPositive.java b/cases/taint/java/model-store-separation-positive/ModelStoreSeparationPositive.java new file mode 100644 index 0000000..73ea7ab --- /dev/null +++ b/cases/taint/java/model-store-separation-positive/ModelStoreSeparationPositive.java @@ -0,0 +1,29 @@ +package dataflowbench.taint; + +final class Store { + void put(String key, String value) { } + + String get(String key) { + return ""; + } +} + +final class ModelStoreSeparationPositive { + static final Store alpha = new Store(); + + static final Store beta = new Store(); + + static String dfb_source() { // DFB-SOURCE: model-store-separation-input + return "t"; + } + + static void dfb_sink(String value) { } // DFB-SINK: model-store-separation-sink + + static void writeSide() { + alpha.put("k", dfb_source()); + } + + static void readSide() { + dfb_sink(alpha.get("k")); + } +} diff --git a/cases/taint/java/model-store-separation-positive/case.json b/cases/taint/java/model-store-separation-positive/case.json new file mode 100644 index 0000000..dc1bdf2 --- /dev/null +++ b/cases/taint/java/model-store-separation-positive/case.json @@ -0,0 +1,64 @@ +{ + "schema_version": 2, + "id": "dfb-taint-java-model-store-separation-positive", + "template_id": "dfb-template-model-store-separation", + "polarity": "positive", + "score_tier": "modeling", + "track": "taint", + "language": "java", + "semantic_dimensions": [ + "interprocedural-flow", + "object-sensitivity" + ], + "feature_tags": [ + "modeled-external", + "heap-access-path" + ], + "model_profile": "benchmark-controlled", + "fixture_files": [ + "ModelStoreSeparationPositive.java" + ], + "source_anchors": [ + { + "marker": "DFB-SOURCE: model-store-separation-input", + "file": "ModelStoreSeparationPositive.java", + "line_hint": 16 + } + ], + "sink_anchors": [ + { + "marker": "DFB-SINK: model-store-separation-sink", + "file": "ModelStoreSeparationPositive.java", + "line_hint": 20 + } + ], + "expected_flows": [ + { + "source": "DFB-SOURCE: model-store-separation-input", + "sink": "DFB-SINK: model-store-separation-sink" + } + ], + "expected_nonflows": [], + "witness_checkpoints": [], + "expected_analysis_capability": { + "kind": "persistence-instance-binding" + }, + "execution_budget": { + "wall_clock_seconds": 60, + "peak_memory_mb": 512 + }, + "fixture_provenance": { + "kind": "authored", + "origin": "DataFlowBench", + "revision": "m3-modeling-java", + "license": "MIT" + }, + "tool_model_references": { + "bifrost": { + "policy": "adapters/bifrost/policies/model-java.rqlp" + }, + "codeql": { + "query": "adapters/codeql/queries/JavaModeling.ql" + } + } +} diff --git a/cases/taint/java/model-summary-field-negative/ModelSummaryFieldNegative.java b/cases/taint/java/model-summary-field-negative/ModelSummaryFieldNegative.java new file mode 100644 index 0000000..2519d08 --- /dev/null +++ b/cases/taint/java/model-summary-field-negative/ModelSummaryFieldNegative.java @@ -0,0 +1,24 @@ +package dataflowbench.taint; + +final class Box { + String payload = ""; + String spare = ""; +} + +final class Bridge { + static void deposit(String value, Box box) { } +} + +final class ModelSummaryFieldNegative { + static String dfb_source() { // DFB-SOURCE: model-summary-field-input + return "t"; + } + + static void dfb_sink(String value) { } // DFB-SINK: model-summary-field-sink + + static void run() { + Box box = new Box(); + Bridge.deposit(dfb_source(), box); + dfb_sink(box.spare); + } +} diff --git a/cases/taint/java/model-summary-field-negative/case.json b/cases/taint/java/model-summary-field-negative/case.json new file mode 100644 index 0000000..02fa5c4 --- /dev/null +++ b/cases/taint/java/model-summary-field-negative/case.json @@ -0,0 +1,67 @@ +{ + "schema_version": 2, + "id": "dfb-taint-java-model-summary-field-negative", + "template_id": "dfb-template-model-summary-field", + "polarity": "negative", + "negative_mechanism": "field-separation", + "score_tier": "modeling", + "track": "taint", + "language": "java", + "semantic_dimensions": [ + "external-summary", + "interprocedural-flow", + "heap-field-sensitivity" + ], + "feature_tags": [ + "modeled-external", + "summary-required", + "heap-access-path" + ], + "model_profile": "benchmark-controlled", + "fixture_files": [ + "ModelSummaryFieldNegative.java" + ], + "source_anchors": [ + { + "marker": "DFB-SOURCE: model-summary-field-input", + "file": "ModelSummaryFieldNegative.java", + "line_hint": 13 + } + ], + "sink_anchors": [ + { + "marker": "DFB-SINK: model-summary-field-sink", + "file": "ModelSummaryFieldNegative.java", + "line_hint": 17 + } + ], + "expected_flows": [], + "expected_nonflows": [ + { + "source": "DFB-SOURCE: model-summary-field-input", + "sink": "DFB-SINK: model-summary-field-sink" + } + ], + "witness_checkpoints": [], + "expected_analysis_capability": { + "kind": "store-through-summary-activation" + }, + "execution_budget": { + "wall_clock_seconds": 60, + "peak_memory_mb": 512 + }, + "fixture_provenance": { + "kind": "authored", + "origin": "DataFlowBench", + "revision": "m3-modeling-java", + "license": "MIT" + }, + "tool_model_references": { + "bifrost": { + "policy": "adapters/bifrost/policies/model-java.rqlp" + }, + "codeql": { + "query": "adapters/codeql/queries/JavaModeling.ql" + } + } +} diff --git a/cases/taint/java/model-summary-field-positive/ModelSummaryFieldPositive.java b/cases/taint/java/model-summary-field-positive/ModelSummaryFieldPositive.java new file mode 100644 index 0000000..036edd2 --- /dev/null +++ b/cases/taint/java/model-summary-field-positive/ModelSummaryFieldPositive.java @@ -0,0 +1,24 @@ +package dataflowbench.taint; + +final class Box { + String payload = ""; + String spare = ""; +} + +final class Bridge { + static void deposit(String value, Box box) { } +} + +final class ModelSummaryFieldPositive { + static String dfb_source() { // DFB-SOURCE: model-summary-field-input + return "t"; + } + + static void dfb_sink(String value) { } // DFB-SINK: model-summary-field-sink + + static void run() { + Box box = new Box(); + Bridge.deposit(dfb_source(), box); + dfb_sink(box.payload); + } +} diff --git a/cases/taint/java/model-summary-field-positive/case.json b/cases/taint/java/model-summary-field-positive/case.json new file mode 100644 index 0000000..f799919 --- /dev/null +++ b/cases/taint/java/model-summary-field-positive/case.json @@ -0,0 +1,66 @@ +{ + "schema_version": 2, + "id": "dfb-taint-java-model-summary-field-positive", + "template_id": "dfb-template-model-summary-field", + "polarity": "positive", + "score_tier": "modeling", + "track": "taint", + "language": "java", + "semantic_dimensions": [ + "external-summary", + "interprocedural-flow", + "heap-field-sensitivity" + ], + "feature_tags": [ + "modeled-external", + "summary-required", + "heap-access-path" + ], + "model_profile": "benchmark-controlled", + "fixture_files": [ + "ModelSummaryFieldPositive.java" + ], + "source_anchors": [ + { + "marker": "DFB-SOURCE: model-summary-field-input", + "file": "ModelSummaryFieldPositive.java", + "line_hint": 13 + } + ], + "sink_anchors": [ + { + "marker": "DFB-SINK: model-summary-field-sink", + "file": "ModelSummaryFieldPositive.java", + "line_hint": 17 + } + ], + "expected_flows": [ + { + "source": "DFB-SOURCE: model-summary-field-input", + "sink": "DFB-SINK: model-summary-field-sink" + } + ], + "expected_nonflows": [], + "witness_checkpoints": [], + "expected_analysis_capability": { + "kind": "store-through-summary-activation" + }, + "execution_budget": { + "wall_clock_seconds": 60, + "peak_memory_mb": 512 + }, + "fixture_provenance": { + "kind": "authored", + "origin": "DataFlowBench", + "revision": "m3-modeling-java", + "license": "MIT" + }, + "tool_model_references": { + "bifrost": { + "policy": "adapters/bifrost/policies/model-java.rqlp" + }, + "codeql": { + "query": "adapters/codeql/queries/JavaModeling.ql" + } + } +} diff --git a/cases/taint/java/model-summary-through-negative/Bridge.java b/cases/taint/java/model-summary-through-negative/Bridge.java new file mode 100644 index 0000000..4934c5e --- /dev/null +++ b/cases/taint/java/model-summary-through-negative/Bridge.java @@ -0,0 +1,11 @@ +package dataflowbench.taint; + +final class Bridge { + static String pass(String value) { + return value; + } + + static String hold(String value) { + return value; + } +} diff --git a/cases/taint/java/model-summary-through-negative/ModelSummaryThroughNegative.java b/cases/taint/java/model-summary-through-negative/ModelSummaryThroughNegative.java new file mode 100644 index 0000000..03703dc --- /dev/null +++ b/cases/taint/java/model-summary-through-negative/ModelSummaryThroughNegative.java @@ -0,0 +1,13 @@ +package dataflowbench.taint; + +final class ModelSummaryThroughNegative { + static String dfb_source() { // DFB-SOURCE: model-summary-through-input + return "t"; + } + + static void dfb_sink(String value) { } // DFB-SINK: model-summary-through-sink + + static void run() { + dfb_sink(Bridge.hold(dfb_source())); + } +} diff --git a/cases/taint/java/model-summary-through-negative/case.json b/cases/taint/java/model-summary-through-negative/case.json new file mode 100644 index 0000000..79ad82c --- /dev/null +++ b/cases/taint/java/model-summary-through-negative/case.json @@ -0,0 +1,66 @@ +{ + "schema_version": 2, + "id": "dfb-taint-java-model-summary-through-negative", + "template_id": "dfb-template-model-summary-through", + "polarity": "negative", + "negative_mechanism": "call-context-separation", + "score_tier": "modeling", + "track": "taint", + "language": "java", + "semantic_dimensions": [ + "external-summary", + "interprocedural-flow" + ], + "feature_tags": [ + "modeled-external", + "summary-required" + ], + "model_profile": "benchmark-controlled", + "fixture_files": [ + "Bridge.java", + "ModelSummaryThroughNegative.java" + ], + "source_anchors": [ + { + "marker": "DFB-SOURCE: model-summary-through-input", + "file": "ModelSummaryThroughNegative.java", + "line_hint": 4 + } + ], + "sink_anchors": [ + { + "marker": "DFB-SINK: model-summary-through-sink", + "file": "ModelSummaryThroughNegative.java", + "line_hint": 8 + } + ], + "expected_flows": [], + "expected_nonflows": [ + { + "source": "DFB-SOURCE: model-summary-through-input", + "sink": "DFB-SINK: model-summary-through-sink" + } + ], + "witness_checkpoints": [], + "expected_analysis_capability": { + "kind": "procedure-summary-activation" + }, + "execution_budget": { + "wall_clock_seconds": 60, + "peak_memory_mb": 512 + }, + "fixture_provenance": { + "kind": "authored", + "origin": "DataFlowBench", + "revision": "m3-modeling-java", + "license": "MIT" + }, + "tool_model_references": { + "bifrost": { + "policy": "adapters/bifrost/policies/model-java.rqlp" + }, + "codeql": { + "query": "adapters/codeql/queries/JavaModeling.ql" + } + } +} diff --git a/cases/taint/java/model-summary-through-positive/Bridge.java b/cases/taint/java/model-summary-through-positive/Bridge.java new file mode 100644 index 0000000..4934c5e --- /dev/null +++ b/cases/taint/java/model-summary-through-positive/Bridge.java @@ -0,0 +1,11 @@ +package dataflowbench.taint; + +final class Bridge { + static String pass(String value) { + return value; + } + + static String hold(String value) { + return value; + } +} diff --git a/cases/taint/java/model-summary-through-positive/ModelSummaryThroughPositive.java b/cases/taint/java/model-summary-through-positive/ModelSummaryThroughPositive.java new file mode 100644 index 0000000..2a07f49 --- /dev/null +++ b/cases/taint/java/model-summary-through-positive/ModelSummaryThroughPositive.java @@ -0,0 +1,13 @@ +package dataflowbench.taint; + +final class ModelSummaryThroughPositive { + static String dfb_source() { // DFB-SOURCE: model-summary-through-input + return "t"; + } + + static void dfb_sink(String value) { } // DFB-SINK: model-summary-through-sink + + static void run() { + dfb_sink(Bridge.pass(dfb_source())); + } +} diff --git a/cases/taint/java/model-summary-through-positive/case.json b/cases/taint/java/model-summary-through-positive/case.json new file mode 100644 index 0000000..4193ef1 --- /dev/null +++ b/cases/taint/java/model-summary-through-positive/case.json @@ -0,0 +1,65 @@ +{ + "schema_version": 2, + "id": "dfb-taint-java-model-summary-through-positive", + "template_id": "dfb-template-model-summary-through", + "polarity": "positive", + "score_tier": "modeling", + "track": "taint", + "language": "java", + "semantic_dimensions": [ + "external-summary", + "interprocedural-flow" + ], + "feature_tags": [ + "modeled-external", + "summary-required" + ], + "model_profile": "benchmark-controlled", + "fixture_files": [ + "Bridge.java", + "ModelSummaryThroughPositive.java" + ], + "source_anchors": [ + { + "marker": "DFB-SOURCE: model-summary-through-input", + "file": "ModelSummaryThroughPositive.java", + "line_hint": 4 + } + ], + "sink_anchors": [ + { + "marker": "DFB-SINK: model-summary-through-sink", + "file": "ModelSummaryThroughPositive.java", + "line_hint": 8 + } + ], + "expected_flows": [ + { + "source": "DFB-SOURCE: model-summary-through-input", + "sink": "DFB-SINK: model-summary-through-sink" + } + ], + "expected_nonflows": [], + "witness_checkpoints": [], + "expected_analysis_capability": { + "kind": "procedure-summary-activation" + }, + "execution_budget": { + "wall_clock_seconds": 60, + "peak_memory_mb": 512 + }, + "fixture_provenance": { + "kind": "authored", + "origin": "DataFlowBench", + "revision": "m3-modeling-java", + "license": "MIT" + }, + "tool_model_references": { + "bifrost": { + "policy": "adapters/bifrost/policies/model-java.rqlp" + }, + "codeql": { + "query": "adapters/codeql/queries/JavaModeling.ql" + } + } +} diff --git a/docs/adapters.md b/docs/adapters.md index e0b26e3..f6e743f 100644 --- a/docs/adapters.md +++ b/docs/adapters.md @@ -238,9 +238,11 @@ ones, so the frozen 118-case Bifrost smoke population cannot absorb one. **The partition is `CHALLENGE_SEMGREP_PARTITION` generalized to four tools.** `MODELING_PARTITION` holds one cell per tool per category — twenty-four cells, transcribed from the preregistration's tables, with the cells it marks *to be -verified* recorded as `unsupported` per its own rule. Scored today: **Bifrost 2 -templates of 12** (category S alone), **Semgrep CE 6 of 12** (S, Z, E), -**CodeQL 12 of 12**, **Joern 12 of 12**. A declined cell is decided from the +verified* recorded as `unsupported` per its own rule, and with the dated +amendments applied on top as template-level overrides. Scored today, after +Amendments A2 and A3: **Bifrost 2 templates of 12** (category S alone), +**Semgrep CE 5 of 12** (S, E, and one of Z's two templates), **CodeQL 12 of +12**, **Joern 8 of 12** (S, Z, E, B). A declined cell is decided from the template ID *before the tool is invoked*, retains the document's rationale verbatim as its reason, and writes a `retained-capability-decision` evidence document beside the report. The decision is keyed by template identity, never @@ -254,7 +256,7 @@ tool per language, hash-bound into the report's `configuration_hash`: | Adapter | Modeling artifact | | --- | --- | | Bifrost | `adapters/bifrost/policies/model-.rqlp` | -| CodeQL | `adapters/codeql//queries/Modeling.ql` | +| CodeQL | `adapters/codeql//queries/Modeling.ql`, except Java's, which is `adapters/codeql/queries/JavaModeling.ql` | | Joern | `adapters/joern/semantics/model-.semantics`, plus the shared `adapters/joern/queries/modeling.sc` | | Semgrep | `adapters/semgrep/rules/model-.yaml` | @@ -262,8 +264,13 @@ The CodeQL path departs from the preregistration's schematic `adapters/codeql/queries/Modeling.ql` and sits inside that language's existing `qlpack`, because a query outside a pack cannot resolve its `codeql/-all` dependency. That is a location, not a declaration -surface: the document's `ConfigSig` encoding is unchanged. Joern is the one -adapter with two files, and both bind the configuration hash. +surface: the document's `ConfigSig` encoding is unchanged. Java is the one +language for which the schematic path is already correct, because Java's pack +*is* the adapter root — `adapters/codeql/qlpack.yml` declares +`dataflowbench/codeql-java` and `JavaKernel.ql` sits beside it — so there is no +`adapters/codeql/java/` to descend into and a query under one would resolve +nothing. Joern is the one adapter with two files, and both bind the +configuration hash. **Four commands, parameterized by language.** `run-bifrost-modeling`, `run-codeql-modeling`, `run-joern-modeling`, and `run-semgrep-modeling`, each @@ -307,14 +314,27 @@ categories to unsupported activation rather than gating them. **The execution arm lands with the language.** The arm that invokes an analyzer over a *scored* cell is written by the pull request that authors that -adapter's declarations for that language. Python's four are wired (wave M1, -`docs/python-modeling.md`) and JavaScript's four are wired on the same runners -(`docs/javascript-modeling.md`); Java's are not, and until they are a scored -cell in that language is a hard error rather than a synthesized outcome, which -the adapter contract at the head of this document forbids. The -`unsupported` arm is independent of all of that, so a tool that declines every -category a population carries produces a whole, validated report of retained -capability decisions without the analyzer being invoked at all. +adapter's declarations for that language. All three of wave M1's languages are +wired on the same four runners: Python (`docs/python-modeling.md`), JavaScript +(`docs/javascript-modeling.md`), and Java (`docs/java-modeling.md`). Wave M1 is +therefore complete, and a scored cell in a language that has no arm stays a hard +error rather than a synthesized outcome, which the adapter contract at the head +of this document forbids. The `unsupported` arm is independent of all of that, +so a tool that declines every category a population carries produces a whole, +validated report of retained capability decisions without the analyzer being +invoked at all. + +**Reconciliation on this tier is source-anchored as well as sink-anchored,** and +that is a property of the fixtures rather than of any adapter. A modeling fixture +carries both halves of its pair in one type — the declared entity and its +undeclared sibling — because that is what the templates say makes the negative a +negative, and category E's handlers need no caller, so the declared handler's +flow is present in the negative's fixture too. A finding therefore counts only +when it lies in the region its case's own source anchor governs *and* on a +callsite of its anchored sink function. An unmatched finding on this tier is the +pair's other entity, fully attributable, so it normalizes to `not-reached` with +the count retained — not to the kernels' `inconclusive`, which is reserved here +for evidence with no usable location at all. **Reporting stays separate.** Modeling reports are their own population per language and per adapter, bound into a freeze manifest like every other report, diff --git a/docs/java-kernel.md b/docs/java-kernel.md index fa6be02..14fae42 100644 --- a/docs/java-kernel.md +++ b/docs/java-kernel.md @@ -10,6 +10,12 @@ was therefore recorded across [the adapter contract](adapters.md) and the per-adapter READMEs rather than in a file of its own. This document is that file, and its subject is the expansion. +Java also carries a population of the +[benchmark-controlled taint-modeling matrix](java-modeling.md), the last of +wave M1's three rows to land. That is a +separate tier with a separate denominator and it is never pooled with anything +below: no number in this document is ever added to a number in that one. + ## Classic core: 16 templates, 32 assertions Unchanged and frozen in v0.3.0. The sixteen `dfb-template-*` identities in diff --git a/docs/java-modeling.md b/docs/java-modeling.md new file mode 100644 index 0000000..2c94484 --- /dev/null +++ b/docs/java-modeling.md @@ -0,0 +1,454 @@ +# Java taint-modeling matrix + +This is wave M1's Java row, and its last: the twenty-four fixtures of +[the benchmark-controlled taint-modeling matrix](modeling-matrix.md), the four +per-adapter model encodings Java's partition entitles it to, and the four runs. +It lands after [Python's](python-modeling.md) and +[JavaScript's](javascript-modeling.md) and is deliberately their mirror — the +same fixture shapes, the same file-per-entity naming, the same runner, the same +shared `modeling.sc` — so that a difference between the three rows is a +difference between the *frontends*, never between three benchmark designs. + +Nothing here amends the preregistration's partition. The twelve template +definitions, the six categories, the negative mechanisms, the capability kinds, +and the per-tool partition were fixed before any of these fixtures existed, and +this document reports against them **as amended by +[A2](modeling-matrix.md#a2--2026-08-26-joerns-propagator-and-summary-categories-are-not-load-bearing), +[A3](modeling-matrix.md#a3--2026-08-26-semgreps-sanitizer-selectivity-cell-is-undecidable-by-construction), +and [A4](modeling-matrix.md#a4--2026-08-26-the-reflective-opaque-propagator-body-is-not-unfollowable-by-joerns-jssrc2cpg)**. +All three were made against earlier rows' evidence, and all three are confirmed +here. This row contributes one amendment of its own, +[A5](modeling-matrix.md#a5--2026-08-26-bifrost-v0106-accepts-unmodeled-require-model), +which is an evidentiary confirmation and moves no cell, and it extends A4's +record from `jssrc2cpg` to `javasrc2cpg`. + +**Java's modeling denominator is 12 templates / 24 assertions**, on the +`modeling` tier, with its own scorecards. No number in this document is ever +pooled with [the Java propagation kernel](java-kernel.md), and a high score here +is not a high propagation score. The two answer different questions: the kernel +asks whether an engine can follow flow it can see, and this matrix asks whether +it can be told things. + +## What is committed + +| Artifact | Path | +| --- | --- | +| Cases and fixtures | `cases/taint/java/model-*-{positive,negative}/` | +| Bifrost policy | `adapters/bifrost/policies/model-java.rqlp` | +| CodeQL query | `adapters/codeql/queries/JavaModeling.ql` | +| Joern semantics | `adapters/joern/semantics/model-java.semantics` | +| Joern query | `adapters/joern/queries/modeling.sc` (shared by every wave-M1 language) | +| Semgrep rule | `adapters/semgrep/rules/model-java.yaml` | +| Reports | `reports/{bifrost,codeql,joern,semgrep}-java-modeling.json` | +| Load-bearing probe | `scripts/probe-java-modeling-load-bearing.sh` | + +The CodeQL query is the one path that departs from the other two rows' +convention, and it departs *back onto* the preregistration's schematic one. +Java's CodeQL pack **is** the adapter root: `adapters/codeql/qlpack.yml` +declares `dataflowbench/codeql-java` with the `codeql/java-all` dependency, and +`queries/JavaKernel.ql` already lives beside it. There is no +`adapters/codeql/java/` pack to descend into, and a query placed under one would +resolve no dependency at all. The rule is unchanged — a modeling query lives +inside its language's existing pack — and a test now asserts that every modeling +query resolves a `qlpack.yml` two directories up. + +## Per-template realization + +Every fixture is stdlib-only Java in package `dataflowbench.taint` — no +framework, no dependency, no build manifest — and compiles warning-free under +`javac --release 21 -Xlint:all -Werror`, which is the same host toolchain the +CodeQL Java adapter traces with `javac -d classes`. Every case is +`score_tier: "modeling"`, `model_profile: "benchmark-controlled"`, provenance +revision `m3-modeling-java`. Eleven templates are a single `.java` file; +template 7 is two, because its summarized procedure has to be external-shaped. + +**Fixtures are named for the entity they declare** where the entity is the +point — `Bridge.java`, `Handler.java` — and otherwise for the case. Java's +identity story is simpler than JavaScript's: `javasrc2cpg` spells a method full +name as `dataflowbench.taint..:`, which is +file-independent, so the Joern flow-semantics artifact binds one entry per +entity regardless of where the type is declared. + +**The endpoint identities come from each fixture's own `DFB-SOURCE:` / +`DFB-SINK:` markers, and those markers always sit on the *declared* entity**, +including in the negatives, where the declared entity is deliberately not the +one the taint runs through. That is what makes a negative measure the +declaration: the runner selects the declared source and the declared sink, and +the fixture arranges for the flow to go somewhere else. + +> **Marker-convention correction, recorded rather than quietly fixed.** Four of +> Java's twelve negatives originally marked the *undeclared sibling* — +> `Audit.discard`, `Config.fetchLocal`, `Handler.onIgnored`, +> `Handler.onUndeclared` — which is the same authoring slip +> [the JavaScript row](javascript-modeling.md) found in four of its own. Marking +> the sibling inverts what the negative measures: it anchors the case on the +> entity the model does *not* declare, so a tool that correctly ignored the +> sibling would be reconciled against the sibling anyway. All four now mark the +> declared entity, matching Python's and JavaScript's convention exactly, and +> the two entry-point negatives' bodies moved with them, because a negative +> whose declared handler still carries the flow is not a negative. The two +> entry-point positives' siblings and the declared-sink positive's control call +> were aligned in the same pass, so the three rows' fixtures are now +> shape-for-shape identical. Every number in this document is from runs on the +> corrected fixtures. + +| # | Template | Java realization | +| --- | --- | --- | +| 1 | `declared-source` | `final class Config` with two constant-returning statics, `fetchRemote` (declared) and `fetchLocal`. The positive sinks `Config.fetchRemote()`, the negative `Config.fetchLocal()`. Both bodies return a string literal, so an engine that reads them learns nothing that distinguishes the two. | +| 2 | `declared-sink` | `final class Audit` with two one-parameter statics that both drop their argument, `record` (declared) and `discard`. The positive calls `Audit.record(dfb_source())` and `Audit.discard("clean")`; the negative swaps them. | +| 3 | `opaque-propagator` | `final class Opaque` with `carry` (declared) and `block`, whose bodies are byte-identical reflective self-dispatch: `Opaque.class.getMethod(target, String.class).invoke(null, value)` with `target` a local `String` constant naming a public `identity` method. | +| 4 | `propagator-position` | `Opaque.select(String first, String second)` with the same reflective body, forwarding `second`. The positive is `Opaque.select("clean", dfb_source())` — taint at declared position 1 — and the negative the identical call with taint at the undeclared position 0. | +| 5 | `sanitizer-kill` | `final class Clean` with the identity method `scrub` (declared). The positive is the bare flow `dfb_sink(dfb_source())`; the negative routes the same flow through `Clean.scrub`. `Clean` is present in both fixtures, so the pair differs only in the routing. | +| 6 | `sanitizer-selectivity` | `Clean` with two identity methods, `scrub` (declared) and `sanitize`. The positive flows through the undeclared `sanitize` and must still be reported; the negative flows through the declared `scrub`. | +| 7 | `summary-through` | `Bridge.java`, a second fixture file, holding `Bridge` with two identity methods `pass` (declared) and `hold`. Both bodies say flow; the summaries disagree, which is what makes reading-the-body and activating-the-summary distinguishable. | +| 8 | `summary-field` | `final class Box { String payload; String spare; }` and `static void deposit(String value, Box box) { }` with an empty body. Both cells call `Bridge.deposit(dfb_source(), box)`; the positive sinks `box.payload`, the negative the sibling `box.spare`. | +| 9 | `entrypoint-parameter` | `final class Handler` with two uncalled one-parameter methods, `onRequest` (declared) and `onIgnored`, and no code invoking either. Exactly one of them carries `dfb_sink(input)` and the other `dfb_sink("clean")`: the declared one in the positive, the undeclared one in the negative. | +| 10 | `entrypoint-selectivity` | The same shape with `onDeclared` (declared) and `onUndeclared`, both plausible roots in one class. | +| 11 | `store-roundtrip` | `final class Store` with two static no-op methods `put(key, value)` and `get(key)`. `writeSide()` calls `Store.put("k", dfb_source())` and a separate `readSide()` calls `dfb_sink(Store.get("k"))`; the negative uses the distinct constant keys `"a"` and `"b"`. No standard-library map is used, so no shipped `HashMap` model can pass the cell without reading the declaration. | +| 12 | `store-separation` | The same shape with *instance* methods and two `static final Store` fields, `alpha` and `beta`, constructed once and never reassigned. The positive writes and reads `alpha`; the negative writes `alpha` and reads `beta` under the same key. | + +No template proved unimplementable as preregistered, and no template's semantics +were altered. + +### One authoring decision worth recording + +Template 8's `Box` and `Bridge` are auxiliary classes in the fixture's own file +rather than in a second one. `javac -Xlint:all` emits `auxiliaryclass` when a +class hidden in one source file is used from another, so the two-file spelling +would not have compiled warning-free. The preregistration requires a second file +only for template 7 — where external *shape* is part of the semantic intent — so +template 8 is single-file. Nothing about the declaration changes: the entity is +still `Bridge.deposit`, bound by type and member. + +## The four encodings + +The same three parts — entity identity, role, binding semantics — in four native +surfaces. Nothing is translated across the surfaces, and a category a tool's +partition declines is **absent** from that tool's artifact rather than +approximated in it. That rule is a test: +`the_modeling_artifacts_declare_only_their_scored_categories` now covers all +three wave-M1 languages and fails the suite if any artifact declares a category +its partition marks unsupported. + +| Adapter | Artifact | Categories it declares | +| --- | --- | --- | +| Bifrost v0.10.6 | `adapters/bifrost/policies/model-java.rqlp` | S | +| CodeQL 2.26.3 | `adapters/codeql/queries/JavaModeling.ql` | S, P, Z, O, E, B | +| Joern 4.0.610 | `adapters/joern/semantics/model-java.semantics` + `adapters/joern/queries/modeling.sc` | S, Z, E, B | +| Semgrep CE 1.174.0 | `adapters/semgrep/rules/model-java.yaml` | S, Z, E | + +**Bifrost** declares category S alone, as two `:sources` entries bound to +`return-value` and two `:sinks` entries bound to `(argument :index 0)`. It sets +`:call-modeling (call-modeling :unmodeled require-model)`, which the pinned +v0.10.6 build accepts — see [A5](#amendment-a5-require-model-is-accepted) below. +That acceptance does **not** promote category P, which also requires a +propagator or transform declaration surface no committed policy has. + +**CodeQL** declares all six categories in one `DataFlow::ConfigSig`: `isSource` +over the declared source calls and over the parameter node of each declared +entry point, `isSink` over argument 0 of the declared sink calls, `isBarrier` +over argument 0 of `Clean.scrub` (plus the explicit no-flow declarations of +`Opaque.block` and `Bridge.hold`), and five `isAdditionalFlowStep` clauses for +`carry`, `select`, `pass`, `deposit`, and the `put`/`get` pair. No data +extensions are used; the query owns the model, which is what +`adapters/codeql/README.md` states as this adapter's design. + +**Joern** splits its declarations across the two files the runner hash-binds +together. `modeling.sc` — shared byte-for-byte with Python and JavaScript, and +deliberately not moved by this row — carries the source, sink, and entry-point +identities as query roots, selected by the identity read off each fixture's own +DFB markers; `model-java.semantics` carries the sanitizer and persistence +declarations as `FullNameSemanticsParser` entries in Joern's own textual syntax. +Categories P and O are absent from the file, because A2 declines them. Three +entries remain: + +``` +"dataflowbench.taint.Clean.scrub:java.lang.String(java.lang.String)" +"dataflowbench.taint.Store.put:void(java.lang.String,java.lang.String)" 2 -> 0 +"dataflowbench.taint.Store.get:java.lang.String(java.lang.String)" 0 -> -1 +``` + +**The Java semantics file carries no comments at all**, where Python's and +JavaScript's carry `#` ones. The pinned 4.0.610 parser fails *silently* in more +than one way — a blank line drops every declaration, and a `//` comment does +too — and on this file a leading comment was measured to produce the same empty +parse, so the commentary lives here and in `adapters/joern/README.md` rather +than in the file. The run's own evidence confirms the file parses: +`declared_semantic_count: 3` in every retained Joern document. `modeling.sc` +additionally raises on an empty parse, so a silent drop is a `runner-error` and +never a scored cell decided by a missing model. + +**Semgrep CE** declares categories S, Z, and E and nothing else — no +`pattern-propagators`, no summary, no persistence boundary — and sets +`options: taint_assume_safe_functions: true`, the load-bearing requirement. +Under A3, template 6 is `unsupported` activation, so Semgrep's scored set is +five templates. Nothing in the rule is templated: the kernel rules substitute +each case's own endpoint identifiers into placeholders, but here the endpoint +identities *are* the model and are the same for every case, so the committed +rule states them literally. + +## Anchor reconciliation + +Modeling cases are reconciled by the same machinery every kernel uses, with two +modeling-specific additions that no kernel path can see. + +**`AnchorDialect::JavaMember`** accepts a member-qualified callsite — +`Audit.record(v)`, `Config.fetchLocal()`, `beta.get("k")` — where the kernel's +`AnchorDialect::Java` deliberately refuses one. It is the exact counterpart of +JavaScript's `AnchorDialect::EcmaMember`, and Java needs it more sharply than +JavaScript does: Java has no free functions, so *every* declared modeling entity +is a member of some type and every callsite of one is written through its +receiver. The kernel dialect is right for a kernel — its `dfb_sink` is a static +method called bare from the same class, and `other.dfb_sink(v)` really is a +different method — and it is unchanged. No kernel reconciliation moves. + +**`JoernEndpointRule::AbsenceIsTheAssertion`** governs what a zero endpoint +count means, exactly as in the other two rows: a modeling negative may +legitimately contain no *declared* endpoint, and that absence is the content of +the assertion rather than an incomplete run. An empty extraction +(`method_count == 0`) is still `inconclusive`. + +Reconciliation on this tier is source-anchored as well as sink-anchored, because +a modeling fixture carries both halves of its pair in one type by construction +and category E's handlers need no caller. A finding counts only when it lies in +the region its case's own source anchor governs *and* on a callsite of its +anchored sink function; an unmatched finding is the pair's other entity, fully +attributable, and normalizes to `not-reached` with the count retained rather +than to the kernels' `inconclusive`. + +## Results + +Run sequentially against the pinned toolchain — Bifrost v0.10.6 (build +`18d09c57`), CodeQL CLI 2.26.3, Joern 4.0.610, Semgrep CE 1.174.0 +(`--oss-only`) — on 2026-08-26. Every outcome below is retained in +`reports/-java-modeling.json` with its raw evidence under +`reports/raw/-java-modeling/`. + +### Outcome distribution + +| Adapter | Scored | `reached` | `not-reached` | `inconclusive` | `unsupported` | Matches | +| --- | --- | --- | --- | --- | --- | --- | +| Bifrost v0.10.6 | 4 (S) | 2 | 2 | 0 | 20 | **4 / 4** | +| CodeQL 2.26.3 | 24 (all six) | 12 | 12 | 0 | 0 | **24 / 24** | +| Joern 4.0.610 | 16 (S, Z, E, B) | 6 | 10 | 0 | 8 | **14 / 16** | +| Semgrep CE 1.174.0 | 10 (S, Z template 5, E) | 5 | 5 | 0 | 14 | **10 / 10** | + +The `unsupported` column is capability coverage, decided from the template +identity before the analyzer was invoked and retained with the +preregistration's own rationale. It is never a negative and it does not reduce +anyone else's denominator. **These four numbers are not comparable to one +another**, because they are over four different denominators. + +No result in this run is `inconclusive` and none is `runner-error`. + +Configuration hashes: Bifrost `921d2c8e…`, CodeQL `38acb5de…`, Joern +`55282607…`, Semgrep `d25d4a40…`. + +### Per category + +`—` is a category the partition declines for that tool, with the amendment that +declined it named where one did. + +| Category | Bifrost | CodeQL | Joern | Semgrep CE | +| --- | --- | --- | --- | --- | +| S — sources and sinks | 4/4 | 4/4 | 4/4 | 4/4 | +| P — propagators | — | 4/4 | — (A2) | — | +| Z — sanitizers | — | 4/4 | 4/4 | 2/2 (template 6 declined, A3) | +| O — summaries | — | 4/4 | — (A2) | — | +| E — entry points | — | 4/4 | 4/4 | 4/4 | +| B — persistence | — | 4/4 | 2/4 | — | + +**This is the same shape as the Python and JavaScript rows, cell for cell**, +including Joern's two category-B false negatives, with one difference: Bifrost +decides all four of its category-S cells on Java, where JavaScript's row +reported three of them `inconclusive`. That is a JavaScript-language property of +the engine — the same incompleteness the frozen JavaScript kernel slice records +— and not a modeling one. Java and Python behave identically here. + +### Mismatches, in full + +There are two across the whole matrix, and both are Joern's. + +**Joern — both category-B positives, false negatives.** The roundtrip does not +close, in either the type-identity (template 11) or the receiver-identity +(template 12) cell. Both boundary declarations key cleanly on `javasrc2cpg` — +`dataflowbench.taint.Store.put:void(java.lang.String,java.lang.String)` is a +stable, file-independent full name, so Java does not hit the +`` binding wall JavaScript does — and both negatives are +correct. Taint deposited on the receiver by `put` simply does not survive into a +separate procedure's `get`. Python's row, where the declarations also bind +cleanly, produces the identical pair. The limitation the cell measures is the +engine's, and all three frontends reach it. + +Neither is a partition change and neither was tuned around. The fixtures are +left as the preregistration's sketch spells them. + +### What the numbers do and do not say + +CodeQL's 24/24 says its data-flow configuration expresses every one of the six +declaration roles and produces the declared semantics. It says nothing at all +about CodeQL's propagation kernel score, and this number is never added to one. +What it does establish across the three rows is that the twelve templates are +*satisfiable as preregistered* — each one has at least one engine that gets it +right — so a miss elsewhere is a statement about that engine and not about a +badly posed cell. + +Joern's 14/16 is over a denominator A2 shrank from 24 to 16. That is not a worse +result reported as a better one: the eight withdrawn cells were withdrawn +because a result there would have scored the engine's default optimism rather +than the model. The +[pre-amendment observations](#retained-pre-amendment-observations) below are what +those eight cells produced when they were still scored, kept as evidence rather +than as a score. + +Semgrep CE decided ten assertions to Bifrost's four, which is the opposite of +the ordering the propagation kernels would suggest — which is the entire reason +this tier exists. + +Bifrost's four decided assertions are four, not four out of twenty-four: it +declined five categories in the preregistration, and a decline is coverage. + +## The three-way distinction + +All three states are representable and two of them occur. + +**Missing model** — none, and unrepresentable. Every scored cell has a +declaration behind it in that adapter's committed artifact, and every declined +cell is declined by the preregistered partition. The runner refuses to start +when an artifact is missing, `modeling.sc` raises when the semantics file parses +to nothing, and the population validator refuses a modeling case that is not one +of the twelve or that is not `model_profile: "benchmark-controlled"`. + +**Unsupported activation** — 42 assertions: Bifrost's twenty, Joern's eight, and +Semgrep CE's fourteen. Each is decided from the template identity *before* the +analyzer is invoked, retains the preregistration's rationale verbatim, and +writes a `retained-capability-decision` evidence document beside the report. No +analyzer process ran for any of them. + +**Incomplete analysis** — none. Unlike JavaScript's row, every invoked cell on +Java completed. + +## Load-bearing verification + +`scripts/probe-java-modeling-load-bearing.sh` runs one positive fixture per +adapter twice — once against the committed artifact and once against a copy with +the single declaration under test deleted — and retains both raw outputs under +`reports/raw/load-bearing-java-modeling/`. It never touches a committed artifact +and never writes a report. + +| Adapter | Category | Declaration removed | With model | Without model | +| --- | --- | --- | --- | --- | +| Bifrost | S | the `Config.fetchRemote` source entry | 1 finding | **0 findings** | +| CodeQL | P | the `Opaque.carry` propagator step | 1 result | **0 results** | +| Joern | Z | the `Clean.scrub` no-flow entry | 0 flows | **1 flow** | +| Semgrep CE | S | the `Audit.record` sink pattern | 1 finding | **0 findings** | + +Every scored category is load-bearing on the adapter that scores it. CodeQL's +probe is also the check that template 3 is doing what it was designed to do: +with the propagator step removed, CodeQL reports nothing through the reflective +body, so the positive cell can only be `reached` because the model was +activated. + +### Amendment A5: `require-model` is accepted + +The preregistration recorded Bifrost's category P as *to be verified* partly +because no committed policy set `:call-modeling (call-modeling :unmodeled +require-model)` and the pinned CLI's acceptance of the setting was unshown. The +committed Java modeling policy sets it, and the pinned v0.10.6 evaluates it to +completion with an empty `diagnostics` array and one finding on template 1's +positive — retained as +`reports/raw/load-bearing-java-modeling/bifrost-require-model-accepted.json`. + +[Amendment A5](modeling-matrix.md#a5--2026-08-26-bifrost-v0106-accepts-unmodeled-require-model) +records that as an evidentiary confirmation. **No partition cell moves.** +Accepting the switch is necessary but not sufficient for promoting category P; +the other stated obstacle — showing that a propagator or transform section +actually lowers — is untouched, and Bifrost's category-S cells were already +scored, so the confirmation changes no denominator and no outcome. + +### Amendment A4, extended to `javasrc2cpg` + +`reports/raw/load-bearing-java-modeling/joern-opaque-propagator-unmodeled.json` +is one run of `modeling.sc` over Java's `model-opaque-propagator-positive` under +the committed Java semantics — which, after A2, declares **nothing whatsoever** +for category P. It records `state: analyzed`, `declared_semantic_count: 3` (the +sanitizer and the two persistence mappings, none of them a propagator), and +`flow_count: 1`. + +A4 was written from `jssrc2cpg` and stated its withdrawal as a general one +rather than a JavaScript-specific one, leaving each language to stand on its own +evidence. This is Java's, and it says the same thing: the pinned engine plus the +`javasrc2cpg` frontend follows +`Opaque.class.getMethod(target, String.class).invoke(null, value)` unaided, +through `Method.invoke`'s `Object[]` argument, with no propagator model +whatsoever. A4's entry carries this as a dated addendum. No cell moves — A2 had +already withdrawn Joern's category-P cells for the stronger reason that +`FlowSemantic` mappings cannot restrict the default pass-through. + +## Retained pre-amendment observations + +Java's matrix was first run before A2 and A3 were applied to this tree, over the +full 24 for Joern and the full 12 for Semgrep CE. Those runs are not the +published result and no number in them is scored. They are retained here because +each independently confirms an amendment made on another language's evidence, +and because the eight and two cells they cover are now decided by the partition +rather than by a run. + +**Joern, categories P and O (now `unsupported`, A2).** The pre-amendment Java +run scored 20 of 24, with four misses: two false positives in P and O and the +same two category-B false negatives published above. Both false positives were +separated from "the model was ignored" by their own crossed probes: + +| `Opaque.select` semantics | T4 positive (taint at declared position 1) | T4 negative (taint at undeclared position 0) | +| --- | --- | --- | +| `2 -> -1` (as then committed) | 1 flow | 1 flow | +| declared with no mapping (`NilSemantics`) | 0 | 0 | +| absent from the file entirely | 1 flow, walking the reflective body | 1 flow, walking the reflective body | + +The middle row shows the declaration *is* acted on; the top row shows its index +is not what selects the argument; the bottom row is the same reflective-body +result A4 now records for `javasrc2cpg`. Separately, `Bridge.deposit` declared +`1 -> 2 "payload"` also tainted the sibling field `box.spare` — the access-path +destination can be *written* and does not discriminate, which is the exact +condition the preregistration named when it marked template 8 unverified for +Joern. A2 supersedes both findings with a stronger and more general one, so +neither becomes an amendment of its own. + +**Semgrep CE, template 6 (now `unsupported`, A3).** The pre-amendment Java run +scored 11 of 12, the single miss being template 6's positive. A crossed four-run +probe over the two selectivity cells and the kill cell, on fixtures this row did +not change, gives the reason: + +| `taint_assume_safe_functions` | `pattern-sanitizers` | T6 positive (`Clean.sanitize`) | T6 negative (`Clean.scrub`) | T5 negative (`Clean.scrub`) | +| --- | --- | --- | --- | --- | +| `true` (committed) | declared | 0 | 0 | 0 | +| `true` | removed | 0 | 0 | 0 | +| `false` | declared | 1 | 0 | 0 | +| `false` | removed | 1 | 1 | 1 | + +Rows one and two are identical: with the option on, removing the declaration +changes nothing, which is the definition of a declaration that is not +load-bearing on those cells. This is A3's finding reproduced independently on +Java, from the opposite direction — A3 was made on Python's evidence — and +template 6 is now decided by the partition, so the cell is `unsupported` rather +than a published false negative. It was not tuned around: declaring a propagator +for `Clean.sanitize` would recover the cell, and category P is one this +partition does not award CE in the first place. + +## Reproduction + +```bash +cargo run -- run-bifrost-modeling --language java --bifrost /path/to/bifrost +cargo run -- run-codeql-modeling --language java --codeql /path/to/codeql +cargo run -- run-joern-modeling --language java --joern /path/to/joern-cli/joern +cargo run -- run-semgrep-modeling --language java --semgrep /path/to/semgrep + +scripts/probe-java-modeling-load-bearing.sh \ + --bifrost /path/to/bifrost --codeql /path/to/codeql \ + --joern /path/to/joern-cli/joern --semgrep /path/to/semgrep +``` + +Run them sequentially, never concurrently. Each writes +`reports/-java-modeling.json` with retained evidence under +`reports/raw/-java-modeling/`; none of the eight paths collides with a +report the v0.4.0 freeze binds. diff --git a/docs/milestones.md b/docs/milestones.md index 07e398c..2314fd8 100644 --- a/docs/milestones.md +++ b/docs/milestones.md @@ -207,6 +207,32 @@ than discovered as a failure. Unlike the challenge tier, these templates are own scorecards and never enter any language's core denominator. Issue #16's tool-native profiles build on the same category taxonomy and supply no models. +### Wave M1: Python, JavaScript, Java — complete + +All three languages of the matrix's first wave have landed, one pull request +each, on the same four runners and the same shared `modeling.sc`: +[Python](python-modeling.md), [JavaScript](javascript-modeling.md), and +[Java](java-modeling.md). Each row is twenty-four assertions, four per-adapter +model artifacts encoding the same analyzer-neutral declarations, and four runs. + +No template proved unimplementable as preregistered, and every partition cell +that moved moved by a **dated amendment on the preregistration**, never by an +edit to a table: A2 (Joern's propagator and summary categories are not +load-bearing), A3 (Semgrep's sanitizer-selectivity cell is undecidable by +construction), A4 (the reflective opaque-propagator body is followed unaided — +extended from `jssrc2cpg` to `javasrc2cpg` by the Java row), and A5 (Bifrost +v0.10.6 accepts `:unmodeled require-model`, an evidentiary confirmation that +moves no cell). Observations made before an amendment applied are retained in +the language rows as evidence rather than deleted. + +Across the three rows the results are the same shape cell for cell, which is the +point of running three languages against one design: CodeQL 24/24 everywhere, +Joern 14/16 with the same two category-B false negatives, Semgrep CE 10/10, and +Bifrost 4/4 on Python and Java — JavaScript's three `inconclusive` category-S +cells are that language's engine incompleteness rather than a modeling property. +The remaining ten languages have no modeling denominator until the applicability +pass merges, which is different from having a zero. + ## M4: real-project confirmation Add a small, pinned, manually reviewed corpus drawn from executable or diff --git a/docs/modeling-matrix.md b/docs/modeling-matrix.md index 3777c53..0dd65c1 100644 --- a/docs/modeling-matrix.md +++ b/docs/modeling-matrix.md @@ -1109,11 +1109,21 @@ fixtures exist would fail against the current corpus. It must enforce: ## Rollout plan -**Wave M1 — Java, JavaScript, Python.** One language per pull request, after -this document merges. Each PR adds that language's twenty-four fixtures and -cases, the per-adapter model encodings its partition entitles it to, the runs, -and the language's row in the modeling validator. A wave never edits a template -definition in this document. +**Wave M1 — Java, JavaScript, Python. Complete.** One language per pull +request, after this document merged. Each PR added that language's twenty-four +fixtures and cases, the per-adapter model encodings its partition entitles it +to, the runs, and the language's row in the modeling validator. A wave never +edits a template definition in this document. + +| Language | Row | Landed | +| --- | --- | --- | +| Python | [python-modeling.md](python-modeling.md) | first; A2 and A3 are made on its evidence | +| JavaScript | [javascript-modeling.md](javascript-modeling.md) | second; A4 is made on its evidence | +| Java | [java-modeling.md](java-modeling.md) | third; A5 is made on its evidence, and A4's addendum | + +All three rows run on the same four runners, the same shared +`adapters/joern/queries/modeling.sc`, and the same twelve templates; a +difference between two rows is a difference between frontends. **Later — the remaining ten languages,** via the applicability pass described under [initial languages](#initial-languages). Those languages have no modeling @@ -1246,3 +1256,75 @@ retained evidence now stands on its own. **Freezes invalidated.** None. No modeling report is bound by any freeze, and no core or challenge result changes. + +#### Addendum, 2026-08-26: the same is true of `javasrc2cpg` + +A4 withdrew the claim as a general one and left each language to stand on its +own evidence. Java's row now supplies its own, and it agrees. +`reports/raw/load-bearing-java-modeling/joern-opaque-propagator-unmodeled.json` +runs `adapters/joern/queries/modeling.sc` over +`cases/taint/java/model-opaque-propagator-positive` under the committed +`adapters/joern/semantics/model-java.semantics` — which, after A2, declares +**nothing whatsoever** for category P — and records `state: analyzed`, +`declared_semantic_count: 3`, `flow_count: 1`. The pinned 4.0.610 follows +`Opaque.class.getMethod(target, String.class).invoke(null, value)` through +`Method.invoke`'s `Object[]` argument with no propagator model at all. + +The reflective body differs between the two languages — `Reflect.get(…).apply` +in JavaScript, `Method.invoke` in Java — so this is a second, independent +measurement rather than the same one restated. A4's correction is therefore not +`jssrc2cpg`-specific, and the withdrawal stands as the general one A4 already +made it. + +**What this addendum changes.** Nothing beyond the record. No partition cell +moves, no denominator moves, and no outcome changes: A2 had already withdrawn +Joern's category-P cells for the stronger reason. See +[the Java modeling row](java-modeling.md#amendment-a4-extended-to-javasrc2cpg). + +### A5 — 2026-08-26: Bifrost v0.10.6 accepts `:unmodeled require-model` + +**What changed.** Nothing in the partition, the templates, or the rollout. This +amendment is an **evidentiary confirmation**: it answers, with a measurement, +one of the two facts the preregistration recorded as *to be verified* about +Bifrost, and it moves no cell in either direction. + +**What the preregistration said.** Bifrost's category-P cell is `unsupported` +with the reason that *"no committed policy declares a propagator or transform, +and the adapter README makes no propagator claim. Additionally, every committed +policy sets `:unmodeled optimistic`, so the modeling policy must also be shown +to accept `require-model` before either P cell is load-bearing. Both must be +demonstrated on the pinned build."* Two obstacles, joined by "both". + +**What was measured.** The second obstacle is cleared. Every committed modeling +policy — Python's, JavaScript's, and Java's — sets +`:call-modeling (call-modeling :unmodeled require-model)`, and the pinned +v0.10.6 (build `18d09c57`) evaluates such a policy to completion rather than +rejecting the setting. Java's run is the retained demonstration: +`reports/raw/load-bearing-java-modeling/bifrost-require-model-accepted.json` +records the committed `model-java.rqlp` evaluated with an empty `diagnostics` +array and one finding on template 1's positive. The runner has enforced the +setting since the infrastructure landed +([the load-bearing-model requirement](#the-load-bearing-model-requirement)), and +`the_java_modeling_artifacts_are_load_bearing` in `src/main.rs` keeps it true. + +**Why no cell moves.** The *first* obstacle is untouched. Nothing here shows +that a propagator or transform section lowers to a flow step on the pinned +build, and no committed policy declares one — a modeling policy that did would +violate this document's own rule that an artifact never declares a category its +partition marks unsupported. Category P therefore stays `unsupported` for +Bifrost. Bifrost's category-S cells, the only ones its partition scores, were +already scored, so this confirmation changes no denominator, no outcome, and no +published number. + +**Why it is recorded at all.** Because the preregistration asked for it by name. +A *to be verified* note that is quietly satisfied and never written down is +indistinguishable from one that was never checked, and the next reader deciding +whether Bifrost's category P can be promoted needs to know which of the two +obstacles is still standing. + +**Tools, templates, and languages touched.** Bifrost only; no template; Java +measured directly, with Python's and JavaScript's committed policies carrying +the same setting. + +**Freezes invalidated.** None. No modeling report is bound by any freeze, and +no core or challenge result changes. diff --git a/reports/bifrost-java-modeling.json b/reports/bifrost-java-modeling.json new file mode 100644 index 0000000..75715dc --- /dev/null +++ b/reports/bifrost-java-modeling.json @@ -0,0 +1,418 @@ +{ + "adapter_version": "0.1.0", + "cold_or_warm": "cold", + "configuration_hash": "921d2c8e531813bf7c9bb93fd6da710e62020f60f9caadc7ac0096c5c31121d9", + "ended_at_unix_seconds": 1787751111, + "fixture_revision": "sha256:f9dab53624e836d29ed6d3e00fc7072b6ac0850bec3c63ec39926b3288cef7d1", + "results": [ + { + "case_id": "dfb-taint-java-model-declared-sink-negative", + "diagnostics": [], + "duration_ms": 42, + "outcome": "not-reached", + "peak_memory_mb": null, + "raw_output": "reports/raw/bifrost-java-modeling/dfb-taint-java-model-declared-sink-negative.json", + "sink_anchors": [ + "DFB-SINK: model-declared-sink-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-declared-sink-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-declared-sink-positive", + "diagnostics": [ + "A benchmark-declared model carried input to the declared sink" + ], + "duration_ms": 40, + "outcome": "reached", + "peak_memory_mb": null, + "raw_output": "reports/raw/bifrost-java-modeling/dfb-taint-java-model-declared-sink-positive.json", + "sink_anchors": [ + "DFB-SINK: model-declared-sink-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-declared-sink-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-declared-source-negative", + "diagnostics": [], + "duration_ms": 38, + "outcome": "not-reached", + "peak_memory_mb": null, + "raw_output": "reports/raw/bifrost-java-modeling/dfb-taint-java-model-declared-source-negative.json", + "sink_anchors": [ + "DFB-SINK: model-declared-source-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-declared-source-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-declared-source-positive", + "diagnostics": [ + "A benchmark-declared model carried input to the declared sink" + ], + "duration_ms": 37, + "outcome": "reached", + "peak_memory_mb": null, + "raw_output": "reports/raw/bifrost-java-modeling/dfb-taint-java-model-declared-source-positive.json", + "sink_anchors": [ + "DFB-SINK: model-declared-source-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-declared-source-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-entrypoint-parameter-negative", + "diagnostics": [ + "category E — framework entry points — is unsupported for Bifrost v0.10.6 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): to be verified — unsupported until shown: nothing in the repository or the README describes an entry-root declaration for the policy CLI" + ], + "duration_ms": 0, + "outcome": "unsupported", + "peak_memory_mb": null, + "raw_output": "reports/raw/bifrost-java-modeling/dfb-taint-java-model-entrypoint-parameter-negative-unsupported.json", + "sink_anchors": [ + "DFB-SINK: model-entrypoint-parameter-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-entrypoint-parameter-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-entrypoint-parameter-positive", + "diagnostics": [ + "category E — framework entry points — is unsupported for Bifrost v0.10.6 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): to be verified — unsupported until shown: nothing in the repository or the README describes an entry-root declaration for the policy CLI" + ], + "duration_ms": 0, + "outcome": "unsupported", + "peak_memory_mb": null, + "raw_output": "reports/raw/bifrost-java-modeling/dfb-taint-java-model-entrypoint-parameter-positive-unsupported.json", + "sink_anchors": [ + "DFB-SINK: model-entrypoint-parameter-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-entrypoint-parameter-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-entrypoint-selectivity-negative", + "diagnostics": [ + "category E — framework entry points — is unsupported for Bifrost v0.10.6 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): to be verified — unsupported until shown: nothing in the repository or the README describes an entry-root declaration for the policy CLI" + ], + "duration_ms": 0, + "outcome": "unsupported", + "peak_memory_mb": null, + "raw_output": "reports/raw/bifrost-java-modeling/dfb-taint-java-model-entrypoint-selectivity-negative-unsupported.json", + "sink_anchors": [ + "DFB-SINK: model-entrypoint-selectivity-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-entrypoint-selectivity-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-entrypoint-selectivity-positive", + "diagnostics": [ + "category E — framework entry points — is unsupported for Bifrost v0.10.6 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): to be verified — unsupported until shown: nothing in the repository or the README describes an entry-root declaration for the policy CLI" + ], + "duration_ms": 0, + "outcome": "unsupported", + "peak_memory_mb": null, + "raw_output": "reports/raw/bifrost-java-modeling/dfb-taint-java-model-entrypoint-selectivity-positive-unsupported.json", + "sink_anchors": [ + "DFB-SINK: model-entrypoint-selectivity-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-entrypoint-selectivity-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-opaque-propagator-negative", + "diagnostics": [ + "category P — declared propagators — is unsupported for Bifrost v0.10.6 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): to be verified — unsupported until shown: no committed policy declares a propagator or transform, and the adapter README makes no propagator claim. Additionally, every committed policy sets `:unmodeled optimistic`, so the modeling policy must also be shown to accept `require-model` before either P cell is load-bearing. Both must be demonstrated on the pinned build" + ], + "duration_ms": 0, + "outcome": "unsupported", + "peak_memory_mb": null, + "raw_output": "reports/raw/bifrost-java-modeling/dfb-taint-java-model-opaque-propagator-negative-unsupported.json", + "sink_anchors": [ + "DFB-SINK: model-opaque-propagator-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-opaque-propagator-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-opaque-propagator-positive", + "diagnostics": [ + "category P — declared propagators — is unsupported for Bifrost v0.10.6 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): to be verified — unsupported until shown: no committed policy declares a propagator or transform, and the adapter README makes no propagator claim. Additionally, every committed policy sets `:unmodeled optimistic`, so the modeling policy must also be shown to accept `require-model` before either P cell is load-bearing. Both must be demonstrated on the pinned build" + ], + "duration_ms": 0, + "outcome": "unsupported", + "peak_memory_mb": null, + "raw_output": "reports/raw/bifrost-java-modeling/dfb-taint-java-model-opaque-propagator-positive-unsupported.json", + "sink_anchors": [ + "DFB-SINK: model-opaque-propagator-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-opaque-propagator-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-propagator-position-negative", + "diagnostics": [ + "category P — declared propagators — is unsupported for Bifrost v0.10.6 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): to be verified — unsupported until shown: no committed policy declares a propagator or transform, and the adapter README makes no propagator claim. Additionally, every committed policy sets `:unmodeled optimistic`, so the modeling policy must also be shown to accept `require-model` before either P cell is load-bearing. Both must be demonstrated on the pinned build" + ], + "duration_ms": 0, + "outcome": "unsupported", + "peak_memory_mb": null, + "raw_output": "reports/raw/bifrost-java-modeling/dfb-taint-java-model-propagator-position-negative-unsupported.json", + "sink_anchors": [ + "DFB-SINK: model-propagator-position-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-propagator-position-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-propagator-position-positive", + "diagnostics": [ + "category P — declared propagators — is unsupported for Bifrost v0.10.6 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): to be verified — unsupported until shown: no committed policy declares a propagator or transform, and the adapter README makes no propagator claim. Additionally, every committed policy sets `:unmodeled optimistic`, so the modeling policy must also be shown to accept `require-model` before either P cell is load-bearing. Both must be demonstrated on the pinned build" + ], + "duration_ms": 0, + "outcome": "unsupported", + "peak_memory_mb": null, + "raw_output": "reports/raw/bifrost-java-modeling/dfb-taint-java-model-propagator-position-positive-unsupported.json", + "sink_anchors": [ + "DFB-SINK: model-propagator-position-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-propagator-position-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-sanitizer-kill-negative", + "diagnostics": [ + "category Z — declared sanitizers — is unsupported for Bifrost v0.10.6 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): the adapter README states it directly: \"Sanitizer lowering is a future Bifrost CLI capability.\" (`adapters/bifrost/README.md`). The matrix surfaces this rather than hiding it. DataFlowBench is published by Bifrost's vendor, and a partition that quietly granted its own engine a category its own documentation says is unimplemented would be the single most damaging thing this document could do" + ], + "duration_ms": 0, + "outcome": "unsupported", + "peak_memory_mb": null, + "raw_output": "reports/raw/bifrost-java-modeling/dfb-taint-java-model-sanitizer-kill-negative-unsupported.json", + "sink_anchors": [ + "DFB-SINK: model-sanitizer-kill-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-sanitizer-kill-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-sanitizer-kill-positive", + "diagnostics": [ + "category Z — declared sanitizers — is unsupported for Bifrost v0.10.6 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): the adapter README states it directly: \"Sanitizer lowering is a future Bifrost CLI capability.\" (`adapters/bifrost/README.md`). The matrix surfaces this rather than hiding it. DataFlowBench is published by Bifrost's vendor, and a partition that quietly granted its own engine a category its own documentation says is unimplemented would be the single most damaging thing this document could do" + ], + "duration_ms": 0, + "outcome": "unsupported", + "peak_memory_mb": null, + "raw_output": "reports/raw/bifrost-java-modeling/dfb-taint-java-model-sanitizer-kill-positive-unsupported.json", + "sink_anchors": [ + "DFB-SINK: model-sanitizer-kill-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-sanitizer-kill-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-sanitizer-selectivity-negative", + "diagnostics": [ + "category Z — declared sanitizers — is unsupported for Bifrost v0.10.6 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): the adapter README states it directly: \"Sanitizer lowering is a future Bifrost CLI capability.\" (`adapters/bifrost/README.md`). The matrix surfaces this rather than hiding it. DataFlowBench is published by Bifrost's vendor, and a partition that quietly granted its own engine a category its own documentation says is unimplemented would be the single most damaging thing this document could do" + ], + "duration_ms": 0, + "outcome": "unsupported", + "peak_memory_mb": null, + "raw_output": "reports/raw/bifrost-java-modeling/dfb-taint-java-model-sanitizer-selectivity-negative-unsupported.json", + "sink_anchors": [ + "DFB-SINK: model-sanitizer-selectivity-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-sanitizer-selectivity-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-sanitizer-selectivity-positive", + "diagnostics": [ + "category Z — declared sanitizers — is unsupported for Bifrost v0.10.6 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): the adapter README states it directly: \"Sanitizer lowering is a future Bifrost CLI capability.\" (`adapters/bifrost/README.md`). The matrix surfaces this rather than hiding it. DataFlowBench is published by Bifrost's vendor, and a partition that quietly granted its own engine a category its own documentation says is unimplemented would be the single most damaging thing this document could do" + ], + "duration_ms": 0, + "outcome": "unsupported", + "peak_memory_mb": null, + "raw_output": "reports/raw/bifrost-java-modeling/dfb-taint-java-model-sanitizer-selectivity-positive-unsupported.json", + "sink_anchors": [ + "DFB-SINK: model-sanitizer-selectivity-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-sanitizer-selectivity-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-store-roundtrip-negative", + "diagnostics": [ + "category B — persistence boundaries — is unsupported for Bifrost v0.10.6 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): to be verified — unsupported until shown: no persistence-boundary vocabulary is described anywhere for any adapter, Bifrost included" + ], + "duration_ms": 0, + "outcome": "unsupported", + "peak_memory_mb": null, + "raw_output": "reports/raw/bifrost-java-modeling/dfb-taint-java-model-store-roundtrip-negative-unsupported.json", + "sink_anchors": [ + "DFB-SINK: model-store-roundtrip-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-store-roundtrip-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-store-roundtrip-positive", + "diagnostics": [ + "category B — persistence boundaries — is unsupported for Bifrost v0.10.6 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): to be verified — unsupported until shown: no persistence-boundary vocabulary is described anywhere for any adapter, Bifrost included" + ], + "duration_ms": 0, + "outcome": "unsupported", + "peak_memory_mb": null, + "raw_output": "reports/raw/bifrost-java-modeling/dfb-taint-java-model-store-roundtrip-positive-unsupported.json", + "sink_anchors": [ + "DFB-SINK: model-store-roundtrip-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-store-roundtrip-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-store-separation-negative", + "diagnostics": [ + "category B — persistence boundaries — is unsupported for Bifrost v0.10.6 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): to be verified — unsupported until shown: no persistence-boundary vocabulary is described anywhere for any adapter, Bifrost included" + ], + "duration_ms": 0, + "outcome": "unsupported", + "peak_memory_mb": null, + "raw_output": "reports/raw/bifrost-java-modeling/dfb-taint-java-model-store-separation-negative-unsupported.json", + "sink_anchors": [ + "DFB-SINK: model-store-separation-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-store-separation-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-store-separation-positive", + "diagnostics": [ + "category B — persistence boundaries — is unsupported for Bifrost v0.10.6 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): to be verified — unsupported until shown: no persistence-boundary vocabulary is described anywhere for any adapter, Bifrost included" + ], + "duration_ms": 0, + "outcome": "unsupported", + "peak_memory_mb": null, + "raw_output": "reports/raw/bifrost-java-modeling/dfb-taint-java-model-store-separation-positive-unsupported.json", + "sink_anchors": [ + "DFB-SINK: model-store-separation-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-store-separation-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-summary-field-negative", + "diagnostics": [ + "category O — opaque procedure summaries — is unsupported for Bifrost v0.10.6 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): the adapter README: \"External semantic-model activation requires an embedding with an explicit catalog, so the modeled-external case is reported as `unsupported` by this CLI adapter with an explicit retained reason. It is not a negative result.\" The existing `dfb-taint-java-modeled-external` calibration case already carries that retained reason in the frozen smoke report" + ], + "duration_ms": 0, + "outcome": "unsupported", + "peak_memory_mb": null, + "raw_output": "reports/raw/bifrost-java-modeling/dfb-taint-java-model-summary-field-negative-unsupported.json", + "sink_anchors": [ + "DFB-SINK: model-summary-field-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-summary-field-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-summary-field-positive", + "diagnostics": [ + "category O — opaque procedure summaries — is unsupported for Bifrost v0.10.6 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): the adapter README: \"External semantic-model activation requires an embedding with an explicit catalog, so the modeled-external case is reported as `unsupported` by this CLI adapter with an explicit retained reason. It is not a negative result.\" The existing `dfb-taint-java-modeled-external` calibration case already carries that retained reason in the frozen smoke report" + ], + "duration_ms": 0, + "outcome": "unsupported", + "peak_memory_mb": null, + "raw_output": "reports/raw/bifrost-java-modeling/dfb-taint-java-model-summary-field-positive-unsupported.json", + "sink_anchors": [ + "DFB-SINK: model-summary-field-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-summary-field-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-summary-through-negative", + "diagnostics": [ + "category O — opaque procedure summaries — is unsupported for Bifrost v0.10.6 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): the adapter README: \"External semantic-model activation requires an embedding with an explicit catalog, so the modeled-external case is reported as `unsupported` by this CLI adapter with an explicit retained reason. It is not a negative result.\" The existing `dfb-taint-java-modeled-external` calibration case already carries that retained reason in the frozen smoke report" + ], + "duration_ms": 0, + "outcome": "unsupported", + "peak_memory_mb": null, + "raw_output": "reports/raw/bifrost-java-modeling/dfb-taint-java-model-summary-through-negative-unsupported.json", + "sink_anchors": [ + "DFB-SINK: model-summary-through-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-summary-through-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-summary-through-positive", + "diagnostics": [ + "category O — opaque procedure summaries — is unsupported for Bifrost v0.10.6 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): the adapter README: \"External semantic-model activation requires an embedding with an explicit catalog, so the modeled-external case is reported as `unsupported` by this CLI adapter with an explicit retained reason. It is not a negative result.\" The existing `dfb-taint-java-modeled-external` calibration case already carries that retained reason in the frozen smoke report" + ], + "duration_ms": 0, + "outcome": "unsupported", + "peak_memory_mb": null, + "raw_output": "reports/raw/bifrost-java-modeling/dfb-taint-java-model-summary-through-positive-unsupported.json", + "sink_anchors": [ + "DFB-SINK: model-summary-through-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-summary-through-input" + ], + "witness_checkpoints": [] + } + ], + "schema_version": 1, + "started_at_unix_seconds": 1787751110, + "tool": "bifrost", + "tool_build_identity": "a3ca30bd3fb994cc07db4abf47a2c796854882ca", + "tool_version": "bifrost 0.9.5" +} diff --git a/reports/codeql-java-modeling.json b/reports/codeql-java-modeling.json new file mode 100644 index 0000000..fa321e3 --- /dev/null +++ b/reports/codeql-java-modeling.json @@ -0,0 +1,398 @@ +{ + "adapter_version": "0.1.0", + "cold_or_warm": "cold", + "configuration_hash": "38acb5de67ed39a244c7eb8a9db755ddbcf197488051a5f1ec0d35b65fa30aee", + "ended_at_unix_seconds": 1787751374, + "fixture_revision": "sha256:f9dab53624e836d29ed6d3e00fc7072b6ac0850bec3c63ec39926b3288cef7d1", + "results": [ + { + "case_id": "dfb-taint-java-model-declared-sink-negative", + "diagnostics": [], + "duration_ms": 10926, + "outcome": "not-reached", + "peak_memory_mb": null, + "raw_output": "reports/raw/codeql-java-modeling/dfb-taint-java-model-declared-sink-negative.sarif.json", + "sink_anchors": [ + "DFB-SINK: model-declared-sink-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-declared-sink-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-declared-sink-positive", + "diagnostics": [ + "A benchmark-declared model carried input to the declared sink." + ], + "duration_ms": 10019, + "outcome": "reached", + "peak_memory_mb": null, + "raw_output": "reports/raw/codeql-java-modeling/dfb-taint-java-model-declared-sink-positive.sarif.json", + "sink_anchors": [ + "DFB-SINK: model-declared-sink-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-declared-sink-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-declared-source-negative", + "diagnostics": [], + "duration_ms": 9888, + "outcome": "not-reached", + "peak_memory_mb": null, + "raw_output": "reports/raw/codeql-java-modeling/dfb-taint-java-model-declared-source-negative.sarif.json", + "sink_anchors": [ + "DFB-SINK: model-declared-source-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-declared-source-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-declared-source-positive", + "diagnostics": [ + "A benchmark-declared model carried input to the declared sink." + ], + "duration_ms": 10012, + "outcome": "reached", + "peak_memory_mb": null, + "raw_output": "reports/raw/codeql-java-modeling/dfb-taint-java-model-declared-source-positive.sarif.json", + "sink_anchors": [ + "DFB-SINK: model-declared-source-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-declared-source-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-entrypoint-parameter-negative", + "diagnostics": [], + "duration_ms": 9958, + "outcome": "not-reached", + "peak_memory_mb": null, + "raw_output": "reports/raw/codeql-java-modeling/dfb-taint-java-model-entrypoint-parameter-negative.sarif.json", + "sink_anchors": [ + "DFB-SINK: model-entrypoint-parameter-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-entrypoint-parameter-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-entrypoint-parameter-positive", + "diagnostics": [ + "A benchmark-declared model carried input to the declared sink." + ], + "duration_ms": 10169, + "outcome": "reached", + "peak_memory_mb": null, + "raw_output": "reports/raw/codeql-java-modeling/dfb-taint-java-model-entrypoint-parameter-positive.sarif.json", + "sink_anchors": [ + "DFB-SINK: model-entrypoint-parameter-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-entrypoint-parameter-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-entrypoint-selectivity-negative", + "diagnostics": [], + "duration_ms": 9989, + "outcome": "not-reached", + "peak_memory_mb": null, + "raw_output": "reports/raw/codeql-java-modeling/dfb-taint-java-model-entrypoint-selectivity-negative.sarif.json", + "sink_anchors": [ + "DFB-SINK: model-entrypoint-selectivity-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-entrypoint-selectivity-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-entrypoint-selectivity-positive", + "diagnostics": [ + "A benchmark-declared model carried input to the declared sink." + ], + "duration_ms": 10159, + "outcome": "reached", + "peak_memory_mb": null, + "raw_output": "reports/raw/codeql-java-modeling/dfb-taint-java-model-entrypoint-selectivity-positive.sarif.json", + "sink_anchors": [ + "DFB-SINK: model-entrypoint-selectivity-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-entrypoint-selectivity-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-opaque-propagator-negative", + "diagnostics": [], + "duration_ms": 10031, + "outcome": "not-reached", + "peak_memory_mb": null, + "raw_output": "reports/raw/codeql-java-modeling/dfb-taint-java-model-opaque-propagator-negative.sarif.json", + "sink_anchors": [ + "DFB-SINK: model-opaque-propagator-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-opaque-propagator-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-opaque-propagator-positive", + "diagnostics": [ + "A benchmark-declared model carried input to the declared sink." + ], + "duration_ms": 10770, + "outcome": "reached", + "peak_memory_mb": null, + "raw_output": "reports/raw/codeql-java-modeling/dfb-taint-java-model-opaque-propagator-positive.sarif.json", + "sink_anchors": [ + "DFB-SINK: model-opaque-propagator-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-opaque-propagator-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-propagator-position-negative", + "diagnostics": [], + "duration_ms": 10196, + "outcome": "not-reached", + "peak_memory_mb": null, + "raw_output": "reports/raw/codeql-java-modeling/dfb-taint-java-model-propagator-position-negative.sarif.json", + "sink_anchors": [ + "DFB-SINK: model-propagator-position-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-propagator-position-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-propagator-position-positive", + "diagnostics": [ + "A benchmark-declared model carried input to the declared sink." + ], + "duration_ms": 10631, + "outcome": "reached", + "peak_memory_mb": null, + "raw_output": "reports/raw/codeql-java-modeling/dfb-taint-java-model-propagator-position-positive.sarif.json", + "sink_anchors": [ + "DFB-SINK: model-propagator-position-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-propagator-position-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-sanitizer-kill-negative", + "diagnostics": [], + "duration_ms": 10337, + "outcome": "not-reached", + "peak_memory_mb": null, + "raw_output": "reports/raw/codeql-java-modeling/dfb-taint-java-model-sanitizer-kill-negative.sarif.json", + "sink_anchors": [ + "DFB-SINK: model-sanitizer-kill-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-sanitizer-kill-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-sanitizer-kill-positive", + "diagnostics": [ + "A benchmark-declared model carried input to the declared sink." + ], + "duration_ms": 10069, + "outcome": "reached", + "peak_memory_mb": null, + "raw_output": "reports/raw/codeql-java-modeling/dfb-taint-java-model-sanitizer-kill-positive.sarif.json", + "sink_anchors": [ + "DFB-SINK: model-sanitizer-kill-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-sanitizer-kill-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-sanitizer-selectivity-negative", + "diagnostics": [], + "duration_ms": 10125, + "outcome": "not-reached", + "peak_memory_mb": null, + "raw_output": "reports/raw/codeql-java-modeling/dfb-taint-java-model-sanitizer-selectivity-negative.sarif.json", + "sink_anchors": [ + "DFB-SINK: model-sanitizer-selectivity-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-sanitizer-selectivity-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-sanitizer-selectivity-positive", + "diagnostics": [ + "A benchmark-declared model carried input to the declared sink." + ], + "duration_ms": 10527, + "outcome": "reached", + "peak_memory_mb": null, + "raw_output": "reports/raw/codeql-java-modeling/dfb-taint-java-model-sanitizer-selectivity-positive.sarif.json", + "sink_anchors": [ + "DFB-SINK: model-sanitizer-selectivity-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-sanitizer-selectivity-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-store-roundtrip-negative", + "diagnostics": [], + "duration_ms": 10260, + "outcome": "not-reached", + "peak_memory_mb": null, + "raw_output": "reports/raw/codeql-java-modeling/dfb-taint-java-model-store-roundtrip-negative.sarif.json", + "sink_anchors": [ + "DFB-SINK: model-store-roundtrip-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-store-roundtrip-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-store-roundtrip-positive", + "diagnostics": [ + "A benchmark-declared model carried input to the declared sink." + ], + "duration_ms": 10912, + "outcome": "reached", + "peak_memory_mb": null, + "raw_output": "reports/raw/codeql-java-modeling/dfb-taint-java-model-store-roundtrip-positive.sarif.json", + "sink_anchors": [ + "DFB-SINK: model-store-roundtrip-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-store-roundtrip-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-store-separation-negative", + "diagnostics": [], + "duration_ms": 11325, + "outcome": "not-reached", + "peak_memory_mb": null, + "raw_output": "reports/raw/codeql-java-modeling/dfb-taint-java-model-store-separation-negative.sarif.json", + "sink_anchors": [ + "DFB-SINK: model-store-separation-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-store-separation-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-store-separation-positive", + "diagnostics": [ + "A benchmark-declared model carried input to the declared sink." + ], + "duration_ms": 11105, + "outcome": "reached", + "peak_memory_mb": null, + "raw_output": "reports/raw/codeql-java-modeling/dfb-taint-java-model-store-separation-positive.sarif.json", + "sink_anchors": [ + "DFB-SINK: model-store-separation-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-store-separation-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-summary-field-negative", + "diagnostics": [], + "duration_ms": 10819, + "outcome": "not-reached", + "peak_memory_mb": null, + "raw_output": "reports/raw/codeql-java-modeling/dfb-taint-java-model-summary-field-negative.sarif.json", + "sink_anchors": [ + "DFB-SINK: model-summary-field-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-summary-field-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-summary-field-positive", + "diagnostics": [ + "A benchmark-declared model carried input to the declared sink." + ], + "duration_ms": 10869, + "outcome": "reached", + "peak_memory_mb": null, + "raw_output": "reports/raw/codeql-java-modeling/dfb-taint-java-model-summary-field-positive.sarif.json", + "sink_anchors": [ + "DFB-SINK: model-summary-field-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-summary-field-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-summary-through-negative", + "diagnostics": [], + "duration_ms": 10691, + "outcome": "not-reached", + "peak_memory_mb": null, + "raw_output": "reports/raw/codeql-java-modeling/dfb-taint-java-model-summary-through-negative.sarif.json", + "sink_anchors": [ + "DFB-SINK: model-summary-through-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-summary-through-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-summary-through-positive", + "diagnostics": [ + "A benchmark-declared model carried input to the declared sink." + ], + "duration_ms": 10712, + "outcome": "reached", + "peak_memory_mb": null, + "raw_output": "reports/raw/codeql-java-modeling/dfb-taint-java-model-summary-through-positive.sarif.json", + "sink_anchors": [ + "DFB-SINK: model-summary-through-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-summary-through-input" + ], + "witness_checkpoints": [] + } + ], + "schema_version": 1, + "started_at_unix_seconds": 1787751123, + "tool": "codeql", + "tool_build_identity": "codeql-cli:7d097a43199effe04ecd9c6bd3ad9bb02a45b3d7", + "tool_version": "2.26.3" +} diff --git a/reports/joern-java-modeling.json b/reports/joern-java-modeling.json new file mode 100644 index 0000000..f50fe6a --- /dev/null +++ b/reports/joern-java-modeling.json @@ -0,0 +1,392 @@ +{ + "adapter_version": "0.1.0", + "cold_or_warm": "cold", + "configuration_hash": "55282607023d6902aebe9e2e4199542f04b407229ac0ab04eab9b70dd4a6980f", + "ended_at_unix_seconds": 1787751467, + "fixture_revision": "sha256:f9dab53624e836d29ed6d3e00fc7072b6ac0850bec3c63ec39926b3288cef7d1", + "results": [ + { + "case_id": "dfb-taint-java-model-declared-sink-negative", + "diagnostics": [], + "duration_ms": 4829, + "outcome": "not-reached", + "peak_memory_mb": null, + "raw_output": "reports/raw/joern-java-modeling/dfb-taint-java-model-declared-sink-negative.json", + "sink_anchors": [ + "DFB-SINK: model-declared-sink-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-declared-sink-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-declared-sink-positive", + "diagnostics": [], + "duration_ms": 4416, + "outcome": "reached", + "peak_memory_mb": null, + "raw_output": "reports/raw/joern-java-modeling/dfb-taint-java-model-declared-sink-positive.json", + "sink_anchors": [ + "DFB-SINK: model-declared-sink-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-declared-sink-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-declared-source-negative", + "diagnostics": [ + "Joern resolved 0 declared source node(s) and 1 declared sink node(s) in this fixture" + ], + "duration_ms": 4461, + "outcome": "not-reached", + "peak_memory_mb": null, + "raw_output": "reports/raw/joern-java-modeling/dfb-taint-java-model-declared-source-negative.json", + "sink_anchors": [ + "DFB-SINK: model-declared-source-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-declared-source-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-declared-source-positive", + "diagnostics": [], + "duration_ms": 4550, + "outcome": "reached", + "peak_memory_mb": null, + "raw_output": "reports/raw/joern-java-modeling/dfb-taint-java-model-declared-source-positive.json", + "sink_anchors": [ + "DFB-SINK: model-declared-source-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-declared-source-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-entrypoint-parameter-negative", + "diagnostics": [], + "duration_ms": 4359, + "outcome": "not-reached", + "peak_memory_mb": null, + "raw_output": "reports/raw/joern-java-modeling/dfb-taint-java-model-entrypoint-parameter-negative.json", + "sink_anchors": [ + "DFB-SINK: model-entrypoint-parameter-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-entrypoint-parameter-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-entrypoint-parameter-positive", + "diagnostics": [], + "duration_ms": 4541, + "outcome": "reached", + "peak_memory_mb": null, + "raw_output": "reports/raw/joern-java-modeling/dfb-taint-java-model-entrypoint-parameter-positive.json", + "sink_anchors": [ + "DFB-SINK: model-entrypoint-parameter-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-entrypoint-parameter-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-entrypoint-selectivity-negative", + "diagnostics": [], + "duration_ms": 4461, + "outcome": "not-reached", + "peak_memory_mb": null, + "raw_output": "reports/raw/joern-java-modeling/dfb-taint-java-model-entrypoint-selectivity-negative.json", + "sink_anchors": [ + "DFB-SINK: model-entrypoint-selectivity-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-entrypoint-selectivity-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-entrypoint-selectivity-positive", + "diagnostics": [], + "duration_ms": 4302, + "outcome": "reached", + "peak_memory_mb": null, + "raw_output": "reports/raw/joern-java-modeling/dfb-taint-java-model-entrypoint-selectivity-positive.json", + "sink_anchors": [ + "DFB-SINK: model-entrypoint-selectivity-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-entrypoint-selectivity-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-opaque-propagator-negative", + "diagnostics": [ + "category P — declared propagators — is unsupported for Joern 4.0.610 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): Joern 4.0.610 FlowSemantic mappings are additive over the default unmodeled-call pass-through and cannot restrict it; a propagator model is not load-bearing on the pinned version (Amendment A2)" + ], + "duration_ms": 0, + "outcome": "unsupported", + "peak_memory_mb": null, + "raw_output": "reports/raw/joern-java-modeling/dfb-taint-java-model-opaque-propagator-negative-unsupported.json", + "sink_anchors": [ + "DFB-SINK: model-opaque-propagator-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-opaque-propagator-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-opaque-propagator-positive", + "diagnostics": [ + "category P — declared propagators — is unsupported for Joern 4.0.610 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): Joern 4.0.610 FlowSemantic mappings are additive over the default unmodeled-call pass-through and cannot restrict it; a propagator model is not load-bearing on the pinned version (Amendment A2)" + ], + "duration_ms": 0, + "outcome": "unsupported", + "peak_memory_mb": null, + "raw_output": "reports/raw/joern-java-modeling/dfb-taint-java-model-opaque-propagator-positive-unsupported.json", + "sink_anchors": [ + "DFB-SINK: model-opaque-propagator-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-opaque-propagator-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-propagator-position-negative", + "diagnostics": [ + "category P — declared propagators — is unsupported for Joern 4.0.610 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): Joern 4.0.610 FlowSemantic mappings are additive over the default unmodeled-call pass-through and cannot restrict it; a propagator model is not load-bearing on the pinned version (Amendment A2)" + ], + "duration_ms": 0, + "outcome": "unsupported", + "peak_memory_mb": null, + "raw_output": "reports/raw/joern-java-modeling/dfb-taint-java-model-propagator-position-negative-unsupported.json", + "sink_anchors": [ + "DFB-SINK: model-propagator-position-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-propagator-position-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-propagator-position-positive", + "diagnostics": [ + "category P — declared propagators — is unsupported for Joern 4.0.610 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): Joern 4.0.610 FlowSemantic mappings are additive over the default unmodeled-call pass-through and cannot restrict it; a propagator model is not load-bearing on the pinned version (Amendment A2)" + ], + "duration_ms": 0, + "outcome": "unsupported", + "peak_memory_mb": null, + "raw_output": "reports/raw/joern-java-modeling/dfb-taint-java-model-propagator-position-positive-unsupported.json", + "sink_anchors": [ + "DFB-SINK: model-propagator-position-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-propagator-position-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-sanitizer-kill-negative", + "diagnostics": [], + "duration_ms": 4243, + "outcome": "not-reached", + "peak_memory_mb": null, + "raw_output": "reports/raw/joern-java-modeling/dfb-taint-java-model-sanitizer-kill-negative.json", + "sink_anchors": [ + "DFB-SINK: model-sanitizer-kill-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-sanitizer-kill-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-sanitizer-kill-positive", + "diagnostics": [], + "duration_ms": 4629, + "outcome": "reached", + "peak_memory_mb": null, + "raw_output": "reports/raw/joern-java-modeling/dfb-taint-java-model-sanitizer-kill-positive.json", + "sink_anchors": [ + "DFB-SINK: model-sanitizer-kill-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-sanitizer-kill-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-sanitizer-selectivity-negative", + "diagnostics": [], + "duration_ms": 4487, + "outcome": "not-reached", + "peak_memory_mb": null, + "raw_output": "reports/raw/joern-java-modeling/dfb-taint-java-model-sanitizer-selectivity-negative.json", + "sink_anchors": [ + "DFB-SINK: model-sanitizer-selectivity-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-sanitizer-selectivity-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-sanitizer-selectivity-positive", + "diagnostics": [], + "duration_ms": 4461, + "outcome": "reached", + "peak_memory_mb": null, + "raw_output": "reports/raw/joern-java-modeling/dfb-taint-java-model-sanitizer-selectivity-positive.json", + "sink_anchors": [ + "DFB-SINK: model-sanitizer-selectivity-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-sanitizer-selectivity-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-store-roundtrip-negative", + "diagnostics": [], + "duration_ms": 5277, + "outcome": "not-reached", + "peak_memory_mb": null, + "raw_output": "reports/raw/joern-java-modeling/dfb-taint-java-model-store-roundtrip-negative.json", + "sink_anchors": [ + "DFB-SINK: model-store-roundtrip-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-store-roundtrip-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-store-roundtrip-positive", + "diagnostics": [], + "duration_ms": 4824, + "outcome": "not-reached", + "peak_memory_mb": null, + "raw_output": "reports/raw/joern-java-modeling/dfb-taint-java-model-store-roundtrip-positive.json", + "sink_anchors": [ + "DFB-SINK: model-store-roundtrip-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-store-roundtrip-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-store-separation-negative", + "diagnostics": [], + "duration_ms": 4769, + "outcome": "not-reached", + "peak_memory_mb": null, + "raw_output": "reports/raw/joern-java-modeling/dfb-taint-java-model-store-separation-negative.json", + "sink_anchors": [ + "DFB-SINK: model-store-separation-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-store-separation-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-store-separation-positive", + "diagnostics": [], + "duration_ms": 4555, + "outcome": "not-reached", + "peak_memory_mb": null, + "raw_output": "reports/raw/joern-java-modeling/dfb-taint-java-model-store-separation-positive.json", + "sink_anchors": [ + "DFB-SINK: model-store-separation-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-store-separation-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-summary-field-negative", + "diagnostics": [ + "category O — opaque procedure summaries — is unsupported for Joern 4.0.610 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): Joern 4.0.610 ignores a summary's field-destination access path and its FlowSemantic cannot restrict the default pass-through; a summary model is not load-bearing on the pinned version (Amendment A2)" + ], + "duration_ms": 0, + "outcome": "unsupported", + "peak_memory_mb": null, + "raw_output": "reports/raw/joern-java-modeling/dfb-taint-java-model-summary-field-negative-unsupported.json", + "sink_anchors": [ + "DFB-SINK: model-summary-field-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-summary-field-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-summary-field-positive", + "diagnostics": [ + "category O — opaque procedure summaries — is unsupported for Joern 4.0.610 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): Joern 4.0.610 ignores a summary's field-destination access path and its FlowSemantic cannot restrict the default pass-through; a summary model is not load-bearing on the pinned version (Amendment A2)" + ], + "duration_ms": 0, + "outcome": "unsupported", + "peak_memory_mb": null, + "raw_output": "reports/raw/joern-java-modeling/dfb-taint-java-model-summary-field-positive-unsupported.json", + "sink_anchors": [ + "DFB-SINK: model-summary-field-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-summary-field-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-summary-through-negative", + "diagnostics": [ + "category O — opaque procedure summaries — is unsupported for Joern 4.0.610 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): Joern 4.0.610 ignores a summary's field-destination access path and its FlowSemantic cannot restrict the default pass-through; a summary model is not load-bearing on the pinned version (Amendment A2)" + ], + "duration_ms": 0, + "outcome": "unsupported", + "peak_memory_mb": null, + "raw_output": "reports/raw/joern-java-modeling/dfb-taint-java-model-summary-through-negative-unsupported.json", + "sink_anchors": [ + "DFB-SINK: model-summary-through-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-summary-through-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-summary-through-positive", + "diagnostics": [ + "category O — opaque procedure summaries — is unsupported for Joern 4.0.610 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): Joern 4.0.610 ignores a summary's field-destination access path and its FlowSemantic cannot restrict the default pass-through; a summary model is not load-bearing on the pinned version (Amendment A2)" + ], + "duration_ms": 0, + "outcome": "unsupported", + "peak_memory_mb": null, + "raw_output": "reports/raw/joern-java-modeling/dfb-taint-java-model-summary-through-positive-unsupported.json", + "sink_anchors": [ + "DFB-SINK: model-summary-through-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-summary-through-input" + ], + "witness_checkpoints": [] + } + ], + "schema_version": 1, + "started_at_unix_seconds": 1787751390, + "tool": "joern", + "tool_build_identity": "joern-cli:4.0.432", + "tool_version": "4.0.432" +} diff --git a/reports/raw/bifrost-java-modeling/dfb-taint-java-model-declared-sink-negative.json b/reports/raw/bifrost-java-modeling/dfb-taint-java-model-declared-sink-negative.json new file mode 100644 index 0000000..173ab05 --- /dev/null +++ b/reports/raw/bifrost-java-modeling/dfb-taint-java-model-declared-sink-negative.json @@ -0,0 +1 @@ +{"schema_version":3,"evaluation":{"evaluation_date":"2026-08-11","suppression_path":".bifrost/suppressions.json","suppression_document_state":"not_found","scope_path":".bifrost/policy-scope.json","scope_document_state":"not_found"},"execution":{"total_elapsed_ms":0,"stage_timings":[],"termination":null,"terminal_stage":null,"active_policy_id":null,"completed_policy_ids":[],"pending_policy_ids":[]},"rules":[{"policy_id":"dataflowbench.taint.model-java","policy_hash":"c419872859b67e67c0583d6b66a4eea7cf3350a36a3207a89222db636e8f3c61","analysis_type":"taint","policy_schema":{"version":1,"origin":"explicit"},"selector_schemas":[{"path":"/analysis/sinks/entries/declared-sink/selector","resolution":{"version":1,"origin":"explicit"}},{"path":"/analysis/sinks/entries/sink/selector","resolution":{"version":1,"origin":"explicit"}},{"path":"/analysis/sources/entries/declared-source/selector","resolution":{"version":1,"origin":"explicit"}},{"path":"/analysis/sources/entries/input/selector","resolution":{"version":1,"origin":"explicit"}}],"endpoint_dependencies":[{"identity":{"type":"local","policy_id":"dataflowbench.taint.model-java","entry_id":"declared-sink"},"definition_schema":{"type":"policy_document","resolution":{"version":1,"origin":"explicit"}},"selector_path":"/analysis/sinks/entries/declared-sink/selector","selector_schema":{"version":1,"origin":"explicit"},"model":{"role":"sink","display_name":"Audit.record","categories":["data.sensitive"],"binding":{"type":"argument_index","index":0},"taint":{"type":"sink","accepts":["attacker-controlled"],"tags":[],"impacts":[]},"supersedes":[]},"semantic_hash":"ca5f95a181dd48460b9824d0efa881784970b23cee888d6978b2ac7052d4e1b8","analysis_projection_hash":"d363c6c98379de62f3b873ddd371d29750835db27374c05eaae279abebe4e570","origins":[{"type":"policy_local","path":"/analysis/sinks/entries/declared-sink"}]},{"identity":{"type":"local","policy_id":"dataflowbench.taint.model-java","entry_id":"declared-source"},"definition_schema":{"type":"policy_document","resolution":{"version":1,"origin":"explicit"}},"selector_path":"/analysis/sources/entries/declared-source/selector","selector_schema":{"version":1,"origin":"explicit"},"model":{"role":"source","display_name":"Config.fetchRemote","categories":["input.user-controlled"],"binding":{"type":"return_value"},"taint":{"type":"source","labels":["attacker-controlled"],"evidence":null},"supersedes":[]},"semantic_hash":"e9a7217df5670b3b88bcdf42ba7e5dfbc6f826f109e75d6d1661192725413ad1","analysis_projection_hash":"cf57d45f5aa9335e9cd6372f1ce817dcc569b8bb153df7d074da79614169b550","origins":[{"type":"policy_local","path":"/analysis/sources/entries/declared-source"}]},{"identity":{"type":"local","policy_id":"dataflowbench.taint.model-java","entry_id":"input"},"definition_schema":{"type":"policy_document","resolution":{"version":1,"origin":"explicit"}},"selector_path":"/analysis/sources/entries/input/selector","selector_schema":{"version":1,"origin":"explicit"},"model":{"role":"source","display_name":"benchmark input","categories":["input.user-controlled"],"binding":{"type":"return_value"},"taint":{"type":"source","labels":["attacker-controlled"],"evidence":null},"supersedes":[]},"semantic_hash":"a7086bee9e3b830fec298d9c60e31a18d0a1b5def9088091dd89ded489a1b094","analysis_projection_hash":"e8c42d395df5363d0a789c7ce734dfbf40662b3cd18757fc730b80ccaea4bab0","origins":[{"type":"policy_local","path":"/analysis/sources/entries/input"}]},{"identity":{"type":"local","policy_id":"dataflowbench.taint.model-java","entry_id":"sink"},"definition_schema":{"type":"policy_document","resolution":{"version":1,"origin":"explicit"}},"selector_path":"/analysis/sinks/entries/sink/selector","selector_schema":{"version":1,"origin":"explicit"},"model":{"role":"sink","display_name":"benchmark sink","categories":["data.sensitive"],"binding":{"type":"argument_index","index":0},"taint":{"type":"sink","accepts":["attacker-controlled"],"tags":[],"impacts":[]},"supersedes":[]},"semantic_hash":"b52687a8ab41d5d17210b86f12a811f4685621b9951f5a655b49bf1de1ec394a","analysis_projection_hash":"25d9c2ebb7b961bbe416e36651d6fec2898ab0d1bee858193f0faedd564ed2e8","origins":[{"type":"policy_local","path":"/analysis/sinks/entries/sink"}]}],"match_directory_manifests":[],"precedence_manifest":{"edges":[]},"name":"DataFlowBench Java taint-modeling matrix","message":{"type":"static","text":"A benchmark-declared model carried input to the declared sink"},"severity":{"type":"fixed","level":"warning"},"description":null,"help_uri":null,"tags":[]}],"runs":[{"policy_id":"dataflowbench.taint.model-java","policy_hash":"c419872859b67e67c0583d6b66a4eea7cf3350a36a3207a89222db636e8f3c61","analysis_type":"taint","completion":{"type":"complete"},"findings":[],"diagnostics":[],"diagnostics_truncated":false,"work":{"scanned_files":4,"scanned_source_bytes":1672,"fact_nodes":84,"pipeline_rows":2,"examined_references":0,"retained_findings":0,"omitted_findings_lower_bound":0,"retained_report_bytes":3929,"metrics":[{"name":"taint.propagation_shared_memberships","unit":"count","value":0},{"name":"taint.propagation_solves","unit":"count","value":1},{"name":"taint.semantic_materialized_files","unit":"count","value":2},{"name":"taint.semantic_program_points","unit":"rows","value":198},{"name":"taint.semantic_source_bytes","unit":"bytes","value":2926},{"name":"taint.semantic_traversal_steps","unit":"count","value":21}]}}],"suppressions":[],"scope":[],"diagnostics":[],"diagnostics_truncated":false,"omitted_diagnostics_lower_bound":0,"worst_omitted_diagnostic_severity":null} \ No newline at end of file diff --git a/reports/raw/bifrost-java-modeling/dfb-taint-java-model-declared-sink-positive.json b/reports/raw/bifrost-java-modeling/dfb-taint-java-model-declared-sink-positive.json new file mode 100644 index 0000000..b010079 --- /dev/null +++ b/reports/raw/bifrost-java-modeling/dfb-taint-java-model-declared-sink-positive.json @@ -0,0 +1 @@ +{"schema_version":3,"evaluation":{"evaluation_date":"2026-08-11","suppression_path":".bifrost/suppressions.json","suppression_document_state":"not_found","scope_path":".bifrost/policy-scope.json","scope_document_state":"not_found"},"execution":{"total_elapsed_ms":0,"stage_timings":[],"termination":null,"terminal_stage":null,"active_policy_id":null,"completed_policy_ids":[],"pending_policy_ids":[]},"rules":[{"policy_id":"dataflowbench.taint.model-java","policy_hash":"c419872859b67e67c0583d6b66a4eea7cf3350a36a3207a89222db636e8f3c61","analysis_type":"taint","policy_schema":{"version":1,"origin":"explicit"},"selector_schemas":[{"path":"/analysis/sinks/entries/declared-sink/selector","resolution":{"version":1,"origin":"explicit"}},{"path":"/analysis/sinks/entries/sink/selector","resolution":{"version":1,"origin":"explicit"}},{"path":"/analysis/sources/entries/declared-source/selector","resolution":{"version":1,"origin":"explicit"}},{"path":"/analysis/sources/entries/input/selector","resolution":{"version":1,"origin":"explicit"}}],"endpoint_dependencies":[{"identity":{"type":"local","policy_id":"dataflowbench.taint.model-java","entry_id":"declared-sink"},"definition_schema":{"type":"policy_document","resolution":{"version":1,"origin":"explicit"}},"selector_path":"/analysis/sinks/entries/declared-sink/selector","selector_schema":{"version":1,"origin":"explicit"},"model":{"role":"sink","display_name":"Audit.record","categories":["data.sensitive"],"binding":{"type":"argument_index","index":0},"taint":{"type":"sink","accepts":["attacker-controlled"],"tags":[],"impacts":[]},"supersedes":[]},"semantic_hash":"ca5f95a181dd48460b9824d0efa881784970b23cee888d6978b2ac7052d4e1b8","analysis_projection_hash":"d363c6c98379de62f3b873ddd371d29750835db27374c05eaae279abebe4e570","origins":[{"type":"policy_local","path":"/analysis/sinks/entries/declared-sink"}]},{"identity":{"type":"local","policy_id":"dataflowbench.taint.model-java","entry_id":"declared-source"},"definition_schema":{"type":"policy_document","resolution":{"version":1,"origin":"explicit"}},"selector_path":"/analysis/sources/entries/declared-source/selector","selector_schema":{"version":1,"origin":"explicit"},"model":{"role":"source","display_name":"Config.fetchRemote","categories":["input.user-controlled"],"binding":{"type":"return_value"},"taint":{"type":"source","labels":["attacker-controlled"],"evidence":null},"supersedes":[]},"semantic_hash":"e9a7217df5670b3b88bcdf42ba7e5dfbc6f826f109e75d6d1661192725413ad1","analysis_projection_hash":"cf57d45f5aa9335e9cd6372f1ce817dcc569b8bb153df7d074da79614169b550","origins":[{"type":"policy_local","path":"/analysis/sources/entries/declared-source"}]},{"identity":{"type":"local","policy_id":"dataflowbench.taint.model-java","entry_id":"input"},"definition_schema":{"type":"policy_document","resolution":{"version":1,"origin":"explicit"}},"selector_path":"/analysis/sources/entries/input/selector","selector_schema":{"version":1,"origin":"explicit"},"model":{"role":"source","display_name":"benchmark input","categories":["input.user-controlled"],"binding":{"type":"return_value"},"taint":{"type":"source","labels":["attacker-controlled"],"evidence":null},"supersedes":[]},"semantic_hash":"a7086bee9e3b830fec298d9c60e31a18d0a1b5def9088091dd89ded489a1b094","analysis_projection_hash":"e8c42d395df5363d0a789c7ce734dfbf40662b3cd18757fc730b80ccaea4bab0","origins":[{"type":"policy_local","path":"/analysis/sources/entries/input"}]},{"identity":{"type":"local","policy_id":"dataflowbench.taint.model-java","entry_id":"sink"},"definition_schema":{"type":"policy_document","resolution":{"version":1,"origin":"explicit"}},"selector_path":"/analysis/sinks/entries/sink/selector","selector_schema":{"version":1,"origin":"explicit"},"model":{"role":"sink","display_name":"benchmark sink","categories":["data.sensitive"],"binding":{"type":"argument_index","index":0},"taint":{"type":"sink","accepts":["attacker-controlled"],"tags":[],"impacts":[]},"supersedes":[]},"semantic_hash":"b52687a8ab41d5d17210b86f12a811f4685621b9951f5a655b49bf1de1ec394a","analysis_projection_hash":"25d9c2ebb7b961bbe416e36651d6fec2898ab0d1bee858193f0faedd564ed2e8","origins":[{"type":"policy_local","path":"/analysis/sinks/entries/sink"}]}],"match_directory_manifests":[],"precedence_manifest":{"edges":[]},"name":"DataFlowBench Java taint-modeling matrix","message":{"type":"static","text":"A benchmark-declared model carried input to the declared sink"},"severity":{"type":"fixed","level":"warning"},"description":null,"help_uri":null,"tags":[]}],"runs":[{"policy_id":"dataflowbench.taint.model-java","policy_hash":"c419872859b67e67c0583d6b66a4eea7cf3350a36a3207a89222db636e8f3c61","analysis_type":"taint","completion":{"type":"complete"},"findings":[{"id":"f4a278151439e308c5f9520ab55dd59ddd4df7827c9a26c825be0dffd4b6df40","identity_stability":"strong","policy_id":"dataflowbench.taint.model-java","policy_hash":"c419872859b67e67c0583d6b66a4eea7cf3350a36a3207a89222db636e8f3c61","analysis_type":"taint","severity":"warning","message":"A benchmark-declared model carried input to the declared sink","classification":{"type":"unclassified"},"certainty":{"type":"definite"},"completeness":{"type":"complete"},"primary":{"path":"ModelDeclaredSinkPositive.java","byte_span":{"start":350,"end":376},"region":{"start_line":15,"start_column":9,"end_line":15,"end_column":35}},"related":[{"relationship":"source","location":{"path":"ModelDeclaredSinkPositive.java","byte_span":{"start":363,"end":375},"region":{"start_line":15,"start_column":22,"end_line":15,"end_column":34}},"evidence_refs":[]}],"related_truncated":false,"omitted_related_locations_lower_bound":0,"evidence":{"type":"taint","evidence":{"analysis_finding_id":"bifrost:0f0da97e6f31d1f6715229294469b40890fe8eb57dbb8e69c467ed391533857b","anchor":{"type":"strong","sink_identity":{"namespace":"java","path":"ModelDeclaredSinkPositive.java","derivation":"canonical_ast_identity","semantic_key":"[[\"file\",\"ModelDeclaredSinkPositive.java\"],[\"type\",\"ModelDeclaredSinkPositive\"],[\"method\",\"run\"],[\"program_point\",null]]"},"source_endpoint_analysis_projection_hash":"e8c42d395df5363d0a789c7ce734dfbf40662b3cd18757fc730b80ccaea4bab0","sink_endpoint_analysis_projection_hash":"d363c6c98379de62f3b873ddd371d29750835db27374c05eaae279abebe4e570","source_scenario_set_hash":"fcdd6e26abdbafa84a133957b6befa98c3475fe81c2cadb67a915e2266d5c978"},"sink":"bifrost:10ec00ddd8f56f310e1346dfd865524f26586ca985a68bb4f394a5ce0539251d","source_endpoint":{"type":"local","policy_id":"dataflowbench.taint.model-java","entry_id":"input"},"sink_endpoint":{"type":"local","policy_id":"dataflowbench.taint.model-java","entry_id":"declared-sink"},"source_display_name":"benchmark input","sink_display_name":"Audit.record","source_categories":["input.user-controlled"],"sink_categories":["data.sensitive"],"selected_combination":null,"sink_tags":[],"sink_impacts":[],"reached_source_labels":["attacker-controlled"],"origins":[{"source_endpoint":{"type":"local","policy_id":"dataflowbench.taint.model-java","entry_id":"input"},"source_label":"attacker-controlled","source_evidence":null,"primary":{"path":"ModelDeclaredSinkPositive.java","byte_span":{"start":363,"end":375},"region":{"start_line":15,"start_column":22,"end_line":15,"end_column":34}},"scenario_id":"bifrost:5332acd675067256244cdd9e5035023b6d92f8d86124319f04d97e15709e5e22:source-event:0","evidence_refs":["bifrost:89ae194caedbcc08974ffdda58fe113abdebbcb88910ee7dab23d64cdc12031d"]}],"origins_truncated":false,"source_scenarios":["bifrost:5332acd675067256244cdd9e5035023b6d92f8d86124319f04d97e15709e5e22:source-event:0"],"source_scenarios_truncated":false,"omitted_source_scenarios_lower_bound":0,"source_scenario_set_hash":"fcdd6e26abdbafa84a133957b6befa98c3475fe81c2cadb67a915e2266d5c978","witness_refs":["bifrost:4ee838183d3276f3d4ead0883201ad23c2261ede0f7b9608c4b5e4a35562b2bf","bifrost:5856f56db63e01060ead3c87f7ebbcba27ab1c5e44a4581e4a3eeee322967e6c","bifrost:7d99f95f61e69f95e5debf2e464008b40f4f1bef5f2b7ce615e86029573485f4"],"witness_refs_truncated":false,"projection_facts_hash":"7023f632d2bf8d71c349cb5c8916357c613b5a3ca968dc436a5af34c700b0120"}},"evidence_refs_truncated":false,"omitted_evidence_refs_lower_bound":0,"cvss":null,"organizational_risk":null,"proof":{"state":"proven","reasons":[{"type":"dataflow_witness"}],"evidence_refs":[]},"witnesses":[{"id":"bifrost:4ee838183d3276f3d4ead0883201ad23c2261ede0f7b9608c4b5e4a35562b2bf","steps":[{"kind":"source","location":{"path":"ModelDeclaredSinkPositive.java","byte_span":{"start":322,"end":415},"region":{"start_line":14,"start_column":5,"end_line":17,"end_column":6}},"label":"taint source","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSinkPositive.java","byte_span":{"start":322,"end":415},"region":{"start_line":14,"start_column":5,"end_line":17,"end_column":6}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSinkPositive.java","byte_span":{"start":340,"end":415},"region":{"start_line":14,"start_column":23,"end_line":17,"end_column":6}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSinkPositive.java","byte_span":{"start":350,"end":377},"region":{"start_line":15,"start_column":9,"end_line":15,"end_column":36}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSinkPositive.java","byte_span":{"start":350,"end":355},"region":{"start_line":15,"start_column":9,"end_line":15,"end_column":14}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSinkPositive.java","byte_span":{"start":363,"end":375},"region":{"start_line":15,"start_column":22,"end_line":15,"end_column":34}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSinkPositive.java","byte_span":{"start":363,"end":375},"region":{"start_line":15,"start_column":22,"end_line":15,"end_column":34}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSinkPositive.java","byte_span":{"start":363,"end":375},"region":{"start_line":15,"start_column":22,"end_line":15,"end_column":34}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSinkPositive.java","byte_span":{"start":350,"end":376},"region":{"start_line":15,"start_column":9,"end_line":15,"end_column":35}},"label":"taint propagation","evidence_refs":[]}],"truncated":false,"omitted_steps_lower_bound":0,"retained_bytes":1850},{"id":"bifrost:5856f56db63e01060ead3c87f7ebbcba27ab1c5e44a4581e4a3eeee322967e6c","steps":[{"kind":"source","location":{"path":"ModelDeclaredSinkPositive.java","byte_span":{"start":322,"end":415},"region":{"start_line":14,"start_column":5,"end_line":17,"end_column":6}},"label":"taint source","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSinkPositive.java","byte_span":{"start":322,"end":415},"region":{"start_line":14,"start_column":5,"end_line":17,"end_column":6}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSinkPositive.java","byte_span":{"start":340,"end":415},"region":{"start_line":14,"start_column":23,"end_line":17,"end_column":6}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSinkPositive.java","byte_span":{"start":350,"end":377},"region":{"start_line":15,"start_column":9,"end_line":15,"end_column":36}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSinkPositive.java","byte_span":{"start":350,"end":355},"region":{"start_line":15,"start_column":9,"end_line":15,"end_column":14}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSinkPositive.java","byte_span":{"start":363,"end":375},"region":{"start_line":15,"start_column":22,"end_line":15,"end_column":34}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSinkPositive.java","byte_span":{"start":363,"end":375},"region":{"start_line":15,"start_column":22,"end_line":15,"end_column":34}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSinkPositive.java","byte_span":{"start":363,"end":375},"region":{"start_line":15,"start_column":22,"end_line":15,"end_column":34}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSinkPositive.java","byte_span":{"start":350,"end":376},"region":{"start_line":15,"start_column":9,"end_line":15,"end_column":35}},"label":"taint propagation","evidence_refs":[]}],"truncated":false,"omitted_steps_lower_bound":0,"retained_bytes":1850},{"id":"bifrost:7d99f95f61e69f95e5debf2e464008b40f4f1bef5f2b7ce615e86029573485f4","steps":[{"kind":"source","location":{"path":"ModelDeclaredSinkPositive.java","byte_span":{"start":322,"end":415},"region":{"start_line":14,"start_column":5,"end_line":17,"end_column":6}},"label":"taint source","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSinkPositive.java","byte_span":{"start":322,"end":415},"region":{"start_line":14,"start_column":5,"end_line":17,"end_column":6}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSinkPositive.java","byte_span":{"start":340,"end":415},"region":{"start_line":14,"start_column":23,"end_line":17,"end_column":6}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSinkPositive.java","byte_span":{"start":350,"end":377},"region":{"start_line":15,"start_column":9,"end_line":15,"end_column":36}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSinkPositive.java","byte_span":{"start":350,"end":355},"region":{"start_line":15,"start_column":9,"end_line":15,"end_column":14}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSinkPositive.java","byte_span":{"start":363,"end":375},"region":{"start_line":15,"start_column":22,"end_line":15,"end_column":34}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSinkPositive.java","byte_span":{"start":363,"end":375},"region":{"start_line":15,"start_column":22,"end_line":15,"end_column":34}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSinkPositive.java","byte_span":{"start":363,"end":375},"region":{"start_line":15,"start_column":22,"end_line":15,"end_column":34}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSinkPositive.java","byte_span":{"start":350,"end":376},"region":{"start_line":15,"start_column":9,"end_line":15,"end_column":35}},"label":"taint propagation","evidence_refs":[]}],"truncated":false,"omitted_steps_lower_bound":0,"retained_bytes":1850}],"witnesses_truncated":false,"omitted_witnesses_lower_bound":0,"suppression":null,"scope":null}],"diagnostics":[],"diagnostics_truncated":false,"work":{"scanned_files":4,"scanned_source_bytes":1672,"fact_nodes":84,"pipeline_rows":2,"examined_references":0,"retained_findings":1,"omitted_findings_lower_bound":0,"retained_report_bytes":12753,"metrics":[{"name":"taint.propagation_shared_memberships","unit":"count","value":0},{"name":"taint.propagation_solves","unit":"count","value":1},{"name":"taint.semantic_materialized_files","unit":"count","value":2},{"name":"taint.semantic_program_points","unit":"rows","value":198},{"name":"taint.semantic_source_bytes","unit":"bytes","value":2926},{"name":"taint.semantic_traversal_steps","unit":"count","value":21}]}}],"suppressions":[],"scope":[],"diagnostics":[],"diagnostics_truncated":false,"omitted_diagnostics_lower_bound":0,"worst_omitted_diagnostic_severity":null} \ No newline at end of file diff --git a/reports/raw/bifrost-java-modeling/dfb-taint-java-model-declared-source-negative.json b/reports/raw/bifrost-java-modeling/dfb-taint-java-model-declared-source-negative.json new file mode 100644 index 0000000..038b1fd --- /dev/null +++ b/reports/raw/bifrost-java-modeling/dfb-taint-java-model-declared-source-negative.json @@ -0,0 +1 @@ +{"schema_version":3,"evaluation":{"evaluation_date":"2026-08-11","suppression_path":".bifrost/suppressions.json","suppression_document_state":"not_found","scope_path":".bifrost/policy-scope.json","scope_document_state":"not_found"},"execution":{"total_elapsed_ms":0,"stage_timings":[],"termination":null,"terminal_stage":null,"active_policy_id":null,"completed_policy_ids":[],"pending_policy_ids":[]},"rules":[{"policy_id":"dataflowbench.taint.model-java","policy_hash":"c419872859b67e67c0583d6b66a4eea7cf3350a36a3207a89222db636e8f3c61","analysis_type":"taint","policy_schema":{"version":1,"origin":"explicit"},"selector_schemas":[{"path":"/analysis/sinks/entries/declared-sink/selector","resolution":{"version":1,"origin":"explicit"}},{"path":"/analysis/sinks/entries/sink/selector","resolution":{"version":1,"origin":"explicit"}},{"path":"/analysis/sources/entries/declared-source/selector","resolution":{"version":1,"origin":"explicit"}},{"path":"/analysis/sources/entries/input/selector","resolution":{"version":1,"origin":"explicit"}}],"endpoint_dependencies":[{"identity":{"type":"local","policy_id":"dataflowbench.taint.model-java","entry_id":"declared-sink"},"definition_schema":{"type":"policy_document","resolution":{"version":1,"origin":"explicit"}},"selector_path":"/analysis/sinks/entries/declared-sink/selector","selector_schema":{"version":1,"origin":"explicit"},"model":{"role":"sink","display_name":"Audit.record","categories":["data.sensitive"],"binding":{"type":"argument_index","index":0},"taint":{"type":"sink","accepts":["attacker-controlled"],"tags":[],"impacts":[]},"supersedes":[]},"semantic_hash":"ca5f95a181dd48460b9824d0efa881784970b23cee888d6978b2ac7052d4e1b8","analysis_projection_hash":"d363c6c98379de62f3b873ddd371d29750835db27374c05eaae279abebe4e570","origins":[{"type":"policy_local","path":"/analysis/sinks/entries/declared-sink"}]},{"identity":{"type":"local","policy_id":"dataflowbench.taint.model-java","entry_id":"declared-source"},"definition_schema":{"type":"policy_document","resolution":{"version":1,"origin":"explicit"}},"selector_path":"/analysis/sources/entries/declared-source/selector","selector_schema":{"version":1,"origin":"explicit"},"model":{"role":"source","display_name":"Config.fetchRemote","categories":["input.user-controlled"],"binding":{"type":"return_value"},"taint":{"type":"source","labels":["attacker-controlled"],"evidence":null},"supersedes":[]},"semantic_hash":"e9a7217df5670b3b88bcdf42ba7e5dfbc6f826f109e75d6d1661192725413ad1","analysis_projection_hash":"cf57d45f5aa9335e9cd6372f1ce817dcc569b8bb153df7d074da79614169b550","origins":[{"type":"policy_local","path":"/analysis/sources/entries/declared-source"}]},{"identity":{"type":"local","policy_id":"dataflowbench.taint.model-java","entry_id":"input"},"definition_schema":{"type":"policy_document","resolution":{"version":1,"origin":"explicit"}},"selector_path":"/analysis/sources/entries/input/selector","selector_schema":{"version":1,"origin":"explicit"},"model":{"role":"source","display_name":"benchmark input","categories":["input.user-controlled"],"binding":{"type":"return_value"},"taint":{"type":"source","labels":["attacker-controlled"],"evidence":null},"supersedes":[]},"semantic_hash":"a7086bee9e3b830fec298d9c60e31a18d0a1b5def9088091dd89ded489a1b094","analysis_projection_hash":"e8c42d395df5363d0a789c7ce734dfbf40662b3cd18757fc730b80ccaea4bab0","origins":[{"type":"policy_local","path":"/analysis/sources/entries/input"}]},{"identity":{"type":"local","policy_id":"dataflowbench.taint.model-java","entry_id":"sink"},"definition_schema":{"type":"policy_document","resolution":{"version":1,"origin":"explicit"}},"selector_path":"/analysis/sinks/entries/sink/selector","selector_schema":{"version":1,"origin":"explicit"},"model":{"role":"sink","display_name":"benchmark sink","categories":["data.sensitive"],"binding":{"type":"argument_index","index":0},"taint":{"type":"sink","accepts":["attacker-controlled"],"tags":[],"impacts":[]},"supersedes":[]},"semantic_hash":"b52687a8ab41d5d17210b86f12a811f4685621b9951f5a655b49bf1de1ec394a","analysis_projection_hash":"25d9c2ebb7b961bbe416e36651d6fec2898ab0d1bee858193f0faedd564ed2e8","origins":[{"type":"policy_local","path":"/analysis/sinks/entries/sink"}]}],"match_directory_manifests":[],"precedence_manifest":{"edges":[]},"name":"DataFlowBench Java taint-modeling matrix","message":{"type":"static","text":"A benchmark-declared model carried input to the declared sink"},"severity":{"type":"fixed","level":"warning"},"description":null,"help_uri":null,"tags":[]}],"runs":[{"policy_id":"dataflowbench.taint.model-java","policy_hash":"c419872859b67e67c0583d6b66a4eea7cf3350a36a3207a89222db636e8f3c61","analysis_type":"taint","completion":{"type":"complete"},"findings":[],"diagnostics":[],"diagnostics_truncated":false,"work":{"scanned_files":4,"scanned_source_bytes":1664,"fact_nodes":72,"pipeline_rows":1,"examined_references":0,"retained_findings":0,"omitted_findings_lower_bound":0,"retained_report_bytes":3789,"metrics":[{"name":"taint.semantic_materialized_files","unit":"count","value":1},{"name":"taint.semantic_program_points","unit":"rows","value":29},{"name":"taint.semantic_source_bytes","unit":"bytes","value":416},{"name":"taint.semantic_traversal_steps","unit":"count","value":7}]}}],"suppressions":[],"scope":[],"diagnostics":[],"diagnostics_truncated":false,"omitted_diagnostics_lower_bound":0,"worst_omitted_diagnostic_severity":null} \ No newline at end of file diff --git a/reports/raw/bifrost-java-modeling/dfb-taint-java-model-declared-source-positive.json b/reports/raw/bifrost-java-modeling/dfb-taint-java-model-declared-source-positive.json new file mode 100644 index 0000000..851010e --- /dev/null +++ b/reports/raw/bifrost-java-modeling/dfb-taint-java-model-declared-source-positive.json @@ -0,0 +1 @@ +{"schema_version":3,"evaluation":{"evaluation_date":"2026-08-11","suppression_path":".bifrost/suppressions.json","suppression_document_state":"not_found","scope_path":".bifrost/policy-scope.json","scope_document_state":"not_found"},"execution":{"total_elapsed_ms":0,"stage_timings":[],"termination":null,"terminal_stage":null,"active_policy_id":null,"completed_policy_ids":[],"pending_policy_ids":[]},"rules":[{"policy_id":"dataflowbench.taint.model-java","policy_hash":"c419872859b67e67c0583d6b66a4eea7cf3350a36a3207a89222db636e8f3c61","analysis_type":"taint","policy_schema":{"version":1,"origin":"explicit"},"selector_schemas":[{"path":"/analysis/sinks/entries/declared-sink/selector","resolution":{"version":1,"origin":"explicit"}},{"path":"/analysis/sinks/entries/sink/selector","resolution":{"version":1,"origin":"explicit"}},{"path":"/analysis/sources/entries/declared-source/selector","resolution":{"version":1,"origin":"explicit"}},{"path":"/analysis/sources/entries/input/selector","resolution":{"version":1,"origin":"explicit"}}],"endpoint_dependencies":[{"identity":{"type":"local","policy_id":"dataflowbench.taint.model-java","entry_id":"declared-sink"},"definition_schema":{"type":"policy_document","resolution":{"version":1,"origin":"explicit"}},"selector_path":"/analysis/sinks/entries/declared-sink/selector","selector_schema":{"version":1,"origin":"explicit"},"model":{"role":"sink","display_name":"Audit.record","categories":["data.sensitive"],"binding":{"type":"argument_index","index":0},"taint":{"type":"sink","accepts":["attacker-controlled"],"tags":[],"impacts":[]},"supersedes":[]},"semantic_hash":"ca5f95a181dd48460b9824d0efa881784970b23cee888d6978b2ac7052d4e1b8","analysis_projection_hash":"d363c6c98379de62f3b873ddd371d29750835db27374c05eaae279abebe4e570","origins":[{"type":"policy_local","path":"/analysis/sinks/entries/declared-sink"}]},{"identity":{"type":"local","policy_id":"dataflowbench.taint.model-java","entry_id":"declared-source"},"definition_schema":{"type":"policy_document","resolution":{"version":1,"origin":"explicit"}},"selector_path":"/analysis/sources/entries/declared-source/selector","selector_schema":{"version":1,"origin":"explicit"},"model":{"role":"source","display_name":"Config.fetchRemote","categories":["input.user-controlled"],"binding":{"type":"return_value"},"taint":{"type":"source","labels":["attacker-controlled"],"evidence":null},"supersedes":[]},"semantic_hash":"e9a7217df5670b3b88bcdf42ba7e5dfbc6f826f109e75d6d1661192725413ad1","analysis_projection_hash":"cf57d45f5aa9335e9cd6372f1ce817dcc569b8bb153df7d074da79614169b550","origins":[{"type":"policy_local","path":"/analysis/sources/entries/declared-source"}]},{"identity":{"type":"local","policy_id":"dataflowbench.taint.model-java","entry_id":"input"},"definition_schema":{"type":"policy_document","resolution":{"version":1,"origin":"explicit"}},"selector_path":"/analysis/sources/entries/input/selector","selector_schema":{"version":1,"origin":"explicit"},"model":{"role":"source","display_name":"benchmark input","categories":["input.user-controlled"],"binding":{"type":"return_value"},"taint":{"type":"source","labels":["attacker-controlled"],"evidence":null},"supersedes":[]},"semantic_hash":"a7086bee9e3b830fec298d9c60e31a18d0a1b5def9088091dd89ded489a1b094","analysis_projection_hash":"e8c42d395df5363d0a789c7ce734dfbf40662b3cd18757fc730b80ccaea4bab0","origins":[{"type":"policy_local","path":"/analysis/sources/entries/input"}]},{"identity":{"type":"local","policy_id":"dataflowbench.taint.model-java","entry_id":"sink"},"definition_schema":{"type":"policy_document","resolution":{"version":1,"origin":"explicit"}},"selector_path":"/analysis/sinks/entries/sink/selector","selector_schema":{"version":1,"origin":"explicit"},"model":{"role":"sink","display_name":"benchmark sink","categories":["data.sensitive"],"binding":{"type":"argument_index","index":0},"taint":{"type":"sink","accepts":["attacker-controlled"],"tags":[],"impacts":[]},"supersedes":[]},"semantic_hash":"b52687a8ab41d5d17210b86f12a811f4685621b9951f5a655b49bf1de1ec394a","analysis_projection_hash":"25d9c2ebb7b961bbe416e36651d6fec2898ab0d1bee858193f0faedd564ed2e8","origins":[{"type":"policy_local","path":"/analysis/sinks/entries/sink"}]}],"match_directory_manifests":[],"precedence_manifest":{"edges":[]},"name":"DataFlowBench Java taint-modeling matrix","message":{"type":"static","text":"A benchmark-declared model carried input to the declared sink"},"severity":{"type":"fixed","level":"warning"},"description":null,"help_uri":null,"tags":[]}],"runs":[{"policy_id":"dataflowbench.taint.model-java","policy_hash":"c419872859b67e67c0583d6b66a4eea7cf3350a36a3207a89222db636e8f3c61","analysis_type":"taint","completion":{"type":"complete"},"findings":[{"id":"beeb5253e576d28e435dd0225619fad02efe94b2808112a24760d675d982e897","identity_stability":"strong","policy_id":"dataflowbench.taint.model-java","policy_hash":"c419872859b67e67c0583d6b66a4eea7cf3350a36a3207a89222db636e8f3c61","analysis_type":"taint","severity":"warning","message":"A benchmark-declared model carried input to the declared sink","classification":{"type":"unclassified"},"certainty":{"type":"definite"},"completeness":{"type":"complete"},"primary":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":377,"end":407},"region":{"start_line":17,"start_column":9,"end_line":17,"end_column":39}},"related":[{"relationship":"source","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":386,"end":406},"region":{"start_line":17,"start_column":18,"end_line":17,"end_column":38}},"evidence_refs":[]}],"related_truncated":false,"omitted_related_locations_lower_bound":0,"evidence":{"type":"taint","evidence":{"analysis_finding_id":"bifrost:e00d01675bf1235d6fd72ce468c9f7046a73b37596ebbd2ef0c0b83a590a6fed","anchor":{"type":"strong","sink_identity":{"namespace":"java","path":"ModelDeclaredSourcePositive.java","derivation":"canonical_ast_identity","semantic_key":"[[\"file\",\"ModelDeclaredSourcePositive.java\"],[\"type\",\"ModelDeclaredSourcePositive\"],[\"method\",\"run\"],[\"program_point\",null]]"},"source_endpoint_analysis_projection_hash":"cf57d45f5aa9335e9cd6372f1ce817dcc569b8bb153df7d074da79614169b550","sink_endpoint_analysis_projection_hash":"25d9c2ebb7b961bbe416e36651d6fec2898ab0d1bee858193f0faedd564ed2e8","source_scenario_set_hash":"ec850b2c1c787682bfec02125cfb8b33992b0e4334cd856b1078fc79d35c4a64"},"sink":"bifrost:f27823f2e9c4a580765d15dd30a1cf01212b7c55506bcd95613503e6613010f4","source_endpoint":{"type":"local","policy_id":"dataflowbench.taint.model-java","entry_id":"declared-source"},"sink_endpoint":{"type":"local","policy_id":"dataflowbench.taint.model-java","entry_id":"sink"},"source_display_name":"Config.fetchRemote","sink_display_name":"benchmark sink","source_categories":["input.user-controlled"],"sink_categories":["data.sensitive"],"selected_combination":null,"sink_tags":[],"sink_impacts":[],"reached_source_labels":["attacker-controlled"],"origins":[{"source_endpoint":{"type":"local","policy_id":"dataflowbench.taint.model-java","entry_id":"declared-source"},"source_label":"attacker-controlled","source_evidence":null,"primary":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":386,"end":406},"region":{"start_line":17,"start_column":18,"end_line":17,"end_column":38}},"scenario_id":"bifrost:0ece02fa406bfd60cd2ffb1a18e36beec3ca367d93661c2bc6b8a99939130bca:source-event:0","evidence_refs":["bifrost:a443d68b45dacdb3e6185cfa13ca92e0306fa7550728d55c36bfbfd70a4e7f01"]}],"origins_truncated":false,"source_scenarios":["bifrost:0ece02fa406bfd60cd2ffb1a18e36beec3ca367d93661c2bc6b8a99939130bca:source-event:0"],"source_scenarios_truncated":false,"omitted_source_scenarios_lower_bound":0,"source_scenario_set_hash":"ec850b2c1c787682bfec02125cfb8b33992b0e4334cd856b1078fc79d35c4a64","witness_refs":["bifrost:37d397db1820c48ce632f7874098b25d455ba86a28d6c654593849af80b71710","bifrost:4d0541b035fb383be82a142536dedd48ca8fb6db74e04080b0fb00649b004edd","bifrost:e2559ba1ef83358ec3138c634166c25dea826db004c2ceebbb67e7a258841ef5"],"witness_refs_truncated":false,"projection_facts_hash":"41d25abaa0ab3935bf5f0e2b385873ac5f64417c7e50b42c1df8a1d9479a6262"}},"evidence_refs_truncated":false,"omitted_evidence_refs_lower_bound":0,"cvss":null,"organizational_risk":null,"proof":{"state":"proven","reasons":[{"type":"dataflow_witness"}],"evidence_refs":[]},"witnesses":[{"id":"bifrost:37d397db1820c48ce632f7874098b25d455ba86a28d6c654593849af80b71710","steps":[{"kind":"source","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":349,"end":414},"region":{"start_line":16,"start_column":5,"end_line":18,"end_column":6}},"label":"taint source","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":349,"end":414},"region":{"start_line":16,"start_column":5,"end_line":18,"end_column":6}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":367,"end":414},"region":{"start_line":16,"start_column":23,"end_line":18,"end_column":6}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":377,"end":408},"region":{"start_line":17,"start_column":9,"end_line":17,"end_column":40}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":386,"end":406},"region":{"start_line":17,"start_column":18,"end_line":17,"end_column":38}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":386,"end":392},"region":{"start_line":17,"start_column":18,"end_line":17,"end_column":24}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":386,"end":406},"region":{"start_line":17,"start_column":18,"end_line":17,"end_column":38}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":386,"end":406},"region":{"start_line":17,"start_column":18,"end_line":17,"end_column":38}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":377,"end":407},"region":{"start_line":17,"start_column":9,"end_line":17,"end_column":39}},"label":"taint propagation","evidence_refs":[]}],"truncated":false,"omitted_steps_lower_bound":0,"retained_bytes":1868},{"id":"bifrost:4d0541b035fb383be82a142536dedd48ca8fb6db74e04080b0fb00649b004edd","steps":[{"kind":"source","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":349,"end":414},"region":{"start_line":16,"start_column":5,"end_line":18,"end_column":6}},"label":"taint source","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":349,"end":414},"region":{"start_line":16,"start_column":5,"end_line":18,"end_column":6}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":367,"end":414},"region":{"start_line":16,"start_column":23,"end_line":18,"end_column":6}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":377,"end":408},"region":{"start_line":17,"start_column":9,"end_line":17,"end_column":40}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":386,"end":406},"region":{"start_line":17,"start_column":18,"end_line":17,"end_column":38}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":386,"end":392},"region":{"start_line":17,"start_column":18,"end_line":17,"end_column":24}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":386,"end":406},"region":{"start_line":17,"start_column":18,"end_line":17,"end_column":38}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":386,"end":406},"region":{"start_line":17,"start_column":18,"end_line":17,"end_column":38}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":377,"end":407},"region":{"start_line":17,"start_column":9,"end_line":17,"end_column":39}},"label":"taint propagation","evidence_refs":[]}],"truncated":false,"omitted_steps_lower_bound":0,"retained_bytes":1868},{"id":"bifrost:e2559ba1ef83358ec3138c634166c25dea826db004c2ceebbb67e7a258841ef5","steps":[{"kind":"source","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":349,"end":414},"region":{"start_line":16,"start_column":5,"end_line":18,"end_column":6}},"label":"taint source","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":349,"end":414},"region":{"start_line":16,"start_column":5,"end_line":18,"end_column":6}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":367,"end":414},"region":{"start_line":16,"start_column":23,"end_line":18,"end_column":6}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":377,"end":408},"region":{"start_line":17,"start_column":9,"end_line":17,"end_column":40}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":386,"end":406},"region":{"start_line":17,"start_column":18,"end_line":17,"end_column":38}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":386,"end":392},"region":{"start_line":17,"start_column":18,"end_line":17,"end_column":24}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":386,"end":406},"region":{"start_line":17,"start_column":18,"end_line":17,"end_column":38}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":386,"end":406},"region":{"start_line":17,"start_column":18,"end_line":17,"end_column":38}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":377,"end":407},"region":{"start_line":17,"start_column":9,"end_line":17,"end_column":39}},"label":"taint propagation","evidence_refs":[]}],"truncated":false,"omitted_steps_lower_bound":0,"retained_bytes":1868}],"witnesses_truncated":false,"omitted_witnesses_lower_bound":0,"suppression":null,"scope":null}],"diagnostics":[],"diagnostics_truncated":false,"work":{"scanned_files":4,"scanned_source_bytes":1668,"fact_nodes":72,"pipeline_rows":2,"examined_references":0,"retained_findings":1,"omitted_findings_lower_bound":0,"retained_report_bytes":12835,"metrics":[{"name":"taint.propagation_shared_memberships","unit":"count","value":0},{"name":"taint.propagation_solves","unit":"count","value":1},{"name":"taint.semantic_materialized_files","unit":"count","value":2},{"name":"taint.semantic_program_points","unit":"rows","value":145},{"name":"taint.semantic_source_bytes","unit":"bytes","value":2085},{"name":"taint.semantic_traversal_steps","unit":"count","value":17}]}}],"suppressions":[],"scope":[],"diagnostics":[],"diagnostics_truncated":false,"omitted_diagnostics_lower_bound":0,"worst_omitted_diagnostic_severity":null} \ No newline at end of file diff --git a/reports/raw/bifrost-java-modeling/dfb-taint-java-model-entrypoint-parameter-negative-unsupported.json b/reports/raw/bifrost-java-modeling/dfb-taint-java-model-entrypoint-parameter-negative-unsupported.json new file mode 100644 index 0000000..fe954ba --- /dev/null +++ b/reports/raw/bifrost-java-modeling/dfb-taint-java-model-entrypoint-parameter-negative-unsupported.json @@ -0,0 +1,13 @@ +{ + "adapter": "bifrost", + "case_id": "dfb-taint-java-model-entrypoint-parameter-negative", + "evidence_kind": "retained-capability-decision", + "modeling_category": "E", + "modeling_category_label": "framework entry points", + "partition_source": "docs/modeling-matrix.md#per-tool-capability-partition", + "pinned_tool_identity": "Bifrost v0.10.6", + "reason": "category E — framework entry points — is unsupported for Bifrost v0.10.6 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): to be verified — unsupported until shown: nothing in the repository or the README describes an entry-root declaration for the policy CLI", + "stage": "preregistered-modeling-partition", + "state": "unsupported", + "template_id": "dfb-template-model-entrypoint-parameter" +} diff --git a/reports/raw/bifrost-java-modeling/dfb-taint-java-model-entrypoint-parameter-positive-unsupported.json b/reports/raw/bifrost-java-modeling/dfb-taint-java-model-entrypoint-parameter-positive-unsupported.json new file mode 100644 index 0000000..137f3f9 --- /dev/null +++ b/reports/raw/bifrost-java-modeling/dfb-taint-java-model-entrypoint-parameter-positive-unsupported.json @@ -0,0 +1,13 @@ +{ + "adapter": "bifrost", + "case_id": "dfb-taint-java-model-entrypoint-parameter-positive", + "evidence_kind": "retained-capability-decision", + "modeling_category": "E", + "modeling_category_label": "framework entry points", + "partition_source": "docs/modeling-matrix.md#per-tool-capability-partition", + "pinned_tool_identity": "Bifrost v0.10.6", + "reason": "category E — framework entry points — is unsupported for Bifrost v0.10.6 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): to be verified — unsupported until shown: nothing in the repository or the README describes an entry-root declaration for the policy CLI", + "stage": "preregistered-modeling-partition", + "state": "unsupported", + "template_id": "dfb-template-model-entrypoint-parameter" +} diff --git a/reports/raw/bifrost-java-modeling/dfb-taint-java-model-entrypoint-selectivity-negative-unsupported.json b/reports/raw/bifrost-java-modeling/dfb-taint-java-model-entrypoint-selectivity-negative-unsupported.json new file mode 100644 index 0000000..c7d45de --- /dev/null +++ b/reports/raw/bifrost-java-modeling/dfb-taint-java-model-entrypoint-selectivity-negative-unsupported.json @@ -0,0 +1,13 @@ +{ + "adapter": "bifrost", + "case_id": "dfb-taint-java-model-entrypoint-selectivity-negative", + "evidence_kind": "retained-capability-decision", + "modeling_category": "E", + "modeling_category_label": "framework entry points", + "partition_source": "docs/modeling-matrix.md#per-tool-capability-partition", + "pinned_tool_identity": "Bifrost v0.10.6", + "reason": "category E — framework entry points — is unsupported for Bifrost v0.10.6 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): to be verified — unsupported until shown: nothing in the repository or the README describes an entry-root declaration for the policy CLI", + "stage": "preregistered-modeling-partition", + "state": "unsupported", + "template_id": "dfb-template-model-entrypoint-selectivity" +} diff --git a/reports/raw/bifrost-java-modeling/dfb-taint-java-model-entrypoint-selectivity-positive-unsupported.json b/reports/raw/bifrost-java-modeling/dfb-taint-java-model-entrypoint-selectivity-positive-unsupported.json new file mode 100644 index 0000000..f805565 --- /dev/null +++ b/reports/raw/bifrost-java-modeling/dfb-taint-java-model-entrypoint-selectivity-positive-unsupported.json @@ -0,0 +1,13 @@ +{ + "adapter": "bifrost", + "case_id": "dfb-taint-java-model-entrypoint-selectivity-positive", + "evidence_kind": "retained-capability-decision", + "modeling_category": "E", + "modeling_category_label": "framework entry points", + "partition_source": "docs/modeling-matrix.md#per-tool-capability-partition", + "pinned_tool_identity": "Bifrost v0.10.6", + "reason": "category E — framework entry points — is unsupported for Bifrost v0.10.6 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): to be verified — unsupported until shown: nothing in the repository or the README describes an entry-root declaration for the policy CLI", + "stage": "preregistered-modeling-partition", + "state": "unsupported", + "template_id": "dfb-template-model-entrypoint-selectivity" +} diff --git a/reports/raw/bifrost-java-modeling/dfb-taint-java-model-opaque-propagator-negative-unsupported.json b/reports/raw/bifrost-java-modeling/dfb-taint-java-model-opaque-propagator-negative-unsupported.json new file mode 100644 index 0000000..8eff32d --- /dev/null +++ b/reports/raw/bifrost-java-modeling/dfb-taint-java-model-opaque-propagator-negative-unsupported.json @@ -0,0 +1,13 @@ +{ + "adapter": "bifrost", + "case_id": "dfb-taint-java-model-opaque-propagator-negative", + "evidence_kind": "retained-capability-decision", + "modeling_category": "P", + "modeling_category_label": "declared propagators", + "partition_source": "docs/modeling-matrix.md#per-tool-capability-partition", + "pinned_tool_identity": "Bifrost v0.10.6", + "reason": "category P — declared propagators — is unsupported for Bifrost v0.10.6 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): to be verified — unsupported until shown: no committed policy declares a propagator or transform, and the adapter README makes no propagator claim. Additionally, every committed policy sets `:unmodeled optimistic`, so the modeling policy must also be shown to accept `require-model` before either P cell is load-bearing. Both must be demonstrated on the pinned build", + "stage": "preregistered-modeling-partition", + "state": "unsupported", + "template_id": "dfb-template-model-opaque-propagator" +} diff --git a/reports/raw/bifrost-java-modeling/dfb-taint-java-model-opaque-propagator-positive-unsupported.json b/reports/raw/bifrost-java-modeling/dfb-taint-java-model-opaque-propagator-positive-unsupported.json new file mode 100644 index 0000000..39e1c5e --- /dev/null +++ b/reports/raw/bifrost-java-modeling/dfb-taint-java-model-opaque-propagator-positive-unsupported.json @@ -0,0 +1,13 @@ +{ + "adapter": "bifrost", + "case_id": "dfb-taint-java-model-opaque-propagator-positive", + "evidence_kind": "retained-capability-decision", + "modeling_category": "P", + "modeling_category_label": "declared propagators", + "partition_source": "docs/modeling-matrix.md#per-tool-capability-partition", + "pinned_tool_identity": "Bifrost v0.10.6", + "reason": "category P — declared propagators — is unsupported for Bifrost v0.10.6 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): to be verified — unsupported until shown: no committed policy declares a propagator or transform, and the adapter README makes no propagator claim. Additionally, every committed policy sets `:unmodeled optimistic`, so the modeling policy must also be shown to accept `require-model` before either P cell is load-bearing. Both must be demonstrated on the pinned build", + "stage": "preregistered-modeling-partition", + "state": "unsupported", + "template_id": "dfb-template-model-opaque-propagator" +} diff --git a/reports/raw/bifrost-java-modeling/dfb-taint-java-model-propagator-position-negative-unsupported.json b/reports/raw/bifrost-java-modeling/dfb-taint-java-model-propagator-position-negative-unsupported.json new file mode 100644 index 0000000..bb201b0 --- /dev/null +++ b/reports/raw/bifrost-java-modeling/dfb-taint-java-model-propagator-position-negative-unsupported.json @@ -0,0 +1,13 @@ +{ + "adapter": "bifrost", + "case_id": "dfb-taint-java-model-propagator-position-negative", + "evidence_kind": "retained-capability-decision", + "modeling_category": "P", + "modeling_category_label": "declared propagators", + "partition_source": "docs/modeling-matrix.md#per-tool-capability-partition", + "pinned_tool_identity": "Bifrost v0.10.6", + "reason": "category P — declared propagators — is unsupported for Bifrost v0.10.6 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): to be verified — unsupported until shown: no committed policy declares a propagator or transform, and the adapter README makes no propagator claim. Additionally, every committed policy sets `:unmodeled optimistic`, so the modeling policy must also be shown to accept `require-model` before either P cell is load-bearing. Both must be demonstrated on the pinned build", + "stage": "preregistered-modeling-partition", + "state": "unsupported", + "template_id": "dfb-template-model-propagator-position" +} diff --git a/reports/raw/bifrost-java-modeling/dfb-taint-java-model-propagator-position-positive-unsupported.json b/reports/raw/bifrost-java-modeling/dfb-taint-java-model-propagator-position-positive-unsupported.json new file mode 100644 index 0000000..ec28d89 --- /dev/null +++ b/reports/raw/bifrost-java-modeling/dfb-taint-java-model-propagator-position-positive-unsupported.json @@ -0,0 +1,13 @@ +{ + "adapter": "bifrost", + "case_id": "dfb-taint-java-model-propagator-position-positive", + "evidence_kind": "retained-capability-decision", + "modeling_category": "P", + "modeling_category_label": "declared propagators", + "partition_source": "docs/modeling-matrix.md#per-tool-capability-partition", + "pinned_tool_identity": "Bifrost v0.10.6", + "reason": "category P — declared propagators — is unsupported for Bifrost v0.10.6 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): to be verified — unsupported until shown: no committed policy declares a propagator or transform, and the adapter README makes no propagator claim. Additionally, every committed policy sets `:unmodeled optimistic`, so the modeling policy must also be shown to accept `require-model` before either P cell is load-bearing. Both must be demonstrated on the pinned build", + "stage": "preregistered-modeling-partition", + "state": "unsupported", + "template_id": "dfb-template-model-propagator-position" +} diff --git a/reports/raw/bifrost-java-modeling/dfb-taint-java-model-sanitizer-kill-negative-unsupported.json b/reports/raw/bifrost-java-modeling/dfb-taint-java-model-sanitizer-kill-negative-unsupported.json new file mode 100644 index 0000000..03c5bd0 --- /dev/null +++ b/reports/raw/bifrost-java-modeling/dfb-taint-java-model-sanitizer-kill-negative-unsupported.json @@ -0,0 +1,13 @@ +{ + "adapter": "bifrost", + "case_id": "dfb-taint-java-model-sanitizer-kill-negative", + "evidence_kind": "retained-capability-decision", + "modeling_category": "Z", + "modeling_category_label": "declared sanitizers", + "partition_source": "docs/modeling-matrix.md#per-tool-capability-partition", + "pinned_tool_identity": "Bifrost v0.10.6", + "reason": "category Z — declared sanitizers — is unsupported for Bifrost v0.10.6 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): the adapter README states it directly: \"Sanitizer lowering is a future Bifrost CLI capability.\" (`adapters/bifrost/README.md`). The matrix surfaces this rather than hiding it. DataFlowBench is published by Bifrost's vendor, and a partition that quietly granted its own engine a category its own documentation says is unimplemented would be the single most damaging thing this document could do", + "stage": "preregistered-modeling-partition", + "state": "unsupported", + "template_id": "dfb-template-model-sanitizer-kill" +} diff --git a/reports/raw/bifrost-java-modeling/dfb-taint-java-model-sanitizer-kill-positive-unsupported.json b/reports/raw/bifrost-java-modeling/dfb-taint-java-model-sanitizer-kill-positive-unsupported.json new file mode 100644 index 0000000..fc32b28 --- /dev/null +++ b/reports/raw/bifrost-java-modeling/dfb-taint-java-model-sanitizer-kill-positive-unsupported.json @@ -0,0 +1,13 @@ +{ + "adapter": "bifrost", + "case_id": "dfb-taint-java-model-sanitizer-kill-positive", + "evidence_kind": "retained-capability-decision", + "modeling_category": "Z", + "modeling_category_label": "declared sanitizers", + "partition_source": "docs/modeling-matrix.md#per-tool-capability-partition", + "pinned_tool_identity": "Bifrost v0.10.6", + "reason": "category Z — declared sanitizers — is unsupported for Bifrost v0.10.6 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): the adapter README states it directly: \"Sanitizer lowering is a future Bifrost CLI capability.\" (`adapters/bifrost/README.md`). The matrix surfaces this rather than hiding it. DataFlowBench is published by Bifrost's vendor, and a partition that quietly granted its own engine a category its own documentation says is unimplemented would be the single most damaging thing this document could do", + "stage": "preregistered-modeling-partition", + "state": "unsupported", + "template_id": "dfb-template-model-sanitizer-kill" +} diff --git a/reports/raw/bifrost-java-modeling/dfb-taint-java-model-sanitizer-selectivity-negative-unsupported.json b/reports/raw/bifrost-java-modeling/dfb-taint-java-model-sanitizer-selectivity-negative-unsupported.json new file mode 100644 index 0000000..110547a --- /dev/null +++ b/reports/raw/bifrost-java-modeling/dfb-taint-java-model-sanitizer-selectivity-negative-unsupported.json @@ -0,0 +1,13 @@ +{ + "adapter": "bifrost", + "case_id": "dfb-taint-java-model-sanitizer-selectivity-negative", + "evidence_kind": "retained-capability-decision", + "modeling_category": "Z", + "modeling_category_label": "declared sanitizers", + "partition_source": "docs/modeling-matrix.md#per-tool-capability-partition", + "pinned_tool_identity": "Bifrost v0.10.6", + "reason": "category Z — declared sanitizers — is unsupported for Bifrost v0.10.6 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): the adapter README states it directly: \"Sanitizer lowering is a future Bifrost CLI capability.\" (`adapters/bifrost/README.md`). The matrix surfaces this rather than hiding it. DataFlowBench is published by Bifrost's vendor, and a partition that quietly granted its own engine a category its own documentation says is unimplemented would be the single most damaging thing this document could do", + "stage": "preregistered-modeling-partition", + "state": "unsupported", + "template_id": "dfb-template-model-sanitizer-selectivity" +} diff --git a/reports/raw/bifrost-java-modeling/dfb-taint-java-model-sanitizer-selectivity-positive-unsupported.json b/reports/raw/bifrost-java-modeling/dfb-taint-java-model-sanitizer-selectivity-positive-unsupported.json new file mode 100644 index 0000000..d6919bb --- /dev/null +++ b/reports/raw/bifrost-java-modeling/dfb-taint-java-model-sanitizer-selectivity-positive-unsupported.json @@ -0,0 +1,13 @@ +{ + "adapter": "bifrost", + "case_id": "dfb-taint-java-model-sanitizer-selectivity-positive", + "evidence_kind": "retained-capability-decision", + "modeling_category": "Z", + "modeling_category_label": "declared sanitizers", + "partition_source": "docs/modeling-matrix.md#per-tool-capability-partition", + "pinned_tool_identity": "Bifrost v0.10.6", + "reason": "category Z — declared sanitizers — is unsupported for Bifrost v0.10.6 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): the adapter README states it directly: \"Sanitizer lowering is a future Bifrost CLI capability.\" (`adapters/bifrost/README.md`). The matrix surfaces this rather than hiding it. DataFlowBench is published by Bifrost's vendor, and a partition that quietly granted its own engine a category its own documentation says is unimplemented would be the single most damaging thing this document could do", + "stage": "preregistered-modeling-partition", + "state": "unsupported", + "template_id": "dfb-template-model-sanitizer-selectivity" +} diff --git a/reports/raw/bifrost-java-modeling/dfb-taint-java-model-store-roundtrip-negative-unsupported.json b/reports/raw/bifrost-java-modeling/dfb-taint-java-model-store-roundtrip-negative-unsupported.json new file mode 100644 index 0000000..69d59b3 --- /dev/null +++ b/reports/raw/bifrost-java-modeling/dfb-taint-java-model-store-roundtrip-negative-unsupported.json @@ -0,0 +1,13 @@ +{ + "adapter": "bifrost", + "case_id": "dfb-taint-java-model-store-roundtrip-negative", + "evidence_kind": "retained-capability-decision", + "modeling_category": "B", + "modeling_category_label": "persistence boundaries", + "partition_source": "docs/modeling-matrix.md#per-tool-capability-partition", + "pinned_tool_identity": "Bifrost v0.10.6", + "reason": "category B — persistence boundaries — is unsupported for Bifrost v0.10.6 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): to be verified — unsupported until shown: no persistence-boundary vocabulary is described anywhere for any adapter, Bifrost included", + "stage": "preregistered-modeling-partition", + "state": "unsupported", + "template_id": "dfb-template-model-store-roundtrip" +} diff --git a/reports/raw/bifrost-java-modeling/dfb-taint-java-model-store-roundtrip-positive-unsupported.json b/reports/raw/bifrost-java-modeling/dfb-taint-java-model-store-roundtrip-positive-unsupported.json new file mode 100644 index 0000000..06e687d --- /dev/null +++ b/reports/raw/bifrost-java-modeling/dfb-taint-java-model-store-roundtrip-positive-unsupported.json @@ -0,0 +1,13 @@ +{ + "adapter": "bifrost", + "case_id": "dfb-taint-java-model-store-roundtrip-positive", + "evidence_kind": "retained-capability-decision", + "modeling_category": "B", + "modeling_category_label": "persistence boundaries", + "partition_source": "docs/modeling-matrix.md#per-tool-capability-partition", + "pinned_tool_identity": "Bifrost v0.10.6", + "reason": "category B — persistence boundaries — is unsupported for Bifrost v0.10.6 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): to be verified — unsupported until shown: no persistence-boundary vocabulary is described anywhere for any adapter, Bifrost included", + "stage": "preregistered-modeling-partition", + "state": "unsupported", + "template_id": "dfb-template-model-store-roundtrip" +} diff --git a/reports/raw/bifrost-java-modeling/dfb-taint-java-model-store-separation-negative-unsupported.json b/reports/raw/bifrost-java-modeling/dfb-taint-java-model-store-separation-negative-unsupported.json new file mode 100644 index 0000000..5e1957c --- /dev/null +++ b/reports/raw/bifrost-java-modeling/dfb-taint-java-model-store-separation-negative-unsupported.json @@ -0,0 +1,13 @@ +{ + "adapter": "bifrost", + "case_id": "dfb-taint-java-model-store-separation-negative", + "evidence_kind": "retained-capability-decision", + "modeling_category": "B", + "modeling_category_label": "persistence boundaries", + "partition_source": "docs/modeling-matrix.md#per-tool-capability-partition", + "pinned_tool_identity": "Bifrost v0.10.6", + "reason": "category B — persistence boundaries — is unsupported for Bifrost v0.10.6 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): to be verified — unsupported until shown: no persistence-boundary vocabulary is described anywhere for any adapter, Bifrost included", + "stage": "preregistered-modeling-partition", + "state": "unsupported", + "template_id": "dfb-template-model-store-separation" +} diff --git a/reports/raw/bifrost-java-modeling/dfb-taint-java-model-store-separation-positive-unsupported.json b/reports/raw/bifrost-java-modeling/dfb-taint-java-model-store-separation-positive-unsupported.json new file mode 100644 index 0000000..1393548 --- /dev/null +++ b/reports/raw/bifrost-java-modeling/dfb-taint-java-model-store-separation-positive-unsupported.json @@ -0,0 +1,13 @@ +{ + "adapter": "bifrost", + "case_id": "dfb-taint-java-model-store-separation-positive", + "evidence_kind": "retained-capability-decision", + "modeling_category": "B", + "modeling_category_label": "persistence boundaries", + "partition_source": "docs/modeling-matrix.md#per-tool-capability-partition", + "pinned_tool_identity": "Bifrost v0.10.6", + "reason": "category B — persistence boundaries — is unsupported for Bifrost v0.10.6 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): to be verified — unsupported until shown: no persistence-boundary vocabulary is described anywhere for any adapter, Bifrost included", + "stage": "preregistered-modeling-partition", + "state": "unsupported", + "template_id": "dfb-template-model-store-separation" +} diff --git a/reports/raw/bifrost-java-modeling/dfb-taint-java-model-summary-field-negative-unsupported.json b/reports/raw/bifrost-java-modeling/dfb-taint-java-model-summary-field-negative-unsupported.json new file mode 100644 index 0000000..9c95ac5 --- /dev/null +++ b/reports/raw/bifrost-java-modeling/dfb-taint-java-model-summary-field-negative-unsupported.json @@ -0,0 +1,13 @@ +{ + "adapter": "bifrost", + "case_id": "dfb-taint-java-model-summary-field-negative", + "evidence_kind": "retained-capability-decision", + "modeling_category": "O", + "modeling_category_label": "opaque procedure summaries", + "partition_source": "docs/modeling-matrix.md#per-tool-capability-partition", + "pinned_tool_identity": "Bifrost v0.10.6", + "reason": "category O — opaque procedure summaries — is unsupported for Bifrost v0.10.6 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): the adapter README: \"External semantic-model activation requires an embedding with an explicit catalog, so the modeled-external case is reported as `unsupported` by this CLI adapter with an explicit retained reason. It is not a negative result.\" The existing `dfb-taint-java-modeled-external` calibration case already carries that retained reason in the frozen smoke report", + "stage": "preregistered-modeling-partition", + "state": "unsupported", + "template_id": "dfb-template-model-summary-field" +} diff --git a/reports/raw/bifrost-java-modeling/dfb-taint-java-model-summary-field-positive-unsupported.json b/reports/raw/bifrost-java-modeling/dfb-taint-java-model-summary-field-positive-unsupported.json new file mode 100644 index 0000000..eb89041 --- /dev/null +++ b/reports/raw/bifrost-java-modeling/dfb-taint-java-model-summary-field-positive-unsupported.json @@ -0,0 +1,13 @@ +{ + "adapter": "bifrost", + "case_id": "dfb-taint-java-model-summary-field-positive", + "evidence_kind": "retained-capability-decision", + "modeling_category": "O", + "modeling_category_label": "opaque procedure summaries", + "partition_source": "docs/modeling-matrix.md#per-tool-capability-partition", + "pinned_tool_identity": "Bifrost v0.10.6", + "reason": "category O — opaque procedure summaries — is unsupported for Bifrost v0.10.6 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): the adapter README: \"External semantic-model activation requires an embedding with an explicit catalog, so the modeled-external case is reported as `unsupported` by this CLI adapter with an explicit retained reason. It is not a negative result.\" The existing `dfb-taint-java-modeled-external` calibration case already carries that retained reason in the frozen smoke report", + "stage": "preregistered-modeling-partition", + "state": "unsupported", + "template_id": "dfb-template-model-summary-field" +} diff --git a/reports/raw/bifrost-java-modeling/dfb-taint-java-model-summary-through-negative-unsupported.json b/reports/raw/bifrost-java-modeling/dfb-taint-java-model-summary-through-negative-unsupported.json new file mode 100644 index 0000000..d6684a6 --- /dev/null +++ b/reports/raw/bifrost-java-modeling/dfb-taint-java-model-summary-through-negative-unsupported.json @@ -0,0 +1,13 @@ +{ + "adapter": "bifrost", + "case_id": "dfb-taint-java-model-summary-through-negative", + "evidence_kind": "retained-capability-decision", + "modeling_category": "O", + "modeling_category_label": "opaque procedure summaries", + "partition_source": "docs/modeling-matrix.md#per-tool-capability-partition", + "pinned_tool_identity": "Bifrost v0.10.6", + "reason": "category O — opaque procedure summaries — is unsupported for Bifrost v0.10.6 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): the adapter README: \"External semantic-model activation requires an embedding with an explicit catalog, so the modeled-external case is reported as `unsupported` by this CLI adapter with an explicit retained reason. It is not a negative result.\" The existing `dfb-taint-java-modeled-external` calibration case already carries that retained reason in the frozen smoke report", + "stage": "preregistered-modeling-partition", + "state": "unsupported", + "template_id": "dfb-template-model-summary-through" +} diff --git a/reports/raw/bifrost-java-modeling/dfb-taint-java-model-summary-through-positive-unsupported.json b/reports/raw/bifrost-java-modeling/dfb-taint-java-model-summary-through-positive-unsupported.json new file mode 100644 index 0000000..e5eef89 --- /dev/null +++ b/reports/raw/bifrost-java-modeling/dfb-taint-java-model-summary-through-positive-unsupported.json @@ -0,0 +1,13 @@ +{ + "adapter": "bifrost", + "case_id": "dfb-taint-java-model-summary-through-positive", + "evidence_kind": "retained-capability-decision", + "modeling_category": "O", + "modeling_category_label": "opaque procedure summaries", + "partition_source": "docs/modeling-matrix.md#per-tool-capability-partition", + "pinned_tool_identity": "Bifrost v0.10.6", + "reason": "category O — opaque procedure summaries — is unsupported for Bifrost v0.10.6 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): the adapter README: \"External semantic-model activation requires an embedding with an explicit catalog, so the modeled-external case is reported as `unsupported` by this CLI adapter with an explicit retained reason. It is not a negative result.\" The existing `dfb-taint-java-modeled-external` calibration case already carries that retained reason in the frozen smoke report", + "stage": "preregistered-modeling-partition", + "state": "unsupported", + "template_id": "dfb-template-model-summary-through" +} diff --git a/reports/raw/codeql-java-modeling/dfb-taint-java-model-declared-sink-negative.sarif.json b/reports/raw/codeql-java-modeling/dfb-taint-java-model-declared-sink-negative.sarif.json new file mode 100644 index 0000000..475750f --- /dev/null +++ b/reports/raw/codeql-java-modeling/dfb-taint-java-model-declared-sink-negative.sarif.json @@ -0,0 +1 @@ +{"$schema":"https://json.schemastore.org/sarif-2.1.0.json","version":"2.1.0","runs":[{"tool":{"driver":{"name":"CodeQL","organization":"GitHub","semanticVersion":"2.26.3","notifications":[{"id":"java/baseline/expected-extracted-files","name":"java/baseline/expected-extracted-files","shortDescription":{"text":"Expected extracted files"},"fullDescription":{"text":"Files appearing in the source archive that are expected to be extracted."},"defaultConfiguration":{"enabled":true},"properties":{"tags":["expected-extracted-files","telemetry"]}},{"id":"cli/file-coverage-baseline","name":"cli/file-coverage-baseline","shortDescription":{"text":"File coverage baseline telemetry"},"fullDescription":{"text":"File coverage baseline telemetry"},"defaultConfiguration":{"enabled":true}},{"id":"cli/platform","name":"cli/platform","shortDescription":{"text":"Platform"},"fullDescription":{"text":"Platform"},"defaultConfiguration":{"enabled":true}},{"id":"cli/sip-enablement","name":"cli/sip-enablement","shortDescription":{"text":"macOS SIP enablement status"},"fullDescription":{"text":"macOS SIP enablement status"},"defaultConfiguration":{"enabled":true}},{"id":"java/extractor/summary","name":"java/extractor/summary","shortDescription":{"text":"Java extractor telemetry"},"fullDescription":{"text":"Java extractor telemetry"},"defaultConfiguration":{"enabled":true}}],"rules":[{"id":"dataflowbench/java-taint-modeling","name":"dataflowbench/java-taint-modeling","shortDescription":{"text":"DataFlowBench Java taint-modeling matrix"},"fullDescription":{"text":"Encodes the twelve benchmark-supplied model declarations of docs/modeling-matrix.md natively in CodeQL's data-flow configuration surface, for the Java modeling population."},"defaultConfiguration":{"enabled":true,"level":"warning"},"properties":{"tags":["security"],"description":"Encodes the twelve benchmark-supplied model declarations of\n docs/modeling-matrix.md natively in CodeQL's data-flow\n configuration surface, for the Java modeling population.","id":"dataflowbench/java-taint-modeling","kind":"path-problem","name":"DataFlowBench Java taint-modeling matrix","precision":"high","problem.severity":"warning"}}]},"extensions":[{"name":"dataflowbench/codeql-java","semanticVersion":"0.0.1","locations":[{"uri":"file:///Users/dave/Workspace/BrokkAi/dataflowbench/.claude/worktrees/agent-af332237afc5e1bcf/adapters/codeql/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/Workspace/BrokkAi/dataflowbench/.claude/worktrees/agent-af332237afc5e1bcf/adapters/codeql/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]},{"name":"codeql/java-all","semanticVersion":"9.2.3+44a68d3a47fcbcd6a6a76ec7d1c1b3a1a28b201e","locations":[{"uri":"file:///Users/dave/.codeql/packages/codeql/java-all/9.2.3/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/.codeql/packages/codeql/java-all/9.2.3/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]},{"name":"codeql/threat-models","semanticVersion":"1.0.55+44a68d3a47fcbcd6a6a76ec7d1c1b3a1a28b201e","locations":[{"uri":"file:///Users/dave/.codeql/packages/codeql/threat-models/1.0.55/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/.codeql/packages/codeql/threat-models/1.0.55/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]}]},"invocations":[{"toolExecutionNotifications":[{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"ModelDeclaredSinkNegative.java","uriBaseId":"%SRCROOT%","index":0}}}],"message":{"text":""},"level":"none","descriptor":{"id":"java/baseline/expected-extracted-files","index":0},"properties":{"formattedMessage":{"text":""}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:32:04.638761Z","descriptor":{"id":"cli/file-coverage-baseline","index":1},"properties":{"attributes":{"durationMilliseconds":51},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:32:04.639820Z","descriptor":{"id":"cli/platform","index":2},"properties":{"attributes":{"arch":"aarch64","name":"Mac OS X","version":"26.6.2"},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:32:04.648208Z","descriptor":{"id":"cli/sip-enablement","index":3},"properties":{"attributes":{"isEnabled":true},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":"Internal telemetry for the Java extractor.\n\nNo action needed.","markdown":"Internal telemetry for the Java extractor.\n\nNo action needed."},"level":"note","timeUtc":"2026-08-26T13:32:06.598164Z","descriptor":{"id":"java/extractor/summary","index":4},"properties":{"attributes":{"java_vendor":"Eclipse Adoptium","java_version":"21.0.8"},"visibility":{"statusPage":false,"telemetry":true}}}],"executionSuccessful":true}],"artifacts":[{"location":{"uri":"ModelDeclaredSinkNegative.java","uriBaseId":"%SRCROOT%","index":0}}],"results":[],"columnKind":"utf16CodeUnits","properties":{"semmle.formatSpecifier":"sarif-latest"}}]} \ No newline at end of file diff --git a/reports/raw/codeql-java-modeling/dfb-taint-java-model-declared-sink-positive.sarif.json b/reports/raw/codeql-java-modeling/dfb-taint-java-model-declared-sink-positive.sarif.json new file mode 100644 index 0000000..f206a17 --- /dev/null +++ b/reports/raw/codeql-java-modeling/dfb-taint-java-model-declared-sink-positive.sarif.json @@ -0,0 +1 @@ +{"$schema":"https://json.schemastore.org/sarif-2.1.0.json","version":"2.1.0","runs":[{"tool":{"driver":{"name":"CodeQL","organization":"GitHub","semanticVersion":"2.26.3","notifications":[{"id":"java/baseline/expected-extracted-files","name":"java/baseline/expected-extracted-files","shortDescription":{"text":"Expected extracted files"},"fullDescription":{"text":"Files appearing in the source archive that are expected to be extracted."},"defaultConfiguration":{"enabled":true},"properties":{"tags":["expected-extracted-files","telemetry"]}},{"id":"cli/file-coverage-baseline","name":"cli/file-coverage-baseline","shortDescription":{"text":"File coverage baseline telemetry"},"fullDescription":{"text":"File coverage baseline telemetry"},"defaultConfiguration":{"enabled":true}},{"id":"cli/platform","name":"cli/platform","shortDescription":{"text":"Platform"},"fullDescription":{"text":"Platform"},"defaultConfiguration":{"enabled":true}},{"id":"cli/sip-enablement","name":"cli/sip-enablement","shortDescription":{"text":"macOS SIP enablement status"},"fullDescription":{"text":"macOS SIP enablement status"},"defaultConfiguration":{"enabled":true}},{"id":"java/extractor/summary","name":"java/extractor/summary","shortDescription":{"text":"Java extractor telemetry"},"fullDescription":{"text":"Java extractor telemetry"},"defaultConfiguration":{"enabled":true}}],"rules":[{"id":"dataflowbench/java-taint-modeling","name":"dataflowbench/java-taint-modeling","shortDescription":{"text":"DataFlowBench Java taint-modeling matrix"},"fullDescription":{"text":"Encodes the twelve benchmark-supplied model declarations of docs/modeling-matrix.md natively in CodeQL's data-flow configuration surface, for the Java modeling population."},"defaultConfiguration":{"enabled":true,"level":"warning"},"properties":{"tags":["security"],"description":"Encodes the twelve benchmark-supplied model declarations of\n docs/modeling-matrix.md natively in CodeQL's data-flow\n configuration surface, for the Java modeling population.","id":"dataflowbench/java-taint-modeling","kind":"path-problem","name":"DataFlowBench Java taint-modeling matrix","precision":"high","problem.severity":"warning"}}]},"extensions":[{"name":"dataflowbench/codeql-java","semanticVersion":"0.0.1","locations":[{"uri":"file:///Users/dave/Workspace/BrokkAi/dataflowbench/.claude/worktrees/agent-af332237afc5e1bcf/adapters/codeql/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/Workspace/BrokkAi/dataflowbench/.claude/worktrees/agent-af332237afc5e1bcf/adapters/codeql/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]},{"name":"codeql/java-all","semanticVersion":"9.2.3+44a68d3a47fcbcd6a6a76ec7d1c1b3a1a28b201e","locations":[{"uri":"file:///Users/dave/.codeql/packages/codeql/java-all/9.2.3/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/.codeql/packages/codeql/java-all/9.2.3/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]},{"name":"codeql/threat-models","semanticVersion":"1.0.55+44a68d3a47fcbcd6a6a76ec7d1c1b3a1a28b201e","locations":[{"uri":"file:///Users/dave/.codeql/packages/codeql/threat-models/1.0.55/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/.codeql/packages/codeql/threat-models/1.0.55/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]}]},"invocations":[{"toolExecutionNotifications":[{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"ModelDeclaredSinkPositive.java","uriBaseId":"%SRCROOT%","index":0}}}],"message":{"text":""},"level":"none","descriptor":{"id":"java/baseline/expected-extracted-files","index":0},"properties":{"formattedMessage":{"text":""}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:32:15.415747Z","descriptor":{"id":"cli/file-coverage-baseline","index":1},"properties":{"attributes":{"durationMilliseconds":19},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:32:15.416617Z","descriptor":{"id":"cli/platform","index":2},"properties":{"attributes":{"arch":"aarch64","name":"Mac OS X","version":"26.6.2"},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:32:15.424117Z","descriptor":{"id":"cli/sip-enablement","index":3},"properties":{"attributes":{"isEnabled":true},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":"Internal telemetry for the Java extractor.\n\nNo action needed.","markdown":"Internal telemetry for the Java extractor.\n\nNo action needed."},"level":"note","timeUtc":"2026-08-26T13:32:16.735713Z","descriptor":{"id":"java/extractor/summary","index":4},"properties":{"attributes":{"java_vendor":"Eclipse Adoptium","java_version":"21.0.8"},"visibility":{"statusPage":false,"telemetry":true}}}],"executionSuccessful":true}],"artifacts":[{"location":{"uri":"ModelDeclaredSinkPositive.java","uriBaseId":"%SRCROOT%","index":0}}],"results":[{"ruleId":"dataflowbench/java-taint-modeling","ruleIndex":0,"rule":{"id":"dataflowbench/java-taint-modeling","index":0},"message":{"text":"A benchmark-declared model carried input to the declared sink."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"ModelDeclaredSinkPositive.java","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":15,"startColumn":22,"endColumn":34}}}],"partialFingerprints":{"primaryLocationLineHash":"3b2d0ea28daf758c:1","primaryLocationStartColumnFingerprint":"13"}}],"columnKind":"utf16CodeUnits","properties":{"semmle.formatSpecifier":"sarif-latest"}}]} \ No newline at end of file diff --git a/reports/raw/codeql-java-modeling/dfb-taint-java-model-declared-source-negative.sarif.json b/reports/raw/codeql-java-modeling/dfb-taint-java-model-declared-source-negative.sarif.json new file mode 100644 index 0000000..e4aa3c2 --- /dev/null +++ b/reports/raw/codeql-java-modeling/dfb-taint-java-model-declared-source-negative.sarif.json @@ -0,0 +1 @@ +{"$schema":"https://json.schemastore.org/sarif-2.1.0.json","version":"2.1.0","runs":[{"tool":{"driver":{"name":"CodeQL","organization":"GitHub","semanticVersion":"2.26.3","notifications":[{"id":"java/baseline/expected-extracted-files","name":"java/baseline/expected-extracted-files","shortDescription":{"text":"Expected extracted files"},"fullDescription":{"text":"Files appearing in the source archive that are expected to be extracted."},"defaultConfiguration":{"enabled":true},"properties":{"tags":["expected-extracted-files","telemetry"]}},{"id":"cli/file-coverage-baseline","name":"cli/file-coverage-baseline","shortDescription":{"text":"File coverage baseline telemetry"},"fullDescription":{"text":"File coverage baseline telemetry"},"defaultConfiguration":{"enabled":true}},{"id":"cli/platform","name":"cli/platform","shortDescription":{"text":"Platform"},"fullDescription":{"text":"Platform"},"defaultConfiguration":{"enabled":true}},{"id":"cli/sip-enablement","name":"cli/sip-enablement","shortDescription":{"text":"macOS SIP enablement status"},"fullDescription":{"text":"macOS SIP enablement status"},"defaultConfiguration":{"enabled":true}},{"id":"java/extractor/summary","name":"java/extractor/summary","shortDescription":{"text":"Java extractor telemetry"},"fullDescription":{"text":"Java extractor telemetry"},"defaultConfiguration":{"enabled":true}}],"rules":[{"id":"dataflowbench/java-taint-modeling","name":"dataflowbench/java-taint-modeling","shortDescription":{"text":"DataFlowBench Java taint-modeling matrix"},"fullDescription":{"text":"Encodes the twelve benchmark-supplied model declarations of docs/modeling-matrix.md natively in CodeQL's data-flow configuration surface, for the Java modeling population."},"defaultConfiguration":{"enabled":true,"level":"warning"},"properties":{"tags":["security"],"description":"Encodes the twelve benchmark-supplied model declarations of\n docs/modeling-matrix.md natively in CodeQL's data-flow\n configuration surface, for the Java modeling population.","id":"dataflowbench/java-taint-modeling","kind":"path-problem","name":"DataFlowBench Java taint-modeling matrix","precision":"high","problem.severity":"warning"}}]},"extensions":[{"name":"dataflowbench/codeql-java","semanticVersion":"0.0.1","locations":[{"uri":"file:///Users/dave/Workspace/BrokkAi/dataflowbench/.claude/worktrees/agent-af332237afc5e1bcf/adapters/codeql/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/Workspace/BrokkAi/dataflowbench/.claude/worktrees/agent-af332237afc5e1bcf/adapters/codeql/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]},{"name":"codeql/java-all","semanticVersion":"9.2.3+44a68d3a47fcbcd6a6a76ec7d1c1b3a1a28b201e","locations":[{"uri":"file:///Users/dave/.codeql/packages/codeql/java-all/9.2.3/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/.codeql/packages/codeql/java-all/9.2.3/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]},{"name":"codeql/threat-models","semanticVersion":"1.0.55+44a68d3a47fcbcd6a6a76ec7d1c1b3a1a28b201e","locations":[{"uri":"file:///Users/dave/.codeql/packages/codeql/threat-models/1.0.55/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/.codeql/packages/codeql/threat-models/1.0.55/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]}]},"invocations":[{"toolExecutionNotifications":[{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"ModelDeclaredSourceNegative.java","uriBaseId":"%SRCROOT%","index":0}}}],"message":{"text":""},"level":"none","descriptor":{"id":"java/baseline/expected-extracted-files","index":0},"properties":{"formattedMessage":{"text":""}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:32:25.401910Z","descriptor":{"id":"cli/file-coverage-baseline","index":1},"properties":{"attributes":{"durationMilliseconds":19},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:32:25.402718Z","descriptor":{"id":"cli/platform","index":2},"properties":{"attributes":{"arch":"aarch64","name":"Mac OS X","version":"26.6.2"},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:32:25.409890Z","descriptor":{"id":"cli/sip-enablement","index":3},"properties":{"attributes":{"isEnabled":true},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":"Internal telemetry for the Java extractor.\n\nNo action needed.","markdown":"Internal telemetry for the Java extractor.\n\nNo action needed."},"level":"note","timeUtc":"2026-08-26T13:32:26.723458Z","descriptor":{"id":"java/extractor/summary","index":4},"properties":{"attributes":{"java_vendor":"Eclipse Adoptium","java_version":"21.0.8"},"visibility":{"statusPage":false,"telemetry":true}}}],"executionSuccessful":true}],"artifacts":[{"location":{"uri":"ModelDeclaredSourceNegative.java","uriBaseId":"%SRCROOT%","index":0}}],"results":[],"columnKind":"utf16CodeUnits","properties":{"semmle.formatSpecifier":"sarif-latest"}}]} \ No newline at end of file diff --git a/reports/raw/codeql-java-modeling/dfb-taint-java-model-declared-source-positive.sarif.json b/reports/raw/codeql-java-modeling/dfb-taint-java-model-declared-source-positive.sarif.json new file mode 100644 index 0000000..2429f20 --- /dev/null +++ b/reports/raw/codeql-java-modeling/dfb-taint-java-model-declared-source-positive.sarif.json @@ -0,0 +1 @@ +{"$schema":"https://json.schemastore.org/sarif-2.1.0.json","version":"2.1.0","runs":[{"tool":{"driver":{"name":"CodeQL","organization":"GitHub","semanticVersion":"2.26.3","notifications":[{"id":"java/baseline/expected-extracted-files","name":"java/baseline/expected-extracted-files","shortDescription":{"text":"Expected extracted files"},"fullDescription":{"text":"Files appearing in the source archive that are expected to be extracted."},"defaultConfiguration":{"enabled":true},"properties":{"tags":["expected-extracted-files","telemetry"]}},{"id":"cli/file-coverage-baseline","name":"cli/file-coverage-baseline","shortDescription":{"text":"File coverage baseline telemetry"},"fullDescription":{"text":"File coverage baseline telemetry"},"defaultConfiguration":{"enabled":true}},{"id":"cli/platform","name":"cli/platform","shortDescription":{"text":"Platform"},"fullDescription":{"text":"Platform"},"defaultConfiguration":{"enabled":true}},{"id":"cli/sip-enablement","name":"cli/sip-enablement","shortDescription":{"text":"macOS SIP enablement status"},"fullDescription":{"text":"macOS SIP enablement status"},"defaultConfiguration":{"enabled":true}},{"id":"java/extractor/summary","name":"java/extractor/summary","shortDescription":{"text":"Java extractor telemetry"},"fullDescription":{"text":"Java extractor telemetry"},"defaultConfiguration":{"enabled":true}}],"rules":[{"id":"dataflowbench/java-taint-modeling","name":"dataflowbench/java-taint-modeling","shortDescription":{"text":"DataFlowBench Java taint-modeling matrix"},"fullDescription":{"text":"Encodes the twelve benchmark-supplied model declarations of docs/modeling-matrix.md natively in CodeQL's data-flow configuration surface, for the Java modeling population."},"defaultConfiguration":{"enabled":true,"level":"warning"},"properties":{"tags":["security"],"description":"Encodes the twelve benchmark-supplied model declarations of\n docs/modeling-matrix.md natively in CodeQL's data-flow\n configuration surface, for the Java modeling population.","id":"dataflowbench/java-taint-modeling","kind":"path-problem","name":"DataFlowBench Java taint-modeling matrix","precision":"high","problem.severity":"warning"}}]},"extensions":[{"name":"dataflowbench/codeql-java","semanticVersion":"0.0.1","locations":[{"uri":"file:///Users/dave/Workspace/BrokkAi/dataflowbench/.claude/worktrees/agent-af332237afc5e1bcf/adapters/codeql/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/Workspace/BrokkAi/dataflowbench/.claude/worktrees/agent-af332237afc5e1bcf/adapters/codeql/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]},{"name":"codeql/java-all","semanticVersion":"9.2.3+44a68d3a47fcbcd6a6a76ec7d1c1b3a1a28b201e","locations":[{"uri":"file:///Users/dave/.codeql/packages/codeql/java-all/9.2.3/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/.codeql/packages/codeql/java-all/9.2.3/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]},{"name":"codeql/threat-models","semanticVersion":"1.0.55+44a68d3a47fcbcd6a6a76ec7d1c1b3a1a28b201e","locations":[{"uri":"file:///Users/dave/.codeql/packages/codeql/threat-models/1.0.55/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/.codeql/packages/codeql/threat-models/1.0.55/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]}]},"invocations":[{"toolExecutionNotifications":[{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"ModelDeclaredSourcePositive.java","uriBaseId":"%SRCROOT%","index":0}}}],"message":{"text":""},"level":"none","descriptor":{"id":"java/baseline/expected-extracted-files","index":0},"properties":{"formattedMessage":{"text":""}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:32:35.327691Z","descriptor":{"id":"cli/file-coverage-baseline","index":1},"properties":{"attributes":{"durationMilliseconds":18},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:32:35.328522Z","descriptor":{"id":"cli/platform","index":2},"properties":{"attributes":{"arch":"aarch64","name":"Mac OS X","version":"26.6.2"},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:32:35.335546Z","descriptor":{"id":"cli/sip-enablement","index":3},"properties":{"attributes":{"isEnabled":true},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":"Internal telemetry for the Java extractor.\n\nNo action needed.","markdown":"Internal telemetry for the Java extractor.\n\nNo action needed."},"level":"note","timeUtc":"2026-08-26T13:32:36.654747Z","descriptor":{"id":"java/extractor/summary","index":4},"properties":{"attributes":{"java_vendor":"Eclipse Adoptium","java_version":"21.0.8"},"visibility":{"statusPage":false,"telemetry":true}}}],"executionSuccessful":true}],"artifacts":[{"location":{"uri":"ModelDeclaredSourcePositive.java","uriBaseId":"%SRCROOT%","index":0}}],"results":[{"ruleId":"dataflowbench/java-taint-modeling","ruleIndex":0,"rule":{"id":"dataflowbench/java-taint-modeling","index":0},"message":{"text":"A benchmark-declared model carried input to the declared sink."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"ModelDeclaredSourcePositive.java","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":17,"startColumn":18,"endColumn":38}}}],"partialFingerprints":{"primaryLocationLineHash":"84f543f78695fa0a:1","primaryLocationStartColumnFingerprint":"9"}}],"columnKind":"utf16CodeUnits","properties":{"semmle.formatSpecifier":"sarif-latest"}}]} \ No newline at end of file diff --git a/reports/raw/codeql-java-modeling/dfb-taint-java-model-entrypoint-parameter-negative.sarif.json b/reports/raw/codeql-java-modeling/dfb-taint-java-model-entrypoint-parameter-negative.sarif.json new file mode 100644 index 0000000..b723907 --- /dev/null +++ b/reports/raw/codeql-java-modeling/dfb-taint-java-model-entrypoint-parameter-negative.sarif.json @@ -0,0 +1 @@ +{"$schema":"https://json.schemastore.org/sarif-2.1.0.json","version":"2.1.0","runs":[{"tool":{"driver":{"name":"CodeQL","organization":"GitHub","semanticVersion":"2.26.3","notifications":[{"id":"java/baseline/expected-extracted-files","name":"java/baseline/expected-extracted-files","shortDescription":{"text":"Expected extracted files"},"fullDescription":{"text":"Files appearing in the source archive that are expected to be extracted."},"defaultConfiguration":{"enabled":true},"properties":{"tags":["expected-extracted-files","telemetry"]}},{"id":"cli/file-coverage-baseline","name":"cli/file-coverage-baseline","shortDescription":{"text":"File coverage baseline telemetry"},"fullDescription":{"text":"File coverage baseline telemetry"},"defaultConfiguration":{"enabled":true}},{"id":"cli/platform","name":"cli/platform","shortDescription":{"text":"Platform"},"fullDescription":{"text":"Platform"},"defaultConfiguration":{"enabled":true}},{"id":"cli/sip-enablement","name":"cli/sip-enablement","shortDescription":{"text":"macOS SIP enablement status"},"fullDescription":{"text":"macOS SIP enablement status"},"defaultConfiguration":{"enabled":true}},{"id":"java/extractor/summary","name":"java/extractor/summary","shortDescription":{"text":"Java extractor telemetry"},"fullDescription":{"text":"Java extractor telemetry"},"defaultConfiguration":{"enabled":true}}],"rules":[{"id":"dataflowbench/java-taint-modeling","name":"dataflowbench/java-taint-modeling","shortDescription":{"text":"DataFlowBench Java taint-modeling matrix"},"fullDescription":{"text":"Encodes the twelve benchmark-supplied model declarations of docs/modeling-matrix.md natively in CodeQL's data-flow configuration surface, for the Java modeling population."},"defaultConfiguration":{"enabled":true,"level":"warning"},"properties":{"tags":["security"],"description":"Encodes the twelve benchmark-supplied model declarations of\n docs/modeling-matrix.md natively in CodeQL's data-flow\n configuration surface, for the Java modeling population.","id":"dataflowbench/java-taint-modeling","kind":"path-problem","name":"DataFlowBench Java taint-modeling matrix","precision":"high","problem.severity":"warning"}}]},"extensions":[{"name":"dataflowbench/codeql-java","semanticVersion":"0.0.1","locations":[{"uri":"file:///Users/dave/Workspace/BrokkAi/dataflowbench/.claude/worktrees/agent-af332237afc5e1bcf/adapters/codeql/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/Workspace/BrokkAi/dataflowbench/.claude/worktrees/agent-af332237afc5e1bcf/adapters/codeql/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]},{"name":"codeql/java-all","semanticVersion":"9.2.3+44a68d3a47fcbcd6a6a76ec7d1c1b3a1a28b201e","locations":[{"uri":"file:///Users/dave/.codeql/packages/codeql/java-all/9.2.3/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/.codeql/packages/codeql/java-all/9.2.3/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]},{"name":"codeql/threat-models","semanticVersion":"1.0.55+44a68d3a47fcbcd6a6a76ec7d1c1b3a1a28b201e","locations":[{"uri":"file:///Users/dave/.codeql/packages/codeql/threat-models/1.0.55/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/.codeql/packages/codeql/threat-models/1.0.55/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]}]},"invocations":[{"toolExecutionNotifications":[{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"Handler.java","uriBaseId":"%SRCROOT%","index":0}}}],"message":{"text":""},"level":"none","descriptor":{"id":"java/baseline/expected-extracted-files","index":0},"properties":{"formattedMessage":{"text":""}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:32:45.316762Z","descriptor":{"id":"cli/file-coverage-baseline","index":1},"properties":{"attributes":{"durationMilliseconds":20},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:32:45.317705Z","descriptor":{"id":"cli/platform","index":2},"properties":{"attributes":{"arch":"aarch64","name":"Mac OS X","version":"26.6.2"},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:32:45.325621Z","descriptor":{"id":"cli/sip-enablement","index":3},"properties":{"attributes":{"isEnabled":true},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":"Internal telemetry for the Java extractor.\n\nNo action needed.","markdown":"Internal telemetry for the Java extractor.\n\nNo action needed."},"level":"note","timeUtc":"2026-08-26T13:32:46.647516Z","descriptor":{"id":"java/extractor/summary","index":4},"properties":{"attributes":{"java_vendor":"Eclipse Adoptium","java_version":"21.0.8"},"visibility":{"statusPage":false,"telemetry":true}}}],"executionSuccessful":true}],"artifacts":[{"location":{"uri":"Handler.java","uriBaseId":"%SRCROOT%","index":0}}],"results":[],"columnKind":"utf16CodeUnits","properties":{"semmle.formatSpecifier":"sarif-latest"}}]} \ No newline at end of file diff --git a/reports/raw/codeql-java-modeling/dfb-taint-java-model-entrypoint-parameter-positive.sarif.json b/reports/raw/codeql-java-modeling/dfb-taint-java-model-entrypoint-parameter-positive.sarif.json new file mode 100644 index 0000000..46b33af --- /dev/null +++ b/reports/raw/codeql-java-modeling/dfb-taint-java-model-entrypoint-parameter-positive.sarif.json @@ -0,0 +1 @@ +{"$schema":"https://json.schemastore.org/sarif-2.1.0.json","version":"2.1.0","runs":[{"tool":{"driver":{"name":"CodeQL","organization":"GitHub","semanticVersion":"2.26.3","notifications":[{"id":"java/baseline/expected-extracted-files","name":"java/baseline/expected-extracted-files","shortDescription":{"text":"Expected extracted files"},"fullDescription":{"text":"Files appearing in the source archive that are expected to be extracted."},"defaultConfiguration":{"enabled":true},"properties":{"tags":["expected-extracted-files","telemetry"]}},{"id":"cli/file-coverage-baseline","name":"cli/file-coverage-baseline","shortDescription":{"text":"File coverage baseline telemetry"},"fullDescription":{"text":"File coverage baseline telemetry"},"defaultConfiguration":{"enabled":true}},{"id":"cli/platform","name":"cli/platform","shortDescription":{"text":"Platform"},"fullDescription":{"text":"Platform"},"defaultConfiguration":{"enabled":true}},{"id":"cli/sip-enablement","name":"cli/sip-enablement","shortDescription":{"text":"macOS SIP enablement status"},"fullDescription":{"text":"macOS SIP enablement status"},"defaultConfiguration":{"enabled":true}},{"id":"java/extractor/summary","name":"java/extractor/summary","shortDescription":{"text":"Java extractor telemetry"},"fullDescription":{"text":"Java extractor telemetry"},"defaultConfiguration":{"enabled":true}}],"rules":[{"id":"dataflowbench/java-taint-modeling","name":"dataflowbench/java-taint-modeling","shortDescription":{"text":"DataFlowBench Java taint-modeling matrix"},"fullDescription":{"text":"Encodes the twelve benchmark-supplied model declarations of docs/modeling-matrix.md natively in CodeQL's data-flow configuration surface, for the Java modeling population."},"defaultConfiguration":{"enabled":true,"level":"warning"},"properties":{"tags":["security"],"description":"Encodes the twelve benchmark-supplied model declarations of\n docs/modeling-matrix.md natively in CodeQL's data-flow\n configuration surface, for the Java modeling population.","id":"dataflowbench/java-taint-modeling","kind":"path-problem","name":"DataFlowBench Java taint-modeling matrix","precision":"high","problem.severity":"warning"}}]},"extensions":[{"name":"dataflowbench/codeql-java","semanticVersion":"0.0.1","locations":[{"uri":"file:///Users/dave/Workspace/BrokkAi/dataflowbench/.claude/worktrees/agent-af332237afc5e1bcf/adapters/codeql/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/Workspace/BrokkAi/dataflowbench/.claude/worktrees/agent-af332237afc5e1bcf/adapters/codeql/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]},{"name":"codeql/java-all","semanticVersion":"9.2.3+44a68d3a47fcbcd6a6a76ec7d1c1b3a1a28b201e","locations":[{"uri":"file:///Users/dave/.codeql/packages/codeql/java-all/9.2.3/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/.codeql/packages/codeql/java-all/9.2.3/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]},{"name":"codeql/threat-models","semanticVersion":"1.0.55+44a68d3a47fcbcd6a6a76ec7d1c1b3a1a28b201e","locations":[{"uri":"file:///Users/dave/.codeql/packages/codeql/threat-models/1.0.55/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/.codeql/packages/codeql/threat-models/1.0.55/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]}]},"invocations":[{"toolExecutionNotifications":[{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"Handler.java","uriBaseId":"%SRCROOT%","index":0}}}],"message":{"text":""},"level":"none","descriptor":{"id":"java/baseline/expected-extracted-files","index":0},"properties":{"formattedMessage":{"text":""}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:32:55.313687Z","descriptor":{"id":"cli/file-coverage-baseline","index":1},"properties":{"attributes":{"durationMilliseconds":18},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:32:55.314508Z","descriptor":{"id":"cli/platform","index":2},"properties":{"attributes":{"arch":"aarch64","name":"Mac OS X","version":"26.6.2"},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:32:55.321675Z","descriptor":{"id":"cli/sip-enablement","index":3},"properties":{"attributes":{"isEnabled":true},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":"Internal telemetry for the Java extractor.\n\nNo action needed.","markdown":"Internal telemetry for the Java extractor.\n\nNo action needed."},"level":"note","timeUtc":"2026-08-26T13:32:56.631487Z","descriptor":{"id":"java/extractor/summary","index":4},"properties":{"attributes":{"java_vendor":"Eclipse Adoptium","java_version":"21.0.8"},"visibility":{"statusPage":false,"telemetry":true}}}],"executionSuccessful":true}],"artifacts":[{"location":{"uri":"Handler.java","uriBaseId":"%SRCROOT%","index":0}}],"results":[{"ruleId":"dataflowbench/java-taint-modeling","ruleIndex":0,"rule":{"id":"dataflowbench/java-taint-modeling","index":0},"message":{"text":"A benchmark-declared model carried input to the declared sink."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"Handler.java","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":7,"startColumn":18,"endColumn":23}}}],"partialFingerprints":{"primaryLocationLineHash":"c56afe4e78799359:1","primaryLocationStartColumnFingerprint":"9"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"Handler.java","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":6,"startColumn":20,"endColumn":32}},"message":{"text":"input : String"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"Handler.java","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":7,"startColumn":18,"endColumn":23}},"message":{"text":"input"}}}]}]}],"relatedLocations":[{"physicalLocation":{"artifactLocation":{"uri":"Handler.java","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":6,"startColumn":20,"endColumn":32}}}]}],"columnKind":"utf16CodeUnits","properties":{"semmle.formatSpecifier":"sarif-latest"}}]} \ No newline at end of file diff --git a/reports/raw/codeql-java-modeling/dfb-taint-java-model-entrypoint-selectivity-negative.sarif.json b/reports/raw/codeql-java-modeling/dfb-taint-java-model-entrypoint-selectivity-negative.sarif.json new file mode 100644 index 0000000..69e43dd --- /dev/null +++ b/reports/raw/codeql-java-modeling/dfb-taint-java-model-entrypoint-selectivity-negative.sarif.json @@ -0,0 +1 @@ +{"$schema":"https://json.schemastore.org/sarif-2.1.0.json","version":"2.1.0","runs":[{"tool":{"driver":{"name":"CodeQL","organization":"GitHub","semanticVersion":"2.26.3","notifications":[{"id":"java/baseline/expected-extracted-files","name":"java/baseline/expected-extracted-files","shortDescription":{"text":"Expected extracted files"},"fullDescription":{"text":"Files appearing in the source archive that are expected to be extracted."},"defaultConfiguration":{"enabled":true},"properties":{"tags":["expected-extracted-files","telemetry"]}},{"id":"cli/file-coverage-baseline","name":"cli/file-coverage-baseline","shortDescription":{"text":"File coverage baseline telemetry"},"fullDescription":{"text":"File coverage baseline telemetry"},"defaultConfiguration":{"enabled":true}},{"id":"cli/platform","name":"cli/platform","shortDescription":{"text":"Platform"},"fullDescription":{"text":"Platform"},"defaultConfiguration":{"enabled":true}},{"id":"cli/sip-enablement","name":"cli/sip-enablement","shortDescription":{"text":"macOS SIP enablement status"},"fullDescription":{"text":"macOS SIP enablement status"},"defaultConfiguration":{"enabled":true}},{"id":"java/extractor/summary","name":"java/extractor/summary","shortDescription":{"text":"Java extractor telemetry"},"fullDescription":{"text":"Java extractor telemetry"},"defaultConfiguration":{"enabled":true}}],"rules":[{"id":"dataflowbench/java-taint-modeling","name":"dataflowbench/java-taint-modeling","shortDescription":{"text":"DataFlowBench Java taint-modeling matrix"},"fullDescription":{"text":"Encodes the twelve benchmark-supplied model declarations of docs/modeling-matrix.md natively in CodeQL's data-flow configuration surface, for the Java modeling population."},"defaultConfiguration":{"enabled":true,"level":"warning"},"properties":{"tags":["security"],"description":"Encodes the twelve benchmark-supplied model declarations of\n docs/modeling-matrix.md natively in CodeQL's data-flow\n configuration surface, for the Java modeling population.","id":"dataflowbench/java-taint-modeling","kind":"path-problem","name":"DataFlowBench Java taint-modeling matrix","precision":"high","problem.severity":"warning"}}]},"extensions":[{"name":"dataflowbench/codeql-java","semanticVersion":"0.0.1","locations":[{"uri":"file:///Users/dave/Workspace/BrokkAi/dataflowbench/.claude/worktrees/agent-af332237afc5e1bcf/adapters/codeql/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/Workspace/BrokkAi/dataflowbench/.claude/worktrees/agent-af332237afc5e1bcf/adapters/codeql/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]},{"name":"codeql/java-all","semanticVersion":"9.2.3+44a68d3a47fcbcd6a6a76ec7d1c1b3a1a28b201e","locations":[{"uri":"file:///Users/dave/.codeql/packages/codeql/java-all/9.2.3/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/.codeql/packages/codeql/java-all/9.2.3/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]},{"name":"codeql/threat-models","semanticVersion":"1.0.55+44a68d3a47fcbcd6a6a76ec7d1c1b3a1a28b201e","locations":[{"uri":"file:///Users/dave/.codeql/packages/codeql/threat-models/1.0.55/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/.codeql/packages/codeql/threat-models/1.0.55/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]}]},"invocations":[{"toolExecutionNotifications":[{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"Handler.java","uriBaseId":"%SRCROOT%","index":0}}}],"message":{"text":""},"level":"none","descriptor":{"id":"java/baseline/expected-extracted-files","index":0},"properties":{"formattedMessage":{"text":""}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:33:05.483809Z","descriptor":{"id":"cli/file-coverage-baseline","index":1},"properties":{"attributes":{"durationMilliseconds":20},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:33:05.484835Z","descriptor":{"id":"cli/platform","index":2},"properties":{"attributes":{"arch":"aarch64","name":"Mac OS X","version":"26.6.2"},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:33:05.493080Z","descriptor":{"id":"cli/sip-enablement","index":3},"properties":{"attributes":{"isEnabled":true},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":"Internal telemetry for the Java extractor.\n\nNo action needed.","markdown":"Internal telemetry for the Java extractor.\n\nNo action needed."},"level":"note","timeUtc":"2026-08-26T13:33:06.815108Z","descriptor":{"id":"java/extractor/summary","index":4},"properties":{"attributes":{"java_vendor":"Eclipse Adoptium","java_version":"21.0.8"},"visibility":{"statusPage":false,"telemetry":true}}}],"executionSuccessful":true}],"artifacts":[{"location":{"uri":"Handler.java","uriBaseId":"%SRCROOT%","index":0}}],"results":[],"columnKind":"utf16CodeUnits","properties":{"semmle.formatSpecifier":"sarif-latest"}}]} \ No newline at end of file diff --git a/reports/raw/codeql-java-modeling/dfb-taint-java-model-entrypoint-selectivity-positive.sarif.json b/reports/raw/codeql-java-modeling/dfb-taint-java-model-entrypoint-selectivity-positive.sarif.json new file mode 100644 index 0000000..8c7334a --- /dev/null +++ b/reports/raw/codeql-java-modeling/dfb-taint-java-model-entrypoint-selectivity-positive.sarif.json @@ -0,0 +1 @@ +{"$schema":"https://json.schemastore.org/sarif-2.1.0.json","version":"2.1.0","runs":[{"tool":{"driver":{"name":"CodeQL","organization":"GitHub","semanticVersion":"2.26.3","notifications":[{"id":"java/baseline/expected-extracted-files","name":"java/baseline/expected-extracted-files","shortDescription":{"text":"Expected extracted files"},"fullDescription":{"text":"Files appearing in the source archive that are expected to be extracted."},"defaultConfiguration":{"enabled":true},"properties":{"tags":["expected-extracted-files","telemetry"]}},{"id":"cli/file-coverage-baseline","name":"cli/file-coverage-baseline","shortDescription":{"text":"File coverage baseline telemetry"},"fullDescription":{"text":"File coverage baseline telemetry"},"defaultConfiguration":{"enabled":true}},{"id":"cli/platform","name":"cli/platform","shortDescription":{"text":"Platform"},"fullDescription":{"text":"Platform"},"defaultConfiguration":{"enabled":true}},{"id":"cli/sip-enablement","name":"cli/sip-enablement","shortDescription":{"text":"macOS SIP enablement status"},"fullDescription":{"text":"macOS SIP enablement status"},"defaultConfiguration":{"enabled":true}},{"id":"java/extractor/summary","name":"java/extractor/summary","shortDescription":{"text":"Java extractor telemetry"},"fullDescription":{"text":"Java extractor telemetry"},"defaultConfiguration":{"enabled":true}}],"rules":[{"id":"dataflowbench/java-taint-modeling","name":"dataflowbench/java-taint-modeling","shortDescription":{"text":"DataFlowBench Java taint-modeling matrix"},"fullDescription":{"text":"Encodes the twelve benchmark-supplied model declarations of docs/modeling-matrix.md natively in CodeQL's data-flow configuration surface, for the Java modeling population."},"defaultConfiguration":{"enabled":true,"level":"warning"},"properties":{"tags":["security"],"description":"Encodes the twelve benchmark-supplied model declarations of\n docs/modeling-matrix.md natively in CodeQL's data-flow\n configuration surface, for the Java modeling population.","id":"dataflowbench/java-taint-modeling","kind":"path-problem","name":"DataFlowBench Java taint-modeling matrix","precision":"high","problem.severity":"warning"}}]},"extensions":[{"name":"dataflowbench/codeql-java","semanticVersion":"0.0.1","locations":[{"uri":"file:///Users/dave/Workspace/BrokkAi/dataflowbench/.claude/worktrees/agent-af332237afc5e1bcf/adapters/codeql/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/Workspace/BrokkAi/dataflowbench/.claude/worktrees/agent-af332237afc5e1bcf/adapters/codeql/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]},{"name":"codeql/java-all","semanticVersion":"9.2.3+44a68d3a47fcbcd6a6a76ec7d1c1b3a1a28b201e","locations":[{"uri":"file:///Users/dave/.codeql/packages/codeql/java-all/9.2.3/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/.codeql/packages/codeql/java-all/9.2.3/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]},{"name":"codeql/threat-models","semanticVersion":"1.0.55+44a68d3a47fcbcd6a6a76ec7d1c1b3a1a28b201e","locations":[{"uri":"file:///Users/dave/.codeql/packages/codeql/threat-models/1.0.55/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/.codeql/packages/codeql/threat-models/1.0.55/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]}]},"invocations":[{"toolExecutionNotifications":[{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"Handler.java","uriBaseId":"%SRCROOT%","index":0}}}],"message":{"text":""},"level":"none","descriptor":{"id":"java/baseline/expected-extracted-files","index":0},"properties":{"formattedMessage":{"text":""}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:33:15.551741Z","descriptor":{"id":"cli/file-coverage-baseline","index":1},"properties":{"attributes":{"durationMilliseconds":25},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:33:15.552671Z","descriptor":{"id":"cli/platform","index":2},"properties":{"attributes":{"arch":"aarch64","name":"Mac OS X","version":"26.6.2"},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:33:15.560322Z","descriptor":{"id":"cli/sip-enablement","index":3},"properties":{"attributes":{"isEnabled":true},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":"Internal telemetry for the Java extractor.\n\nNo action needed.","markdown":"Internal telemetry for the Java extractor.\n\nNo action needed."},"level":"note","timeUtc":"2026-08-26T13:33:16.865357Z","descriptor":{"id":"java/extractor/summary","index":4},"properties":{"attributes":{"java_vendor":"Eclipse Adoptium","java_version":"21.0.8"},"visibility":{"statusPage":false,"telemetry":true}}}],"executionSuccessful":true}],"artifacts":[{"location":{"uri":"Handler.java","uriBaseId":"%SRCROOT%","index":0}}],"results":[{"ruleId":"dataflowbench/java-taint-modeling","ruleIndex":0,"rule":{"id":"dataflowbench/java-taint-modeling","index":0},"message":{"text":"A benchmark-declared model carried input to the declared sink."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"Handler.java","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":7,"startColumn":18,"endColumn":23}}}],"partialFingerprints":{"primaryLocationLineHash":"ff6cdaf8cd52220:1","primaryLocationStartColumnFingerprint":"9"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"Handler.java","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":6,"startColumn":21,"endColumn":33}},"message":{"text":"input : String"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"Handler.java","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":7,"startColumn":18,"endColumn":23}},"message":{"text":"input"}}}]}]}],"relatedLocations":[{"physicalLocation":{"artifactLocation":{"uri":"Handler.java","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":6,"startColumn":21,"endColumn":33}}}]}],"columnKind":"utf16CodeUnits","properties":{"semmle.formatSpecifier":"sarif-latest"}}]} \ No newline at end of file diff --git a/reports/raw/codeql-java-modeling/dfb-taint-java-model-opaque-propagator-negative.sarif.json b/reports/raw/codeql-java-modeling/dfb-taint-java-model-opaque-propagator-negative.sarif.json new file mode 100644 index 0000000..5d19acd --- /dev/null +++ b/reports/raw/codeql-java-modeling/dfb-taint-java-model-opaque-propagator-negative.sarif.json @@ -0,0 +1 @@ +{"$schema":"https://json.schemastore.org/sarif-2.1.0.json","version":"2.1.0","runs":[{"tool":{"driver":{"name":"CodeQL","organization":"GitHub","semanticVersion":"2.26.3","notifications":[{"id":"java/baseline/expected-extracted-files","name":"java/baseline/expected-extracted-files","shortDescription":{"text":"Expected extracted files"},"fullDescription":{"text":"Files appearing in the source archive that are expected to be extracted."},"defaultConfiguration":{"enabled":true},"properties":{"tags":["expected-extracted-files","telemetry"]}},{"id":"cli/file-coverage-baseline","name":"cli/file-coverage-baseline","shortDescription":{"text":"File coverage baseline telemetry"},"fullDescription":{"text":"File coverage baseline telemetry"},"defaultConfiguration":{"enabled":true}},{"id":"cli/platform","name":"cli/platform","shortDescription":{"text":"Platform"},"fullDescription":{"text":"Platform"},"defaultConfiguration":{"enabled":true}},{"id":"cli/sip-enablement","name":"cli/sip-enablement","shortDescription":{"text":"macOS SIP enablement status"},"fullDescription":{"text":"macOS SIP enablement status"},"defaultConfiguration":{"enabled":true}},{"id":"java/extractor/summary","name":"java/extractor/summary","shortDescription":{"text":"Java extractor telemetry"},"fullDescription":{"text":"Java extractor telemetry"},"defaultConfiguration":{"enabled":true}}],"rules":[{"id":"dataflowbench/java-taint-modeling","name":"dataflowbench/java-taint-modeling","shortDescription":{"text":"DataFlowBench Java taint-modeling matrix"},"fullDescription":{"text":"Encodes the twelve benchmark-supplied model declarations of docs/modeling-matrix.md natively in CodeQL's data-flow configuration surface, for the Java modeling population."},"defaultConfiguration":{"enabled":true,"level":"warning"},"properties":{"tags":["security"],"description":"Encodes the twelve benchmark-supplied model declarations of\n docs/modeling-matrix.md natively in CodeQL's data-flow\n configuration surface, for the Java modeling population.","id":"dataflowbench/java-taint-modeling","kind":"path-problem","name":"DataFlowBench Java taint-modeling matrix","precision":"high","problem.severity":"warning"}}]},"extensions":[{"name":"dataflowbench/codeql-java","semanticVersion":"0.0.1","locations":[{"uri":"file:///Users/dave/Workspace/BrokkAi/dataflowbench/.claude/worktrees/agent-af332237afc5e1bcf/adapters/codeql/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/Workspace/BrokkAi/dataflowbench/.claude/worktrees/agent-af332237afc5e1bcf/adapters/codeql/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]},{"name":"codeql/java-all","semanticVersion":"9.2.3+44a68d3a47fcbcd6a6a76ec7d1c1b3a1a28b201e","locations":[{"uri":"file:///Users/dave/.codeql/packages/codeql/java-all/9.2.3/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/.codeql/packages/codeql/java-all/9.2.3/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]},{"name":"codeql/threat-models","semanticVersion":"1.0.55+44a68d3a47fcbcd6a6a76ec7d1c1b3a1a28b201e","locations":[{"uri":"file:///Users/dave/.codeql/packages/codeql/threat-models/1.0.55/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/.codeql/packages/codeql/threat-models/1.0.55/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]}]},"invocations":[{"toolExecutionNotifications":[{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"ModelOpaquePropagatorNegative.java","uriBaseId":"%SRCROOT%","index":0}}}],"message":{"text":""},"level":"none","descriptor":{"id":"java/baseline/expected-extracted-files","index":0},"properties":{"formattedMessage":{"text":""}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:33:25.590296Z","descriptor":{"id":"cli/file-coverage-baseline","index":1},"properties":{"attributes":{"durationMilliseconds":18},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:33:25.591117Z","descriptor":{"id":"cli/platform","index":2},"properties":{"attributes":{"arch":"aarch64","name":"Mac OS X","version":"26.6.2"},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:33:25.598039Z","descriptor":{"id":"cli/sip-enablement","index":3},"properties":{"attributes":{"isEnabled":true},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":"Internal telemetry for the Java extractor.\n\nNo action needed.","markdown":"Internal telemetry for the Java extractor.\n\nNo action needed."},"level":"note","timeUtc":"2026-08-26T13:33:26.972761Z","descriptor":{"id":"java/extractor/summary","index":4},"properties":{"attributes":{"java_vendor":"Eclipse Adoptium","java_version":"21.0.8"},"visibility":{"statusPage":false,"telemetry":true}}}],"executionSuccessful":true}],"artifacts":[{"location":{"uri":"ModelOpaquePropagatorNegative.java","uriBaseId":"%SRCROOT%","index":0}}],"results":[],"columnKind":"utf16CodeUnits","properties":{"semmle.formatSpecifier":"sarif-latest"}}]} \ No newline at end of file diff --git a/reports/raw/codeql-java-modeling/dfb-taint-java-model-opaque-propagator-positive.sarif.json b/reports/raw/codeql-java-modeling/dfb-taint-java-model-opaque-propagator-positive.sarif.json new file mode 100644 index 0000000..5f982e5 --- /dev/null +++ b/reports/raw/codeql-java-modeling/dfb-taint-java-model-opaque-propagator-positive.sarif.json @@ -0,0 +1 @@ +{"$schema":"https://json.schemastore.org/sarif-2.1.0.json","version":"2.1.0","runs":[{"tool":{"driver":{"name":"CodeQL","organization":"GitHub","semanticVersion":"2.26.3","notifications":[{"id":"java/baseline/expected-extracted-files","name":"java/baseline/expected-extracted-files","shortDescription":{"text":"Expected extracted files"},"fullDescription":{"text":"Files appearing in the source archive that are expected to be extracted."},"defaultConfiguration":{"enabled":true},"properties":{"tags":["expected-extracted-files","telemetry"]}},{"id":"cli/file-coverage-baseline","name":"cli/file-coverage-baseline","shortDescription":{"text":"File coverage baseline telemetry"},"fullDescription":{"text":"File coverage baseline telemetry"},"defaultConfiguration":{"enabled":true}},{"id":"cli/platform","name":"cli/platform","shortDescription":{"text":"Platform"},"fullDescription":{"text":"Platform"},"defaultConfiguration":{"enabled":true}},{"id":"cli/sip-enablement","name":"cli/sip-enablement","shortDescription":{"text":"macOS SIP enablement status"},"fullDescription":{"text":"macOS SIP enablement status"},"defaultConfiguration":{"enabled":true}},{"id":"java/extractor/summary","name":"java/extractor/summary","shortDescription":{"text":"Java extractor telemetry"},"fullDescription":{"text":"Java extractor telemetry"},"defaultConfiguration":{"enabled":true}}],"rules":[{"id":"dataflowbench/java-taint-modeling","name":"dataflowbench/java-taint-modeling","shortDescription":{"text":"DataFlowBench Java taint-modeling matrix"},"fullDescription":{"text":"Encodes the twelve benchmark-supplied model declarations of docs/modeling-matrix.md natively in CodeQL's data-flow configuration surface, for the Java modeling population."},"defaultConfiguration":{"enabled":true,"level":"warning"},"properties":{"tags":["security"],"description":"Encodes the twelve benchmark-supplied model declarations of\n docs/modeling-matrix.md natively in CodeQL's data-flow\n configuration surface, for the Java modeling population.","id":"dataflowbench/java-taint-modeling","kind":"path-problem","name":"DataFlowBench Java taint-modeling matrix","precision":"high","problem.severity":"warning"}}]},"extensions":[{"name":"dataflowbench/codeql-java","semanticVersion":"0.0.1","locations":[{"uri":"file:///Users/dave/Workspace/BrokkAi/dataflowbench/.claude/worktrees/agent-af332237afc5e1bcf/adapters/codeql/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/Workspace/BrokkAi/dataflowbench/.claude/worktrees/agent-af332237afc5e1bcf/adapters/codeql/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]},{"name":"codeql/java-all","semanticVersion":"9.2.3+44a68d3a47fcbcd6a6a76ec7d1c1b3a1a28b201e","locations":[{"uri":"file:///Users/dave/.codeql/packages/codeql/java-all/9.2.3/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/.codeql/packages/codeql/java-all/9.2.3/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]},{"name":"codeql/threat-models","semanticVersion":"1.0.55+44a68d3a47fcbcd6a6a76ec7d1c1b3a1a28b201e","locations":[{"uri":"file:///Users/dave/.codeql/packages/codeql/threat-models/1.0.55/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/.codeql/packages/codeql/threat-models/1.0.55/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]}]},"invocations":[{"toolExecutionNotifications":[{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"ModelOpaquePropagatorPositive.java","uriBaseId":"%SRCROOT%","index":0}}}],"message":{"text":""},"level":"none","descriptor":{"id":"java/baseline/expected-extracted-files","index":0},"properties":{"formattedMessage":{"text":""}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:33:35.671632Z","descriptor":{"id":"cli/file-coverage-baseline","index":1},"properties":{"attributes":{"durationMilliseconds":20},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:33:35.674035Z","descriptor":{"id":"cli/platform","index":2},"properties":{"attributes":{"arch":"aarch64","name":"Mac OS X","version":"26.6.2"},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:33:35.682276Z","descriptor":{"id":"cli/sip-enablement","index":3},"properties":{"attributes":{"isEnabled":true},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":"Internal telemetry for the Java extractor.\n\nNo action needed.","markdown":"Internal telemetry for the Java extractor.\n\nNo action needed."},"level":"note","timeUtc":"2026-08-26T13:33:37.534395Z","descriptor":{"id":"java/extractor/summary","index":4},"properties":{"attributes":{"java_vendor":"Eclipse Adoptium","java_version":"21.0.8"},"visibility":{"statusPage":false,"telemetry":true}}}],"executionSuccessful":true}],"artifacts":[{"location":{"uri":"ModelOpaquePropagatorPositive.java","uriBaseId":"%SRCROOT%","index":0}}],"results":[{"ruleId":"dataflowbench/java-taint-modeling","ruleIndex":0,"rule":{"id":"dataflowbench/java-taint-modeling","index":0},"message":{"text":"A benchmark-declared model carried input to the declared sink."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"ModelOpaquePropagatorPositive.java","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":37,"startColumn":18,"endColumn":44}}}],"partialFingerprints":{"primaryLocationLineHash":"5ada21557e92fb97:1","primaryLocationStartColumnFingerprint":"9"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"ModelOpaquePropagatorPositive.java","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":37,"startColumn":31,"endColumn":43}},"message":{"text":"dfb_source(...) : String"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"ModelOpaquePropagatorPositive.java","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":37,"startColumn":18,"endColumn":44}},"message":{"text":"carry(...)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]}]}]}],"relatedLocations":[{"physicalLocation":{"artifactLocation":{"uri":"ModelOpaquePropagatorPositive.java","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":37,"startColumn":31,"endColumn":43}}}]}],"columnKind":"utf16CodeUnits","properties":{"semmle.formatSpecifier":"sarif-latest"}}]} \ No newline at end of file diff --git a/reports/raw/codeql-java-modeling/dfb-taint-java-model-propagator-position-negative.sarif.json b/reports/raw/codeql-java-modeling/dfb-taint-java-model-propagator-position-negative.sarif.json new file mode 100644 index 0000000..53168b6 --- /dev/null +++ b/reports/raw/codeql-java-modeling/dfb-taint-java-model-propagator-position-negative.sarif.json @@ -0,0 +1 @@ +{"$schema":"https://json.schemastore.org/sarif-2.1.0.json","version":"2.1.0","runs":[{"tool":{"driver":{"name":"CodeQL","organization":"GitHub","semanticVersion":"2.26.3","notifications":[{"id":"java/baseline/expected-extracted-files","name":"java/baseline/expected-extracted-files","shortDescription":{"text":"Expected extracted files"},"fullDescription":{"text":"Files appearing in the source archive that are expected to be extracted."},"defaultConfiguration":{"enabled":true},"properties":{"tags":["expected-extracted-files","telemetry"]}},{"id":"cli/file-coverage-baseline","name":"cli/file-coverage-baseline","shortDescription":{"text":"File coverage baseline telemetry"},"fullDescription":{"text":"File coverage baseline telemetry"},"defaultConfiguration":{"enabled":true}},{"id":"cli/platform","name":"cli/platform","shortDescription":{"text":"Platform"},"fullDescription":{"text":"Platform"},"defaultConfiguration":{"enabled":true}},{"id":"cli/sip-enablement","name":"cli/sip-enablement","shortDescription":{"text":"macOS SIP enablement status"},"fullDescription":{"text":"macOS SIP enablement status"},"defaultConfiguration":{"enabled":true}},{"id":"java/extractor/summary","name":"java/extractor/summary","shortDescription":{"text":"Java extractor telemetry"},"fullDescription":{"text":"Java extractor telemetry"},"defaultConfiguration":{"enabled":true}}],"rules":[{"id":"dataflowbench/java-taint-modeling","name":"dataflowbench/java-taint-modeling","shortDescription":{"text":"DataFlowBench Java taint-modeling matrix"},"fullDescription":{"text":"Encodes the twelve benchmark-supplied model declarations of docs/modeling-matrix.md natively in CodeQL's data-flow configuration surface, for the Java modeling population."},"defaultConfiguration":{"enabled":true,"level":"warning"},"properties":{"tags":["security"],"description":"Encodes the twelve benchmark-supplied model declarations of\n docs/modeling-matrix.md natively in CodeQL's data-flow\n configuration surface, for the Java modeling population.","id":"dataflowbench/java-taint-modeling","kind":"path-problem","name":"DataFlowBench Java taint-modeling matrix","precision":"high","problem.severity":"warning"}}]},"extensions":[{"name":"dataflowbench/codeql-java","semanticVersion":"0.0.1","locations":[{"uri":"file:///Users/dave/Workspace/BrokkAi/dataflowbench/.claude/worktrees/agent-af332237afc5e1bcf/adapters/codeql/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/Workspace/BrokkAi/dataflowbench/.claude/worktrees/agent-af332237afc5e1bcf/adapters/codeql/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]},{"name":"codeql/java-all","semanticVersion":"9.2.3+44a68d3a47fcbcd6a6a76ec7d1c1b3a1a28b201e","locations":[{"uri":"file:///Users/dave/.codeql/packages/codeql/java-all/9.2.3/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/.codeql/packages/codeql/java-all/9.2.3/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]},{"name":"codeql/threat-models","semanticVersion":"1.0.55+44a68d3a47fcbcd6a6a76ec7d1c1b3a1a28b201e","locations":[{"uri":"file:///Users/dave/.codeql/packages/codeql/threat-models/1.0.55/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/.codeql/packages/codeql/threat-models/1.0.55/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]}]},"invocations":[{"toolExecutionNotifications":[{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"ModelPropagatorPositionNegative.java","uriBaseId":"%SRCROOT%","index":0}}}],"message":{"text":""},"level":"none","descriptor":{"id":"java/baseline/expected-extracted-files","index":0},"properties":{"formattedMessage":{"text":""}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:33:46.391500Z","descriptor":{"id":"cli/file-coverage-baseline","index":1},"properties":{"attributes":{"durationMilliseconds":18},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:33:46.392296Z","descriptor":{"id":"cli/platform","index":2},"properties":{"attributes":{"arch":"aarch64","name":"Mac OS X","version":"26.6.2"},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:33:46.399611Z","descriptor":{"id":"cli/sip-enablement","index":3},"properties":{"attributes":{"isEnabled":true},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":"Internal telemetry for the Java extractor.\n\nNo action needed.","markdown":"Internal telemetry for the Java extractor.\n\nNo action needed."},"level":"note","timeUtc":"2026-08-26T13:33:47.753342Z","descriptor":{"id":"java/extractor/summary","index":4},"properties":{"attributes":{"java_vendor":"Eclipse Adoptium","java_version":"21.0.8"},"visibility":{"statusPage":false,"telemetry":true}}}],"executionSuccessful":true}],"artifacts":[{"location":{"uri":"ModelPropagatorPositionNegative.java","uriBaseId":"%SRCROOT%","index":0}}],"results":[],"columnKind":"utf16CodeUnits","properties":{"semmle.formatSpecifier":"sarif-latest"}}]} \ No newline at end of file diff --git a/reports/raw/codeql-java-modeling/dfb-taint-java-model-propagator-position-positive.sarif.json b/reports/raw/codeql-java-modeling/dfb-taint-java-model-propagator-position-positive.sarif.json new file mode 100644 index 0000000..d4b056f --- /dev/null +++ b/reports/raw/codeql-java-modeling/dfb-taint-java-model-propagator-position-positive.sarif.json @@ -0,0 +1 @@ +{"$schema":"https://json.schemastore.org/sarif-2.1.0.json","version":"2.1.0","runs":[{"tool":{"driver":{"name":"CodeQL","organization":"GitHub","semanticVersion":"2.26.3","notifications":[{"id":"java/baseline/expected-extracted-files","name":"java/baseline/expected-extracted-files","shortDescription":{"text":"Expected extracted files"},"fullDescription":{"text":"Files appearing in the source archive that are expected to be extracted."},"defaultConfiguration":{"enabled":true},"properties":{"tags":["expected-extracted-files","telemetry"]}},{"id":"cli/file-coverage-baseline","name":"cli/file-coverage-baseline","shortDescription":{"text":"File coverage baseline telemetry"},"fullDescription":{"text":"File coverage baseline telemetry"},"defaultConfiguration":{"enabled":true}},{"id":"cli/platform","name":"cli/platform","shortDescription":{"text":"Platform"},"fullDescription":{"text":"Platform"},"defaultConfiguration":{"enabled":true}},{"id":"cli/sip-enablement","name":"cli/sip-enablement","shortDescription":{"text":"macOS SIP enablement status"},"fullDescription":{"text":"macOS SIP enablement status"},"defaultConfiguration":{"enabled":true}},{"id":"java/extractor/summary","name":"java/extractor/summary","shortDescription":{"text":"Java extractor telemetry"},"fullDescription":{"text":"Java extractor telemetry"},"defaultConfiguration":{"enabled":true}}],"rules":[{"id":"dataflowbench/java-taint-modeling","name":"dataflowbench/java-taint-modeling","shortDescription":{"text":"DataFlowBench Java taint-modeling matrix"},"fullDescription":{"text":"Encodes the twelve benchmark-supplied model declarations of docs/modeling-matrix.md natively in CodeQL's data-flow configuration surface, for the Java modeling population."},"defaultConfiguration":{"enabled":true,"level":"warning"},"properties":{"tags":["security"],"description":"Encodes the twelve benchmark-supplied model declarations of\n docs/modeling-matrix.md natively in CodeQL's data-flow\n configuration surface, for the Java modeling population.","id":"dataflowbench/java-taint-modeling","kind":"path-problem","name":"DataFlowBench Java taint-modeling matrix","precision":"high","problem.severity":"warning"}}]},"extensions":[{"name":"dataflowbench/codeql-java","semanticVersion":"0.0.1","locations":[{"uri":"file:///Users/dave/Workspace/BrokkAi/dataflowbench/.claude/worktrees/agent-af332237afc5e1bcf/adapters/codeql/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/Workspace/BrokkAi/dataflowbench/.claude/worktrees/agent-af332237afc5e1bcf/adapters/codeql/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]},{"name":"codeql/java-all","semanticVersion":"9.2.3+44a68d3a47fcbcd6a6a76ec7d1c1b3a1a28b201e","locations":[{"uri":"file:///Users/dave/.codeql/packages/codeql/java-all/9.2.3/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/.codeql/packages/codeql/java-all/9.2.3/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]},{"name":"codeql/threat-models","semanticVersion":"1.0.55+44a68d3a47fcbcd6a6a76ec7d1c1b3a1a28b201e","locations":[{"uri":"file:///Users/dave/.codeql/packages/codeql/threat-models/1.0.55/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/.codeql/packages/codeql/threat-models/1.0.55/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]}]},"invocations":[{"toolExecutionNotifications":[{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"ModelPropagatorPositionPositive.java","uriBaseId":"%SRCROOT%","index":0}}}],"message":{"text":""},"level":"none","descriptor":{"id":"java/baseline/expected-extracted-files","index":0},"properties":{"formattedMessage":{"text":""}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:33:56.651073Z","descriptor":{"id":"cli/file-coverage-baseline","index":1},"properties":{"attributes":{"durationMilliseconds":23},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:33:56.652036Z","descriptor":{"id":"cli/platform","index":2},"properties":{"attributes":{"arch":"aarch64","name":"Mac OS X","version":"26.6.2"},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:33:56.661378Z","descriptor":{"id":"cli/sip-enablement","index":3},"properties":{"attributes":{"isEnabled":true},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":"Internal telemetry for the Java extractor.\n\nNo action needed.","markdown":"Internal telemetry for the Java extractor.\n\nNo action needed."},"level":"note","timeUtc":"2026-08-26T13:33:57.990757Z","descriptor":{"id":"java/extractor/summary","index":4},"properties":{"attributes":{"java_vendor":"Eclipse Adoptium","java_version":"21.0.8"},"visibility":{"statusPage":false,"telemetry":true}}}],"executionSuccessful":true}],"artifacts":[{"location":{"uri":"ModelPropagatorPositionPositive.java","uriBaseId":"%SRCROOT%","index":0}}],"results":[{"ruleId":"dataflowbench/java-taint-modeling","ruleIndex":0,"rule":{"id":"dataflowbench/java-taint-modeling","index":0},"message":{"text":"A benchmark-declared model carried input to the declared sink."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"ModelPropagatorPositionPositive.java","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":27,"startColumn":18,"endColumn":54}}}],"partialFingerprints":{"primaryLocationLineHash":"ead92e0a01a72fc5:1","primaryLocationStartColumnFingerprint":"9"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"ModelPropagatorPositionPositive.java","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":27,"startColumn":41,"endColumn":53}},"message":{"text":"dfb_source(...) : String"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"ModelPropagatorPositionPositive.java","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":27,"startColumn":18,"endColumn":54}},"message":{"text":"select(...)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]}]}]}],"relatedLocations":[{"physicalLocation":{"artifactLocation":{"uri":"ModelPropagatorPositionPositive.java","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":27,"startColumn":41,"endColumn":53}}}]}],"columnKind":"utf16CodeUnits","properties":{"semmle.formatSpecifier":"sarif-latest"}}]} \ No newline at end of file diff --git a/reports/raw/codeql-java-modeling/dfb-taint-java-model-sanitizer-kill-negative.sarif.json b/reports/raw/codeql-java-modeling/dfb-taint-java-model-sanitizer-kill-negative.sarif.json new file mode 100644 index 0000000..8787ab0 --- /dev/null +++ b/reports/raw/codeql-java-modeling/dfb-taint-java-model-sanitizer-kill-negative.sarif.json @@ -0,0 +1 @@ +{"$schema":"https://json.schemastore.org/sarif-2.1.0.json","version":"2.1.0","runs":[{"tool":{"driver":{"name":"CodeQL","organization":"GitHub","semanticVersion":"2.26.3","notifications":[{"id":"java/baseline/expected-extracted-files","name":"java/baseline/expected-extracted-files","shortDescription":{"text":"Expected extracted files"},"fullDescription":{"text":"Files appearing in the source archive that are expected to be extracted."},"defaultConfiguration":{"enabled":true},"properties":{"tags":["expected-extracted-files","telemetry"]}},{"id":"cli/file-coverage-baseline","name":"cli/file-coverage-baseline","shortDescription":{"text":"File coverage baseline telemetry"},"fullDescription":{"text":"File coverage baseline telemetry"},"defaultConfiguration":{"enabled":true}},{"id":"cli/platform","name":"cli/platform","shortDescription":{"text":"Platform"},"fullDescription":{"text":"Platform"},"defaultConfiguration":{"enabled":true}},{"id":"cli/sip-enablement","name":"cli/sip-enablement","shortDescription":{"text":"macOS SIP enablement status"},"fullDescription":{"text":"macOS SIP enablement status"},"defaultConfiguration":{"enabled":true}},{"id":"java/extractor/summary","name":"java/extractor/summary","shortDescription":{"text":"Java extractor telemetry"},"fullDescription":{"text":"Java extractor telemetry"},"defaultConfiguration":{"enabled":true}}],"rules":[{"id":"dataflowbench/java-taint-modeling","name":"dataflowbench/java-taint-modeling","shortDescription":{"text":"DataFlowBench Java taint-modeling matrix"},"fullDescription":{"text":"Encodes the twelve benchmark-supplied model declarations of docs/modeling-matrix.md natively in CodeQL's data-flow configuration surface, for the Java modeling population."},"defaultConfiguration":{"enabled":true,"level":"warning"},"properties":{"tags":["security"],"description":"Encodes the twelve benchmark-supplied model declarations of\n docs/modeling-matrix.md natively in CodeQL's data-flow\n configuration surface, for the Java modeling population.","id":"dataflowbench/java-taint-modeling","kind":"path-problem","name":"DataFlowBench Java taint-modeling matrix","precision":"high","problem.severity":"warning"}}]},"extensions":[{"name":"dataflowbench/codeql-java","semanticVersion":"0.0.1","locations":[{"uri":"file:///Users/dave/Workspace/BrokkAi/dataflowbench/.claude/worktrees/agent-af332237afc5e1bcf/adapters/codeql/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/Workspace/BrokkAi/dataflowbench/.claude/worktrees/agent-af332237afc5e1bcf/adapters/codeql/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]},{"name":"codeql/java-all","semanticVersion":"9.2.3+44a68d3a47fcbcd6a6a76ec7d1c1b3a1a28b201e","locations":[{"uri":"file:///Users/dave/.codeql/packages/codeql/java-all/9.2.3/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/.codeql/packages/codeql/java-all/9.2.3/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]},{"name":"codeql/threat-models","semanticVersion":"1.0.55+44a68d3a47fcbcd6a6a76ec7d1c1b3a1a28b201e","locations":[{"uri":"file:///Users/dave/.codeql/packages/codeql/threat-models/1.0.55/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/.codeql/packages/codeql/threat-models/1.0.55/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]}]},"invocations":[{"toolExecutionNotifications":[{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"ModelSanitizerKillNegative.java","uriBaseId":"%SRCROOT%","index":0}}}],"message":{"text":""},"level":"none","descriptor":{"id":"java/baseline/expected-extracted-files","index":0},"properties":{"formattedMessage":{"text":""}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:34:07.232475Z","descriptor":{"id":"cli/file-coverage-baseline","index":1},"properties":{"attributes":{"durationMilliseconds":19},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:34:07.233420Z","descriptor":{"id":"cli/platform","index":2},"properties":{"attributes":{"arch":"aarch64","name":"Mac OS X","version":"26.6.2"},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:34:07.241987Z","descriptor":{"id":"cli/sip-enablement","index":3},"properties":{"attributes":{"isEnabled":true},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":"Internal telemetry for the Java extractor.\n\nNo action needed.","markdown":"Internal telemetry for the Java extractor.\n\nNo action needed."},"level":"note","timeUtc":"2026-08-26T13:34:08.609678Z","descriptor":{"id":"java/extractor/summary","index":4},"properties":{"attributes":{"java_vendor":"Eclipse Adoptium","java_version":"21.0.8"},"visibility":{"statusPage":false,"telemetry":true}}}],"executionSuccessful":true}],"artifacts":[{"location":{"uri":"ModelSanitizerKillNegative.java","uriBaseId":"%SRCROOT%","index":0}}],"results":[],"columnKind":"utf16CodeUnits","properties":{"semmle.formatSpecifier":"sarif-latest"}}]} \ No newline at end of file diff --git a/reports/raw/codeql-java-modeling/dfb-taint-java-model-sanitizer-kill-positive.sarif.json b/reports/raw/codeql-java-modeling/dfb-taint-java-model-sanitizer-kill-positive.sarif.json new file mode 100644 index 0000000..69f53e5 --- /dev/null +++ b/reports/raw/codeql-java-modeling/dfb-taint-java-model-sanitizer-kill-positive.sarif.json @@ -0,0 +1 @@ +{"$schema":"https://json.schemastore.org/sarif-2.1.0.json","version":"2.1.0","runs":[{"tool":{"driver":{"name":"CodeQL","organization":"GitHub","semanticVersion":"2.26.3","notifications":[{"id":"java/baseline/expected-extracted-files","name":"java/baseline/expected-extracted-files","shortDescription":{"text":"Expected extracted files"},"fullDescription":{"text":"Files appearing in the source archive that are expected to be extracted."},"defaultConfiguration":{"enabled":true},"properties":{"tags":["expected-extracted-files","telemetry"]}},{"id":"cli/file-coverage-baseline","name":"cli/file-coverage-baseline","shortDescription":{"text":"File coverage baseline telemetry"},"fullDescription":{"text":"File coverage baseline telemetry"},"defaultConfiguration":{"enabled":true}},{"id":"cli/platform","name":"cli/platform","shortDescription":{"text":"Platform"},"fullDescription":{"text":"Platform"},"defaultConfiguration":{"enabled":true}},{"id":"cli/sip-enablement","name":"cli/sip-enablement","shortDescription":{"text":"macOS SIP enablement status"},"fullDescription":{"text":"macOS SIP enablement status"},"defaultConfiguration":{"enabled":true}},{"id":"java/extractor/summary","name":"java/extractor/summary","shortDescription":{"text":"Java extractor telemetry"},"fullDescription":{"text":"Java extractor telemetry"},"defaultConfiguration":{"enabled":true}}],"rules":[{"id":"dataflowbench/java-taint-modeling","name":"dataflowbench/java-taint-modeling","shortDescription":{"text":"DataFlowBench Java taint-modeling matrix"},"fullDescription":{"text":"Encodes the twelve benchmark-supplied model declarations of docs/modeling-matrix.md natively in CodeQL's data-flow configuration surface, for the Java modeling population."},"defaultConfiguration":{"enabled":true,"level":"warning"},"properties":{"tags":["security"],"description":"Encodes the twelve benchmark-supplied model declarations of\n docs/modeling-matrix.md natively in CodeQL's data-flow\n configuration surface, for the Java modeling population.","id":"dataflowbench/java-taint-modeling","kind":"path-problem","name":"DataFlowBench Java taint-modeling matrix","precision":"high","problem.severity":"warning"}}]},"extensions":[{"name":"dataflowbench/codeql-java","semanticVersion":"0.0.1","locations":[{"uri":"file:///Users/dave/Workspace/BrokkAi/dataflowbench/.claude/worktrees/agent-af332237afc5e1bcf/adapters/codeql/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/Workspace/BrokkAi/dataflowbench/.claude/worktrees/agent-af332237afc5e1bcf/adapters/codeql/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]},{"name":"codeql/java-all","semanticVersion":"9.2.3+44a68d3a47fcbcd6a6a76ec7d1c1b3a1a28b201e","locations":[{"uri":"file:///Users/dave/.codeql/packages/codeql/java-all/9.2.3/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/.codeql/packages/codeql/java-all/9.2.3/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]},{"name":"codeql/threat-models","semanticVersion":"1.0.55+44a68d3a47fcbcd6a6a76ec7d1c1b3a1a28b201e","locations":[{"uri":"file:///Users/dave/.codeql/packages/codeql/threat-models/1.0.55/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/.codeql/packages/codeql/threat-models/1.0.55/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]}]},"invocations":[{"toolExecutionNotifications":[{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"ModelSanitizerKillPositive.java","uriBaseId":"%SRCROOT%","index":0}}}],"message":{"text":""},"level":"none","descriptor":{"id":"java/baseline/expected-extracted-files","index":0},"properties":{"formattedMessage":{"text":""}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:34:17.601194Z","descriptor":{"id":"cli/file-coverage-baseline","index":1},"properties":{"attributes":{"durationMilliseconds":19},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:34:17.602114Z","descriptor":{"id":"cli/platform","index":2},"properties":{"attributes":{"arch":"aarch64","name":"Mac OS X","version":"26.6.2"},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:34:17.610977Z","descriptor":{"id":"cli/sip-enablement","index":3},"properties":{"attributes":{"isEnabled":true},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":"Internal telemetry for the Java extractor.\n\nNo action needed.","markdown":"Internal telemetry for the Java extractor.\n\nNo action needed."},"level":"note","timeUtc":"2026-08-26T13:34:18.920291Z","descriptor":{"id":"java/extractor/summary","index":4},"properties":{"attributes":{"java_vendor":"Eclipse Adoptium","java_version":"21.0.8"},"visibility":{"statusPage":false,"telemetry":true}}}],"executionSuccessful":true}],"artifacts":[{"location":{"uri":"ModelSanitizerKillPositive.java","uriBaseId":"%SRCROOT%","index":0}}],"results":[{"ruleId":"dataflowbench/java-taint-modeling","ruleIndex":0,"rule":{"id":"dataflowbench/java-taint-modeling","index":0},"message":{"text":"A benchmark-declared model carried input to the declared sink."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"ModelSanitizerKillPositive.java","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":17,"startColumn":18,"endColumn":30}}}],"partialFingerprints":{"primaryLocationLineHash":"efb75cb48b7ee9b4:1","primaryLocationStartColumnFingerprint":"9"}}],"columnKind":"utf16CodeUnits","properties":{"semmle.formatSpecifier":"sarif-latest"}}]} \ No newline at end of file diff --git a/reports/raw/codeql-java-modeling/dfb-taint-java-model-sanitizer-selectivity-negative.sarif.json b/reports/raw/codeql-java-modeling/dfb-taint-java-model-sanitizer-selectivity-negative.sarif.json new file mode 100644 index 0000000..2281ce9 --- /dev/null +++ b/reports/raw/codeql-java-modeling/dfb-taint-java-model-sanitizer-selectivity-negative.sarif.json @@ -0,0 +1 @@ +{"$schema":"https://json.schemastore.org/sarif-2.1.0.json","version":"2.1.0","runs":[{"tool":{"driver":{"name":"CodeQL","organization":"GitHub","semanticVersion":"2.26.3","notifications":[{"id":"java/baseline/expected-extracted-files","name":"java/baseline/expected-extracted-files","shortDescription":{"text":"Expected extracted files"},"fullDescription":{"text":"Files appearing in the source archive that are expected to be extracted."},"defaultConfiguration":{"enabled":true},"properties":{"tags":["expected-extracted-files","telemetry"]}},{"id":"cli/file-coverage-baseline","name":"cli/file-coverage-baseline","shortDescription":{"text":"File coverage baseline telemetry"},"fullDescription":{"text":"File coverage baseline telemetry"},"defaultConfiguration":{"enabled":true}},{"id":"cli/platform","name":"cli/platform","shortDescription":{"text":"Platform"},"fullDescription":{"text":"Platform"},"defaultConfiguration":{"enabled":true}},{"id":"cli/sip-enablement","name":"cli/sip-enablement","shortDescription":{"text":"macOS SIP enablement status"},"fullDescription":{"text":"macOS SIP enablement status"},"defaultConfiguration":{"enabled":true}},{"id":"java/extractor/summary","name":"java/extractor/summary","shortDescription":{"text":"Java extractor telemetry"},"fullDescription":{"text":"Java extractor telemetry"},"defaultConfiguration":{"enabled":true}}],"rules":[{"id":"dataflowbench/java-taint-modeling","name":"dataflowbench/java-taint-modeling","shortDescription":{"text":"DataFlowBench Java taint-modeling matrix"},"fullDescription":{"text":"Encodes the twelve benchmark-supplied model declarations of docs/modeling-matrix.md natively in CodeQL's data-flow configuration surface, for the Java modeling population."},"defaultConfiguration":{"enabled":true,"level":"warning"},"properties":{"tags":["security"],"description":"Encodes the twelve benchmark-supplied model declarations of\n docs/modeling-matrix.md natively in CodeQL's data-flow\n configuration surface, for the Java modeling population.","id":"dataflowbench/java-taint-modeling","kind":"path-problem","name":"DataFlowBench Java taint-modeling matrix","precision":"high","problem.severity":"warning"}}]},"extensions":[{"name":"dataflowbench/codeql-java","semanticVersion":"0.0.1","locations":[{"uri":"file:///Users/dave/Workspace/BrokkAi/dataflowbench/.claude/worktrees/agent-af332237afc5e1bcf/adapters/codeql/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/Workspace/BrokkAi/dataflowbench/.claude/worktrees/agent-af332237afc5e1bcf/adapters/codeql/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]},{"name":"codeql/java-all","semanticVersion":"9.2.3+44a68d3a47fcbcd6a6a76ec7d1c1b3a1a28b201e","locations":[{"uri":"file:///Users/dave/.codeql/packages/codeql/java-all/9.2.3/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/.codeql/packages/codeql/java-all/9.2.3/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]},{"name":"codeql/threat-models","semanticVersion":"1.0.55+44a68d3a47fcbcd6a6a76ec7d1c1b3a1a28b201e","locations":[{"uri":"file:///Users/dave/.codeql/packages/codeql/threat-models/1.0.55/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/.codeql/packages/codeql/threat-models/1.0.55/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]}]},"invocations":[{"toolExecutionNotifications":[{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"ModelSanitizerSelectivityNegative.java","uriBaseId":"%SRCROOT%","index":0}}}],"message":{"text":""},"level":"none","descriptor":{"id":"java/baseline/expected-extracted-files","index":0},"properties":{"formattedMessage":{"text":""}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:34:27.656686Z","descriptor":{"id":"cli/file-coverage-baseline","index":1},"properties":{"attributes":{"durationMilliseconds":18},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:34:27.658758Z","descriptor":{"id":"cli/platform","index":2},"properties":{"attributes":{"arch":"aarch64","name":"Mac OS X","version":"26.6.2"},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:34:27.665574Z","descriptor":{"id":"cli/sip-enablement","index":3},"properties":{"attributes":{"isEnabled":true},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":"Internal telemetry for the Java extractor.\n\nNo action needed.","markdown":"Internal telemetry for the Java extractor.\n\nNo action needed."},"level":"note","timeUtc":"2026-08-26T13:34:29.024075Z","descriptor":{"id":"java/extractor/summary","index":4},"properties":{"attributes":{"java_vendor":"Eclipse Adoptium","java_version":"21.0.8"},"visibility":{"statusPage":false,"telemetry":true}}}],"executionSuccessful":true}],"artifacts":[{"location":{"uri":"ModelSanitizerSelectivityNegative.java","uriBaseId":"%SRCROOT%","index":0}}],"results":[],"columnKind":"utf16CodeUnits","properties":{"semmle.formatSpecifier":"sarif-latest"}}]} \ No newline at end of file diff --git a/reports/raw/codeql-java-modeling/dfb-taint-java-model-sanitizer-selectivity-positive.sarif.json b/reports/raw/codeql-java-modeling/dfb-taint-java-model-sanitizer-selectivity-positive.sarif.json new file mode 100644 index 0000000..210a7c3 --- /dev/null +++ b/reports/raw/codeql-java-modeling/dfb-taint-java-model-sanitizer-selectivity-positive.sarif.json @@ -0,0 +1 @@ +{"$schema":"https://json.schemastore.org/sarif-2.1.0.json","version":"2.1.0","runs":[{"tool":{"driver":{"name":"CodeQL","organization":"GitHub","semanticVersion":"2.26.3","notifications":[{"id":"java/baseline/expected-extracted-files","name":"java/baseline/expected-extracted-files","shortDescription":{"text":"Expected extracted files"},"fullDescription":{"text":"Files appearing in the source archive that are expected to be extracted."},"defaultConfiguration":{"enabled":true},"properties":{"tags":["expected-extracted-files","telemetry"]}},{"id":"cli/file-coverage-baseline","name":"cli/file-coverage-baseline","shortDescription":{"text":"File coverage baseline telemetry"},"fullDescription":{"text":"File coverage baseline telemetry"},"defaultConfiguration":{"enabled":true}},{"id":"cli/platform","name":"cli/platform","shortDescription":{"text":"Platform"},"fullDescription":{"text":"Platform"},"defaultConfiguration":{"enabled":true}},{"id":"cli/sip-enablement","name":"cli/sip-enablement","shortDescription":{"text":"macOS SIP enablement status"},"fullDescription":{"text":"macOS SIP enablement status"},"defaultConfiguration":{"enabled":true}},{"id":"java/extractor/summary","name":"java/extractor/summary","shortDescription":{"text":"Java extractor telemetry"},"fullDescription":{"text":"Java extractor telemetry"},"defaultConfiguration":{"enabled":true}}],"rules":[{"id":"dataflowbench/java-taint-modeling","name":"dataflowbench/java-taint-modeling","shortDescription":{"text":"DataFlowBench Java taint-modeling matrix"},"fullDescription":{"text":"Encodes the twelve benchmark-supplied model declarations of docs/modeling-matrix.md natively in CodeQL's data-flow configuration surface, for the Java modeling population."},"defaultConfiguration":{"enabled":true,"level":"warning"},"properties":{"tags":["security"],"description":"Encodes the twelve benchmark-supplied model declarations of\n docs/modeling-matrix.md natively in CodeQL's data-flow\n configuration surface, for the Java modeling population.","id":"dataflowbench/java-taint-modeling","kind":"path-problem","name":"DataFlowBench Java taint-modeling matrix","precision":"high","problem.severity":"warning"}}]},"extensions":[{"name":"dataflowbench/codeql-java","semanticVersion":"0.0.1","locations":[{"uri":"file:///Users/dave/Workspace/BrokkAi/dataflowbench/.claude/worktrees/agent-af332237afc5e1bcf/adapters/codeql/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/Workspace/BrokkAi/dataflowbench/.claude/worktrees/agent-af332237afc5e1bcf/adapters/codeql/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]},{"name":"codeql/java-all","semanticVersion":"9.2.3+44a68d3a47fcbcd6a6a76ec7d1c1b3a1a28b201e","locations":[{"uri":"file:///Users/dave/.codeql/packages/codeql/java-all/9.2.3/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/.codeql/packages/codeql/java-all/9.2.3/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]},{"name":"codeql/threat-models","semanticVersion":"1.0.55+44a68d3a47fcbcd6a6a76ec7d1c1b3a1a28b201e","locations":[{"uri":"file:///Users/dave/.codeql/packages/codeql/threat-models/1.0.55/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/.codeql/packages/codeql/threat-models/1.0.55/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]}]},"invocations":[{"toolExecutionNotifications":[{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"ModelSanitizerSelectivityPositive.java","uriBaseId":"%SRCROOT%","index":0}}}],"message":{"text":""},"level":"none","descriptor":{"id":"java/baseline/expected-extracted-files","index":0},"properties":{"formattedMessage":{"text":""}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:34:37.813097Z","descriptor":{"id":"cli/file-coverage-baseline","index":1},"properties":{"attributes":{"durationMilliseconds":20},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:34:37.814203Z","descriptor":{"id":"cli/platform","index":2},"properties":{"attributes":{"arch":"aarch64","name":"Mac OS X","version":"26.6.2"},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:34:37.822748Z","descriptor":{"id":"cli/sip-enablement","index":3},"properties":{"attributes":{"isEnabled":true},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":"Internal telemetry for the Java extractor.\n\nNo action needed.","markdown":"Internal telemetry for the Java extractor.\n\nNo action needed."},"level":"note","timeUtc":"2026-08-26T13:34:39.171091Z","descriptor":{"id":"java/extractor/summary","index":4},"properties":{"attributes":{"java_vendor":"Eclipse Adoptium","java_version":"21.0.8"},"visibility":{"statusPage":false,"telemetry":true}}}],"executionSuccessful":true}],"artifacts":[{"location":{"uri":"ModelSanitizerSelectivityPositive.java","uriBaseId":"%SRCROOT%","index":0}}],"results":[{"ruleId":"dataflowbench/java-taint-modeling","ruleIndex":0,"rule":{"id":"dataflowbench/java-taint-modeling","index":0},"message":{"text":"A benchmark-declared model carried input to the declared sink."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"ModelSanitizerSelectivityPositive.java","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":21,"startColumn":18,"endColumn":46}}}],"partialFingerprints":{"primaryLocationLineHash":"f7e06401abf63749:1","primaryLocationStartColumnFingerprint":"9"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"ModelSanitizerSelectivityPositive.java","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":21,"startColumn":33,"endColumn":45}},"message":{"text":"dfb_source(...) : String"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"ModelSanitizerSelectivityPositive.java","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":8,"startColumn":28,"endColumn":40}},"message":{"text":"value : String"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"ModelSanitizerSelectivityPositive.java","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":9,"startColumn":16,"endColumn":21}},"message":{"text":"value : String"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"ModelSanitizerSelectivityPositive.java","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":21,"startColumn":18,"endColumn":46}},"message":{"text":"sanitize(...)"}}}]}]}],"relatedLocations":[{"physicalLocation":{"artifactLocation":{"uri":"ModelSanitizerSelectivityPositive.java","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":21,"startColumn":33,"endColumn":45}}}]}],"columnKind":"utf16CodeUnits","properties":{"semmle.formatSpecifier":"sarif-latest"}}]} \ No newline at end of file diff --git a/reports/raw/codeql-java-modeling/dfb-taint-java-model-store-roundtrip-negative.sarif.json b/reports/raw/codeql-java-modeling/dfb-taint-java-model-store-roundtrip-negative.sarif.json new file mode 100644 index 0000000..77eaf3f --- /dev/null +++ b/reports/raw/codeql-java-modeling/dfb-taint-java-model-store-roundtrip-negative.sarif.json @@ -0,0 +1 @@ +{"$schema":"https://json.schemastore.org/sarif-2.1.0.json","version":"2.1.0","runs":[{"tool":{"driver":{"name":"CodeQL","organization":"GitHub","semanticVersion":"2.26.3","notifications":[{"id":"java/baseline/expected-extracted-files","name":"java/baseline/expected-extracted-files","shortDescription":{"text":"Expected extracted files"},"fullDescription":{"text":"Files appearing in the source archive that are expected to be extracted."},"defaultConfiguration":{"enabled":true},"properties":{"tags":["expected-extracted-files","telemetry"]}},{"id":"cli/file-coverage-baseline","name":"cli/file-coverage-baseline","shortDescription":{"text":"File coverage baseline telemetry"},"fullDescription":{"text":"File coverage baseline telemetry"},"defaultConfiguration":{"enabled":true}},{"id":"cli/platform","name":"cli/platform","shortDescription":{"text":"Platform"},"fullDescription":{"text":"Platform"},"defaultConfiguration":{"enabled":true}},{"id":"cli/sip-enablement","name":"cli/sip-enablement","shortDescription":{"text":"macOS SIP enablement status"},"fullDescription":{"text":"macOS SIP enablement status"},"defaultConfiguration":{"enabled":true}},{"id":"java/extractor/summary","name":"java/extractor/summary","shortDescription":{"text":"Java extractor telemetry"},"fullDescription":{"text":"Java extractor telemetry"},"defaultConfiguration":{"enabled":true}}],"rules":[{"id":"dataflowbench/java-taint-modeling","name":"dataflowbench/java-taint-modeling","shortDescription":{"text":"DataFlowBench Java taint-modeling matrix"},"fullDescription":{"text":"Encodes the twelve benchmark-supplied model declarations of docs/modeling-matrix.md natively in CodeQL's data-flow configuration surface, for the Java modeling population."},"defaultConfiguration":{"enabled":true,"level":"warning"},"properties":{"tags":["security"],"description":"Encodes the twelve benchmark-supplied model declarations of\n docs/modeling-matrix.md natively in CodeQL's data-flow\n configuration surface, for the Java modeling population.","id":"dataflowbench/java-taint-modeling","kind":"path-problem","name":"DataFlowBench Java taint-modeling matrix","precision":"high","problem.severity":"warning"}}]},"extensions":[{"name":"dataflowbench/codeql-java","semanticVersion":"0.0.1","locations":[{"uri":"file:///Users/dave/Workspace/BrokkAi/dataflowbench/.claude/worktrees/agent-af332237afc5e1bcf/adapters/codeql/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/Workspace/BrokkAi/dataflowbench/.claude/worktrees/agent-af332237afc5e1bcf/adapters/codeql/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]},{"name":"codeql/java-all","semanticVersion":"9.2.3+44a68d3a47fcbcd6a6a76ec7d1c1b3a1a28b201e","locations":[{"uri":"file:///Users/dave/.codeql/packages/codeql/java-all/9.2.3/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/.codeql/packages/codeql/java-all/9.2.3/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]},{"name":"codeql/threat-models","semanticVersion":"1.0.55+44a68d3a47fcbcd6a6a76ec7d1c1b3a1a28b201e","locations":[{"uri":"file:///Users/dave/.codeql/packages/codeql/threat-models/1.0.55/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/.codeql/packages/codeql/threat-models/1.0.55/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]}]},"invocations":[{"toolExecutionNotifications":[{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"ModelStoreRoundtripNegative.java","uriBaseId":"%SRCROOT%","index":0}}}],"message":{"text":""},"level":"none","descriptor":{"id":"java/baseline/expected-extracted-files","index":0},"properties":{"formattedMessage":{"text":""}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:34:48.353289Z","descriptor":{"id":"cli/file-coverage-baseline","index":1},"properties":{"attributes":{"durationMilliseconds":18},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:34:48.354109Z","descriptor":{"id":"cli/platform","index":2},"properties":{"attributes":{"arch":"aarch64","name":"Mac OS X","version":"26.6.2"},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:34:48.361062Z","descriptor":{"id":"cli/sip-enablement","index":3},"properties":{"attributes":{"isEnabled":true},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":"Internal telemetry for the Java extractor.\n\nNo action needed.","markdown":"Internal telemetry for the Java extractor.\n\nNo action needed."},"level":"note","timeUtc":"2026-08-26T13:34:49.767682Z","descriptor":{"id":"java/extractor/summary","index":4},"properties":{"attributes":{"java_vendor":"Eclipse Adoptium","java_version":"21.0.8"},"visibility":{"statusPage":false,"telemetry":true}}}],"executionSuccessful":true}],"artifacts":[{"location":{"uri":"ModelStoreRoundtripNegative.java","uriBaseId":"%SRCROOT%","index":0}}],"results":[],"columnKind":"utf16CodeUnits","properties":{"semmle.formatSpecifier":"sarif-latest"}}]} \ No newline at end of file diff --git a/reports/raw/codeql-java-modeling/dfb-taint-java-model-store-roundtrip-positive.sarif.json b/reports/raw/codeql-java-modeling/dfb-taint-java-model-store-roundtrip-positive.sarif.json new file mode 100644 index 0000000..f4c1439 --- /dev/null +++ b/reports/raw/codeql-java-modeling/dfb-taint-java-model-store-roundtrip-positive.sarif.json @@ -0,0 +1 @@ +{"$schema":"https://json.schemastore.org/sarif-2.1.0.json","version":"2.1.0","runs":[{"tool":{"driver":{"name":"CodeQL","organization":"GitHub","semanticVersion":"2.26.3","notifications":[{"id":"java/baseline/expected-extracted-files","name":"java/baseline/expected-extracted-files","shortDescription":{"text":"Expected extracted files"},"fullDescription":{"text":"Files appearing in the source archive that are expected to be extracted."},"defaultConfiguration":{"enabled":true},"properties":{"tags":["expected-extracted-files","telemetry"]}},{"id":"cli/file-coverage-baseline","name":"cli/file-coverage-baseline","shortDescription":{"text":"File coverage baseline telemetry"},"fullDescription":{"text":"File coverage baseline telemetry"},"defaultConfiguration":{"enabled":true}},{"id":"cli/platform","name":"cli/platform","shortDescription":{"text":"Platform"},"fullDescription":{"text":"Platform"},"defaultConfiguration":{"enabled":true}},{"id":"cli/sip-enablement","name":"cli/sip-enablement","shortDescription":{"text":"macOS SIP enablement status"},"fullDescription":{"text":"macOS SIP enablement status"},"defaultConfiguration":{"enabled":true}},{"id":"java/extractor/summary","name":"java/extractor/summary","shortDescription":{"text":"Java extractor telemetry"},"fullDescription":{"text":"Java extractor telemetry"},"defaultConfiguration":{"enabled":true}}],"rules":[{"id":"dataflowbench/java-taint-modeling","name":"dataflowbench/java-taint-modeling","shortDescription":{"text":"DataFlowBench Java taint-modeling matrix"},"fullDescription":{"text":"Encodes the twelve benchmark-supplied model declarations of docs/modeling-matrix.md natively in CodeQL's data-flow configuration surface, for the Java modeling population."},"defaultConfiguration":{"enabled":true,"level":"warning"},"properties":{"tags":["security"],"description":"Encodes the twelve benchmark-supplied model declarations of\n docs/modeling-matrix.md natively in CodeQL's data-flow\n configuration surface, for the Java modeling population.","id":"dataflowbench/java-taint-modeling","kind":"path-problem","name":"DataFlowBench Java taint-modeling matrix","precision":"high","problem.severity":"warning"}}]},"extensions":[{"name":"dataflowbench/codeql-java","semanticVersion":"0.0.1","locations":[{"uri":"file:///Users/dave/Workspace/BrokkAi/dataflowbench/.claude/worktrees/agent-af332237afc5e1bcf/adapters/codeql/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/Workspace/BrokkAi/dataflowbench/.claude/worktrees/agent-af332237afc5e1bcf/adapters/codeql/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]},{"name":"codeql/java-all","semanticVersion":"9.2.3+44a68d3a47fcbcd6a6a76ec7d1c1b3a1a28b201e","locations":[{"uri":"file:///Users/dave/.codeql/packages/codeql/java-all/9.2.3/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/.codeql/packages/codeql/java-all/9.2.3/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]},{"name":"codeql/threat-models","semanticVersion":"1.0.55+44a68d3a47fcbcd6a6a76ec7d1c1b3a1a28b201e","locations":[{"uri":"file:///Users/dave/.codeql/packages/codeql/threat-models/1.0.55/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/.codeql/packages/codeql/threat-models/1.0.55/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]}]},"invocations":[{"toolExecutionNotifications":[{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"ModelStoreRoundtripPositive.java","uriBaseId":"%SRCROOT%","index":0}}}],"message":{"text":""},"level":"none","descriptor":{"id":"java/baseline/expected-extracted-files","index":0},"properties":{"formattedMessage":{"text":""}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:34:58.573565Z","descriptor":{"id":"cli/file-coverage-baseline","index":1},"properties":{"attributes":{"durationMilliseconds":21},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:34:58.574565Z","descriptor":{"id":"cli/platform","index":2},"properties":{"attributes":{"arch":"aarch64","name":"Mac OS X","version":"26.6.2"},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:34:58.583787Z","descriptor":{"id":"cli/sip-enablement","index":3},"properties":{"attributes":{"isEnabled":true},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":"Internal telemetry for the Java extractor.\n\nNo action needed.","markdown":"Internal telemetry for the Java extractor.\n\nNo action needed."},"level":"note","timeUtc":"2026-08-26T13:34:59.940968Z","descriptor":{"id":"java/extractor/summary","index":4},"properties":{"attributes":{"java_vendor":"Eclipse Adoptium","java_version":"21.0.8"},"visibility":{"statusPage":false,"telemetry":true}}}],"executionSuccessful":true}],"artifacts":[{"location":{"uri":"ModelStoreRoundtripPositive.java","uriBaseId":"%SRCROOT%","index":0}}],"results":[{"ruleId":"dataflowbench/java-taint-modeling","ruleIndex":0,"rule":{"id":"dataflowbench/java-taint-modeling","index":0},"message":{"text":"A benchmark-declared model carried input to the declared sink."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"ModelStoreRoundtripPositive.java","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":23,"startColumn":18,"endColumn":32}}}],"partialFingerprints":{"primaryLocationLineHash":"5bfaf43b096b20ae:1","primaryLocationStartColumnFingerprint":"9"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"ModelStoreRoundtripPositive.java","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":19,"startColumn":24,"endColumn":36}},"message":{"text":"dfb_source(...) : String"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"ModelStoreRoundtripPositive.java","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":23,"startColumn":18,"endColumn":32}},"message":{"text":"get(...)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]}]}]}],"relatedLocations":[{"physicalLocation":{"artifactLocation":{"uri":"ModelStoreRoundtripPositive.java","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":19,"startColumn":24,"endColumn":36}}}]}],"columnKind":"utf16CodeUnits","properties":{"semmle.formatSpecifier":"sarif-latest"}}]} \ No newline at end of file diff --git a/reports/raw/codeql-java-modeling/dfb-taint-java-model-store-separation-negative.sarif.json b/reports/raw/codeql-java-modeling/dfb-taint-java-model-store-separation-negative.sarif.json new file mode 100644 index 0000000..bccd5a2 --- /dev/null +++ b/reports/raw/codeql-java-modeling/dfb-taint-java-model-store-separation-negative.sarif.json @@ -0,0 +1 @@ +{"$schema":"https://json.schemastore.org/sarif-2.1.0.json","version":"2.1.0","runs":[{"tool":{"driver":{"name":"CodeQL","organization":"GitHub","semanticVersion":"2.26.3","notifications":[{"id":"java/baseline/expected-extracted-files","name":"java/baseline/expected-extracted-files","shortDescription":{"text":"Expected extracted files"},"fullDescription":{"text":"Files appearing in the source archive that are expected to be extracted."},"defaultConfiguration":{"enabled":true},"properties":{"tags":["expected-extracted-files","telemetry"]}},{"id":"cli/file-coverage-baseline","name":"cli/file-coverage-baseline","shortDescription":{"text":"File coverage baseline telemetry"},"fullDescription":{"text":"File coverage baseline telemetry"},"defaultConfiguration":{"enabled":true}},{"id":"cli/platform","name":"cli/platform","shortDescription":{"text":"Platform"},"fullDescription":{"text":"Platform"},"defaultConfiguration":{"enabled":true}},{"id":"cli/sip-enablement","name":"cli/sip-enablement","shortDescription":{"text":"macOS SIP enablement status"},"fullDescription":{"text":"macOS SIP enablement status"},"defaultConfiguration":{"enabled":true}},{"id":"java/extractor/summary","name":"java/extractor/summary","shortDescription":{"text":"Java extractor telemetry"},"fullDescription":{"text":"Java extractor telemetry"},"defaultConfiguration":{"enabled":true}}],"rules":[{"id":"dataflowbench/java-taint-modeling","name":"dataflowbench/java-taint-modeling","shortDescription":{"text":"DataFlowBench Java taint-modeling matrix"},"fullDescription":{"text":"Encodes the twelve benchmark-supplied model declarations of docs/modeling-matrix.md natively in CodeQL's data-flow configuration surface, for the Java modeling population."},"defaultConfiguration":{"enabled":true,"level":"warning"},"properties":{"tags":["security"],"description":"Encodes the twelve benchmark-supplied model declarations of\n docs/modeling-matrix.md natively in CodeQL's data-flow\n configuration surface, for the Java modeling population.","id":"dataflowbench/java-taint-modeling","kind":"path-problem","name":"DataFlowBench Java taint-modeling matrix","precision":"high","problem.severity":"warning"}}]},"extensions":[{"name":"dataflowbench/codeql-java","semanticVersion":"0.0.1","locations":[{"uri":"file:///Users/dave/Workspace/BrokkAi/dataflowbench/.claude/worktrees/agent-af332237afc5e1bcf/adapters/codeql/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/Workspace/BrokkAi/dataflowbench/.claude/worktrees/agent-af332237afc5e1bcf/adapters/codeql/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]},{"name":"codeql/java-all","semanticVersion":"9.2.3+44a68d3a47fcbcd6a6a76ec7d1c1b3a1a28b201e","locations":[{"uri":"file:///Users/dave/.codeql/packages/codeql/java-all/9.2.3/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/.codeql/packages/codeql/java-all/9.2.3/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]},{"name":"codeql/threat-models","semanticVersion":"1.0.55+44a68d3a47fcbcd6a6a76ec7d1c1b3a1a28b201e","locations":[{"uri":"file:///Users/dave/.codeql/packages/codeql/threat-models/1.0.55/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/.codeql/packages/codeql/threat-models/1.0.55/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]}]},"invocations":[{"toolExecutionNotifications":[{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"ModelStoreSeparationNegative.java","uriBaseId":"%SRCROOT%","index":0}}}],"message":{"text":""},"level":"none","descriptor":{"id":"java/baseline/expected-extracted-files","index":0},"properties":{"formattedMessage":{"text":""}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:35:09.579255Z","descriptor":{"id":"cli/file-coverage-baseline","index":1},"properties":{"attributes":{"durationMilliseconds":21},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:35:09.580159Z","descriptor":{"id":"cli/platform","index":2},"properties":{"attributes":{"arch":"aarch64","name":"Mac OS X","version":"26.6.2"},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:35:09.587980Z","descriptor":{"id":"cli/sip-enablement","index":3},"properties":{"attributes":{"isEnabled":true},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":"Internal telemetry for the Java extractor.\n\nNo action needed.","markdown":"Internal telemetry for the Java extractor.\n\nNo action needed."},"level":"note","timeUtc":"2026-08-26T13:35:10.934428Z","descriptor":{"id":"java/extractor/summary","index":4},"properties":{"attributes":{"java_vendor":"Eclipse Adoptium","java_version":"21.0.8"},"visibility":{"statusPage":false,"telemetry":true}}}],"executionSuccessful":true}],"artifacts":[{"location":{"uri":"ModelStoreSeparationNegative.java","uriBaseId":"%SRCROOT%","index":0}}],"results":[],"columnKind":"utf16CodeUnits","properties":{"semmle.formatSpecifier":"sarif-latest"}}]} \ No newline at end of file diff --git a/reports/raw/codeql-java-modeling/dfb-taint-java-model-store-separation-positive.sarif.json b/reports/raw/codeql-java-modeling/dfb-taint-java-model-store-separation-positive.sarif.json new file mode 100644 index 0000000..71fee2a --- /dev/null +++ b/reports/raw/codeql-java-modeling/dfb-taint-java-model-store-separation-positive.sarif.json @@ -0,0 +1 @@ +{"$schema":"https://json.schemastore.org/sarif-2.1.0.json","version":"2.1.0","runs":[{"tool":{"driver":{"name":"CodeQL","organization":"GitHub","semanticVersion":"2.26.3","notifications":[{"id":"java/baseline/expected-extracted-files","name":"java/baseline/expected-extracted-files","shortDescription":{"text":"Expected extracted files"},"fullDescription":{"text":"Files appearing in the source archive that are expected to be extracted."},"defaultConfiguration":{"enabled":true},"properties":{"tags":["expected-extracted-files","telemetry"]}},{"id":"cli/file-coverage-baseline","name":"cli/file-coverage-baseline","shortDescription":{"text":"File coverage baseline telemetry"},"fullDescription":{"text":"File coverage baseline telemetry"},"defaultConfiguration":{"enabled":true}},{"id":"cli/platform","name":"cli/platform","shortDescription":{"text":"Platform"},"fullDescription":{"text":"Platform"},"defaultConfiguration":{"enabled":true}},{"id":"cli/sip-enablement","name":"cli/sip-enablement","shortDescription":{"text":"macOS SIP enablement status"},"fullDescription":{"text":"macOS SIP enablement status"},"defaultConfiguration":{"enabled":true}},{"id":"java/extractor/summary","name":"java/extractor/summary","shortDescription":{"text":"Java extractor telemetry"},"fullDescription":{"text":"Java extractor telemetry"},"defaultConfiguration":{"enabled":true}}],"rules":[{"id":"dataflowbench/java-taint-modeling","name":"dataflowbench/java-taint-modeling","shortDescription":{"text":"DataFlowBench Java taint-modeling matrix"},"fullDescription":{"text":"Encodes the twelve benchmark-supplied model declarations of docs/modeling-matrix.md natively in CodeQL's data-flow configuration surface, for the Java modeling population."},"defaultConfiguration":{"enabled":true,"level":"warning"},"properties":{"tags":["security"],"description":"Encodes the twelve benchmark-supplied model declarations of\n docs/modeling-matrix.md natively in CodeQL's data-flow\n configuration surface, for the Java modeling population.","id":"dataflowbench/java-taint-modeling","kind":"path-problem","name":"DataFlowBench Java taint-modeling matrix","precision":"high","problem.severity":"warning"}}]},"extensions":[{"name":"dataflowbench/codeql-java","semanticVersion":"0.0.1","locations":[{"uri":"file:///Users/dave/Workspace/BrokkAi/dataflowbench/.claude/worktrees/agent-af332237afc5e1bcf/adapters/codeql/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/Workspace/BrokkAi/dataflowbench/.claude/worktrees/agent-af332237afc5e1bcf/adapters/codeql/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]},{"name":"codeql/java-all","semanticVersion":"9.2.3+44a68d3a47fcbcd6a6a76ec7d1c1b3a1a28b201e","locations":[{"uri":"file:///Users/dave/.codeql/packages/codeql/java-all/9.2.3/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/.codeql/packages/codeql/java-all/9.2.3/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]},{"name":"codeql/threat-models","semanticVersion":"1.0.55+44a68d3a47fcbcd6a6a76ec7d1c1b3a1a28b201e","locations":[{"uri":"file:///Users/dave/.codeql/packages/codeql/threat-models/1.0.55/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/.codeql/packages/codeql/threat-models/1.0.55/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]}]},"invocations":[{"toolExecutionNotifications":[{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"ModelStoreSeparationPositive.java","uriBaseId":"%SRCROOT%","index":0}}}],"message":{"text":""},"level":"none","descriptor":{"id":"java/baseline/expected-extracted-files","index":0},"properties":{"formattedMessage":{"text":""}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:35:20.883262Z","descriptor":{"id":"cli/file-coverage-baseline","index":1},"properties":{"attributes":{"durationMilliseconds":20},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:35:20.885204Z","descriptor":{"id":"cli/platform","index":2},"properties":{"attributes":{"arch":"aarch64","name":"Mac OS X","version":"26.6.2"},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:35:20.894566Z","descriptor":{"id":"cli/sip-enablement","index":3},"properties":{"attributes":{"isEnabled":true},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":"Internal telemetry for the Java extractor.\n\nNo action needed.","markdown":"Internal telemetry for the Java extractor.\n\nNo action needed."},"level":"note","timeUtc":"2026-08-26T13:35:22.461559Z","descriptor":{"id":"java/extractor/summary","index":4},"properties":{"attributes":{"java_vendor":"Eclipse Adoptium","java_version":"21.0.8"},"visibility":{"statusPage":false,"telemetry":true}}}],"executionSuccessful":true}],"artifacts":[{"location":{"uri":"ModelStoreSeparationPositive.java","uriBaseId":"%SRCROOT%","index":0}}],"results":[{"ruleId":"dataflowbench/java-taint-modeling","ruleIndex":0,"rule":{"id":"dataflowbench/java-taint-modeling","index":0},"message":{"text":"A benchmark-declared model carried input to the declared sink."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"ModelStoreSeparationPositive.java","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":27,"startColumn":18,"endColumn":32}}}],"partialFingerprints":{"primaryLocationLineHash":"3b7079b5f762b79f:1","primaryLocationStartColumnFingerprint":"9"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"ModelStoreSeparationPositive.java","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":23,"startColumn":24,"endColumn":36}},"message":{"text":"dfb_source(...) : String"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"ModelStoreSeparationPositive.java","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":27,"startColumn":18,"endColumn":32}},"message":{"text":"get(...)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]}]}]}],"relatedLocations":[{"physicalLocation":{"artifactLocation":{"uri":"ModelStoreSeparationPositive.java","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":23,"startColumn":24,"endColumn":36}}}]}],"columnKind":"utf16CodeUnits","properties":{"semmle.formatSpecifier":"sarif-latest"}}]} \ No newline at end of file diff --git a/reports/raw/codeql-java-modeling/dfb-taint-java-model-summary-field-negative.sarif.json b/reports/raw/codeql-java-modeling/dfb-taint-java-model-summary-field-negative.sarif.json new file mode 100644 index 0000000..55d4165 --- /dev/null +++ b/reports/raw/codeql-java-modeling/dfb-taint-java-model-summary-field-negative.sarif.json @@ -0,0 +1 @@ +{"$schema":"https://json.schemastore.org/sarif-2.1.0.json","version":"2.1.0","runs":[{"tool":{"driver":{"name":"CodeQL","organization":"GitHub","semanticVersion":"2.26.3","notifications":[{"id":"java/baseline/expected-extracted-files","name":"java/baseline/expected-extracted-files","shortDescription":{"text":"Expected extracted files"},"fullDescription":{"text":"Files appearing in the source archive that are expected to be extracted."},"defaultConfiguration":{"enabled":true},"properties":{"tags":["expected-extracted-files","telemetry"]}},{"id":"cli/file-coverage-baseline","name":"cli/file-coverage-baseline","shortDescription":{"text":"File coverage baseline telemetry"},"fullDescription":{"text":"File coverage baseline telemetry"},"defaultConfiguration":{"enabled":true}},{"id":"cli/platform","name":"cli/platform","shortDescription":{"text":"Platform"},"fullDescription":{"text":"Platform"},"defaultConfiguration":{"enabled":true}},{"id":"cli/sip-enablement","name":"cli/sip-enablement","shortDescription":{"text":"macOS SIP enablement status"},"fullDescription":{"text":"macOS SIP enablement status"},"defaultConfiguration":{"enabled":true}},{"id":"java/extractor/summary","name":"java/extractor/summary","shortDescription":{"text":"Java extractor telemetry"},"fullDescription":{"text":"Java extractor telemetry"},"defaultConfiguration":{"enabled":true}}],"rules":[{"id":"dataflowbench/java-taint-modeling","name":"dataflowbench/java-taint-modeling","shortDescription":{"text":"DataFlowBench Java taint-modeling matrix"},"fullDescription":{"text":"Encodes the twelve benchmark-supplied model declarations of docs/modeling-matrix.md natively in CodeQL's data-flow configuration surface, for the Java modeling population."},"defaultConfiguration":{"enabled":true,"level":"warning"},"properties":{"tags":["security"],"description":"Encodes the twelve benchmark-supplied model declarations of\n docs/modeling-matrix.md natively in CodeQL's data-flow\n configuration surface, for the Java modeling population.","id":"dataflowbench/java-taint-modeling","kind":"path-problem","name":"DataFlowBench Java taint-modeling matrix","precision":"high","problem.severity":"warning"}}]},"extensions":[{"name":"dataflowbench/codeql-java","semanticVersion":"0.0.1","locations":[{"uri":"file:///Users/dave/Workspace/BrokkAi/dataflowbench/.claude/worktrees/agent-af332237afc5e1bcf/adapters/codeql/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/Workspace/BrokkAi/dataflowbench/.claude/worktrees/agent-af332237afc5e1bcf/adapters/codeql/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]},{"name":"codeql/java-all","semanticVersion":"9.2.3+44a68d3a47fcbcd6a6a76ec7d1c1b3a1a28b201e","locations":[{"uri":"file:///Users/dave/.codeql/packages/codeql/java-all/9.2.3/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/.codeql/packages/codeql/java-all/9.2.3/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]},{"name":"codeql/threat-models","semanticVersion":"1.0.55+44a68d3a47fcbcd6a6a76ec7d1c1b3a1a28b201e","locations":[{"uri":"file:///Users/dave/.codeql/packages/codeql/threat-models/1.0.55/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/.codeql/packages/codeql/threat-models/1.0.55/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]}]},"invocations":[{"toolExecutionNotifications":[{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"ModelSummaryFieldNegative.java","uriBaseId":"%SRCROOT%","index":0}}}],"message":{"text":""},"level":"none","descriptor":{"id":"java/baseline/expected-extracted-files","index":0},"properties":{"formattedMessage":{"text":""}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:35:31.941734Z","descriptor":{"id":"cli/file-coverage-baseline","index":1},"properties":{"attributes":{"durationMilliseconds":21},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:35:31.943Z","descriptor":{"id":"cli/platform","index":2},"properties":{"attributes":{"arch":"aarch64","name":"Mac OS X","version":"26.6.2"},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:35:31.952053Z","descriptor":{"id":"cli/sip-enablement","index":3},"properties":{"attributes":{"isEnabled":true},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":"Internal telemetry for the Java extractor.\n\nNo action needed.","markdown":"Internal telemetry for the Java extractor.\n\nNo action needed."},"level":"note","timeUtc":"2026-08-26T13:35:33.273854Z","descriptor":{"id":"java/extractor/summary","index":4},"properties":{"attributes":{"java_vendor":"Eclipse Adoptium","java_version":"21.0.8"},"visibility":{"statusPage":false,"telemetry":true}}}],"executionSuccessful":true}],"artifacts":[{"location":{"uri":"ModelSummaryFieldNegative.java","uriBaseId":"%SRCROOT%","index":0}}],"results":[],"columnKind":"utf16CodeUnits","properties":{"semmle.formatSpecifier":"sarif-latest"}}]} \ No newline at end of file diff --git a/reports/raw/codeql-java-modeling/dfb-taint-java-model-summary-field-positive.sarif.json b/reports/raw/codeql-java-modeling/dfb-taint-java-model-summary-field-positive.sarif.json new file mode 100644 index 0000000..7378c49 --- /dev/null +++ b/reports/raw/codeql-java-modeling/dfb-taint-java-model-summary-field-positive.sarif.json @@ -0,0 +1 @@ +{"$schema":"https://json.schemastore.org/sarif-2.1.0.json","version":"2.1.0","runs":[{"tool":{"driver":{"name":"CodeQL","organization":"GitHub","semanticVersion":"2.26.3","notifications":[{"id":"java/baseline/expected-extracted-files","name":"java/baseline/expected-extracted-files","shortDescription":{"text":"Expected extracted files"},"fullDescription":{"text":"Files appearing in the source archive that are expected to be extracted."},"defaultConfiguration":{"enabled":true},"properties":{"tags":["expected-extracted-files","telemetry"]}},{"id":"cli/file-coverage-baseline","name":"cli/file-coverage-baseline","shortDescription":{"text":"File coverage baseline telemetry"},"fullDescription":{"text":"File coverage baseline telemetry"},"defaultConfiguration":{"enabled":true}},{"id":"cli/platform","name":"cli/platform","shortDescription":{"text":"Platform"},"fullDescription":{"text":"Platform"},"defaultConfiguration":{"enabled":true}},{"id":"cli/sip-enablement","name":"cli/sip-enablement","shortDescription":{"text":"macOS SIP enablement status"},"fullDescription":{"text":"macOS SIP enablement status"},"defaultConfiguration":{"enabled":true}},{"id":"java/extractor/summary","name":"java/extractor/summary","shortDescription":{"text":"Java extractor telemetry"},"fullDescription":{"text":"Java extractor telemetry"},"defaultConfiguration":{"enabled":true}}],"rules":[{"id":"dataflowbench/java-taint-modeling","name":"dataflowbench/java-taint-modeling","shortDescription":{"text":"DataFlowBench Java taint-modeling matrix"},"fullDescription":{"text":"Encodes the twelve benchmark-supplied model declarations of docs/modeling-matrix.md natively in CodeQL's data-flow configuration surface, for the Java modeling population."},"defaultConfiguration":{"enabled":true,"level":"warning"},"properties":{"tags":["security"],"description":"Encodes the twelve benchmark-supplied model declarations of\n docs/modeling-matrix.md natively in CodeQL's data-flow\n configuration surface, for the Java modeling population.","id":"dataflowbench/java-taint-modeling","kind":"path-problem","name":"DataFlowBench Java taint-modeling matrix","precision":"high","problem.severity":"warning"}}]},"extensions":[{"name":"dataflowbench/codeql-java","semanticVersion":"0.0.1","locations":[{"uri":"file:///Users/dave/Workspace/BrokkAi/dataflowbench/.claude/worktrees/agent-af332237afc5e1bcf/adapters/codeql/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/Workspace/BrokkAi/dataflowbench/.claude/worktrees/agent-af332237afc5e1bcf/adapters/codeql/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]},{"name":"codeql/java-all","semanticVersion":"9.2.3+44a68d3a47fcbcd6a6a76ec7d1c1b3a1a28b201e","locations":[{"uri":"file:///Users/dave/.codeql/packages/codeql/java-all/9.2.3/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/.codeql/packages/codeql/java-all/9.2.3/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]},{"name":"codeql/threat-models","semanticVersion":"1.0.55+44a68d3a47fcbcd6a6a76ec7d1c1b3a1a28b201e","locations":[{"uri":"file:///Users/dave/.codeql/packages/codeql/threat-models/1.0.55/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/.codeql/packages/codeql/threat-models/1.0.55/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]}]},"invocations":[{"toolExecutionNotifications":[{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"ModelSummaryFieldPositive.java","uriBaseId":"%SRCROOT%","index":0}}}],"message":{"text":""},"level":"none","descriptor":{"id":"java/baseline/expected-extracted-files","index":0},"properties":{"formattedMessage":{"text":""}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:35:42.750731Z","descriptor":{"id":"cli/file-coverage-baseline","index":1},"properties":{"attributes":{"durationMilliseconds":19},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:35:42.751755Z","descriptor":{"id":"cli/platform","index":2},"properties":{"attributes":{"arch":"aarch64","name":"Mac OS X","version":"26.6.2"},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:35:42.759253Z","descriptor":{"id":"cli/sip-enablement","index":3},"properties":{"attributes":{"isEnabled":true},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":"Internal telemetry for the Java extractor.\n\nNo action needed.","markdown":"Internal telemetry for the Java extractor.\n\nNo action needed."},"level":"note","timeUtc":"2026-08-26T13:35:44.143362Z","descriptor":{"id":"java/extractor/summary","index":4},"properties":{"attributes":{"java_vendor":"Eclipse Adoptium","java_version":"21.0.8"},"visibility":{"statusPage":false,"telemetry":true}}}],"executionSuccessful":true}],"artifacts":[{"location":{"uri":"ModelSummaryFieldPositive.java","uriBaseId":"%SRCROOT%","index":0}}],"results":[{"ruleId":"dataflowbench/java-taint-modeling","ruleIndex":0,"rule":{"id":"dataflowbench/java-taint-modeling","index":0},"message":{"text":"A benchmark-declared model carried input to the declared sink."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"ModelSummaryFieldPositive.java","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":22,"startColumn":18,"endColumn":29}}}],"partialFingerprints":{"primaryLocationLineHash":"eb50e249d481ac68:1","primaryLocationStartColumnFingerprint":"9"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"ModelSummaryFieldPositive.java","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":21,"startColumn":24,"endColumn":36}},"message":{"text":"dfb_source(...) : String"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"ModelSummaryFieldPositive.java","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":22,"startColumn":18,"endColumn":29}},"message":{"text":"box.payload"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]}]}]}],"relatedLocations":[{"physicalLocation":{"artifactLocation":{"uri":"ModelSummaryFieldPositive.java","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":21,"startColumn":24,"endColumn":36}}}]}],"columnKind":"utf16CodeUnits","properties":{"semmle.formatSpecifier":"sarif-latest"}}]} \ No newline at end of file diff --git a/reports/raw/codeql-java-modeling/dfb-taint-java-model-summary-through-negative.sarif.json b/reports/raw/codeql-java-modeling/dfb-taint-java-model-summary-through-negative.sarif.json new file mode 100644 index 0000000..f543795 --- /dev/null +++ b/reports/raw/codeql-java-modeling/dfb-taint-java-model-summary-through-negative.sarif.json @@ -0,0 +1 @@ +{"$schema":"https://json.schemastore.org/sarif-2.1.0.json","version":"2.1.0","runs":[{"tool":{"driver":{"name":"CodeQL","organization":"GitHub","semanticVersion":"2.26.3","notifications":[{"id":"java/baseline/expected-extracted-files","name":"java/baseline/expected-extracted-files","shortDescription":{"text":"Expected extracted files"},"fullDescription":{"text":"Files appearing in the source archive that are expected to be extracted."},"defaultConfiguration":{"enabled":true},"properties":{"tags":["expected-extracted-files","telemetry"]}},{"id":"cli/file-coverage-baseline","name":"cli/file-coverage-baseline","shortDescription":{"text":"File coverage baseline telemetry"},"fullDescription":{"text":"File coverage baseline telemetry"},"defaultConfiguration":{"enabled":true}},{"id":"cli/platform","name":"cli/platform","shortDescription":{"text":"Platform"},"fullDescription":{"text":"Platform"},"defaultConfiguration":{"enabled":true}},{"id":"cli/sip-enablement","name":"cli/sip-enablement","shortDescription":{"text":"macOS SIP enablement status"},"fullDescription":{"text":"macOS SIP enablement status"},"defaultConfiguration":{"enabled":true}},{"id":"java/extractor/summary","name":"java/extractor/summary","shortDescription":{"text":"Java extractor telemetry"},"fullDescription":{"text":"Java extractor telemetry"},"defaultConfiguration":{"enabled":true}}],"rules":[{"id":"dataflowbench/java-taint-modeling","name":"dataflowbench/java-taint-modeling","shortDescription":{"text":"DataFlowBench Java taint-modeling matrix"},"fullDescription":{"text":"Encodes the twelve benchmark-supplied model declarations of docs/modeling-matrix.md natively in CodeQL's data-flow configuration surface, for the Java modeling population."},"defaultConfiguration":{"enabled":true,"level":"warning"},"properties":{"tags":["security"],"description":"Encodes the twelve benchmark-supplied model declarations of\n docs/modeling-matrix.md natively in CodeQL's data-flow\n configuration surface, for the Java modeling population.","id":"dataflowbench/java-taint-modeling","kind":"path-problem","name":"DataFlowBench Java taint-modeling matrix","precision":"high","problem.severity":"warning"}}]},"extensions":[{"name":"dataflowbench/codeql-java","semanticVersion":"0.0.1","locations":[{"uri":"file:///Users/dave/Workspace/BrokkAi/dataflowbench/.claude/worktrees/agent-af332237afc5e1bcf/adapters/codeql/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/Workspace/BrokkAi/dataflowbench/.claude/worktrees/agent-af332237afc5e1bcf/adapters/codeql/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]},{"name":"codeql/java-all","semanticVersion":"9.2.3+44a68d3a47fcbcd6a6a76ec7d1c1b3a1a28b201e","locations":[{"uri":"file:///Users/dave/.codeql/packages/codeql/java-all/9.2.3/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/.codeql/packages/codeql/java-all/9.2.3/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]},{"name":"codeql/threat-models","semanticVersion":"1.0.55+44a68d3a47fcbcd6a6a76ec7d1c1b3a1a28b201e","locations":[{"uri":"file:///Users/dave/.codeql/packages/codeql/threat-models/1.0.55/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/.codeql/packages/codeql/threat-models/1.0.55/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]}]},"invocations":[{"toolExecutionNotifications":[{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"Bridge.java","uriBaseId":"%SRCROOT%","index":0}}}],"message":{"text":""},"level":"none","descriptor":{"id":"java/baseline/expected-extracted-files","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"ModelSummaryThroughNegative.java","uriBaseId":"%SRCROOT%","index":1}}}],"message":{"text":""},"level":"none","descriptor":{"id":"java/baseline/expected-extracted-files","index":0},"properties":{"formattedMessage":{"text":""}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:35:53.659732Z","descriptor":{"id":"cli/file-coverage-baseline","index":1},"properties":{"attributes":{"durationMilliseconds":20},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:35:53.661037Z","descriptor":{"id":"cli/platform","index":2},"properties":{"attributes":{"arch":"aarch64","name":"Mac OS X","version":"26.6.2"},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:35:53.670168Z","descriptor":{"id":"cli/sip-enablement","index":3},"properties":{"attributes":{"isEnabled":true},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":"Internal telemetry for the Java extractor.\n\nNo action needed.","markdown":"Internal telemetry for the Java extractor.\n\nNo action needed."},"level":"note","timeUtc":"2026-08-26T13:35:55.009280Z","descriptor":{"id":"java/extractor/summary","index":4},"properties":{"attributes":{"java_vendor":"Eclipse Adoptium","java_version":"21.0.8"},"visibility":{"statusPage":false,"telemetry":true}}}],"executionSuccessful":true}],"artifacts":[{"location":{"uri":"Bridge.java","uriBaseId":"%SRCROOT%","index":0}},{"location":{"uri":"ModelSummaryThroughNegative.java","uriBaseId":"%SRCROOT%","index":1}}],"results":[],"columnKind":"utf16CodeUnits","properties":{"semmle.formatSpecifier":"sarif-latest"}}]} \ No newline at end of file diff --git a/reports/raw/codeql-java-modeling/dfb-taint-java-model-summary-through-positive.sarif.json b/reports/raw/codeql-java-modeling/dfb-taint-java-model-summary-through-positive.sarif.json new file mode 100644 index 0000000..226b866 --- /dev/null +++ b/reports/raw/codeql-java-modeling/dfb-taint-java-model-summary-through-positive.sarif.json @@ -0,0 +1 @@ +{"$schema":"https://json.schemastore.org/sarif-2.1.0.json","version":"2.1.0","runs":[{"tool":{"driver":{"name":"CodeQL","organization":"GitHub","semanticVersion":"2.26.3","notifications":[{"id":"java/baseline/expected-extracted-files","name":"java/baseline/expected-extracted-files","shortDescription":{"text":"Expected extracted files"},"fullDescription":{"text":"Files appearing in the source archive that are expected to be extracted."},"defaultConfiguration":{"enabled":true},"properties":{"tags":["expected-extracted-files","telemetry"]}},{"id":"cli/file-coverage-baseline","name":"cli/file-coverage-baseline","shortDescription":{"text":"File coverage baseline telemetry"},"fullDescription":{"text":"File coverage baseline telemetry"},"defaultConfiguration":{"enabled":true}},{"id":"cli/platform","name":"cli/platform","shortDescription":{"text":"Platform"},"fullDescription":{"text":"Platform"},"defaultConfiguration":{"enabled":true}},{"id":"cli/sip-enablement","name":"cli/sip-enablement","shortDescription":{"text":"macOS SIP enablement status"},"fullDescription":{"text":"macOS SIP enablement status"},"defaultConfiguration":{"enabled":true}},{"id":"java/extractor/summary","name":"java/extractor/summary","shortDescription":{"text":"Java extractor telemetry"},"fullDescription":{"text":"Java extractor telemetry"},"defaultConfiguration":{"enabled":true}}],"rules":[{"id":"dataflowbench/java-taint-modeling","name":"dataflowbench/java-taint-modeling","shortDescription":{"text":"DataFlowBench Java taint-modeling matrix"},"fullDescription":{"text":"Encodes the twelve benchmark-supplied model declarations of docs/modeling-matrix.md natively in CodeQL's data-flow configuration surface, for the Java modeling population."},"defaultConfiguration":{"enabled":true,"level":"warning"},"properties":{"tags":["security"],"description":"Encodes the twelve benchmark-supplied model declarations of\n docs/modeling-matrix.md natively in CodeQL's data-flow\n configuration surface, for the Java modeling population.","id":"dataflowbench/java-taint-modeling","kind":"path-problem","name":"DataFlowBench Java taint-modeling matrix","precision":"high","problem.severity":"warning"}}]},"extensions":[{"name":"dataflowbench/codeql-java","semanticVersion":"0.0.1","locations":[{"uri":"file:///Users/dave/Workspace/BrokkAi/dataflowbench/.claude/worktrees/agent-af332237afc5e1bcf/adapters/codeql/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/Workspace/BrokkAi/dataflowbench/.claude/worktrees/agent-af332237afc5e1bcf/adapters/codeql/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]},{"name":"codeql/java-all","semanticVersion":"9.2.3+44a68d3a47fcbcd6a6a76ec7d1c1b3a1a28b201e","locations":[{"uri":"file:///Users/dave/.codeql/packages/codeql/java-all/9.2.3/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/.codeql/packages/codeql/java-all/9.2.3/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]},{"name":"codeql/threat-models","semanticVersion":"1.0.55+44a68d3a47fcbcd6a6a76ec7d1c1b3a1a28b201e","locations":[{"uri":"file:///Users/dave/.codeql/packages/codeql/threat-models/1.0.55/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/.codeql/packages/codeql/threat-models/1.0.55/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]}]},"invocations":[{"toolExecutionNotifications":[{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"Bridge.java","uriBaseId":"%SRCROOT%","index":1}}}],"message":{"text":""},"level":"none","descriptor":{"id":"java/baseline/expected-extracted-files","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"ModelSummaryThroughPositive.java","uriBaseId":"%SRCROOT%","index":0}}}],"message":{"text":""},"level":"none","descriptor":{"id":"java/baseline/expected-extracted-files","index":0},"properties":{"formattedMessage":{"text":""}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:36:04.350955Z","descriptor":{"id":"cli/file-coverage-baseline","index":1},"properties":{"attributes":{"durationMilliseconds":18},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:36:04.352098Z","descriptor":{"id":"cli/platform","index":2},"properties":{"attributes":{"arch":"aarch64","name":"Mac OS X","version":"26.6.2"},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:36:04.360838Z","descriptor":{"id":"cli/sip-enablement","index":3},"properties":{"attributes":{"isEnabled":true},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":"Internal telemetry for the Java extractor.\n\nNo action needed.","markdown":"Internal telemetry for the Java extractor.\n\nNo action needed."},"level":"note","timeUtc":"2026-08-26T13:36:05.677465Z","descriptor":{"id":"java/extractor/summary","index":4},"properties":{"attributes":{"java_vendor":"Eclipse Adoptium","java_version":"21.0.8"},"visibility":{"statusPage":false,"telemetry":true}}}],"executionSuccessful":true}],"artifacts":[{"location":{"uri":"ModelSummaryThroughPositive.java","uriBaseId":"%SRCROOT%","index":0}},{"location":{"uri":"Bridge.java","uriBaseId":"%SRCROOT%","index":1}}],"results":[{"ruleId":"dataflowbench/java-taint-modeling","ruleIndex":0,"rule":{"id":"dataflowbench/java-taint-modeling","index":0},"message":{"text":"A benchmark-declared model carried input to the declared sink."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"ModelSummaryThroughPositive.java","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":11,"startColumn":18,"endColumn":43}}}],"partialFingerprints":{"primaryLocationLineHash":"b44d1b374e8684bb:1","primaryLocationStartColumnFingerprint":"9"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"ModelSummaryThroughPositive.java","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":11,"startColumn":30,"endColumn":42}},"message":{"text":"dfb_source(...) : String"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"Bridge.java","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":4,"startColumn":24,"endColumn":36}},"message":{"text":"value : String"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"Bridge.java","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":5,"startColumn":16,"endColumn":21}},"message":{"text":"value : String"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"ModelSummaryThroughPositive.java","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":11,"startColumn":18,"endColumn":43}},"message":{"text":"pass(...)"}}}]}]}],"relatedLocations":[{"physicalLocation":{"artifactLocation":{"uri":"ModelSummaryThroughPositive.java","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":11,"startColumn":30,"endColumn":42}}}]}],"columnKind":"utf16CodeUnits","properties":{"semmle.formatSpecifier":"sarif-latest"}}]} \ No newline at end of file diff --git a/reports/raw/joern-java-modeling/dfb-taint-java-model-declared-sink-negative.json b/reports/raw/joern-java-modeling/dfb-taint-java-model-declared-sink-negative.json new file mode 100644 index 0000000..e5dd0a2 --- /dev/null +++ b/reports/raw/joern-java-modeling/dfb-taint-java-model-declared-sink-negative.json @@ -0,0 +1 @@ +{"adapter":"joern","evidence_kind":"joern-modeled-reachable-by-flows","input_path":"/var/folders/t1/k_27wjcd4095w9w121dm92_w0000gn/T/dataflowbench-modeling-joern-java/dfb-taint-java-model-declared-sink-negative/source","frontend_language":"JAVASRC","source_function":"dfb_source","sink_function":"record","source_kind":"call-return","semantics_path":"/Users/dave/Workspace/BrokkAi/dataflowbench/.claude/worktrees/agent-af332237afc5e1bcf/adapters/joern/semantics/model-java.semantics","state":"analyzed","method_count":6,"declared_semantic_count":3,"source_node_count":1,"sink_node_count":1,"source_nodes":[{"label":"CALL","file":"ModelDeclaredSinkNegative.java","line":15,"method":"dataflowbench.taint.ModelDeclaredSinkNegative.run:void()","code":"dfb_source()"}],"sink_nodes":[{"label":"LITERAL","file":"ModelDeclaredSinkNegative.java","line":16,"method":"dataflowbench.taint.ModelDeclaredSinkNegative.run:void()","code":"\"clean\""}],"flow_count":0,"flows":[]} diff --git a/reports/raw/joern-java-modeling/dfb-taint-java-model-declared-sink-positive.json b/reports/raw/joern-java-modeling/dfb-taint-java-model-declared-sink-positive.json new file mode 100644 index 0000000..f0b2372 --- /dev/null +++ b/reports/raw/joern-java-modeling/dfb-taint-java-model-declared-sink-positive.json @@ -0,0 +1 @@ +{"adapter":"joern","evidence_kind":"joern-modeled-reachable-by-flows","input_path":"/var/folders/t1/k_27wjcd4095w9w121dm92_w0000gn/T/dataflowbench-modeling-joern-java/dfb-taint-java-model-declared-sink-positive/source","frontend_language":"JAVASRC","source_function":"dfb_source","sink_function":"record","source_kind":"call-return","semantics_path":"/Users/dave/Workspace/BrokkAi/dataflowbench/.claude/worktrees/agent-af332237afc5e1bcf/adapters/joern/semantics/model-java.semantics","state":"analyzed","method_count":6,"declared_semantic_count":3,"source_node_count":1,"sink_node_count":1,"source_nodes":[{"label":"CALL","file":"ModelDeclaredSinkPositive.java","line":15,"method":"dataflowbench.taint.ModelDeclaredSinkPositive.run:void()","code":"dfb_source()"}],"sink_nodes":[{"label":"CALL","file":"ModelDeclaredSinkPositive.java","line":15,"method":"dataflowbench.taint.ModelDeclaredSinkPositive.run:void()","code":"dfb_source()"}],"flow_count":1,"flows":[{"elements":[{"label":"CALL","file":"ModelDeclaredSinkPositive.java","line":15,"method":"dataflowbench.taint.ModelDeclaredSinkPositive.run:void()","code":"dfb_source()"}]}]} diff --git a/reports/raw/joern-java-modeling/dfb-taint-java-model-declared-source-negative.json b/reports/raw/joern-java-modeling/dfb-taint-java-model-declared-source-negative.json new file mode 100644 index 0000000..8dae026 --- /dev/null +++ b/reports/raw/joern-java-modeling/dfb-taint-java-model-declared-source-negative.json @@ -0,0 +1 @@ +{"adapter":"joern","evidence_kind":"joern-modeled-reachable-by-flows","input_path":"/var/folders/t1/k_27wjcd4095w9w121dm92_w0000gn/T/dataflowbench-modeling-joern-java/dfb-taint-java-model-declared-source-negative/source","frontend_language":"JAVASRC","source_function":"fetchRemote","sink_function":"dfb_sink","source_kind":"call-return","semantics_path":"/Users/dave/Workspace/BrokkAi/dataflowbench/.claude/worktrees/agent-af332237afc5e1bcf/adapters/joern/semantics/model-java.semantics","state":"analyzed","method_count":6,"declared_semantic_count":3,"source_node_count":0,"sink_node_count":1,"source_nodes":[],"sink_nodes":[{"label":"CALL","file":"ModelDeclaredSourceNegative.java","line":17,"method":"dataflowbench.taint.ModelDeclaredSourceNegative.run:void()","code":"Config.fetchLocal()"}],"flow_count":0,"flows":[]} diff --git a/reports/raw/joern-java-modeling/dfb-taint-java-model-declared-source-positive.json b/reports/raw/joern-java-modeling/dfb-taint-java-model-declared-source-positive.json new file mode 100644 index 0000000..5b8c02b --- /dev/null +++ b/reports/raw/joern-java-modeling/dfb-taint-java-model-declared-source-positive.json @@ -0,0 +1 @@ +{"adapter":"joern","evidence_kind":"joern-modeled-reachable-by-flows","input_path":"/var/folders/t1/k_27wjcd4095w9w121dm92_w0000gn/T/dataflowbench-modeling-joern-java/dfb-taint-java-model-declared-source-positive/source","frontend_language":"JAVASRC","source_function":"fetchRemote","sink_function":"dfb_sink","source_kind":"call-return","semantics_path":"/Users/dave/Workspace/BrokkAi/dataflowbench/.claude/worktrees/agent-af332237afc5e1bcf/adapters/joern/semantics/model-java.semantics","state":"analyzed","method_count":6,"declared_semantic_count":3,"source_node_count":1,"sink_node_count":1,"source_nodes":[{"label":"CALL","file":"ModelDeclaredSourcePositive.java","line":17,"method":"dataflowbench.taint.ModelDeclaredSourcePositive.run:void()","code":"Config.fetchRemote()"}],"sink_nodes":[{"label":"CALL","file":"ModelDeclaredSourcePositive.java","line":17,"method":"dataflowbench.taint.ModelDeclaredSourcePositive.run:void()","code":"Config.fetchRemote()"}],"flow_count":1,"flows":[{"elements":[{"label":"CALL","file":"ModelDeclaredSourcePositive.java","line":17,"method":"dataflowbench.taint.ModelDeclaredSourcePositive.run:void()","code":"Config.fetchRemote()"}]}]} diff --git a/reports/raw/joern-java-modeling/dfb-taint-java-model-entrypoint-parameter-negative.json b/reports/raw/joern-java-modeling/dfb-taint-java-model-entrypoint-parameter-negative.json new file mode 100644 index 0000000..7885b24 --- /dev/null +++ b/reports/raw/joern-java-modeling/dfb-taint-java-model-entrypoint-parameter-negative.json @@ -0,0 +1 @@ +{"adapter":"joern","evidence_kind":"joern-modeled-reachable-by-flows","input_path":"/var/folders/t1/k_27wjcd4095w9w121dm92_w0000gn/T/dataflowbench-modeling-joern-java/dfb-taint-java-model-entrypoint-parameter-negative/source","frontend_language":"JAVASRC","source_function":"onRequest","sink_function":"dfb_sink","source_kind":"method-parameter","semantics_path":"/Users/dave/Workspace/BrokkAi/dataflowbench/.claude/worktrees/agent-af332237afc5e1bcf/adapters/joern/semantics/model-java.semantics","state":"analyzed","method_count":4,"declared_semantic_count":3,"source_node_count":1,"sink_node_count":2,"source_nodes":[{"label":"METHOD_PARAMETER_IN","file":"Handler.java","line":6,"method":"dataflowbench.taint.Handler.onRequest:void(java.lang.String)","code":"String input"}],"sink_nodes":[{"label":"LITERAL","file":"Handler.java","line":7,"method":"dataflowbench.taint.Handler.onRequest:void(java.lang.String)","code":"\"clean\""},{"label":"IDENTIFIER","file":"Handler.java","line":11,"method":"dataflowbench.taint.Handler.onIgnored:void(java.lang.String)","code":"input"}],"flow_count":0,"flows":[]} diff --git a/reports/raw/joern-java-modeling/dfb-taint-java-model-entrypoint-parameter-positive.json b/reports/raw/joern-java-modeling/dfb-taint-java-model-entrypoint-parameter-positive.json new file mode 100644 index 0000000..df1bfdc --- /dev/null +++ b/reports/raw/joern-java-modeling/dfb-taint-java-model-entrypoint-parameter-positive.json @@ -0,0 +1 @@ +{"adapter":"joern","evidence_kind":"joern-modeled-reachable-by-flows","input_path":"/var/folders/t1/k_27wjcd4095w9w121dm92_w0000gn/T/dataflowbench-modeling-joern-java/dfb-taint-java-model-entrypoint-parameter-positive/source","frontend_language":"JAVASRC","source_function":"onRequest","sink_function":"dfb_sink","source_kind":"method-parameter","semantics_path":"/Users/dave/Workspace/BrokkAi/dataflowbench/.claude/worktrees/agent-af332237afc5e1bcf/adapters/joern/semantics/model-java.semantics","state":"analyzed","method_count":4,"declared_semantic_count":3,"source_node_count":1,"sink_node_count":2,"source_nodes":[{"label":"METHOD_PARAMETER_IN","file":"Handler.java","line":6,"method":"dataflowbench.taint.Handler.onRequest:void(java.lang.String)","code":"String input"}],"sink_nodes":[{"label":"IDENTIFIER","file":"Handler.java","line":7,"method":"dataflowbench.taint.Handler.onRequest:void(java.lang.String)","code":"input"},{"label":"LITERAL","file":"Handler.java","line":11,"method":"dataflowbench.taint.Handler.onIgnored:void(java.lang.String)","code":"\"clean\""}],"flow_count":1,"flows":[{"elements":[{"label":"METHOD_PARAMETER_IN","file":"Handler.java","line":6,"method":"dataflowbench.taint.Handler.onRequest:void(java.lang.String)","code":"String input"},{"label":"IDENTIFIER","file":"Handler.java","line":7,"method":"dataflowbench.taint.Handler.onRequest:void(java.lang.String)","code":"input"}]}]} diff --git a/reports/raw/joern-java-modeling/dfb-taint-java-model-entrypoint-selectivity-negative.json b/reports/raw/joern-java-modeling/dfb-taint-java-model-entrypoint-selectivity-negative.json new file mode 100644 index 0000000..8c76627 --- /dev/null +++ b/reports/raw/joern-java-modeling/dfb-taint-java-model-entrypoint-selectivity-negative.json @@ -0,0 +1 @@ +{"adapter":"joern","evidence_kind":"joern-modeled-reachable-by-flows","input_path":"/var/folders/t1/k_27wjcd4095w9w121dm92_w0000gn/T/dataflowbench-modeling-joern-java/dfb-taint-java-model-entrypoint-selectivity-negative/source","frontend_language":"JAVASRC","source_function":"onDeclared","sink_function":"dfb_sink","source_kind":"method-parameter","semantics_path":"/Users/dave/Workspace/BrokkAi/dataflowbench/.claude/worktrees/agent-af332237afc5e1bcf/adapters/joern/semantics/model-java.semantics","state":"analyzed","method_count":4,"declared_semantic_count":3,"source_node_count":1,"sink_node_count":2,"source_nodes":[{"label":"METHOD_PARAMETER_IN","file":"Handler.java","line":6,"method":"dataflowbench.taint.Handler.onDeclared:void(java.lang.String)","code":"String input"}],"sink_nodes":[{"label":"LITERAL","file":"Handler.java","line":7,"method":"dataflowbench.taint.Handler.onDeclared:void(java.lang.String)","code":"\"clean\""},{"label":"IDENTIFIER","file":"Handler.java","line":11,"method":"dataflowbench.taint.Handler.onUndeclared:void(java.lang.String)","code":"input"}],"flow_count":0,"flows":[]} diff --git a/reports/raw/joern-java-modeling/dfb-taint-java-model-entrypoint-selectivity-positive.json b/reports/raw/joern-java-modeling/dfb-taint-java-model-entrypoint-selectivity-positive.json new file mode 100644 index 0000000..c911630 --- /dev/null +++ b/reports/raw/joern-java-modeling/dfb-taint-java-model-entrypoint-selectivity-positive.json @@ -0,0 +1 @@ +{"adapter":"joern","evidence_kind":"joern-modeled-reachable-by-flows","input_path":"/var/folders/t1/k_27wjcd4095w9w121dm92_w0000gn/T/dataflowbench-modeling-joern-java/dfb-taint-java-model-entrypoint-selectivity-positive/source","frontend_language":"JAVASRC","source_function":"onDeclared","sink_function":"dfb_sink","source_kind":"method-parameter","semantics_path":"/Users/dave/Workspace/BrokkAi/dataflowbench/.claude/worktrees/agent-af332237afc5e1bcf/adapters/joern/semantics/model-java.semantics","state":"analyzed","method_count":4,"declared_semantic_count":3,"source_node_count":1,"sink_node_count":2,"source_nodes":[{"label":"METHOD_PARAMETER_IN","file":"Handler.java","line":6,"method":"dataflowbench.taint.Handler.onDeclared:void(java.lang.String)","code":"String input"}],"sink_nodes":[{"label":"IDENTIFIER","file":"Handler.java","line":7,"method":"dataflowbench.taint.Handler.onDeclared:void(java.lang.String)","code":"input"},{"label":"LITERAL","file":"Handler.java","line":11,"method":"dataflowbench.taint.Handler.onUndeclared:void(java.lang.String)","code":"\"clean\""}],"flow_count":1,"flows":[{"elements":[{"label":"METHOD_PARAMETER_IN","file":"Handler.java","line":6,"method":"dataflowbench.taint.Handler.onDeclared:void(java.lang.String)","code":"String input"},{"label":"IDENTIFIER","file":"Handler.java","line":7,"method":"dataflowbench.taint.Handler.onDeclared:void(java.lang.String)","code":"input"}]}]} diff --git a/reports/raw/joern-java-modeling/dfb-taint-java-model-opaque-propagator-negative-unsupported.json b/reports/raw/joern-java-modeling/dfb-taint-java-model-opaque-propagator-negative-unsupported.json new file mode 100644 index 0000000..03802cd --- /dev/null +++ b/reports/raw/joern-java-modeling/dfb-taint-java-model-opaque-propagator-negative-unsupported.json @@ -0,0 +1,13 @@ +{ + "adapter": "joern", + "case_id": "dfb-taint-java-model-opaque-propagator-negative", + "evidence_kind": "retained-capability-decision", + "modeling_category": "P", + "modeling_category_label": "declared propagators", + "partition_source": "docs/modeling-matrix.md#per-tool-capability-partition", + "pinned_tool_identity": "Joern 4.0.610", + "reason": "category P — declared propagators — is unsupported for Joern 4.0.610 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): Joern 4.0.610 FlowSemantic mappings are additive over the default unmodeled-call pass-through and cannot restrict it; a propagator model is not load-bearing on the pinned version (Amendment A2)", + "stage": "preregistered-modeling-partition", + "state": "unsupported", + "template_id": "dfb-template-model-opaque-propagator" +} diff --git a/reports/raw/joern-java-modeling/dfb-taint-java-model-opaque-propagator-positive-unsupported.json b/reports/raw/joern-java-modeling/dfb-taint-java-model-opaque-propagator-positive-unsupported.json new file mode 100644 index 0000000..dcc8928 --- /dev/null +++ b/reports/raw/joern-java-modeling/dfb-taint-java-model-opaque-propagator-positive-unsupported.json @@ -0,0 +1,13 @@ +{ + "adapter": "joern", + "case_id": "dfb-taint-java-model-opaque-propagator-positive", + "evidence_kind": "retained-capability-decision", + "modeling_category": "P", + "modeling_category_label": "declared propagators", + "partition_source": "docs/modeling-matrix.md#per-tool-capability-partition", + "pinned_tool_identity": "Joern 4.0.610", + "reason": "category P — declared propagators — is unsupported for Joern 4.0.610 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): Joern 4.0.610 FlowSemantic mappings are additive over the default unmodeled-call pass-through and cannot restrict it; a propagator model is not load-bearing on the pinned version (Amendment A2)", + "stage": "preregistered-modeling-partition", + "state": "unsupported", + "template_id": "dfb-template-model-opaque-propagator" +} diff --git a/reports/raw/joern-java-modeling/dfb-taint-java-model-propagator-position-negative-unsupported.json b/reports/raw/joern-java-modeling/dfb-taint-java-model-propagator-position-negative-unsupported.json new file mode 100644 index 0000000..d8ff926 --- /dev/null +++ b/reports/raw/joern-java-modeling/dfb-taint-java-model-propagator-position-negative-unsupported.json @@ -0,0 +1,13 @@ +{ + "adapter": "joern", + "case_id": "dfb-taint-java-model-propagator-position-negative", + "evidence_kind": "retained-capability-decision", + "modeling_category": "P", + "modeling_category_label": "declared propagators", + "partition_source": "docs/modeling-matrix.md#per-tool-capability-partition", + "pinned_tool_identity": "Joern 4.0.610", + "reason": "category P — declared propagators — is unsupported for Joern 4.0.610 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): Joern 4.0.610 FlowSemantic mappings are additive over the default unmodeled-call pass-through and cannot restrict it; a propagator model is not load-bearing on the pinned version (Amendment A2)", + "stage": "preregistered-modeling-partition", + "state": "unsupported", + "template_id": "dfb-template-model-propagator-position" +} diff --git a/reports/raw/joern-java-modeling/dfb-taint-java-model-propagator-position-positive-unsupported.json b/reports/raw/joern-java-modeling/dfb-taint-java-model-propagator-position-positive-unsupported.json new file mode 100644 index 0000000..0f923fb --- /dev/null +++ b/reports/raw/joern-java-modeling/dfb-taint-java-model-propagator-position-positive-unsupported.json @@ -0,0 +1,13 @@ +{ + "adapter": "joern", + "case_id": "dfb-taint-java-model-propagator-position-positive", + "evidence_kind": "retained-capability-decision", + "modeling_category": "P", + "modeling_category_label": "declared propagators", + "partition_source": "docs/modeling-matrix.md#per-tool-capability-partition", + "pinned_tool_identity": "Joern 4.0.610", + "reason": "category P — declared propagators — is unsupported for Joern 4.0.610 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): Joern 4.0.610 FlowSemantic mappings are additive over the default unmodeled-call pass-through and cannot restrict it; a propagator model is not load-bearing on the pinned version (Amendment A2)", + "stage": "preregistered-modeling-partition", + "state": "unsupported", + "template_id": "dfb-template-model-propagator-position" +} diff --git a/reports/raw/joern-java-modeling/dfb-taint-java-model-sanitizer-kill-negative.json b/reports/raw/joern-java-modeling/dfb-taint-java-model-sanitizer-kill-negative.json new file mode 100644 index 0000000..8360b23 --- /dev/null +++ b/reports/raw/joern-java-modeling/dfb-taint-java-model-sanitizer-kill-negative.json @@ -0,0 +1 @@ +{"adapter":"joern","evidence_kind":"joern-modeled-reachable-by-flows","input_path":"/var/folders/t1/k_27wjcd4095w9w121dm92_w0000gn/T/dataflowbench-modeling-joern-java/dfb-taint-java-model-sanitizer-kill-negative/source","frontend_language":"JAVASRC","source_function":"dfb_source","sink_function":"dfb_sink","source_kind":"call-return","semantics_path":"/Users/dave/Workspace/BrokkAi/dataflowbench/.claude/worktrees/agent-af332237afc5e1bcf/adapters/joern/semantics/model-java.semantics","state":"analyzed","method_count":6,"declared_semantic_count":3,"source_node_count":1,"sink_node_count":1,"source_nodes":[{"label":"CALL","file":"ModelSanitizerKillNegative.java","line":17,"method":"dataflowbench.taint.ModelSanitizerKillNegative.run:void()","code":"dfb_source()"}],"sink_nodes":[{"label":"CALL","file":"ModelSanitizerKillNegative.java","line":17,"method":"dataflowbench.taint.ModelSanitizerKillNegative.run:void()","code":"Clean.scrub(dfb_source())"}],"flow_count":0,"flows":[]} diff --git a/reports/raw/joern-java-modeling/dfb-taint-java-model-sanitizer-kill-positive.json b/reports/raw/joern-java-modeling/dfb-taint-java-model-sanitizer-kill-positive.json new file mode 100644 index 0000000..d9536ac --- /dev/null +++ b/reports/raw/joern-java-modeling/dfb-taint-java-model-sanitizer-kill-positive.json @@ -0,0 +1 @@ +{"adapter":"joern","evidence_kind":"joern-modeled-reachable-by-flows","input_path":"/var/folders/t1/k_27wjcd4095w9w121dm92_w0000gn/T/dataflowbench-modeling-joern-java/dfb-taint-java-model-sanitizer-kill-positive/source","frontend_language":"JAVASRC","source_function":"dfb_source","sink_function":"dfb_sink","source_kind":"call-return","semantics_path":"/Users/dave/Workspace/BrokkAi/dataflowbench/.claude/worktrees/agent-af332237afc5e1bcf/adapters/joern/semantics/model-java.semantics","state":"analyzed","method_count":6,"declared_semantic_count":3,"source_node_count":1,"sink_node_count":1,"source_nodes":[{"label":"CALL","file":"ModelSanitizerKillPositive.java","line":17,"method":"dataflowbench.taint.ModelSanitizerKillPositive.run:void()","code":"dfb_source()"}],"sink_nodes":[{"label":"CALL","file":"ModelSanitizerKillPositive.java","line":17,"method":"dataflowbench.taint.ModelSanitizerKillPositive.run:void()","code":"dfb_source()"}],"flow_count":1,"flows":[{"elements":[{"label":"CALL","file":"ModelSanitizerKillPositive.java","line":17,"method":"dataflowbench.taint.ModelSanitizerKillPositive.run:void()","code":"dfb_source()"}]}]} diff --git a/reports/raw/joern-java-modeling/dfb-taint-java-model-sanitizer-selectivity-negative.json b/reports/raw/joern-java-modeling/dfb-taint-java-model-sanitizer-selectivity-negative.json new file mode 100644 index 0000000..269ddf5 --- /dev/null +++ b/reports/raw/joern-java-modeling/dfb-taint-java-model-sanitizer-selectivity-negative.json @@ -0,0 +1 @@ +{"adapter":"joern","evidence_kind":"joern-modeled-reachable-by-flows","input_path":"/var/folders/t1/k_27wjcd4095w9w121dm92_w0000gn/T/dataflowbench-modeling-joern-java/dfb-taint-java-model-sanitizer-selectivity-negative/source","frontend_language":"JAVASRC","source_function":"dfb_source","sink_function":"dfb_sink","source_kind":"call-return","semantics_path":"/Users/dave/Workspace/BrokkAi/dataflowbench/.claude/worktrees/agent-af332237afc5e1bcf/adapters/joern/semantics/model-java.semantics","state":"analyzed","method_count":7,"declared_semantic_count":3,"source_node_count":1,"sink_node_count":1,"source_nodes":[{"label":"CALL","file":"ModelSanitizerSelectivityNegative.java","line":21,"method":"dataflowbench.taint.ModelSanitizerSelectivityNegative.run:void()","code":"dfb_source()"}],"sink_nodes":[{"label":"CALL","file":"ModelSanitizerSelectivityNegative.java","line":21,"method":"dataflowbench.taint.ModelSanitizerSelectivityNegative.run:void()","code":"Clean.scrub(dfb_source())"}],"flow_count":0,"flows":[]} diff --git a/reports/raw/joern-java-modeling/dfb-taint-java-model-sanitizer-selectivity-positive.json b/reports/raw/joern-java-modeling/dfb-taint-java-model-sanitizer-selectivity-positive.json new file mode 100644 index 0000000..920954e --- /dev/null +++ b/reports/raw/joern-java-modeling/dfb-taint-java-model-sanitizer-selectivity-positive.json @@ -0,0 +1 @@ +{"adapter":"joern","evidence_kind":"joern-modeled-reachable-by-flows","input_path":"/var/folders/t1/k_27wjcd4095w9w121dm92_w0000gn/T/dataflowbench-modeling-joern-java/dfb-taint-java-model-sanitizer-selectivity-positive/source","frontend_language":"JAVASRC","source_function":"dfb_source","sink_function":"dfb_sink","source_kind":"call-return","semantics_path":"/Users/dave/Workspace/BrokkAi/dataflowbench/.claude/worktrees/agent-af332237afc5e1bcf/adapters/joern/semantics/model-java.semantics","state":"analyzed","method_count":7,"declared_semantic_count":3,"source_node_count":1,"sink_node_count":1,"source_nodes":[{"label":"CALL","file":"ModelSanitizerSelectivityPositive.java","line":21,"method":"dataflowbench.taint.ModelSanitizerSelectivityPositive.run:void()","code":"dfb_source()"}],"sink_nodes":[{"label":"CALL","file":"ModelSanitizerSelectivityPositive.java","line":21,"method":"dataflowbench.taint.ModelSanitizerSelectivityPositive.run:void()","code":"Clean.sanitize(dfb_source())"}],"flow_count":1,"flows":[{"elements":[{"label":"CALL","file":"ModelSanitizerSelectivityPositive.java","line":21,"method":"dataflowbench.taint.ModelSanitizerSelectivityPositive.run:void()","code":"dfb_source()"},{"label":"METHOD_PARAMETER_IN","file":"ModelSanitizerSelectivityPositive.java","line":8,"method":"dataflowbench.taint.Clean.sanitize:java.lang.String(java.lang.String)","code":"String value"},{"label":"IDENTIFIER","file":"ModelSanitizerSelectivityPositive.java","line":9,"method":"dataflowbench.taint.Clean.sanitize:java.lang.String(java.lang.String)","code":"value"},{"label":"RETURN","file":"ModelSanitizerSelectivityPositive.java","line":9,"method":"dataflowbench.taint.Clean.sanitize:java.lang.String(java.lang.String)","code":"return value;"},{"label":"METHOD_RETURN","file":"ModelSanitizerSelectivityPositive.java","line":8,"method":"dataflowbench.taint.Clean.sanitize:java.lang.String(java.lang.String)","code":"RET"},{"label":"CALL","file":"ModelSanitizerSelectivityPositive.java","line":21,"method":"dataflowbench.taint.ModelSanitizerSelectivityPositive.run:void()","code":"Clean.sanitize(dfb_source())"}]}]} diff --git a/reports/raw/joern-java-modeling/dfb-taint-java-model-store-roundtrip-negative.json b/reports/raw/joern-java-modeling/dfb-taint-java-model-store-roundtrip-negative.json new file mode 100644 index 0000000..d47d81f --- /dev/null +++ b/reports/raw/joern-java-modeling/dfb-taint-java-model-store-roundtrip-negative.json @@ -0,0 +1 @@ +{"adapter":"joern","evidence_kind":"joern-modeled-reachable-by-flows","input_path":"/var/folders/t1/k_27wjcd4095w9w121dm92_w0000gn/T/dataflowbench-modeling-joern-java/dfb-taint-java-model-store-roundtrip-negative/source","frontend_language":"JAVASRC","source_function":"dfb_source","sink_function":"dfb_sink","source_kind":"call-return","semantics_path":"/Users/dave/Workspace/BrokkAi/dataflowbench/.claude/worktrees/agent-af332237afc5e1bcf/adapters/joern/semantics/model-java.semantics","state":"analyzed","method_count":8,"declared_semantic_count":3,"source_node_count":1,"sink_node_count":1,"source_nodes":[{"label":"CALL","file":"ModelStoreRoundtripNegative.java","line":19,"method":"dataflowbench.taint.ModelStoreRoundtripNegative.writeSide:void()","code":"dfb_source()"}],"sink_nodes":[{"label":"CALL","file":"ModelStoreRoundtripNegative.java","line":23,"method":"dataflowbench.taint.ModelStoreRoundtripNegative.readSide:void()","code":"Store.get(\"b\")"}],"flow_count":0,"flows":[]} diff --git a/reports/raw/joern-java-modeling/dfb-taint-java-model-store-roundtrip-positive.json b/reports/raw/joern-java-modeling/dfb-taint-java-model-store-roundtrip-positive.json new file mode 100644 index 0000000..06ed9ac --- /dev/null +++ b/reports/raw/joern-java-modeling/dfb-taint-java-model-store-roundtrip-positive.json @@ -0,0 +1 @@ +{"adapter":"joern","evidence_kind":"joern-modeled-reachable-by-flows","input_path":"/var/folders/t1/k_27wjcd4095w9w121dm92_w0000gn/T/dataflowbench-modeling-joern-java/dfb-taint-java-model-store-roundtrip-positive/source","frontend_language":"JAVASRC","source_function":"dfb_source","sink_function":"dfb_sink","source_kind":"call-return","semantics_path":"/Users/dave/Workspace/BrokkAi/dataflowbench/.claude/worktrees/agent-af332237afc5e1bcf/adapters/joern/semantics/model-java.semantics","state":"analyzed","method_count":8,"declared_semantic_count":3,"source_node_count":1,"sink_node_count":1,"source_nodes":[{"label":"CALL","file":"ModelStoreRoundtripPositive.java","line":19,"method":"dataflowbench.taint.ModelStoreRoundtripPositive.writeSide:void()","code":"dfb_source()"}],"sink_nodes":[{"label":"CALL","file":"ModelStoreRoundtripPositive.java","line":23,"method":"dataflowbench.taint.ModelStoreRoundtripPositive.readSide:void()","code":"Store.get(\"k\")"}],"flow_count":0,"flows":[]} diff --git a/reports/raw/joern-java-modeling/dfb-taint-java-model-store-separation-negative.json b/reports/raw/joern-java-modeling/dfb-taint-java-model-store-separation-negative.json new file mode 100644 index 0000000..fd43b67 --- /dev/null +++ b/reports/raw/joern-java-modeling/dfb-taint-java-model-store-separation-negative.json @@ -0,0 +1 @@ +{"adapter":"joern","evidence_kind":"joern-modeled-reachable-by-flows","input_path":"/var/folders/t1/k_27wjcd4095w9w121dm92_w0000gn/T/dataflowbench-modeling-joern-java/dfb-taint-java-model-store-separation-negative/source","frontend_language":"JAVASRC","source_function":"dfb_source","sink_function":"dfb_sink","source_kind":"call-return","semantics_path":"/Users/dave/Workspace/BrokkAi/dataflowbench/.claude/worktrees/agent-af332237afc5e1bcf/adapters/joern/semantics/model-java.semantics","state":"analyzed","method_count":12,"declared_semantic_count":3,"source_node_count":1,"sink_node_count":1,"source_nodes":[{"label":"CALL","file":"ModelStoreSeparationNegative.java","line":23,"method":"dataflowbench.taint.ModelStoreSeparationNegative.writeSide:void()","code":"dfb_source()"}],"sink_nodes":[{"label":"CALL","file":"ModelStoreSeparationNegative.java","line":27,"method":"dataflowbench.taint.ModelStoreSeparationNegative.readSide:void()","code":"ModelStoreSeparationNegative.beta.get(\"k\")"}],"flow_count":0,"flows":[]} diff --git a/reports/raw/joern-java-modeling/dfb-taint-java-model-store-separation-positive.json b/reports/raw/joern-java-modeling/dfb-taint-java-model-store-separation-positive.json new file mode 100644 index 0000000..bf6e027 --- /dev/null +++ b/reports/raw/joern-java-modeling/dfb-taint-java-model-store-separation-positive.json @@ -0,0 +1 @@ +{"adapter":"joern","evidence_kind":"joern-modeled-reachable-by-flows","input_path":"/var/folders/t1/k_27wjcd4095w9w121dm92_w0000gn/T/dataflowbench-modeling-joern-java/dfb-taint-java-model-store-separation-positive/source","frontend_language":"JAVASRC","source_function":"dfb_source","sink_function":"dfb_sink","source_kind":"call-return","semantics_path":"/Users/dave/Workspace/BrokkAi/dataflowbench/.claude/worktrees/agent-af332237afc5e1bcf/adapters/joern/semantics/model-java.semantics","state":"analyzed","method_count":12,"declared_semantic_count":3,"source_node_count":1,"sink_node_count":1,"source_nodes":[{"label":"CALL","file":"ModelStoreSeparationPositive.java","line":23,"method":"dataflowbench.taint.ModelStoreSeparationPositive.writeSide:void()","code":"dfb_source()"}],"sink_nodes":[{"label":"CALL","file":"ModelStoreSeparationPositive.java","line":27,"method":"dataflowbench.taint.ModelStoreSeparationPositive.readSide:void()","code":"ModelStoreSeparationPositive.alpha.get(\"k\")"}],"flow_count":0,"flows":[]} diff --git a/reports/raw/joern-java-modeling/dfb-taint-java-model-summary-field-negative-unsupported.json b/reports/raw/joern-java-modeling/dfb-taint-java-model-summary-field-negative-unsupported.json new file mode 100644 index 0000000..9094802 --- /dev/null +++ b/reports/raw/joern-java-modeling/dfb-taint-java-model-summary-field-negative-unsupported.json @@ -0,0 +1,13 @@ +{ + "adapter": "joern", + "case_id": "dfb-taint-java-model-summary-field-negative", + "evidence_kind": "retained-capability-decision", + "modeling_category": "O", + "modeling_category_label": "opaque procedure summaries", + "partition_source": "docs/modeling-matrix.md#per-tool-capability-partition", + "pinned_tool_identity": "Joern 4.0.610", + "reason": "category O — opaque procedure summaries — is unsupported for Joern 4.0.610 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): Joern 4.0.610 ignores a summary's field-destination access path and its FlowSemantic cannot restrict the default pass-through; a summary model is not load-bearing on the pinned version (Amendment A2)", + "stage": "preregistered-modeling-partition", + "state": "unsupported", + "template_id": "dfb-template-model-summary-field" +} diff --git a/reports/raw/joern-java-modeling/dfb-taint-java-model-summary-field-positive-unsupported.json b/reports/raw/joern-java-modeling/dfb-taint-java-model-summary-field-positive-unsupported.json new file mode 100644 index 0000000..1b0d932 --- /dev/null +++ b/reports/raw/joern-java-modeling/dfb-taint-java-model-summary-field-positive-unsupported.json @@ -0,0 +1,13 @@ +{ + "adapter": "joern", + "case_id": "dfb-taint-java-model-summary-field-positive", + "evidence_kind": "retained-capability-decision", + "modeling_category": "O", + "modeling_category_label": "opaque procedure summaries", + "partition_source": "docs/modeling-matrix.md#per-tool-capability-partition", + "pinned_tool_identity": "Joern 4.0.610", + "reason": "category O — opaque procedure summaries — is unsupported for Joern 4.0.610 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): Joern 4.0.610 ignores a summary's field-destination access path and its FlowSemantic cannot restrict the default pass-through; a summary model is not load-bearing on the pinned version (Amendment A2)", + "stage": "preregistered-modeling-partition", + "state": "unsupported", + "template_id": "dfb-template-model-summary-field" +} diff --git a/reports/raw/joern-java-modeling/dfb-taint-java-model-summary-through-negative-unsupported.json b/reports/raw/joern-java-modeling/dfb-taint-java-model-summary-through-negative-unsupported.json new file mode 100644 index 0000000..32db4e9 --- /dev/null +++ b/reports/raw/joern-java-modeling/dfb-taint-java-model-summary-through-negative-unsupported.json @@ -0,0 +1,13 @@ +{ + "adapter": "joern", + "case_id": "dfb-taint-java-model-summary-through-negative", + "evidence_kind": "retained-capability-decision", + "modeling_category": "O", + "modeling_category_label": "opaque procedure summaries", + "partition_source": "docs/modeling-matrix.md#per-tool-capability-partition", + "pinned_tool_identity": "Joern 4.0.610", + "reason": "category O — opaque procedure summaries — is unsupported for Joern 4.0.610 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): Joern 4.0.610 ignores a summary's field-destination access path and its FlowSemantic cannot restrict the default pass-through; a summary model is not load-bearing on the pinned version (Amendment A2)", + "stage": "preregistered-modeling-partition", + "state": "unsupported", + "template_id": "dfb-template-model-summary-through" +} diff --git a/reports/raw/joern-java-modeling/dfb-taint-java-model-summary-through-positive-unsupported.json b/reports/raw/joern-java-modeling/dfb-taint-java-model-summary-through-positive-unsupported.json new file mode 100644 index 0000000..9242107 --- /dev/null +++ b/reports/raw/joern-java-modeling/dfb-taint-java-model-summary-through-positive-unsupported.json @@ -0,0 +1,13 @@ +{ + "adapter": "joern", + "case_id": "dfb-taint-java-model-summary-through-positive", + "evidence_kind": "retained-capability-decision", + "modeling_category": "O", + "modeling_category_label": "opaque procedure summaries", + "partition_source": "docs/modeling-matrix.md#per-tool-capability-partition", + "pinned_tool_identity": "Joern 4.0.610", + "reason": "category O — opaque procedure summaries — is unsupported for Joern 4.0.610 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): Joern 4.0.610 ignores a summary's field-destination access path and its FlowSemantic cannot restrict the default pass-through; a summary model is not load-bearing on the pinned version (Amendment A2)", + "stage": "preregistered-modeling-partition", + "state": "unsupported", + "template_id": "dfb-template-model-summary-through" +} diff --git a/reports/raw/load-bearing-java-modeling/bifrost-declared-source-with-model.json b/reports/raw/load-bearing-java-modeling/bifrost-declared-source-with-model.json new file mode 100644 index 0000000..851010e --- /dev/null +++ b/reports/raw/load-bearing-java-modeling/bifrost-declared-source-with-model.json @@ -0,0 +1 @@ +{"schema_version":3,"evaluation":{"evaluation_date":"2026-08-11","suppression_path":".bifrost/suppressions.json","suppression_document_state":"not_found","scope_path":".bifrost/policy-scope.json","scope_document_state":"not_found"},"execution":{"total_elapsed_ms":0,"stage_timings":[],"termination":null,"terminal_stage":null,"active_policy_id":null,"completed_policy_ids":[],"pending_policy_ids":[]},"rules":[{"policy_id":"dataflowbench.taint.model-java","policy_hash":"c419872859b67e67c0583d6b66a4eea7cf3350a36a3207a89222db636e8f3c61","analysis_type":"taint","policy_schema":{"version":1,"origin":"explicit"},"selector_schemas":[{"path":"/analysis/sinks/entries/declared-sink/selector","resolution":{"version":1,"origin":"explicit"}},{"path":"/analysis/sinks/entries/sink/selector","resolution":{"version":1,"origin":"explicit"}},{"path":"/analysis/sources/entries/declared-source/selector","resolution":{"version":1,"origin":"explicit"}},{"path":"/analysis/sources/entries/input/selector","resolution":{"version":1,"origin":"explicit"}}],"endpoint_dependencies":[{"identity":{"type":"local","policy_id":"dataflowbench.taint.model-java","entry_id":"declared-sink"},"definition_schema":{"type":"policy_document","resolution":{"version":1,"origin":"explicit"}},"selector_path":"/analysis/sinks/entries/declared-sink/selector","selector_schema":{"version":1,"origin":"explicit"},"model":{"role":"sink","display_name":"Audit.record","categories":["data.sensitive"],"binding":{"type":"argument_index","index":0},"taint":{"type":"sink","accepts":["attacker-controlled"],"tags":[],"impacts":[]},"supersedes":[]},"semantic_hash":"ca5f95a181dd48460b9824d0efa881784970b23cee888d6978b2ac7052d4e1b8","analysis_projection_hash":"d363c6c98379de62f3b873ddd371d29750835db27374c05eaae279abebe4e570","origins":[{"type":"policy_local","path":"/analysis/sinks/entries/declared-sink"}]},{"identity":{"type":"local","policy_id":"dataflowbench.taint.model-java","entry_id":"declared-source"},"definition_schema":{"type":"policy_document","resolution":{"version":1,"origin":"explicit"}},"selector_path":"/analysis/sources/entries/declared-source/selector","selector_schema":{"version":1,"origin":"explicit"},"model":{"role":"source","display_name":"Config.fetchRemote","categories":["input.user-controlled"],"binding":{"type":"return_value"},"taint":{"type":"source","labels":["attacker-controlled"],"evidence":null},"supersedes":[]},"semantic_hash":"e9a7217df5670b3b88bcdf42ba7e5dfbc6f826f109e75d6d1661192725413ad1","analysis_projection_hash":"cf57d45f5aa9335e9cd6372f1ce817dcc569b8bb153df7d074da79614169b550","origins":[{"type":"policy_local","path":"/analysis/sources/entries/declared-source"}]},{"identity":{"type":"local","policy_id":"dataflowbench.taint.model-java","entry_id":"input"},"definition_schema":{"type":"policy_document","resolution":{"version":1,"origin":"explicit"}},"selector_path":"/analysis/sources/entries/input/selector","selector_schema":{"version":1,"origin":"explicit"},"model":{"role":"source","display_name":"benchmark input","categories":["input.user-controlled"],"binding":{"type":"return_value"},"taint":{"type":"source","labels":["attacker-controlled"],"evidence":null},"supersedes":[]},"semantic_hash":"a7086bee9e3b830fec298d9c60e31a18d0a1b5def9088091dd89ded489a1b094","analysis_projection_hash":"e8c42d395df5363d0a789c7ce734dfbf40662b3cd18757fc730b80ccaea4bab0","origins":[{"type":"policy_local","path":"/analysis/sources/entries/input"}]},{"identity":{"type":"local","policy_id":"dataflowbench.taint.model-java","entry_id":"sink"},"definition_schema":{"type":"policy_document","resolution":{"version":1,"origin":"explicit"}},"selector_path":"/analysis/sinks/entries/sink/selector","selector_schema":{"version":1,"origin":"explicit"},"model":{"role":"sink","display_name":"benchmark sink","categories":["data.sensitive"],"binding":{"type":"argument_index","index":0},"taint":{"type":"sink","accepts":["attacker-controlled"],"tags":[],"impacts":[]},"supersedes":[]},"semantic_hash":"b52687a8ab41d5d17210b86f12a811f4685621b9951f5a655b49bf1de1ec394a","analysis_projection_hash":"25d9c2ebb7b961bbe416e36651d6fec2898ab0d1bee858193f0faedd564ed2e8","origins":[{"type":"policy_local","path":"/analysis/sinks/entries/sink"}]}],"match_directory_manifests":[],"precedence_manifest":{"edges":[]},"name":"DataFlowBench Java taint-modeling matrix","message":{"type":"static","text":"A benchmark-declared model carried input to the declared sink"},"severity":{"type":"fixed","level":"warning"},"description":null,"help_uri":null,"tags":[]}],"runs":[{"policy_id":"dataflowbench.taint.model-java","policy_hash":"c419872859b67e67c0583d6b66a4eea7cf3350a36a3207a89222db636e8f3c61","analysis_type":"taint","completion":{"type":"complete"},"findings":[{"id":"beeb5253e576d28e435dd0225619fad02efe94b2808112a24760d675d982e897","identity_stability":"strong","policy_id":"dataflowbench.taint.model-java","policy_hash":"c419872859b67e67c0583d6b66a4eea7cf3350a36a3207a89222db636e8f3c61","analysis_type":"taint","severity":"warning","message":"A benchmark-declared model carried input to the declared sink","classification":{"type":"unclassified"},"certainty":{"type":"definite"},"completeness":{"type":"complete"},"primary":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":377,"end":407},"region":{"start_line":17,"start_column":9,"end_line":17,"end_column":39}},"related":[{"relationship":"source","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":386,"end":406},"region":{"start_line":17,"start_column":18,"end_line":17,"end_column":38}},"evidence_refs":[]}],"related_truncated":false,"omitted_related_locations_lower_bound":0,"evidence":{"type":"taint","evidence":{"analysis_finding_id":"bifrost:e00d01675bf1235d6fd72ce468c9f7046a73b37596ebbd2ef0c0b83a590a6fed","anchor":{"type":"strong","sink_identity":{"namespace":"java","path":"ModelDeclaredSourcePositive.java","derivation":"canonical_ast_identity","semantic_key":"[[\"file\",\"ModelDeclaredSourcePositive.java\"],[\"type\",\"ModelDeclaredSourcePositive\"],[\"method\",\"run\"],[\"program_point\",null]]"},"source_endpoint_analysis_projection_hash":"cf57d45f5aa9335e9cd6372f1ce817dcc569b8bb153df7d074da79614169b550","sink_endpoint_analysis_projection_hash":"25d9c2ebb7b961bbe416e36651d6fec2898ab0d1bee858193f0faedd564ed2e8","source_scenario_set_hash":"ec850b2c1c787682bfec02125cfb8b33992b0e4334cd856b1078fc79d35c4a64"},"sink":"bifrost:f27823f2e9c4a580765d15dd30a1cf01212b7c55506bcd95613503e6613010f4","source_endpoint":{"type":"local","policy_id":"dataflowbench.taint.model-java","entry_id":"declared-source"},"sink_endpoint":{"type":"local","policy_id":"dataflowbench.taint.model-java","entry_id":"sink"},"source_display_name":"Config.fetchRemote","sink_display_name":"benchmark sink","source_categories":["input.user-controlled"],"sink_categories":["data.sensitive"],"selected_combination":null,"sink_tags":[],"sink_impacts":[],"reached_source_labels":["attacker-controlled"],"origins":[{"source_endpoint":{"type":"local","policy_id":"dataflowbench.taint.model-java","entry_id":"declared-source"},"source_label":"attacker-controlled","source_evidence":null,"primary":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":386,"end":406},"region":{"start_line":17,"start_column":18,"end_line":17,"end_column":38}},"scenario_id":"bifrost:0ece02fa406bfd60cd2ffb1a18e36beec3ca367d93661c2bc6b8a99939130bca:source-event:0","evidence_refs":["bifrost:a443d68b45dacdb3e6185cfa13ca92e0306fa7550728d55c36bfbfd70a4e7f01"]}],"origins_truncated":false,"source_scenarios":["bifrost:0ece02fa406bfd60cd2ffb1a18e36beec3ca367d93661c2bc6b8a99939130bca:source-event:0"],"source_scenarios_truncated":false,"omitted_source_scenarios_lower_bound":0,"source_scenario_set_hash":"ec850b2c1c787682bfec02125cfb8b33992b0e4334cd856b1078fc79d35c4a64","witness_refs":["bifrost:37d397db1820c48ce632f7874098b25d455ba86a28d6c654593849af80b71710","bifrost:4d0541b035fb383be82a142536dedd48ca8fb6db74e04080b0fb00649b004edd","bifrost:e2559ba1ef83358ec3138c634166c25dea826db004c2ceebbb67e7a258841ef5"],"witness_refs_truncated":false,"projection_facts_hash":"41d25abaa0ab3935bf5f0e2b385873ac5f64417c7e50b42c1df8a1d9479a6262"}},"evidence_refs_truncated":false,"omitted_evidence_refs_lower_bound":0,"cvss":null,"organizational_risk":null,"proof":{"state":"proven","reasons":[{"type":"dataflow_witness"}],"evidence_refs":[]},"witnesses":[{"id":"bifrost:37d397db1820c48ce632f7874098b25d455ba86a28d6c654593849af80b71710","steps":[{"kind":"source","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":349,"end":414},"region":{"start_line":16,"start_column":5,"end_line":18,"end_column":6}},"label":"taint source","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":349,"end":414},"region":{"start_line":16,"start_column":5,"end_line":18,"end_column":6}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":367,"end":414},"region":{"start_line":16,"start_column":23,"end_line":18,"end_column":6}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":377,"end":408},"region":{"start_line":17,"start_column":9,"end_line":17,"end_column":40}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":386,"end":406},"region":{"start_line":17,"start_column":18,"end_line":17,"end_column":38}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":386,"end":392},"region":{"start_line":17,"start_column":18,"end_line":17,"end_column":24}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":386,"end":406},"region":{"start_line":17,"start_column":18,"end_line":17,"end_column":38}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":386,"end":406},"region":{"start_line":17,"start_column":18,"end_line":17,"end_column":38}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":377,"end":407},"region":{"start_line":17,"start_column":9,"end_line":17,"end_column":39}},"label":"taint propagation","evidence_refs":[]}],"truncated":false,"omitted_steps_lower_bound":0,"retained_bytes":1868},{"id":"bifrost:4d0541b035fb383be82a142536dedd48ca8fb6db74e04080b0fb00649b004edd","steps":[{"kind":"source","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":349,"end":414},"region":{"start_line":16,"start_column":5,"end_line":18,"end_column":6}},"label":"taint source","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":349,"end":414},"region":{"start_line":16,"start_column":5,"end_line":18,"end_column":6}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":367,"end":414},"region":{"start_line":16,"start_column":23,"end_line":18,"end_column":6}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":377,"end":408},"region":{"start_line":17,"start_column":9,"end_line":17,"end_column":40}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":386,"end":406},"region":{"start_line":17,"start_column":18,"end_line":17,"end_column":38}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":386,"end":392},"region":{"start_line":17,"start_column":18,"end_line":17,"end_column":24}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":386,"end":406},"region":{"start_line":17,"start_column":18,"end_line":17,"end_column":38}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":386,"end":406},"region":{"start_line":17,"start_column":18,"end_line":17,"end_column":38}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":377,"end":407},"region":{"start_line":17,"start_column":9,"end_line":17,"end_column":39}},"label":"taint propagation","evidence_refs":[]}],"truncated":false,"omitted_steps_lower_bound":0,"retained_bytes":1868},{"id":"bifrost:e2559ba1ef83358ec3138c634166c25dea826db004c2ceebbb67e7a258841ef5","steps":[{"kind":"source","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":349,"end":414},"region":{"start_line":16,"start_column":5,"end_line":18,"end_column":6}},"label":"taint source","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":349,"end":414},"region":{"start_line":16,"start_column":5,"end_line":18,"end_column":6}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":367,"end":414},"region":{"start_line":16,"start_column":23,"end_line":18,"end_column":6}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":377,"end":408},"region":{"start_line":17,"start_column":9,"end_line":17,"end_column":40}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":386,"end":406},"region":{"start_line":17,"start_column":18,"end_line":17,"end_column":38}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":386,"end":392},"region":{"start_line":17,"start_column":18,"end_line":17,"end_column":24}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":386,"end":406},"region":{"start_line":17,"start_column":18,"end_line":17,"end_column":38}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":386,"end":406},"region":{"start_line":17,"start_column":18,"end_line":17,"end_column":38}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":377,"end":407},"region":{"start_line":17,"start_column":9,"end_line":17,"end_column":39}},"label":"taint propagation","evidence_refs":[]}],"truncated":false,"omitted_steps_lower_bound":0,"retained_bytes":1868}],"witnesses_truncated":false,"omitted_witnesses_lower_bound":0,"suppression":null,"scope":null}],"diagnostics":[],"diagnostics_truncated":false,"work":{"scanned_files":4,"scanned_source_bytes":1668,"fact_nodes":72,"pipeline_rows":2,"examined_references":0,"retained_findings":1,"omitted_findings_lower_bound":0,"retained_report_bytes":12835,"metrics":[{"name":"taint.propagation_shared_memberships","unit":"count","value":0},{"name":"taint.propagation_solves","unit":"count","value":1},{"name":"taint.semantic_materialized_files","unit":"count","value":2},{"name":"taint.semantic_program_points","unit":"rows","value":145},{"name":"taint.semantic_source_bytes","unit":"bytes","value":2085},{"name":"taint.semantic_traversal_steps","unit":"count","value":17}]}}],"suppressions":[],"scope":[],"diagnostics":[],"diagnostics_truncated":false,"omitted_diagnostics_lower_bound":0,"worst_omitted_diagnostic_severity":null} \ No newline at end of file diff --git a/reports/raw/load-bearing-java-modeling/bifrost-declared-source-without-model.json b/reports/raw/load-bearing-java-modeling/bifrost-declared-source-without-model.json new file mode 100644 index 0000000..9358471 --- /dev/null +++ b/reports/raw/load-bearing-java-modeling/bifrost-declared-source-without-model.json @@ -0,0 +1 @@ +{"schema_version":3,"evaluation":{"evaluation_date":"2026-08-11","suppression_path":".bifrost/suppressions.json","suppression_document_state":"not_found","scope_path":".bifrost/policy-scope.json","scope_document_state":"not_found"},"execution":{"total_elapsed_ms":0,"stage_timings":[],"termination":null,"terminal_stage":null,"active_policy_id":null,"completed_policy_ids":[],"pending_policy_ids":[]},"rules":[{"policy_id":"dataflowbench.taint.model-java","policy_hash":"68abcba8acc9e700c56c7aaacea4878cd31ab0ce435bbcd8ba7e74caf4fdd42a","analysis_type":"taint","policy_schema":{"version":1,"origin":"explicit"},"selector_schemas":[{"path":"/analysis/sinks/entries/declared-sink/selector","resolution":{"version":1,"origin":"explicit"}},{"path":"/analysis/sinks/entries/sink/selector","resolution":{"version":1,"origin":"explicit"}},{"path":"/analysis/sources/entries/input/selector","resolution":{"version":1,"origin":"explicit"}}],"endpoint_dependencies":[{"identity":{"type":"local","policy_id":"dataflowbench.taint.model-java","entry_id":"declared-sink"},"definition_schema":{"type":"policy_document","resolution":{"version":1,"origin":"explicit"}},"selector_path":"/analysis/sinks/entries/declared-sink/selector","selector_schema":{"version":1,"origin":"explicit"},"model":{"role":"sink","display_name":"Audit.record","categories":["data.sensitive"],"binding":{"type":"argument_index","index":0},"taint":{"type":"sink","accepts":["attacker-controlled"],"tags":[],"impacts":[]},"supersedes":[]},"semantic_hash":"ca5f95a181dd48460b9824d0efa881784970b23cee888d6978b2ac7052d4e1b8","analysis_projection_hash":"d363c6c98379de62f3b873ddd371d29750835db27374c05eaae279abebe4e570","origins":[{"type":"policy_local","path":"/analysis/sinks/entries/declared-sink"}]},{"identity":{"type":"local","policy_id":"dataflowbench.taint.model-java","entry_id":"input"},"definition_schema":{"type":"policy_document","resolution":{"version":1,"origin":"explicit"}},"selector_path":"/analysis/sources/entries/input/selector","selector_schema":{"version":1,"origin":"explicit"},"model":{"role":"source","display_name":"benchmark input","categories":["input.user-controlled"],"binding":{"type":"return_value"},"taint":{"type":"source","labels":["attacker-controlled"],"evidence":null},"supersedes":[]},"semantic_hash":"a7086bee9e3b830fec298d9c60e31a18d0a1b5def9088091dd89ded489a1b094","analysis_projection_hash":"e8c42d395df5363d0a789c7ce734dfbf40662b3cd18757fc730b80ccaea4bab0","origins":[{"type":"policy_local","path":"/analysis/sources/entries/input"}]},{"identity":{"type":"local","policy_id":"dataflowbench.taint.model-java","entry_id":"sink"},"definition_schema":{"type":"policy_document","resolution":{"version":1,"origin":"explicit"}},"selector_path":"/analysis/sinks/entries/sink/selector","selector_schema":{"version":1,"origin":"explicit"},"model":{"role":"sink","display_name":"benchmark sink","categories":["data.sensitive"],"binding":{"type":"argument_index","index":0},"taint":{"type":"sink","accepts":["attacker-controlled"],"tags":[],"impacts":[]},"supersedes":[]},"semantic_hash":"b52687a8ab41d5d17210b86f12a811f4685621b9951f5a655b49bf1de1ec394a","analysis_projection_hash":"25d9c2ebb7b961bbe416e36651d6fec2898ab0d1bee858193f0faedd564ed2e8","origins":[{"type":"policy_local","path":"/analysis/sinks/entries/sink"}]}],"match_directory_manifests":[],"precedence_manifest":{"edges":[]},"name":"DataFlowBench Java taint-modeling matrix","message":{"type":"static","text":"A benchmark-declared model carried input to the declared sink"},"severity":{"type":"fixed","level":"warning"},"description":null,"help_uri":null,"tags":[]}],"runs":[{"policy_id":"dataflowbench.taint.model-java","policy_hash":"68abcba8acc9e700c56c7aaacea4878cd31ab0ce435bbcd8ba7e74caf4fdd42a","analysis_type":"taint","completion":{"type":"complete"},"findings":[],"diagnostics":[],"diagnostics_truncated":false,"work":{"scanned_files":3,"scanned_source_bytes":1251,"fact_nodes":36,"pipeline_rows":1,"examined_references":0,"retained_findings":0,"omitted_findings_lower_bound":0,"retained_report_bytes":3049,"metrics":[{"name":"taint.semantic_materialized_files","unit":"count","value":1},{"name":"taint.semantic_program_points","unit":"rows","value":29},{"name":"taint.semantic_source_bytes","unit":"bytes","value":417},{"name":"taint.semantic_traversal_steps","unit":"count","value":7}]}}],"suppressions":[],"scope":[],"diagnostics":[],"diagnostics_truncated":false,"omitted_diagnostics_lower_bound":0,"worst_omitted_diagnostic_severity":null} \ No newline at end of file diff --git a/reports/raw/load-bearing-java-modeling/bifrost-require-model-accepted.json b/reports/raw/load-bearing-java-modeling/bifrost-require-model-accepted.json new file mode 100644 index 0000000..851010e --- /dev/null +++ b/reports/raw/load-bearing-java-modeling/bifrost-require-model-accepted.json @@ -0,0 +1 @@ +{"schema_version":3,"evaluation":{"evaluation_date":"2026-08-11","suppression_path":".bifrost/suppressions.json","suppression_document_state":"not_found","scope_path":".bifrost/policy-scope.json","scope_document_state":"not_found"},"execution":{"total_elapsed_ms":0,"stage_timings":[],"termination":null,"terminal_stage":null,"active_policy_id":null,"completed_policy_ids":[],"pending_policy_ids":[]},"rules":[{"policy_id":"dataflowbench.taint.model-java","policy_hash":"c419872859b67e67c0583d6b66a4eea7cf3350a36a3207a89222db636e8f3c61","analysis_type":"taint","policy_schema":{"version":1,"origin":"explicit"},"selector_schemas":[{"path":"/analysis/sinks/entries/declared-sink/selector","resolution":{"version":1,"origin":"explicit"}},{"path":"/analysis/sinks/entries/sink/selector","resolution":{"version":1,"origin":"explicit"}},{"path":"/analysis/sources/entries/declared-source/selector","resolution":{"version":1,"origin":"explicit"}},{"path":"/analysis/sources/entries/input/selector","resolution":{"version":1,"origin":"explicit"}}],"endpoint_dependencies":[{"identity":{"type":"local","policy_id":"dataflowbench.taint.model-java","entry_id":"declared-sink"},"definition_schema":{"type":"policy_document","resolution":{"version":1,"origin":"explicit"}},"selector_path":"/analysis/sinks/entries/declared-sink/selector","selector_schema":{"version":1,"origin":"explicit"},"model":{"role":"sink","display_name":"Audit.record","categories":["data.sensitive"],"binding":{"type":"argument_index","index":0},"taint":{"type":"sink","accepts":["attacker-controlled"],"tags":[],"impacts":[]},"supersedes":[]},"semantic_hash":"ca5f95a181dd48460b9824d0efa881784970b23cee888d6978b2ac7052d4e1b8","analysis_projection_hash":"d363c6c98379de62f3b873ddd371d29750835db27374c05eaae279abebe4e570","origins":[{"type":"policy_local","path":"/analysis/sinks/entries/declared-sink"}]},{"identity":{"type":"local","policy_id":"dataflowbench.taint.model-java","entry_id":"declared-source"},"definition_schema":{"type":"policy_document","resolution":{"version":1,"origin":"explicit"}},"selector_path":"/analysis/sources/entries/declared-source/selector","selector_schema":{"version":1,"origin":"explicit"},"model":{"role":"source","display_name":"Config.fetchRemote","categories":["input.user-controlled"],"binding":{"type":"return_value"},"taint":{"type":"source","labels":["attacker-controlled"],"evidence":null},"supersedes":[]},"semantic_hash":"e9a7217df5670b3b88bcdf42ba7e5dfbc6f826f109e75d6d1661192725413ad1","analysis_projection_hash":"cf57d45f5aa9335e9cd6372f1ce817dcc569b8bb153df7d074da79614169b550","origins":[{"type":"policy_local","path":"/analysis/sources/entries/declared-source"}]},{"identity":{"type":"local","policy_id":"dataflowbench.taint.model-java","entry_id":"input"},"definition_schema":{"type":"policy_document","resolution":{"version":1,"origin":"explicit"}},"selector_path":"/analysis/sources/entries/input/selector","selector_schema":{"version":1,"origin":"explicit"},"model":{"role":"source","display_name":"benchmark input","categories":["input.user-controlled"],"binding":{"type":"return_value"},"taint":{"type":"source","labels":["attacker-controlled"],"evidence":null},"supersedes":[]},"semantic_hash":"a7086bee9e3b830fec298d9c60e31a18d0a1b5def9088091dd89ded489a1b094","analysis_projection_hash":"e8c42d395df5363d0a789c7ce734dfbf40662b3cd18757fc730b80ccaea4bab0","origins":[{"type":"policy_local","path":"/analysis/sources/entries/input"}]},{"identity":{"type":"local","policy_id":"dataflowbench.taint.model-java","entry_id":"sink"},"definition_schema":{"type":"policy_document","resolution":{"version":1,"origin":"explicit"}},"selector_path":"/analysis/sinks/entries/sink/selector","selector_schema":{"version":1,"origin":"explicit"},"model":{"role":"sink","display_name":"benchmark sink","categories":["data.sensitive"],"binding":{"type":"argument_index","index":0},"taint":{"type":"sink","accepts":["attacker-controlled"],"tags":[],"impacts":[]},"supersedes":[]},"semantic_hash":"b52687a8ab41d5d17210b86f12a811f4685621b9951f5a655b49bf1de1ec394a","analysis_projection_hash":"25d9c2ebb7b961bbe416e36651d6fec2898ab0d1bee858193f0faedd564ed2e8","origins":[{"type":"policy_local","path":"/analysis/sinks/entries/sink"}]}],"match_directory_manifests":[],"precedence_manifest":{"edges":[]},"name":"DataFlowBench Java taint-modeling matrix","message":{"type":"static","text":"A benchmark-declared model carried input to the declared sink"},"severity":{"type":"fixed","level":"warning"},"description":null,"help_uri":null,"tags":[]}],"runs":[{"policy_id":"dataflowbench.taint.model-java","policy_hash":"c419872859b67e67c0583d6b66a4eea7cf3350a36a3207a89222db636e8f3c61","analysis_type":"taint","completion":{"type":"complete"},"findings":[{"id":"beeb5253e576d28e435dd0225619fad02efe94b2808112a24760d675d982e897","identity_stability":"strong","policy_id":"dataflowbench.taint.model-java","policy_hash":"c419872859b67e67c0583d6b66a4eea7cf3350a36a3207a89222db636e8f3c61","analysis_type":"taint","severity":"warning","message":"A benchmark-declared model carried input to the declared sink","classification":{"type":"unclassified"},"certainty":{"type":"definite"},"completeness":{"type":"complete"},"primary":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":377,"end":407},"region":{"start_line":17,"start_column":9,"end_line":17,"end_column":39}},"related":[{"relationship":"source","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":386,"end":406},"region":{"start_line":17,"start_column":18,"end_line":17,"end_column":38}},"evidence_refs":[]}],"related_truncated":false,"omitted_related_locations_lower_bound":0,"evidence":{"type":"taint","evidence":{"analysis_finding_id":"bifrost:e00d01675bf1235d6fd72ce468c9f7046a73b37596ebbd2ef0c0b83a590a6fed","anchor":{"type":"strong","sink_identity":{"namespace":"java","path":"ModelDeclaredSourcePositive.java","derivation":"canonical_ast_identity","semantic_key":"[[\"file\",\"ModelDeclaredSourcePositive.java\"],[\"type\",\"ModelDeclaredSourcePositive\"],[\"method\",\"run\"],[\"program_point\",null]]"},"source_endpoint_analysis_projection_hash":"cf57d45f5aa9335e9cd6372f1ce817dcc569b8bb153df7d074da79614169b550","sink_endpoint_analysis_projection_hash":"25d9c2ebb7b961bbe416e36651d6fec2898ab0d1bee858193f0faedd564ed2e8","source_scenario_set_hash":"ec850b2c1c787682bfec02125cfb8b33992b0e4334cd856b1078fc79d35c4a64"},"sink":"bifrost:f27823f2e9c4a580765d15dd30a1cf01212b7c55506bcd95613503e6613010f4","source_endpoint":{"type":"local","policy_id":"dataflowbench.taint.model-java","entry_id":"declared-source"},"sink_endpoint":{"type":"local","policy_id":"dataflowbench.taint.model-java","entry_id":"sink"},"source_display_name":"Config.fetchRemote","sink_display_name":"benchmark sink","source_categories":["input.user-controlled"],"sink_categories":["data.sensitive"],"selected_combination":null,"sink_tags":[],"sink_impacts":[],"reached_source_labels":["attacker-controlled"],"origins":[{"source_endpoint":{"type":"local","policy_id":"dataflowbench.taint.model-java","entry_id":"declared-source"},"source_label":"attacker-controlled","source_evidence":null,"primary":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":386,"end":406},"region":{"start_line":17,"start_column":18,"end_line":17,"end_column":38}},"scenario_id":"bifrost:0ece02fa406bfd60cd2ffb1a18e36beec3ca367d93661c2bc6b8a99939130bca:source-event:0","evidence_refs":["bifrost:a443d68b45dacdb3e6185cfa13ca92e0306fa7550728d55c36bfbfd70a4e7f01"]}],"origins_truncated":false,"source_scenarios":["bifrost:0ece02fa406bfd60cd2ffb1a18e36beec3ca367d93661c2bc6b8a99939130bca:source-event:0"],"source_scenarios_truncated":false,"omitted_source_scenarios_lower_bound":0,"source_scenario_set_hash":"ec850b2c1c787682bfec02125cfb8b33992b0e4334cd856b1078fc79d35c4a64","witness_refs":["bifrost:37d397db1820c48ce632f7874098b25d455ba86a28d6c654593849af80b71710","bifrost:4d0541b035fb383be82a142536dedd48ca8fb6db74e04080b0fb00649b004edd","bifrost:e2559ba1ef83358ec3138c634166c25dea826db004c2ceebbb67e7a258841ef5"],"witness_refs_truncated":false,"projection_facts_hash":"41d25abaa0ab3935bf5f0e2b385873ac5f64417c7e50b42c1df8a1d9479a6262"}},"evidence_refs_truncated":false,"omitted_evidence_refs_lower_bound":0,"cvss":null,"organizational_risk":null,"proof":{"state":"proven","reasons":[{"type":"dataflow_witness"}],"evidence_refs":[]},"witnesses":[{"id":"bifrost:37d397db1820c48ce632f7874098b25d455ba86a28d6c654593849af80b71710","steps":[{"kind":"source","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":349,"end":414},"region":{"start_line":16,"start_column":5,"end_line":18,"end_column":6}},"label":"taint source","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":349,"end":414},"region":{"start_line":16,"start_column":5,"end_line":18,"end_column":6}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":367,"end":414},"region":{"start_line":16,"start_column":23,"end_line":18,"end_column":6}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":377,"end":408},"region":{"start_line":17,"start_column":9,"end_line":17,"end_column":40}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":386,"end":406},"region":{"start_line":17,"start_column":18,"end_line":17,"end_column":38}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":386,"end":392},"region":{"start_line":17,"start_column":18,"end_line":17,"end_column":24}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":386,"end":406},"region":{"start_line":17,"start_column":18,"end_line":17,"end_column":38}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":386,"end":406},"region":{"start_line":17,"start_column":18,"end_line":17,"end_column":38}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":377,"end":407},"region":{"start_line":17,"start_column":9,"end_line":17,"end_column":39}},"label":"taint propagation","evidence_refs":[]}],"truncated":false,"omitted_steps_lower_bound":0,"retained_bytes":1868},{"id":"bifrost:4d0541b035fb383be82a142536dedd48ca8fb6db74e04080b0fb00649b004edd","steps":[{"kind":"source","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":349,"end":414},"region":{"start_line":16,"start_column":5,"end_line":18,"end_column":6}},"label":"taint source","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":349,"end":414},"region":{"start_line":16,"start_column":5,"end_line":18,"end_column":6}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":367,"end":414},"region":{"start_line":16,"start_column":23,"end_line":18,"end_column":6}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":377,"end":408},"region":{"start_line":17,"start_column":9,"end_line":17,"end_column":40}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":386,"end":406},"region":{"start_line":17,"start_column":18,"end_line":17,"end_column":38}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":386,"end":392},"region":{"start_line":17,"start_column":18,"end_line":17,"end_column":24}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":386,"end":406},"region":{"start_line":17,"start_column":18,"end_line":17,"end_column":38}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":386,"end":406},"region":{"start_line":17,"start_column":18,"end_line":17,"end_column":38}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":377,"end":407},"region":{"start_line":17,"start_column":9,"end_line":17,"end_column":39}},"label":"taint propagation","evidence_refs":[]}],"truncated":false,"omitted_steps_lower_bound":0,"retained_bytes":1868},{"id":"bifrost:e2559ba1ef83358ec3138c634166c25dea826db004c2ceebbb67e7a258841ef5","steps":[{"kind":"source","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":349,"end":414},"region":{"start_line":16,"start_column":5,"end_line":18,"end_column":6}},"label":"taint source","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":349,"end":414},"region":{"start_line":16,"start_column":5,"end_line":18,"end_column":6}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":367,"end":414},"region":{"start_line":16,"start_column":23,"end_line":18,"end_column":6}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":377,"end":408},"region":{"start_line":17,"start_column":9,"end_line":17,"end_column":40}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":386,"end":406},"region":{"start_line":17,"start_column":18,"end_line":17,"end_column":38}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":386,"end":392},"region":{"start_line":17,"start_column":18,"end_line":17,"end_column":24}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":386,"end":406},"region":{"start_line":17,"start_column":18,"end_line":17,"end_column":38}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":386,"end":406},"region":{"start_line":17,"start_column":18,"end_line":17,"end_column":38}},"label":"taint propagation","evidence_refs":[]},{"kind":"propagation","location":{"path":"ModelDeclaredSourcePositive.java","byte_span":{"start":377,"end":407},"region":{"start_line":17,"start_column":9,"end_line":17,"end_column":39}},"label":"taint propagation","evidence_refs":[]}],"truncated":false,"omitted_steps_lower_bound":0,"retained_bytes":1868}],"witnesses_truncated":false,"omitted_witnesses_lower_bound":0,"suppression":null,"scope":null}],"diagnostics":[],"diagnostics_truncated":false,"work":{"scanned_files":4,"scanned_source_bytes":1668,"fact_nodes":72,"pipeline_rows":2,"examined_references":0,"retained_findings":1,"omitted_findings_lower_bound":0,"retained_report_bytes":12835,"metrics":[{"name":"taint.propagation_shared_memberships","unit":"count","value":0},{"name":"taint.propagation_solves","unit":"count","value":1},{"name":"taint.semantic_materialized_files","unit":"count","value":2},{"name":"taint.semantic_program_points","unit":"rows","value":145},{"name":"taint.semantic_source_bytes","unit":"bytes","value":2085},{"name":"taint.semantic_traversal_steps","unit":"count","value":17}]}}],"suppressions":[],"scope":[],"diagnostics":[],"diagnostics_truncated":false,"omitted_diagnostics_lower_bound":0,"worst_omitted_diagnostic_severity":null} \ No newline at end of file diff --git a/reports/raw/load-bearing-java-modeling/codeql-opaque-propagator-with-model.sarif.json b/reports/raw/load-bearing-java-modeling/codeql-opaque-propagator-with-model.sarif.json new file mode 100644 index 0000000..a9cba03 --- /dev/null +++ b/reports/raw/load-bearing-java-modeling/codeql-opaque-propagator-with-model.sarif.json @@ -0,0 +1 @@ +{"$schema":"https://json.schemastore.org/sarif-2.1.0.json","version":"2.1.0","runs":[{"tool":{"driver":{"name":"CodeQL","organization":"GitHub","semanticVersion":"2.26.3","notifications":[{"id":"java/baseline/expected-extracted-files","name":"java/baseline/expected-extracted-files","shortDescription":{"text":"Expected extracted files"},"fullDescription":{"text":"Files appearing in the source archive that are expected to be extracted."},"defaultConfiguration":{"enabled":true},"properties":{"tags":["expected-extracted-files","telemetry"]}},{"id":"cli/file-coverage-baseline","name":"cli/file-coverage-baseline","shortDescription":{"text":"File coverage baseline telemetry"},"fullDescription":{"text":"File coverage baseline telemetry"},"defaultConfiguration":{"enabled":true}},{"id":"cli/platform","name":"cli/platform","shortDescription":{"text":"Platform"},"fullDescription":{"text":"Platform"},"defaultConfiguration":{"enabled":true}},{"id":"cli/sip-enablement","name":"cli/sip-enablement","shortDescription":{"text":"macOS SIP enablement status"},"fullDescription":{"text":"macOS SIP enablement status"},"defaultConfiguration":{"enabled":true}},{"id":"java/extractor/summary","name":"java/extractor/summary","shortDescription":{"text":"Java extractor telemetry"},"fullDescription":{"text":"Java extractor telemetry"},"defaultConfiguration":{"enabled":true}}],"rules":[{"id":"dataflowbench/java-taint-modeling","name":"dataflowbench/java-taint-modeling","shortDescription":{"text":"DataFlowBench Java taint-modeling matrix"},"fullDescription":{"text":"Encodes the twelve benchmark-supplied model declarations of docs/modeling-matrix.md natively in CodeQL's data-flow configuration surface, for the Java modeling population."},"defaultConfiguration":{"enabled":true,"level":"warning"},"properties":{"tags":["security"],"description":"Encodes the twelve benchmark-supplied model declarations of\n docs/modeling-matrix.md natively in CodeQL's data-flow\n configuration surface, for the Java modeling population.","id":"dataflowbench/java-taint-modeling","kind":"path-problem","name":"DataFlowBench Java taint-modeling matrix","precision":"high","problem.severity":"warning"}}]},"extensions":[{"name":"dataflowbench/codeql-java","semanticVersion":"0.0.1","locations":[{"uri":"file:///Users/dave/Workspace/BrokkAi/dataflowbench/.claude/worktrees/agent-af332237afc5e1bcf/adapters/codeql/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/Workspace/BrokkAi/dataflowbench/.claude/worktrees/agent-af332237afc5e1bcf/adapters/codeql/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]},{"name":"codeql/java-all","semanticVersion":"9.2.3+44a68d3a47fcbcd6a6a76ec7d1c1b3a1a28b201e","locations":[{"uri":"file:///Users/dave/.codeql/packages/codeql/java-all/9.2.3/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/.codeql/packages/codeql/java-all/9.2.3/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]},{"name":"codeql/threat-models","semanticVersion":"1.0.55+44a68d3a47fcbcd6a6a76ec7d1c1b3a1a28b201e","locations":[{"uri":"file:///Users/dave/.codeql/packages/codeql/threat-models/1.0.55/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/.codeql/packages/codeql/threat-models/1.0.55/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]}]},"invocations":[{"toolExecutionNotifications":[{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"ModelOpaquePropagatorPositive.java","uriBaseId":"%SRCROOT%","index":0}}}],"message":{"text":""},"level":"none","descriptor":{"id":"java/baseline/expected-extracted-files","index":0},"properties":{"formattedMessage":{"text":""}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:40:13.637868Z","descriptor":{"id":"cli/file-coverage-baseline","index":1},"properties":{"attributes":{"durationMilliseconds":19},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:40:13.638781Z","descriptor":{"id":"cli/platform","index":2},"properties":{"attributes":{"arch":"aarch64","name":"Mac OS X","version":"26.6.2"},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:40:13.646952Z","descriptor":{"id":"cli/sip-enablement","index":3},"properties":{"attributes":{"isEnabled":true},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":"Internal telemetry for the Java extractor.\n\nNo action needed.","markdown":"Internal telemetry for the Java extractor.\n\nNo action needed."},"level":"note","timeUtc":"2026-08-26T13:40:15.631739Z","descriptor":{"id":"java/extractor/summary","index":4},"properties":{"attributes":{"java_vendor":"Eclipse Adoptium","java_version":"21.0.8"},"visibility":{"statusPage":false,"telemetry":true}}}],"executionSuccessful":true}],"artifacts":[{"location":{"uri":"ModelOpaquePropagatorPositive.java","uriBaseId":"%SRCROOT%","index":0}}],"results":[{"ruleId":"dataflowbench/java-taint-modeling","ruleIndex":0,"rule":{"id":"dataflowbench/java-taint-modeling","index":0},"message":{"text":"A benchmark-declared model carried input to the declared sink."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"ModelOpaquePropagatorPositive.java","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":37,"startColumn":18,"endColumn":44}}}],"partialFingerprints":{"primaryLocationLineHash":"5ada21557e92fb97:1","primaryLocationStartColumnFingerprint":"9"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"ModelOpaquePropagatorPositive.java","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":37,"startColumn":31,"endColumn":43}},"message":{"text":"dfb_source(...) : String"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"ModelOpaquePropagatorPositive.java","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":37,"startColumn":18,"endColumn":44}},"message":{"text":"carry(...)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]}]}]}],"relatedLocations":[{"physicalLocation":{"artifactLocation":{"uri":"ModelOpaquePropagatorPositive.java","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":37,"startColumn":31,"endColumn":43}}}]}],"columnKind":"utf16CodeUnits","properties":{"semmle.formatSpecifier":"sarif-latest"}}]} \ No newline at end of file diff --git a/reports/raw/load-bearing-java-modeling/codeql-opaque-propagator-without-model.sarif.json b/reports/raw/load-bearing-java-modeling/codeql-opaque-propagator-without-model.sarif.json new file mode 100644 index 0000000..af038dd --- /dev/null +++ b/reports/raw/load-bearing-java-modeling/codeql-opaque-propagator-without-model.sarif.json @@ -0,0 +1 @@ +{"$schema":"https://json.schemastore.org/sarif-2.1.0.json","version":"2.1.0","runs":[{"tool":{"driver":{"name":"CodeQL","organization":"GitHub","semanticVersion":"2.26.3","notifications":[{"id":"java/baseline/expected-extracted-files","name":"java/baseline/expected-extracted-files","shortDescription":{"text":"Expected extracted files"},"fullDescription":{"text":"Files appearing in the source archive that are expected to be extracted."},"defaultConfiguration":{"enabled":true},"properties":{"tags":["expected-extracted-files","telemetry"]}},{"id":"cli/file-coverage-baseline","name":"cli/file-coverage-baseline","shortDescription":{"text":"File coverage baseline telemetry"},"fullDescription":{"text":"File coverage baseline telemetry"},"defaultConfiguration":{"enabled":true}},{"id":"cli/platform","name":"cli/platform","shortDescription":{"text":"Platform"},"fullDescription":{"text":"Platform"},"defaultConfiguration":{"enabled":true}},{"id":"cli/sip-enablement","name":"cli/sip-enablement","shortDescription":{"text":"macOS SIP enablement status"},"fullDescription":{"text":"macOS SIP enablement status"},"defaultConfiguration":{"enabled":true}},{"id":"java/extractor/summary","name":"java/extractor/summary","shortDescription":{"text":"Java extractor telemetry"},"fullDescription":{"text":"Java extractor telemetry"},"defaultConfiguration":{"enabled":true}}],"rules":[{"id":"dataflowbench/java-taint-modeling","name":"dataflowbench/java-taint-modeling","shortDescription":{"text":"DataFlowBench Java taint-modeling matrix"},"fullDescription":{"text":"Encodes the twelve benchmark-supplied model declarations of docs/modeling-matrix.md natively in CodeQL's data-flow configuration surface, for the Java modeling population."},"defaultConfiguration":{"enabled":true,"level":"warning"},"properties":{"tags":["security"],"description":"Encodes the twelve benchmark-supplied model declarations of\n docs/modeling-matrix.md natively in CodeQL's data-flow\n configuration surface, for the Java modeling population.","id":"dataflowbench/java-taint-modeling","kind":"path-problem","name":"DataFlowBench Java taint-modeling matrix","precision":"high","problem.severity":"warning"}}]},"extensions":[{"name":"dataflowbench/codeql-java","semanticVersion":"0.0.1","locations":[{"uri":"file:///var/folders/t1/k_27wjcd4095w9w121dm92_w0000gn/T/tmp.phZjpVzZqU/codeql-pack/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///var/folders/t1/k_27wjcd4095w9w121dm92_w0000gn/T/tmp.phZjpVzZqU/codeql-pack/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]},{"name":"codeql/java-all","semanticVersion":"9.2.3+44a68d3a47fcbcd6a6a76ec7d1c1b3a1a28b201e","locations":[{"uri":"file:///Users/dave/.codeql/packages/codeql/java-all/9.2.3/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/.codeql/packages/codeql/java-all/9.2.3/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]},{"name":"codeql/threat-models","semanticVersion":"1.0.55+44a68d3a47fcbcd6a6a76ec7d1c1b3a1a28b201e","locations":[{"uri":"file:///Users/dave/.codeql/packages/codeql/threat-models/1.0.55/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///Users/dave/.codeql/packages/codeql/threat-models/1.0.55/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]}]},"invocations":[{"toolExecutionNotifications":[{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"ModelOpaquePropagatorPositive.java","uriBaseId":"%SRCROOT%","index":0}}}],"message":{"text":""},"level":"none","descriptor":{"id":"java/baseline/expected-extracted-files","index":0},"properties":{"formattedMessage":{"text":""}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:40:13.637868Z","descriptor":{"id":"cli/file-coverage-baseline","index":1},"properties":{"attributes":{"durationMilliseconds":19},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:40:13.638781Z","descriptor":{"id":"cli/platform","index":2},"properties":{"attributes":{"arch":"aarch64","name":"Mac OS X","version":"26.6.2"},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":""},"level":"none","timeUtc":"2026-08-26T13:40:13.646952Z","descriptor":{"id":"cli/sip-enablement","index":3},"properties":{"attributes":{"isEnabled":true},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":"Internal telemetry for the Java extractor.\n\nNo action needed.","markdown":"Internal telemetry for the Java extractor.\n\nNo action needed."},"level":"note","timeUtc":"2026-08-26T13:40:15.631739Z","descriptor":{"id":"java/extractor/summary","index":4},"properties":{"attributes":{"java_vendor":"Eclipse Adoptium","java_version":"21.0.8"},"visibility":{"statusPage":false,"telemetry":true}}}],"executionSuccessful":true}],"artifacts":[{"location":{"uri":"ModelOpaquePropagatorPositive.java","uriBaseId":"%SRCROOT%","index":0}}],"results":[],"columnKind":"utf16CodeUnits","properties":{"semmle.formatSpecifier":"sarif-latest"}}]} \ No newline at end of file diff --git a/reports/raw/load-bearing-java-modeling/joern-opaque-propagator-unmodeled.json b/reports/raw/load-bearing-java-modeling/joern-opaque-propagator-unmodeled.json new file mode 100644 index 0000000..cd8afa0 --- /dev/null +++ b/reports/raw/load-bearing-java-modeling/joern-opaque-propagator-unmodeled.json @@ -0,0 +1 @@ +{"adapter":"joern","evidence_kind":"joern-modeled-reachable-by-flows","input_path":"/var/folders/t1/k_27wjcd4095w9w121dm92_w0000gn/T/tmp.phZjpVzZqU/joern-source","frontend_language":"JAVASRC","source_function":"dfb_source","sink_function":"dfb_sink","source_kind":"call-return","semantics_path":"/var/folders/t1/k_27wjcd4095w9w121dm92_w0000gn/T/tmp.phZjpVzZqU/with.semantics","state":"analyzed","method_count":14,"declared_semantic_count":3,"source_node_count":1,"sink_node_count":1,"source_nodes":[{"label":"CALL","file":"ModelOpaquePropagatorPositive.java","line":37,"method":"dataflowbench.taint.ModelOpaquePropagatorPositive.run:void()","code":"dfb_source()"}],"sink_nodes":[{"label":"CALL","file":"ModelOpaquePropagatorPositive.java","line":37,"method":"dataflowbench.taint.ModelOpaquePropagatorPositive.run:void()","code":"Opaque.carry(dfb_source())"}],"flow_count":1,"flows":[{"elements":[{"label":"CALL","file":"ModelOpaquePropagatorPositive.java","line":37,"method":"dataflowbench.taint.ModelOpaquePropagatorPositive.run:void()","code":"dfb_source()"},{"label":"METHOD_PARAMETER_IN","file":"ModelOpaquePropagatorPositive.java","line":8,"method":"dataflowbench.taint.Opaque.carry:java.lang.String(java.lang.String)","code":"String value"},{"label":"IDENTIFIER","file":"ModelOpaquePropagatorPositive.java","line":12,"method":"dataflowbench.taint.Opaque.carry:java.lang.String(java.lang.String)","code":"value"},{"label":"CALL","file":"ModelOpaquePropagatorPositive.java","line":11,"method":"dataflowbench.taint.Opaque.carry:java.lang.String(java.lang.String)","code":".arrayInitializer"},{"label":"CALL","file":"ModelOpaquePropagatorPositive.java","line":11,"method":"dataflowbench.taint.Opaque.carry:java.lang.String(java.lang.String)","code":"Opaque.class.getMethod(target, String.class)"},{"label":"CALL","file":"ModelOpaquePropagatorPositive.java","line":11,"method":"dataflowbench.taint.Opaque.carry:java.lang.String(java.lang.String)","code":"(String) Opaque.class.getMethod(target, String.class).invoke(null, value)"},{"label":"RETURN","file":"ModelOpaquePropagatorPositive.java","line":11,"method":"dataflowbench.taint.Opaque.carry:java.lang.String(java.lang.String)","code":"return (String) Opaque.class.getMethod(target, String.class).invoke(null, value);"},{"label":"METHOD_RETURN","file":"ModelOpaquePropagatorPositive.java","line":8,"method":"dataflowbench.taint.Opaque.carry:java.lang.String(java.lang.String)","code":"RET"},{"label":"CALL","file":"ModelOpaquePropagatorPositive.java","line":37,"method":"dataflowbench.taint.ModelOpaquePropagatorPositive.run:void()","code":"Opaque.carry(dfb_source())"}]}]} diff --git a/reports/raw/load-bearing-java-modeling/joern-sanitizer-kill-with-model.json b/reports/raw/load-bearing-java-modeling/joern-sanitizer-kill-with-model.json new file mode 100644 index 0000000..cfbf696 --- /dev/null +++ b/reports/raw/load-bearing-java-modeling/joern-sanitizer-kill-with-model.json @@ -0,0 +1 @@ +{"adapter":"joern","evidence_kind":"joern-modeled-reachable-by-flows","input_path":"/var/folders/t1/k_27wjcd4095w9w121dm92_w0000gn/T/tmp.phZjpVzZqU/joern-source","frontend_language":"JAVASRC","source_function":"dfb_source","sink_function":"dfb_sink","source_kind":"call-return","semantics_path":"/var/folders/t1/k_27wjcd4095w9w121dm92_w0000gn/T/tmp.phZjpVzZqU/with.semantics","state":"analyzed","method_count":6,"declared_semantic_count":3,"source_node_count":1,"sink_node_count":1,"source_nodes":[{"label":"CALL","file":"ModelSanitizerKillNegative.java","line":17,"method":"dataflowbench.taint.ModelSanitizerKillNegative.run:void()","code":"dfb_source()"}],"sink_nodes":[{"label":"CALL","file":"ModelSanitizerKillNegative.java","line":17,"method":"dataflowbench.taint.ModelSanitizerKillNegative.run:void()","code":"Clean.scrub(dfb_source())"}],"flow_count":0,"flows":[]} diff --git a/reports/raw/load-bearing-java-modeling/joern-sanitizer-kill-without-model.json b/reports/raw/load-bearing-java-modeling/joern-sanitizer-kill-without-model.json new file mode 100644 index 0000000..af02281 --- /dev/null +++ b/reports/raw/load-bearing-java-modeling/joern-sanitizer-kill-without-model.json @@ -0,0 +1 @@ +{"adapter":"joern","evidence_kind":"joern-modeled-reachable-by-flows","input_path":"/var/folders/t1/k_27wjcd4095w9w121dm92_w0000gn/T/tmp.phZjpVzZqU/joern-source","frontend_language":"JAVASRC","source_function":"dfb_source","sink_function":"dfb_sink","source_kind":"call-return","semantics_path":"/var/folders/t1/k_27wjcd4095w9w121dm92_w0000gn/T/tmp.phZjpVzZqU/no-scrub.semantics","state":"analyzed","method_count":6,"declared_semantic_count":2,"source_node_count":1,"sink_node_count":1,"source_nodes":[{"label":"CALL","file":"ModelSanitizerKillNegative.java","line":17,"method":"dataflowbench.taint.ModelSanitizerKillNegative.run:void()","code":"dfb_source()"}],"sink_nodes":[{"label":"CALL","file":"ModelSanitizerKillNegative.java","line":17,"method":"dataflowbench.taint.ModelSanitizerKillNegative.run:void()","code":"Clean.scrub(dfb_source())"}],"flow_count":1,"flows":[{"elements":[{"label":"CALL","file":"ModelSanitizerKillNegative.java","line":17,"method":"dataflowbench.taint.ModelSanitizerKillNegative.run:void()","code":"dfb_source()"},{"label":"METHOD_PARAMETER_IN","file":"ModelSanitizerKillNegative.java","line":4,"method":"dataflowbench.taint.Clean.scrub:java.lang.String(java.lang.String)","code":"String value"},{"label":"IDENTIFIER","file":"ModelSanitizerKillNegative.java","line":5,"method":"dataflowbench.taint.Clean.scrub:java.lang.String(java.lang.String)","code":"value"},{"label":"RETURN","file":"ModelSanitizerKillNegative.java","line":5,"method":"dataflowbench.taint.Clean.scrub:java.lang.String(java.lang.String)","code":"return value;"},{"label":"METHOD_RETURN","file":"ModelSanitizerKillNegative.java","line":4,"method":"dataflowbench.taint.Clean.scrub:java.lang.String(java.lang.String)","code":"RET"},{"label":"CALL","file":"ModelSanitizerKillNegative.java","line":17,"method":"dataflowbench.taint.ModelSanitizerKillNegative.run:void()","code":"Clean.scrub(dfb_source())"}]}]} diff --git a/reports/raw/load-bearing-java-modeling/semgrep-declared-sink-with-model.json b/reports/raw/load-bearing-java-modeling/semgrep-declared-sink-with-model.json new file mode 100644 index 0000000..5d05a5d --- /dev/null +++ b/reports/raw/load-bearing-java-modeling/semgrep-declared-sink-with-model.json @@ -0,0 +1 @@ +{"version":"1.174.0","results":[{"check_id":"var.folders.t1.k_27wjcd4095w9w121dm92_w0000gn.T.tmp.phZjpVzZqU.dfb-model-java","path":"/var/folders/t1/k_27wjcd4095w9w121dm92_w0000gn/T/tmp.phZjpVzZqU/semgrep-source/ModelDeclaredSinkPositive.java","start":{"line":15,"col":9,"offset":350},"end":{"line":15,"col":35,"offset":376},"extra":{"message":"a benchmark-declared model carried input to the declared sink","metadata":{},"severity":"WARNING","fingerprint":"requires login","lines":"requires login","validation_state":"NO_VALIDATOR","engine_kind":"OSS"}}],"errors":[],"paths":{"scanned":["/var/folders/t1/k_27wjcd4095w9w121dm92_w0000gn/T/tmp.phZjpVzZqU/semgrep-source/ModelDeclaredSinkPositive.java"]},"time":{"rules":[],"rules_parse_time":0.000431060791015625,"profiling_times":{"config_time":0.10271286964416504,"core_time":0.2065422534942627,"ignores_time":7.486343383789062e-05,"total_time":0.31559300422668457},"parsing_time":{"total_time":0.0,"per_file_time":{"mean":0.0,"std_dev":0.0},"very_slow_stats":{"time_ratio":0.0,"count_ratio":0.0},"very_slow_files":[]},"scanning_time":{"total_time":0.005340099334716797,"per_file_time":{"mean":0.005340099334716797,"std_dev":0.0},"very_slow_stats":{"time_ratio":0.0,"count_ratio":0.0},"very_slow_files":[]},"matching_time":{"total_time":0.0,"per_file_and_rule_time":{"mean":0.0,"std_dev":0.0},"very_slow_stats":{"time_ratio":0.0,"count_ratio":0.0},"very_slow_rules_on_files":[]},"tainting_time":{"total_time":0.0,"per_def_and_rule_time":{"mean":0.0,"std_dev":0.0},"very_slow_stats":{"time_ratio":0.0,"count_ratio":0.0},"very_slow_rules_on_defs":[]},"fixpoint_timeouts":[],"prefiltering":{"project_level_time":0.0,"file_level_time":0.0,"rules_with_project_prefilters_ratio":0.0,"rules_with_file_prefilters_ratio":1.0,"rules_selected_ratio":1.0,"rules_matched_ratio":1.0},"targets":[],"total_bytes":0,"max_memory_bytes":93633216},"engine_requested":"OSS","skipped_rules":[],"profiling_results":[]} diff --git a/reports/raw/load-bearing-java-modeling/semgrep-declared-sink-without-model.json b/reports/raw/load-bearing-java-modeling/semgrep-declared-sink-without-model.json new file mode 100644 index 0000000..0374aea --- /dev/null +++ b/reports/raw/load-bearing-java-modeling/semgrep-declared-sink-without-model.json @@ -0,0 +1 @@ +{"version":"1.174.0","results":[],"errors":[],"paths":{"scanned":["/var/folders/t1/k_27wjcd4095w9w121dm92_w0000gn/T/tmp.phZjpVzZqU/semgrep-source/ModelDeclaredSinkPositive.java"]},"time":{"rules":[],"rules_parse_time":0.0004298686981201172,"profiling_times":{"config_time":0.11513018608093262,"core_time":0.2255558967590332,"ignores_time":0.0001819133758544922,"total_time":0.3473541736602783},"parsing_time":{"total_time":0.0,"per_file_time":{"mean":0.0,"std_dev":0.0},"very_slow_stats":{"time_ratio":0.0,"count_ratio":0.0},"very_slow_files":[]},"scanning_time":{"total_time":7.796287536621094e-05,"per_file_time":{"mean":7.796287536621094e-05,"std_dev":0.0},"very_slow_stats":{"time_ratio":0.0,"count_ratio":0.0},"very_slow_files":[]},"matching_time":{"total_time":0.0,"per_file_and_rule_time":{"mean":0.0,"std_dev":0.0},"very_slow_stats":{"time_ratio":0.0,"count_ratio":0.0},"very_slow_rules_on_files":[]},"tainting_time":{"total_time":0.0,"per_def_and_rule_time":{"mean":0.0,"std_dev":0.0},"very_slow_stats":{"time_ratio":0.0,"count_ratio":0.0},"very_slow_rules_on_defs":[]},"fixpoint_timeouts":[],"prefiltering":{"project_level_time":0.0,"file_level_time":0.0,"rules_with_project_prefilters_ratio":0.0,"rules_with_file_prefilters_ratio":1.0,"rules_selected_ratio":0.0,"rules_matched_ratio":0.0},"targets":[],"total_bytes":0,"max_memory_bytes":78599488},"engine_requested":"OSS","skipped_rules":[],"profiling_results":[]} diff --git a/reports/raw/semgrep-java-modeling/dfb-taint-java-model-declared-sink-negative.json b/reports/raw/semgrep-java-modeling/dfb-taint-java-model-declared-sink-negative.json new file mode 100644 index 0000000..2850b55 --- /dev/null +++ b/reports/raw/semgrep-java-modeling/dfb-taint-java-model-declared-sink-negative.json @@ -0,0 +1 @@ +{"version":"1.174.0","results":[],"errors":[],"paths":{"scanned":["/var/folders/t1/k_27wjcd4095w9w121dm92_w0000gn/T/dataflowbench-modeling-semgrep-java/dfb-taint-java-model-declared-sink-negative/source/ModelDeclaredSinkNegative.java"]},"time":{"rules":[],"rules_parse_time":0.0004591941833496094,"profiling_times":{"config_time":0.12427711486816406,"core_time":0.2239689826965332,"ignores_time":6.914138793945312e-05,"total_time":0.3546619415283203},"parsing_time":{"total_time":0.0,"per_file_time":{"mean":0.0,"std_dev":0.0},"very_slow_stats":{"time_ratio":0.0,"count_ratio":0.0},"very_slow_files":[]},"scanning_time":{"total_time":0.008769989013671875,"per_file_time":{"mean":0.008769989013671875,"std_dev":0.0},"very_slow_stats":{"time_ratio":0.0,"count_ratio":0.0},"very_slow_files":[]},"matching_time":{"total_time":0.0,"per_file_and_rule_time":{"mean":0.0,"std_dev":0.0},"very_slow_stats":{"time_ratio":0.0,"count_ratio":0.0},"very_slow_rules_on_files":[]},"tainting_time":{"total_time":0.0,"per_def_and_rule_time":{"mean":0.0,"std_dev":0.0},"very_slow_stats":{"time_ratio":0.0,"count_ratio":0.0},"very_slow_rules_on_defs":[]},"fixpoint_timeouts":[],"prefiltering":{"project_level_time":0.0,"file_level_time":0.0,"rules_with_project_prefilters_ratio":0.0,"rules_with_file_prefilters_ratio":1.0,"rules_selected_ratio":1.0,"rules_matched_ratio":1.0},"targets":[],"total_bytes":0,"max_memory_bytes":93108928},"engine_requested":"OSS","skipped_rules":[],"profiling_results":[]} diff --git a/reports/raw/semgrep-java-modeling/dfb-taint-java-model-declared-sink-positive.json b/reports/raw/semgrep-java-modeling/dfb-taint-java-model-declared-sink-positive.json new file mode 100644 index 0000000..e0c80b1 --- /dev/null +++ b/reports/raw/semgrep-java-modeling/dfb-taint-java-model-declared-sink-positive.json @@ -0,0 +1 @@ +{"version":"1.174.0","results":[{"check_id":"Users.dave.Workspace.BrokkAi.dataflowbench..claude.worktrees.agent-af332237afc5e1bcf.adapters.semgrep.rules.dfb-model-java","path":"/var/folders/t1/k_27wjcd4095w9w121dm92_w0000gn/T/dataflowbench-modeling-semgrep-java/dfb-taint-java-model-declared-sink-positive/source/ModelDeclaredSinkPositive.java","start":{"line":15,"col":9,"offset":350},"end":{"line":15,"col":35,"offset":376},"extra":{"message":"a benchmark-declared model carried input to the declared sink","metadata":{},"severity":"WARNING","fingerprint":"requires login","lines":"requires login","validation_state":"NO_VALIDATOR","engine_kind":"OSS"}}],"errors":[],"paths":{"scanned":["/var/folders/t1/k_27wjcd4095w9w121dm92_w0000gn/T/dataflowbench-modeling-semgrep-java/dfb-taint-java-model-declared-sink-positive/source/ModelDeclaredSinkPositive.java"]},"time":{"rules":[],"rules_parse_time":0.0004968643188476562,"profiling_times":{"config_time":0.11249279975891113,"core_time":0.2339038848876953,"ignores_time":2.9087066650390625e-05,"total_time":0.35289692878723145},"parsing_time":{"total_time":0.0,"per_file_time":{"mean":0.0,"std_dev":0.0},"very_slow_stats":{"time_ratio":0.0,"count_ratio":0.0},"very_slow_files":[]},"scanning_time":{"total_time":0.005838155746459961,"per_file_time":{"mean":0.005838155746459961,"std_dev":0.0},"very_slow_stats":{"time_ratio":0.0,"count_ratio":0.0},"very_slow_files":[]},"matching_time":{"total_time":0.0,"per_file_and_rule_time":{"mean":0.0,"std_dev":0.0},"very_slow_stats":{"time_ratio":0.0,"count_ratio":0.0},"very_slow_rules_on_files":[]},"tainting_time":{"total_time":0.0,"per_def_and_rule_time":{"mean":0.0,"std_dev":0.0},"very_slow_stats":{"time_ratio":0.0,"count_ratio":0.0},"very_slow_rules_on_defs":[]},"fixpoint_timeouts":[],"prefiltering":{"project_level_time":0.0,"file_level_time":0.0,"rules_with_project_prefilters_ratio":0.0,"rules_with_file_prefilters_ratio":1.0,"rules_selected_ratio":1.0,"rules_matched_ratio":1.0},"targets":[],"total_bytes":0,"max_memory_bytes":92584640},"engine_requested":"OSS","skipped_rules":[],"profiling_results":[]} diff --git a/reports/raw/semgrep-java-modeling/dfb-taint-java-model-declared-source-negative.json b/reports/raw/semgrep-java-modeling/dfb-taint-java-model-declared-source-negative.json new file mode 100644 index 0000000..cf2f9d0 --- /dev/null +++ b/reports/raw/semgrep-java-modeling/dfb-taint-java-model-declared-source-negative.json @@ -0,0 +1 @@ +{"version":"1.174.0","results":[],"errors":[],"paths":{"scanned":["/var/folders/t1/k_27wjcd4095w9w121dm92_w0000gn/T/dataflowbench-modeling-semgrep-java/dfb-taint-java-model-declared-source-negative/source/ModelDeclaredSourceNegative.java"]},"time":{"rules":[],"rules_parse_time":0.0004420280456542969,"profiling_times":{"config_time":0.10534906387329102,"core_time":0.21794676780700684,"ignores_time":3.1948089599609375e-05,"total_time":0.32935595512390137},"parsing_time":{"total_time":0.0,"per_file_time":{"mean":0.0,"std_dev":0.0},"very_slow_stats":{"time_ratio":0.0,"count_ratio":0.0},"very_slow_files":[]},"scanning_time":{"total_time":0.005228996276855469,"per_file_time":{"mean":0.005228996276855469,"std_dev":0.0},"very_slow_stats":{"time_ratio":0.0,"count_ratio":0.0},"very_slow_files":[]},"matching_time":{"total_time":0.0,"per_file_and_rule_time":{"mean":0.0,"std_dev":0.0},"very_slow_stats":{"time_ratio":0.0,"count_ratio":0.0},"very_slow_rules_on_files":[]},"tainting_time":{"total_time":0.0,"per_def_and_rule_time":{"mean":0.0,"std_dev":0.0},"very_slow_stats":{"time_ratio":0.0,"count_ratio":0.0},"very_slow_rules_on_defs":[]},"fixpoint_timeouts":[],"prefiltering":{"project_level_time":0.0,"file_level_time":0.0,"rules_with_project_prefilters_ratio":0.0,"rules_with_file_prefilters_ratio":1.0,"rules_selected_ratio":1.0,"rules_matched_ratio":1.0},"targets":[],"total_bytes":0,"max_memory_bytes":93895360},"engine_requested":"OSS","skipped_rules":[],"profiling_results":[]} diff --git a/reports/raw/semgrep-java-modeling/dfb-taint-java-model-declared-source-positive.json b/reports/raw/semgrep-java-modeling/dfb-taint-java-model-declared-source-positive.json new file mode 100644 index 0000000..c1c418f --- /dev/null +++ b/reports/raw/semgrep-java-modeling/dfb-taint-java-model-declared-source-positive.json @@ -0,0 +1 @@ +{"version":"1.174.0","results":[{"check_id":"Users.dave.Workspace.BrokkAi.dataflowbench..claude.worktrees.agent-af332237afc5e1bcf.adapters.semgrep.rules.dfb-model-java","path":"/var/folders/t1/k_27wjcd4095w9w121dm92_w0000gn/T/dataflowbench-modeling-semgrep-java/dfb-taint-java-model-declared-source-positive/source/ModelDeclaredSourcePositive.java","start":{"line":17,"col":9,"offset":377},"end":{"line":17,"col":39,"offset":407},"extra":{"message":"a benchmark-declared model carried input to the declared sink","metadata":{},"severity":"WARNING","fingerprint":"requires login","lines":"requires login","validation_state":"NO_VALIDATOR","engine_kind":"OSS"}}],"errors":[],"paths":{"scanned":["/var/folders/t1/k_27wjcd4095w9w121dm92_w0000gn/T/dataflowbench-modeling-semgrep-java/dfb-taint-java-model-declared-source-positive/source/ModelDeclaredSourcePositive.java"]},"time":{"rules":[],"rules_parse_time":0.0004699230194091797,"profiling_times":{"config_time":0.11797094345092773,"core_time":0.22850394248962402,"ignores_time":3.886222839355469e-05,"total_time":0.3529388904571533},"parsing_time":{"total_time":0.0,"per_file_time":{"mean":0.0,"std_dev":0.0},"very_slow_stats":{"time_ratio":0.0,"count_ratio":0.0},"very_slow_files":[]},"scanning_time":{"total_time":0.0055389404296875,"per_file_time":{"mean":0.0055389404296875,"std_dev":0.0},"very_slow_stats":{"time_ratio":0.0,"count_ratio":0.0},"very_slow_files":[]},"matching_time":{"total_time":0.0,"per_file_and_rule_time":{"mean":0.0,"std_dev":0.0},"very_slow_stats":{"time_ratio":0.0,"count_ratio":0.0},"very_slow_rules_on_files":[]},"tainting_time":{"total_time":0.0,"per_def_and_rule_time":{"mean":0.0,"std_dev":0.0},"very_slow_stats":{"time_ratio":0.0,"count_ratio":0.0},"very_slow_rules_on_defs":[]},"fixpoint_timeouts":[],"prefiltering":{"project_level_time":0.0,"file_level_time":0.0,"rules_with_project_prefilters_ratio":0.0,"rules_with_file_prefilters_ratio":1.0,"rules_selected_ratio":1.0,"rules_matched_ratio":1.0},"targets":[],"total_bytes":0,"max_memory_bytes":93108928},"engine_requested":"OSS","skipped_rules":[],"profiling_results":[]} diff --git a/reports/raw/semgrep-java-modeling/dfb-taint-java-model-entrypoint-parameter-negative.json b/reports/raw/semgrep-java-modeling/dfb-taint-java-model-entrypoint-parameter-negative.json new file mode 100644 index 0000000..30414cc --- /dev/null +++ b/reports/raw/semgrep-java-modeling/dfb-taint-java-model-entrypoint-parameter-negative.json @@ -0,0 +1 @@ +{"version":"1.174.0","results":[],"errors":[],"paths":{"scanned":["/var/folders/t1/k_27wjcd4095w9w121dm92_w0000gn/T/dataflowbench-modeling-semgrep-java/dfb-taint-java-model-entrypoint-parameter-negative/source/Handler.java"]},"time":{"rules":[],"rules_parse_time":0.00043702125549316406,"profiling_times":{"config_time":0.1194601058959961,"core_time":0.22427082061767578,"ignores_time":3.1948089599609375e-05,"total_time":0.3504161834716797},"parsing_time":{"total_time":0.0,"per_file_time":{"mean":0.0,"std_dev":0.0},"very_slow_stats":{"time_ratio":0.0,"count_ratio":0.0},"very_slow_files":[]},"scanning_time":{"total_time":0.004684925079345703,"per_file_time":{"mean":0.004684925079345703,"std_dev":0.0},"very_slow_stats":{"time_ratio":0.0,"count_ratio":0.0},"very_slow_files":[]},"matching_time":{"total_time":0.0,"per_file_and_rule_time":{"mean":0.0,"std_dev":0.0},"very_slow_stats":{"time_ratio":0.0,"count_ratio":0.0},"very_slow_rules_on_files":[]},"tainting_time":{"total_time":0.0,"per_def_and_rule_time":{"mean":0.0,"std_dev":0.0},"very_slow_stats":{"time_ratio":0.0,"count_ratio":0.0},"very_slow_rules_on_defs":[]},"fixpoint_timeouts":[],"prefiltering":{"project_level_time":0.0,"file_level_time":0.0,"rules_with_project_prefilters_ratio":0.0,"rules_with_file_prefilters_ratio":1.0,"rules_selected_ratio":1.0,"rules_matched_ratio":1.0},"targets":[],"total_bytes":0,"max_memory_bytes":91094336},"engine_requested":"OSS","skipped_rules":[],"profiling_results":[]} diff --git a/reports/raw/semgrep-java-modeling/dfb-taint-java-model-entrypoint-parameter-positive.json b/reports/raw/semgrep-java-modeling/dfb-taint-java-model-entrypoint-parameter-positive.json new file mode 100644 index 0000000..e416e26 --- /dev/null +++ b/reports/raw/semgrep-java-modeling/dfb-taint-java-model-entrypoint-parameter-positive.json @@ -0,0 +1 @@ +{"version":"1.174.0","results":[{"check_id":"Users.dave.Workspace.BrokkAi.dataflowbench..claude.worktrees.agent-af332237afc5e1bcf.adapters.semgrep.rules.dfb-model-java","path":"/var/folders/t1/k_27wjcd4095w9w121dm92_w0000gn/T/dataflowbench-modeling-semgrep-java/dfb-taint-java-model-entrypoint-parameter-positive/source/Handler.java","start":{"line":7,"col":9,"offset":234},"end":{"line":7,"col":24,"offset":249},"extra":{"message":"a benchmark-declared model carried input to the declared sink","metadata":{},"severity":"WARNING","fingerprint":"requires login","lines":"requires login","validation_state":"NO_VALIDATOR","engine_kind":"OSS"}}],"errors":[],"paths":{"scanned":["/var/folders/t1/k_27wjcd4095w9w121dm92_w0000gn/T/dataflowbench-modeling-semgrep-java/dfb-taint-java-model-entrypoint-parameter-positive/source/Handler.java"]},"time":{"rules":[],"rules_parse_time":0.0004398822784423828,"profiling_times":{"config_time":0.10509109497070312,"core_time":0.2099611759185791,"ignores_time":7.414817810058594e-05,"total_time":0.32163310050964355},"parsing_time":{"total_time":0.0,"per_file_time":{"mean":0.0,"std_dev":0.0},"very_slow_stats":{"time_ratio":0.0,"count_ratio":0.0},"very_slow_files":[]},"scanning_time":{"total_time":0.0051310062408447266,"per_file_time":{"mean":0.0051310062408447266,"std_dev":0.0},"very_slow_stats":{"time_ratio":0.0,"count_ratio":0.0},"very_slow_files":[]},"matching_time":{"total_time":0.0,"per_file_and_rule_time":{"mean":0.0,"std_dev":0.0},"very_slow_stats":{"time_ratio":0.0,"count_ratio":0.0},"very_slow_rules_on_files":[]},"tainting_time":{"total_time":0.0,"per_def_and_rule_time":{"mean":0.0,"std_dev":0.0},"very_slow_stats":{"time_ratio":0.0,"count_ratio":0.0},"very_slow_rules_on_defs":[]},"fixpoint_timeouts":[],"prefiltering":{"project_level_time":0.0,"file_level_time":0.0,"rules_with_project_prefilters_ratio":0.0,"rules_with_file_prefilters_ratio":1.0,"rules_selected_ratio":1.0,"rules_matched_ratio":1.0},"targets":[],"total_bytes":0,"max_memory_bytes":91880768},"engine_requested":"OSS","skipped_rules":[],"profiling_results":[]} diff --git a/reports/raw/semgrep-java-modeling/dfb-taint-java-model-entrypoint-selectivity-negative.json b/reports/raw/semgrep-java-modeling/dfb-taint-java-model-entrypoint-selectivity-negative.json new file mode 100644 index 0000000..03c1757 --- /dev/null +++ b/reports/raw/semgrep-java-modeling/dfb-taint-java-model-entrypoint-selectivity-negative.json @@ -0,0 +1 @@ +{"version":"1.174.0","results":[],"errors":[],"paths":{"scanned":["/var/folders/t1/k_27wjcd4095w9w121dm92_w0000gn/T/dataflowbench-modeling-semgrep-java/dfb-taint-java-model-entrypoint-selectivity-negative/source/Handler.java"]},"time":{"rules":[],"rules_parse_time":0.00044083595275878906,"profiling_times":{"config_time":0.12002897262573242,"core_time":0.22905278205871582,"ignores_time":3.218650817871094e-05,"total_time":0.355543851852417},"parsing_time":{"total_time":0.0,"per_file_time":{"mean":0.0,"std_dev":0.0},"very_slow_stats":{"time_ratio":0.0,"count_ratio":0.0},"very_slow_files":[]},"scanning_time":{"total_time":0.00468897819519043,"per_file_time":{"mean":0.00468897819519043,"std_dev":0.0},"very_slow_stats":{"time_ratio":0.0,"count_ratio":0.0},"very_slow_files":[]},"matching_time":{"total_time":0.0,"per_file_and_rule_time":{"mean":0.0,"std_dev":0.0},"very_slow_stats":{"time_ratio":0.0,"count_ratio":0.0},"very_slow_rules_on_files":[]},"tainting_time":{"total_time":0.0,"per_def_and_rule_time":{"mean":0.0,"std_dev":0.0},"very_slow_stats":{"time_ratio":0.0,"count_ratio":0.0},"very_slow_rules_on_defs":[]},"fixpoint_timeouts":[],"prefiltering":{"project_level_time":0.0,"file_level_time":0.0,"rules_with_project_prefilters_ratio":0.0,"rules_with_file_prefilters_ratio":1.0,"rules_selected_ratio":1.0,"rules_matched_ratio":1.0},"targets":[],"total_bytes":0,"max_memory_bytes":91880768},"engine_requested":"OSS","skipped_rules":[],"profiling_results":[]} diff --git a/reports/raw/semgrep-java-modeling/dfb-taint-java-model-entrypoint-selectivity-positive.json b/reports/raw/semgrep-java-modeling/dfb-taint-java-model-entrypoint-selectivity-positive.json new file mode 100644 index 0000000..d157e79 --- /dev/null +++ b/reports/raw/semgrep-java-modeling/dfb-taint-java-model-entrypoint-selectivity-positive.json @@ -0,0 +1 @@ +{"version":"1.174.0","results":[{"check_id":"Users.dave.Workspace.BrokkAi.dataflowbench..claude.worktrees.agent-af332237afc5e1bcf.adapters.semgrep.rules.dfb-model-java","path":"/var/folders/t1/k_27wjcd4095w9w121dm92_w0000gn/T/dataflowbench-modeling-semgrep-java/dfb-taint-java-model-entrypoint-selectivity-positive/source/Handler.java","start":{"line":7,"col":9,"offset":239},"end":{"line":7,"col":24,"offset":254},"extra":{"message":"a benchmark-declared model carried input to the declared sink","metadata":{},"severity":"WARNING","fingerprint":"requires login","lines":"requires login","validation_state":"NO_VALIDATOR","engine_kind":"OSS"}}],"errors":[],"paths":{"scanned":["/var/folders/t1/k_27wjcd4095w9w121dm92_w0000gn/T/dataflowbench-modeling-semgrep-java/dfb-taint-java-model-entrypoint-selectivity-positive/source/Handler.java"]},"time":{"rules":[],"rules_parse_time":0.00045800209045410156,"profiling_times":{"config_time":0.11116313934326172,"core_time":0.2270967960357666,"ignores_time":3.504753112792969e-05,"total_time":0.3446691036224365},"parsing_time":{"total_time":0.0,"per_file_time":{"mean":0.0,"std_dev":0.0},"very_slow_stats":{"time_ratio":0.0,"count_ratio":0.0},"very_slow_files":[]},"scanning_time":{"total_time":0.004820108413696289,"per_file_time":{"mean":0.004820108413696289,"std_dev":0.0},"very_slow_stats":{"time_ratio":0.0,"count_ratio":0.0},"very_slow_files":[]},"matching_time":{"total_time":0.0,"per_file_and_rule_time":{"mean":0.0,"std_dev":0.0},"very_slow_stats":{"time_ratio":0.0,"count_ratio":0.0},"very_slow_rules_on_files":[]},"tainting_time":{"total_time":0.0,"per_def_and_rule_time":{"mean":0.0,"std_dev":0.0},"very_slow_stats":{"time_ratio":0.0,"count_ratio":0.0},"very_slow_rules_on_defs":[]},"fixpoint_timeouts":[],"prefiltering":{"project_level_time":0.0,"file_level_time":0.0,"rules_with_project_prefilters_ratio":0.0,"rules_with_file_prefilters_ratio":1.0,"rules_selected_ratio":1.0,"rules_matched_ratio":1.0},"targets":[],"total_bytes":0,"max_memory_bytes":91356480},"engine_requested":"OSS","skipped_rules":[],"profiling_results":[]} diff --git a/reports/raw/semgrep-java-modeling/dfb-taint-java-model-opaque-propagator-negative-unsupported.json b/reports/raw/semgrep-java-modeling/dfb-taint-java-model-opaque-propagator-negative-unsupported.json new file mode 100644 index 0000000..13eea35 --- /dev/null +++ b/reports/raw/semgrep-java-modeling/dfb-taint-java-model-opaque-propagator-negative-unsupported.json @@ -0,0 +1,13 @@ +{ + "adapter": "semgrep", + "case_id": "dfb-taint-java-model-opaque-propagator-negative", + "evidence_kind": "retained-capability-decision", + "modeling_category": "P", + "modeling_category_label": "declared propagators", + "partition_source": "docs/modeling-matrix.md#per-tool-capability-partition", + "pinned_tool_identity": "Semgrep CE 1.174.0", + "reason": "category P — declared propagators — is unsupported for Semgrep CE 1.174.0 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): verified twice over. First, `pattern-propagators` binds `to:` to a **metavariable**, not to a call's return value: a propagator written `pattern: prop($A,$B) / from: $B / to: prop(...)` produced no finding when the default pass-through was disabled. Second, with the default enabled, CE reports the sink whether taint sits at the declared position 1 or the undeclared position 0 — so both cells of template 4 are decided by the default, not the model, and the load-bearing-model requirement is violated either way. Arg→return propagation is outside CE's propagator vocabulary", + "stage": "preregistered-modeling-partition", + "state": "unsupported", + "template_id": "dfb-template-model-opaque-propagator" +} diff --git a/reports/raw/semgrep-java-modeling/dfb-taint-java-model-opaque-propagator-positive-unsupported.json b/reports/raw/semgrep-java-modeling/dfb-taint-java-model-opaque-propagator-positive-unsupported.json new file mode 100644 index 0000000..5ddd167 --- /dev/null +++ b/reports/raw/semgrep-java-modeling/dfb-taint-java-model-opaque-propagator-positive-unsupported.json @@ -0,0 +1,13 @@ +{ + "adapter": "semgrep", + "case_id": "dfb-taint-java-model-opaque-propagator-positive", + "evidence_kind": "retained-capability-decision", + "modeling_category": "P", + "modeling_category_label": "declared propagators", + "partition_source": "docs/modeling-matrix.md#per-tool-capability-partition", + "pinned_tool_identity": "Semgrep CE 1.174.0", + "reason": "category P — declared propagators — is unsupported for Semgrep CE 1.174.0 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): verified twice over. First, `pattern-propagators` binds `to:` to a **metavariable**, not to a call's return value: a propagator written `pattern: prop($A,$B) / from: $B / to: prop(...)` produced no finding when the default pass-through was disabled. Second, with the default enabled, CE reports the sink whether taint sits at the declared position 1 or the undeclared position 0 — so both cells of template 4 are decided by the default, not the model, and the load-bearing-model requirement is violated either way. Arg→return propagation is outside CE's propagator vocabulary", + "stage": "preregistered-modeling-partition", + "state": "unsupported", + "template_id": "dfb-template-model-opaque-propagator" +} diff --git a/reports/raw/semgrep-java-modeling/dfb-taint-java-model-propagator-position-negative-unsupported.json b/reports/raw/semgrep-java-modeling/dfb-taint-java-model-propagator-position-negative-unsupported.json new file mode 100644 index 0000000..97562a8 --- /dev/null +++ b/reports/raw/semgrep-java-modeling/dfb-taint-java-model-propagator-position-negative-unsupported.json @@ -0,0 +1,13 @@ +{ + "adapter": "semgrep", + "case_id": "dfb-taint-java-model-propagator-position-negative", + "evidence_kind": "retained-capability-decision", + "modeling_category": "P", + "modeling_category_label": "declared propagators", + "partition_source": "docs/modeling-matrix.md#per-tool-capability-partition", + "pinned_tool_identity": "Semgrep CE 1.174.0", + "reason": "category P — declared propagators — is unsupported for Semgrep CE 1.174.0 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): verified twice over. First, `pattern-propagators` binds `to:` to a **metavariable**, not to a call's return value: a propagator written `pattern: prop($A,$B) / from: $B / to: prop(...)` produced no finding when the default pass-through was disabled. Second, with the default enabled, CE reports the sink whether taint sits at the declared position 1 or the undeclared position 0 — so both cells of template 4 are decided by the default, not the model, and the load-bearing-model requirement is violated either way. Arg→return propagation is outside CE's propagator vocabulary", + "stage": "preregistered-modeling-partition", + "state": "unsupported", + "template_id": "dfb-template-model-propagator-position" +} diff --git a/reports/raw/semgrep-java-modeling/dfb-taint-java-model-propagator-position-positive-unsupported.json b/reports/raw/semgrep-java-modeling/dfb-taint-java-model-propagator-position-positive-unsupported.json new file mode 100644 index 0000000..83dc49f --- /dev/null +++ b/reports/raw/semgrep-java-modeling/dfb-taint-java-model-propagator-position-positive-unsupported.json @@ -0,0 +1,13 @@ +{ + "adapter": "semgrep", + "case_id": "dfb-taint-java-model-propagator-position-positive", + "evidence_kind": "retained-capability-decision", + "modeling_category": "P", + "modeling_category_label": "declared propagators", + "partition_source": "docs/modeling-matrix.md#per-tool-capability-partition", + "pinned_tool_identity": "Semgrep CE 1.174.0", + "reason": "category P — declared propagators — is unsupported for Semgrep CE 1.174.0 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): verified twice over. First, `pattern-propagators` binds `to:` to a **metavariable**, not to a call's return value: a propagator written `pattern: prop($A,$B) / from: $B / to: prop(...)` produced no finding when the default pass-through was disabled. Second, with the default enabled, CE reports the sink whether taint sits at the declared position 1 or the undeclared position 0 — so both cells of template 4 are decided by the default, not the model, and the load-bearing-model requirement is violated either way. Arg→return propagation is outside CE's propagator vocabulary", + "stage": "preregistered-modeling-partition", + "state": "unsupported", + "template_id": "dfb-template-model-propagator-position" +} diff --git a/reports/raw/semgrep-java-modeling/dfb-taint-java-model-sanitizer-kill-negative.json b/reports/raw/semgrep-java-modeling/dfb-taint-java-model-sanitizer-kill-negative.json new file mode 100644 index 0000000..1cb3ef6 --- /dev/null +++ b/reports/raw/semgrep-java-modeling/dfb-taint-java-model-sanitizer-kill-negative.json @@ -0,0 +1 @@ +{"version":"1.174.0","results":[],"errors":[],"paths":{"scanned":["/var/folders/t1/k_27wjcd4095w9w121dm92_w0000gn/T/dataflowbench-modeling-semgrep-java/dfb-taint-java-model-sanitizer-kill-negative/source/ModelSanitizerKillNegative.java"]},"time":{"rules":[],"rules_parse_time":0.00046896934509277344,"profiling_times":{"config_time":0.11996912956237793,"core_time":0.22400307655334473,"ignores_time":6.794929504394531e-05,"total_time":0.3506631851196289},"parsing_time":{"total_time":0.0,"per_file_time":{"mean":0.0,"std_dev":0.0},"very_slow_stats":{"time_ratio":0.0,"count_ratio":0.0},"very_slow_files":[]},"scanning_time":{"total_time":0.005338907241821289,"per_file_time":{"mean":0.005338907241821289,"std_dev":0.0},"very_slow_stats":{"time_ratio":0.0,"count_ratio":0.0},"very_slow_files":[]},"matching_time":{"total_time":0.0,"per_file_and_rule_time":{"mean":0.0,"std_dev":0.0},"very_slow_stats":{"time_ratio":0.0,"count_ratio":0.0},"very_slow_rules_on_files":[]},"tainting_time":{"total_time":0.0,"per_def_and_rule_time":{"mean":0.0,"std_dev":0.0},"very_slow_stats":{"time_ratio":0.0,"count_ratio":0.0},"very_slow_rules_on_defs":[]},"fixpoint_timeouts":[],"prefiltering":{"project_level_time":0.0,"file_level_time":0.0,"rules_with_project_prefilters_ratio":0.0,"rules_with_file_prefilters_ratio":1.0,"rules_selected_ratio":1.0,"rules_matched_ratio":1.0},"targets":[],"total_bytes":0,"max_memory_bytes":93633216},"engine_requested":"OSS","skipped_rules":[],"profiling_results":[]} diff --git a/reports/raw/semgrep-java-modeling/dfb-taint-java-model-sanitizer-kill-positive.json b/reports/raw/semgrep-java-modeling/dfb-taint-java-model-sanitizer-kill-positive.json new file mode 100644 index 0000000..353e562 --- /dev/null +++ b/reports/raw/semgrep-java-modeling/dfb-taint-java-model-sanitizer-kill-positive.json @@ -0,0 +1 @@ +{"version":"1.174.0","results":[{"check_id":"Users.dave.Workspace.BrokkAi.dataflowbench..claude.worktrees.agent-af332237afc5e1bcf.adapters.semgrep.rules.dfb-model-java","path":"/var/folders/t1/k_27wjcd4095w9w121dm92_w0000gn/T/dataflowbench-modeling-semgrep-java/dfb-taint-java-model-sanitizer-kill-positive/source/ModelSanitizerKillPositive.java","start":{"line":17,"col":9,"offset":381},"end":{"line":17,"col":31,"offset":403},"extra":{"message":"a benchmark-declared model carried input to the declared sink","metadata":{},"severity":"WARNING","fingerprint":"requires login","lines":"requires login","validation_state":"NO_VALIDATOR","engine_kind":"OSS"}}],"errors":[],"paths":{"scanned":["/var/folders/t1/k_27wjcd4095w9w121dm92_w0000gn/T/dataflowbench-modeling-semgrep-java/dfb-taint-java-model-sanitizer-kill-positive/source/ModelSanitizerKillPositive.java"]},"time":{"rules":[],"rules_parse_time":0.0005311965942382812,"profiling_times":{"config_time":0.1166226863861084,"core_time":0.22866392135620117,"ignores_time":3.600120544433594e-05,"total_time":0.3519008159637451},"parsing_time":{"total_time":0.0,"per_file_time":{"mean":0.0,"std_dev":0.0},"very_slow_stats":{"time_ratio":0.0,"count_ratio":0.0},"very_slow_files":[]},"scanning_time":{"total_time":0.005283832550048828,"per_file_time":{"mean":0.005283832550048828,"std_dev":0.0},"very_slow_stats":{"time_ratio":0.0,"count_ratio":0.0},"very_slow_files":[]},"matching_time":{"total_time":0.0,"per_file_and_rule_time":{"mean":0.0,"std_dev":0.0},"very_slow_stats":{"time_ratio":0.0,"count_ratio":0.0},"very_slow_rules_on_files":[]},"tainting_time":{"total_time":0.0,"per_def_and_rule_time":{"mean":0.0,"std_dev":0.0},"very_slow_stats":{"time_ratio":0.0,"count_ratio":0.0},"very_slow_rules_on_defs":[]},"fixpoint_timeouts":[],"prefiltering":{"project_level_time":0.0,"file_level_time":0.0,"rules_with_project_prefilters_ratio":0.0,"rules_with_file_prefilters_ratio":1.0,"rules_selected_ratio":1.0,"rules_matched_ratio":1.0},"targets":[],"total_bytes":0,"max_memory_bytes":93371072},"engine_requested":"OSS","skipped_rules":[],"profiling_results":[]} diff --git a/reports/raw/semgrep-java-modeling/dfb-taint-java-model-sanitizer-selectivity-negative-unsupported.json b/reports/raw/semgrep-java-modeling/dfb-taint-java-model-sanitizer-selectivity-negative-unsupported.json new file mode 100644 index 0000000..244ff77 --- /dev/null +++ b/reports/raw/semgrep-java-modeling/dfb-taint-java-model-sanitizer-selectivity-negative-unsupported.json @@ -0,0 +1,13 @@ +{ + "adapter": "semgrep", + "case_id": "dfb-taint-java-model-sanitizer-selectivity-negative", + "evidence_kind": "retained-capability-decision", + "modeling_category": "Z", + "modeling_category_label": "declared sanitizers", + "partition_source": "docs/modeling-matrix.md#per-tool-capability-partition", + "pinned_tool_identity": "Semgrep CE 1.174.0", + "reason": "category Z — declared sanitizers — is unsupported for Semgrep CE 1.174.0 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): Semgrep CE cannot express sanitizer selectivity and the safe-function assumption in one invocation: taint_assume_safe_functions suppresses flow through the undeclared sanitizer-lookalike, so the positive is undecidable by construction (Amendment A3)", + "stage": "preregistered-modeling-partition", + "state": "unsupported", + "template_id": "dfb-template-model-sanitizer-selectivity" +} diff --git a/reports/raw/semgrep-java-modeling/dfb-taint-java-model-sanitizer-selectivity-positive-unsupported.json b/reports/raw/semgrep-java-modeling/dfb-taint-java-model-sanitizer-selectivity-positive-unsupported.json new file mode 100644 index 0000000..856d71e --- /dev/null +++ b/reports/raw/semgrep-java-modeling/dfb-taint-java-model-sanitizer-selectivity-positive-unsupported.json @@ -0,0 +1,13 @@ +{ + "adapter": "semgrep", + "case_id": "dfb-taint-java-model-sanitizer-selectivity-positive", + "evidence_kind": "retained-capability-decision", + "modeling_category": "Z", + "modeling_category_label": "declared sanitizers", + "partition_source": "docs/modeling-matrix.md#per-tool-capability-partition", + "pinned_tool_identity": "Semgrep CE 1.174.0", + "reason": "category Z — declared sanitizers — is unsupported for Semgrep CE 1.174.0 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): Semgrep CE cannot express sanitizer selectivity and the safe-function assumption in one invocation: taint_assume_safe_functions suppresses flow through the undeclared sanitizer-lookalike, so the positive is undecidable by construction (Amendment A3)", + "stage": "preregistered-modeling-partition", + "state": "unsupported", + "template_id": "dfb-template-model-sanitizer-selectivity" +} diff --git a/reports/raw/semgrep-java-modeling/dfb-taint-java-model-store-roundtrip-negative-unsupported.json b/reports/raw/semgrep-java-modeling/dfb-taint-java-model-store-roundtrip-negative-unsupported.json new file mode 100644 index 0000000..3f33a2e --- /dev/null +++ b/reports/raw/semgrep-java-modeling/dfb-taint-java-model-store-roundtrip-negative-unsupported.json @@ -0,0 +1,13 @@ +{ + "adapter": "semgrep", + "case_id": "dfb-taint-java-model-store-roundtrip-negative", + "evidence_kind": "retained-capability-decision", + "modeling_category": "B", + "modeling_category_label": "persistence boundaries", + "partition_source": "docs/modeling-matrix.md#per-tool-capability-partition", + "pinned_tool_identity": "Semgrep CE 1.174.0", + "reason": "category B — persistence boundaries — is unsupported for Semgrep CE 1.174.0 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): the write and the read are in two different procedures by construction, and the pinned CE engine has no interprocedural taint at all: `semgrep scan --help` offers `--pro-intrafile` (\"Intra-file inter-procedural taint analysis … Requires Semgrep Pro Engine\"), so the step from `put` to `get` is outside the engine regardless of what is declared", + "stage": "preregistered-modeling-partition", + "state": "unsupported", + "template_id": "dfb-template-model-store-roundtrip" +} diff --git a/reports/raw/semgrep-java-modeling/dfb-taint-java-model-store-roundtrip-positive-unsupported.json b/reports/raw/semgrep-java-modeling/dfb-taint-java-model-store-roundtrip-positive-unsupported.json new file mode 100644 index 0000000..ceba22e --- /dev/null +++ b/reports/raw/semgrep-java-modeling/dfb-taint-java-model-store-roundtrip-positive-unsupported.json @@ -0,0 +1,13 @@ +{ + "adapter": "semgrep", + "case_id": "dfb-taint-java-model-store-roundtrip-positive", + "evidence_kind": "retained-capability-decision", + "modeling_category": "B", + "modeling_category_label": "persistence boundaries", + "partition_source": "docs/modeling-matrix.md#per-tool-capability-partition", + "pinned_tool_identity": "Semgrep CE 1.174.0", + "reason": "category B — persistence boundaries — is unsupported for Semgrep CE 1.174.0 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): the write and the read are in two different procedures by construction, and the pinned CE engine has no interprocedural taint at all: `semgrep scan --help` offers `--pro-intrafile` (\"Intra-file inter-procedural taint analysis … Requires Semgrep Pro Engine\"), so the step from `put` to `get` is outside the engine regardless of what is declared", + "stage": "preregistered-modeling-partition", + "state": "unsupported", + "template_id": "dfb-template-model-store-roundtrip" +} diff --git a/reports/raw/semgrep-java-modeling/dfb-taint-java-model-store-separation-negative-unsupported.json b/reports/raw/semgrep-java-modeling/dfb-taint-java-model-store-separation-negative-unsupported.json new file mode 100644 index 0000000..1f80456 --- /dev/null +++ b/reports/raw/semgrep-java-modeling/dfb-taint-java-model-store-separation-negative-unsupported.json @@ -0,0 +1,13 @@ +{ + "adapter": "semgrep", + "case_id": "dfb-taint-java-model-store-separation-negative", + "evidence_kind": "retained-capability-decision", + "modeling_category": "B", + "modeling_category_label": "persistence boundaries", + "partition_source": "docs/modeling-matrix.md#per-tool-capability-partition", + "pinned_tool_identity": "Semgrep CE 1.174.0", + "reason": "category B — persistence boundaries — is unsupported for Semgrep CE 1.174.0 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): the write and the read are in two different procedures by construction, and the pinned CE engine has no interprocedural taint at all: `semgrep scan --help` offers `--pro-intrafile` (\"Intra-file inter-procedural taint analysis … Requires Semgrep Pro Engine\"), so the step from `put` to `get` is outside the engine regardless of what is declared", + "stage": "preregistered-modeling-partition", + "state": "unsupported", + "template_id": "dfb-template-model-store-separation" +} diff --git a/reports/raw/semgrep-java-modeling/dfb-taint-java-model-store-separation-positive-unsupported.json b/reports/raw/semgrep-java-modeling/dfb-taint-java-model-store-separation-positive-unsupported.json new file mode 100644 index 0000000..7338c9f --- /dev/null +++ b/reports/raw/semgrep-java-modeling/dfb-taint-java-model-store-separation-positive-unsupported.json @@ -0,0 +1,13 @@ +{ + "adapter": "semgrep", + "case_id": "dfb-taint-java-model-store-separation-positive", + "evidence_kind": "retained-capability-decision", + "modeling_category": "B", + "modeling_category_label": "persistence boundaries", + "partition_source": "docs/modeling-matrix.md#per-tool-capability-partition", + "pinned_tool_identity": "Semgrep CE 1.174.0", + "reason": "category B — persistence boundaries — is unsupported for Semgrep CE 1.174.0 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): the write and the read are in two different procedures by construction, and the pinned CE engine has no interprocedural taint at all: `semgrep scan --help` offers `--pro-intrafile` (\"Intra-file inter-procedural taint analysis … Requires Semgrep Pro Engine\"), so the step from `put` to `get` is outside the engine regardless of what is declared", + "stage": "preregistered-modeling-partition", + "state": "unsupported", + "template_id": "dfb-template-model-store-separation" +} diff --git a/reports/raw/semgrep-java-modeling/dfb-taint-java-model-summary-field-negative-unsupported.json b/reports/raw/semgrep-java-modeling/dfb-taint-java-model-summary-field-negative-unsupported.json new file mode 100644 index 0000000..d7b6a9c --- /dev/null +++ b/reports/raw/semgrep-java-modeling/dfb-taint-java-model-summary-field-negative-unsupported.json @@ -0,0 +1,13 @@ +{ + "adapter": "semgrep", + "case_id": "dfb-taint-java-model-summary-field-negative", + "evidence_kind": "retained-capability-decision", + "modeling_category": "O", + "modeling_category_label": "opaque procedure summaries", + "partition_source": "docs/modeling-matrix.md#per-tool-capability-partition", + "pinned_tool_identity": "Semgrep CE 1.174.0", + "reason": "category O — opaque procedure summaries — is unsupported for Semgrep CE 1.174.0 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): template 7 needs arg→return summary semantics, which P has already established CE cannot express, and puts the summarized procedure in a separate file, which CE's intra-file engine does not cross. Template 8's destination is a *field* of an argument; `to: $L` reaches the whole object, and the pinned CE documents only \"Experimental support for basic field-sensitive taint tracking\" — so the field-separation negative would be decided by CE's heap approximation rather than by the summary", + "stage": "preregistered-modeling-partition", + "state": "unsupported", + "template_id": "dfb-template-model-summary-field" +} diff --git a/reports/raw/semgrep-java-modeling/dfb-taint-java-model-summary-field-positive-unsupported.json b/reports/raw/semgrep-java-modeling/dfb-taint-java-model-summary-field-positive-unsupported.json new file mode 100644 index 0000000..dc6e01c --- /dev/null +++ b/reports/raw/semgrep-java-modeling/dfb-taint-java-model-summary-field-positive-unsupported.json @@ -0,0 +1,13 @@ +{ + "adapter": "semgrep", + "case_id": "dfb-taint-java-model-summary-field-positive", + "evidence_kind": "retained-capability-decision", + "modeling_category": "O", + "modeling_category_label": "opaque procedure summaries", + "partition_source": "docs/modeling-matrix.md#per-tool-capability-partition", + "pinned_tool_identity": "Semgrep CE 1.174.0", + "reason": "category O — opaque procedure summaries — is unsupported for Semgrep CE 1.174.0 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): template 7 needs arg→return summary semantics, which P has already established CE cannot express, and puts the summarized procedure in a separate file, which CE's intra-file engine does not cross. Template 8's destination is a *field* of an argument; `to: $L` reaches the whole object, and the pinned CE documents only \"Experimental support for basic field-sensitive taint tracking\" — so the field-separation negative would be decided by CE's heap approximation rather than by the summary", + "stage": "preregistered-modeling-partition", + "state": "unsupported", + "template_id": "dfb-template-model-summary-field" +} diff --git a/reports/raw/semgrep-java-modeling/dfb-taint-java-model-summary-through-negative-unsupported.json b/reports/raw/semgrep-java-modeling/dfb-taint-java-model-summary-through-negative-unsupported.json new file mode 100644 index 0000000..798cffe --- /dev/null +++ b/reports/raw/semgrep-java-modeling/dfb-taint-java-model-summary-through-negative-unsupported.json @@ -0,0 +1,13 @@ +{ + "adapter": "semgrep", + "case_id": "dfb-taint-java-model-summary-through-negative", + "evidence_kind": "retained-capability-decision", + "modeling_category": "O", + "modeling_category_label": "opaque procedure summaries", + "partition_source": "docs/modeling-matrix.md#per-tool-capability-partition", + "pinned_tool_identity": "Semgrep CE 1.174.0", + "reason": "category O — opaque procedure summaries — is unsupported for Semgrep CE 1.174.0 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): template 7 needs arg→return summary semantics, which P has already established CE cannot express, and puts the summarized procedure in a separate file, which CE's intra-file engine does not cross. Template 8's destination is a *field* of an argument; `to: $L` reaches the whole object, and the pinned CE documents only \"Experimental support for basic field-sensitive taint tracking\" — so the field-separation negative would be decided by CE's heap approximation rather than by the summary", + "stage": "preregistered-modeling-partition", + "state": "unsupported", + "template_id": "dfb-template-model-summary-through" +} diff --git a/reports/raw/semgrep-java-modeling/dfb-taint-java-model-summary-through-positive-unsupported.json b/reports/raw/semgrep-java-modeling/dfb-taint-java-model-summary-through-positive-unsupported.json new file mode 100644 index 0000000..84b827e --- /dev/null +++ b/reports/raw/semgrep-java-modeling/dfb-taint-java-model-summary-through-positive-unsupported.json @@ -0,0 +1,13 @@ +{ + "adapter": "semgrep", + "case_id": "dfb-taint-java-model-summary-through-positive", + "evidence_kind": "retained-capability-decision", + "modeling_category": "O", + "modeling_category_label": "opaque procedure summaries", + "partition_source": "docs/modeling-matrix.md#per-tool-capability-partition", + "pinned_tool_identity": "Semgrep CE 1.174.0", + "reason": "category O — opaque procedure summaries — is unsupported for Semgrep CE 1.174.0 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): template 7 needs arg→return summary semantics, which P has already established CE cannot express, and puts the summarized procedure in a separate file, which CE's intra-file engine does not cross. Template 8's destination is a *field* of an argument; `to: $L` reaches the whole object, and the pinned CE documents only \"Experimental support for basic field-sensitive taint tracking\" — so the field-separation negative would be decided by CE's heap approximation rather than by the summary", + "stage": "preregistered-modeling-partition", + "state": "unsupported", + "template_id": "dfb-template-model-summary-through" +} diff --git a/reports/semgrep-java-modeling.json b/reports/semgrep-java-modeling.json new file mode 100644 index 0000000..57e39c8 --- /dev/null +++ b/reports/semgrep-java-modeling.json @@ -0,0 +1,402 @@ +{ + "adapter_version": "0.1.0", + "cold_or_warm": "cold", + "configuration_hash": "d25d4a4058ae7bd67131d38d05d0579a642ad1841071f965719dd8cea7efd59e", + "ended_at_unix_seconds": 1787751504, + "fixture_revision": "sha256:f9dab53624e836d29ed6d3e00fc7072b6ac0850bec3c63ec39926b3288cef7d1", + "results": [ + { + "case_id": "dfb-taint-java-model-declared-sink-negative", + "diagnostics": [], + "duration_ms": 1208, + "outcome": "not-reached", + "peak_memory_mb": null, + "raw_output": "reports/raw/semgrep-java-modeling/dfb-taint-java-model-declared-sink-negative.json", + "sink_anchors": [ + "DFB-SINK: model-declared-sink-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-declared-sink-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-declared-sink-positive", + "diagnostics": [], + "duration_ms": 1223, + "outcome": "reached", + "peak_memory_mb": null, + "raw_output": "reports/raw/semgrep-java-modeling/dfb-taint-java-model-declared-sink-positive.json", + "sink_anchors": [ + "DFB-SINK: model-declared-sink-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-declared-sink-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-declared-source-negative", + "diagnostics": [], + "duration_ms": 1202, + "outcome": "not-reached", + "peak_memory_mb": null, + "raw_output": "reports/raw/semgrep-java-modeling/dfb-taint-java-model-declared-source-negative.json", + "sink_anchors": [ + "DFB-SINK: model-declared-source-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-declared-source-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-declared-source-positive", + "diagnostics": [], + "duration_ms": 1227, + "outcome": "reached", + "peak_memory_mb": null, + "raw_output": "reports/raw/semgrep-java-modeling/dfb-taint-java-model-declared-source-positive.json", + "sink_anchors": [ + "DFB-SINK: model-declared-source-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-declared-source-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-entrypoint-parameter-negative", + "diagnostics": [], + "duration_ms": 1198, + "outcome": "not-reached", + "peak_memory_mb": null, + "raw_output": "reports/raw/semgrep-java-modeling/dfb-taint-java-model-entrypoint-parameter-negative.json", + "sink_anchors": [ + "DFB-SINK: model-entrypoint-parameter-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-entrypoint-parameter-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-entrypoint-parameter-positive", + "diagnostics": [], + "duration_ms": 1190, + "outcome": "reached", + "peak_memory_mb": null, + "raw_output": "reports/raw/semgrep-java-modeling/dfb-taint-java-model-entrypoint-parameter-positive.json", + "sink_anchors": [ + "DFB-SINK: model-entrypoint-parameter-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-entrypoint-parameter-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-entrypoint-selectivity-negative", + "diagnostics": [], + "duration_ms": 1246, + "outcome": "not-reached", + "peak_memory_mb": null, + "raw_output": "reports/raw/semgrep-java-modeling/dfb-taint-java-model-entrypoint-selectivity-negative.json", + "sink_anchors": [ + "DFB-SINK: model-entrypoint-selectivity-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-entrypoint-selectivity-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-entrypoint-selectivity-positive", + "diagnostics": [], + "duration_ms": 1170, + "outcome": "reached", + "peak_memory_mb": null, + "raw_output": "reports/raw/semgrep-java-modeling/dfb-taint-java-model-entrypoint-selectivity-positive.json", + "sink_anchors": [ + "DFB-SINK: model-entrypoint-selectivity-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-entrypoint-selectivity-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-opaque-propagator-negative", + "diagnostics": [ + "category P — declared propagators — is unsupported for Semgrep CE 1.174.0 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): verified twice over. First, `pattern-propagators` binds `to:` to a **metavariable**, not to a call's return value: a propagator written `pattern: prop($A,$B) / from: $B / to: prop(...)` produced no finding when the default pass-through was disabled. Second, with the default enabled, CE reports the sink whether taint sits at the declared position 1 or the undeclared position 0 — so both cells of template 4 are decided by the default, not the model, and the load-bearing-model requirement is violated either way. Arg→return propagation is outside CE's propagator vocabulary" + ], + "duration_ms": 0, + "outcome": "unsupported", + "peak_memory_mb": null, + "raw_output": "reports/raw/semgrep-java-modeling/dfb-taint-java-model-opaque-propagator-negative-unsupported.json", + "sink_anchors": [ + "DFB-SINK: model-opaque-propagator-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-opaque-propagator-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-opaque-propagator-positive", + "diagnostics": [ + "category P — declared propagators — is unsupported for Semgrep CE 1.174.0 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): verified twice over. First, `pattern-propagators` binds `to:` to a **metavariable**, not to a call's return value: a propagator written `pattern: prop($A,$B) / from: $B / to: prop(...)` produced no finding when the default pass-through was disabled. Second, with the default enabled, CE reports the sink whether taint sits at the declared position 1 or the undeclared position 0 — so both cells of template 4 are decided by the default, not the model, and the load-bearing-model requirement is violated either way. Arg→return propagation is outside CE's propagator vocabulary" + ], + "duration_ms": 0, + "outcome": "unsupported", + "peak_memory_mb": null, + "raw_output": "reports/raw/semgrep-java-modeling/dfb-taint-java-model-opaque-propagator-positive-unsupported.json", + "sink_anchors": [ + "DFB-SINK: model-opaque-propagator-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-opaque-propagator-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-propagator-position-negative", + "diagnostics": [ + "category P — declared propagators — is unsupported for Semgrep CE 1.174.0 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): verified twice over. First, `pattern-propagators` binds `to:` to a **metavariable**, not to a call's return value: a propagator written `pattern: prop($A,$B) / from: $B / to: prop(...)` produced no finding when the default pass-through was disabled. Second, with the default enabled, CE reports the sink whether taint sits at the declared position 1 or the undeclared position 0 — so both cells of template 4 are decided by the default, not the model, and the load-bearing-model requirement is violated either way. Arg→return propagation is outside CE's propagator vocabulary" + ], + "duration_ms": 0, + "outcome": "unsupported", + "peak_memory_mb": null, + "raw_output": "reports/raw/semgrep-java-modeling/dfb-taint-java-model-propagator-position-negative-unsupported.json", + "sink_anchors": [ + "DFB-SINK: model-propagator-position-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-propagator-position-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-propagator-position-positive", + "diagnostics": [ + "category P — declared propagators — is unsupported for Semgrep CE 1.174.0 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): verified twice over. First, `pattern-propagators` binds `to:` to a **metavariable**, not to a call's return value: a propagator written `pattern: prop($A,$B) / from: $B / to: prop(...)` produced no finding when the default pass-through was disabled. Second, with the default enabled, CE reports the sink whether taint sits at the declared position 1 or the undeclared position 0 — so both cells of template 4 are decided by the default, not the model, and the load-bearing-model requirement is violated either way. Arg→return propagation is outside CE's propagator vocabulary" + ], + "duration_ms": 0, + "outcome": "unsupported", + "peak_memory_mb": null, + "raw_output": "reports/raw/semgrep-java-modeling/dfb-taint-java-model-propagator-position-positive-unsupported.json", + "sink_anchors": [ + "DFB-SINK: model-propagator-position-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-propagator-position-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-sanitizer-kill-negative", + "diagnostics": [], + "duration_ms": 1214, + "outcome": "not-reached", + "peak_memory_mb": null, + "raw_output": "reports/raw/semgrep-java-modeling/dfb-taint-java-model-sanitizer-kill-negative.json", + "sink_anchors": [ + "DFB-SINK: model-sanitizer-kill-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-sanitizer-kill-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-sanitizer-kill-positive", + "diagnostics": [], + "duration_ms": 1209, + "outcome": "reached", + "peak_memory_mb": null, + "raw_output": "reports/raw/semgrep-java-modeling/dfb-taint-java-model-sanitizer-kill-positive.json", + "sink_anchors": [ + "DFB-SINK: model-sanitizer-kill-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-sanitizer-kill-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-sanitizer-selectivity-negative", + "diagnostics": [ + "category Z — declared sanitizers — is unsupported for Semgrep CE 1.174.0 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): Semgrep CE cannot express sanitizer selectivity and the safe-function assumption in one invocation: taint_assume_safe_functions suppresses flow through the undeclared sanitizer-lookalike, so the positive is undecidable by construction (Amendment A3)" + ], + "duration_ms": 0, + "outcome": "unsupported", + "peak_memory_mb": null, + "raw_output": "reports/raw/semgrep-java-modeling/dfb-taint-java-model-sanitizer-selectivity-negative-unsupported.json", + "sink_anchors": [ + "DFB-SINK: model-sanitizer-selectivity-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-sanitizer-selectivity-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-sanitizer-selectivity-positive", + "diagnostics": [ + "category Z — declared sanitizers — is unsupported for Semgrep CE 1.174.0 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): Semgrep CE cannot express sanitizer selectivity and the safe-function assumption in one invocation: taint_assume_safe_functions suppresses flow through the undeclared sanitizer-lookalike, so the positive is undecidable by construction (Amendment A3)" + ], + "duration_ms": 0, + "outcome": "unsupported", + "peak_memory_mb": null, + "raw_output": "reports/raw/semgrep-java-modeling/dfb-taint-java-model-sanitizer-selectivity-positive-unsupported.json", + "sink_anchors": [ + "DFB-SINK: model-sanitizer-selectivity-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-sanitizer-selectivity-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-store-roundtrip-negative", + "diagnostics": [ + "category B — persistence boundaries — is unsupported for Semgrep CE 1.174.0 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): the write and the read are in two different procedures by construction, and the pinned CE engine has no interprocedural taint at all: `semgrep scan --help` offers `--pro-intrafile` (\"Intra-file inter-procedural taint analysis … Requires Semgrep Pro Engine\"), so the step from `put` to `get` is outside the engine regardless of what is declared" + ], + "duration_ms": 0, + "outcome": "unsupported", + "peak_memory_mb": null, + "raw_output": "reports/raw/semgrep-java-modeling/dfb-taint-java-model-store-roundtrip-negative-unsupported.json", + "sink_anchors": [ + "DFB-SINK: model-store-roundtrip-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-store-roundtrip-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-store-roundtrip-positive", + "diagnostics": [ + "category B — persistence boundaries — is unsupported for Semgrep CE 1.174.0 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): the write and the read are in two different procedures by construction, and the pinned CE engine has no interprocedural taint at all: `semgrep scan --help` offers `--pro-intrafile` (\"Intra-file inter-procedural taint analysis … Requires Semgrep Pro Engine\"), so the step from `put` to `get` is outside the engine regardless of what is declared" + ], + "duration_ms": 0, + "outcome": "unsupported", + "peak_memory_mb": null, + "raw_output": "reports/raw/semgrep-java-modeling/dfb-taint-java-model-store-roundtrip-positive-unsupported.json", + "sink_anchors": [ + "DFB-SINK: model-store-roundtrip-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-store-roundtrip-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-store-separation-negative", + "diagnostics": [ + "category B — persistence boundaries — is unsupported for Semgrep CE 1.174.0 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): the write and the read are in two different procedures by construction, and the pinned CE engine has no interprocedural taint at all: `semgrep scan --help` offers `--pro-intrafile` (\"Intra-file inter-procedural taint analysis … Requires Semgrep Pro Engine\"), so the step from `put` to `get` is outside the engine regardless of what is declared" + ], + "duration_ms": 0, + "outcome": "unsupported", + "peak_memory_mb": null, + "raw_output": "reports/raw/semgrep-java-modeling/dfb-taint-java-model-store-separation-negative-unsupported.json", + "sink_anchors": [ + "DFB-SINK: model-store-separation-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-store-separation-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-store-separation-positive", + "diagnostics": [ + "category B — persistence boundaries — is unsupported for Semgrep CE 1.174.0 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): the write and the read are in two different procedures by construction, and the pinned CE engine has no interprocedural taint at all: `semgrep scan --help` offers `--pro-intrafile` (\"Intra-file inter-procedural taint analysis … Requires Semgrep Pro Engine\"), so the step from `put` to `get` is outside the engine regardless of what is declared" + ], + "duration_ms": 0, + "outcome": "unsupported", + "peak_memory_mb": null, + "raw_output": "reports/raw/semgrep-java-modeling/dfb-taint-java-model-store-separation-positive-unsupported.json", + "sink_anchors": [ + "DFB-SINK: model-store-separation-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-store-separation-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-summary-field-negative", + "diagnostics": [ + "category O — opaque procedure summaries — is unsupported for Semgrep CE 1.174.0 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): template 7 needs arg→return summary semantics, which P has already established CE cannot express, and puts the summarized procedure in a separate file, which CE's intra-file engine does not cross. Template 8's destination is a *field* of an argument; `to: $L` reaches the whole object, and the pinned CE documents only \"Experimental support for basic field-sensitive taint tracking\" — so the field-separation negative would be decided by CE's heap approximation rather than by the summary" + ], + "duration_ms": 0, + "outcome": "unsupported", + "peak_memory_mb": null, + "raw_output": "reports/raw/semgrep-java-modeling/dfb-taint-java-model-summary-field-negative-unsupported.json", + "sink_anchors": [ + "DFB-SINK: model-summary-field-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-summary-field-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-summary-field-positive", + "diagnostics": [ + "category O — opaque procedure summaries — is unsupported for Semgrep CE 1.174.0 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): template 7 needs arg→return summary semantics, which P has already established CE cannot express, and puts the summarized procedure in a separate file, which CE's intra-file engine does not cross. Template 8's destination is a *field* of an argument; `to: $L` reaches the whole object, and the pinned CE documents only \"Experimental support for basic field-sensitive taint tracking\" — so the field-separation negative would be decided by CE's heap approximation rather than by the summary" + ], + "duration_ms": 0, + "outcome": "unsupported", + "peak_memory_mb": null, + "raw_output": "reports/raw/semgrep-java-modeling/dfb-taint-java-model-summary-field-positive-unsupported.json", + "sink_anchors": [ + "DFB-SINK: model-summary-field-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-summary-field-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-summary-through-negative", + "diagnostics": [ + "category O — opaque procedure summaries — is unsupported for Semgrep CE 1.174.0 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): template 7 needs arg→return summary semantics, which P has already established CE cannot express, and puts the summarized procedure in a separate file, which CE's intra-file engine does not cross. Template 8's destination is a *field* of an argument; `to: $L` reaches the whole object, and the pinned CE documents only \"Experimental support for basic field-sensitive taint tracking\" — so the field-separation negative would be decided by CE's heap approximation rather than by the summary" + ], + "duration_ms": 0, + "outcome": "unsupported", + "peak_memory_mb": null, + "raw_output": "reports/raw/semgrep-java-modeling/dfb-taint-java-model-summary-through-negative-unsupported.json", + "sink_anchors": [ + "DFB-SINK: model-summary-through-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-summary-through-input" + ], + "witness_checkpoints": [] + }, + { + "case_id": "dfb-taint-java-model-summary-through-positive", + "diagnostics": [ + "category O — opaque procedure summaries — is unsupported for Semgrep CE 1.174.0 by the preregistered modeling partition (docs/modeling-matrix.md#per-tool-capability-partition): template 7 needs arg→return summary semantics, which P has already established CE cannot express, and puts the summarized procedure in a separate file, which CE's intra-file engine does not cross. Template 8's destination is a *field* of an argument; `to: $L` reaches the whole object, and the pinned CE documents only \"Experimental support for basic field-sensitive taint tracking\" — so the field-separation negative would be decided by CE's heap approximation rather than by the summary" + ], + "duration_ms": 0, + "outcome": "unsupported", + "peak_memory_mb": null, + "raw_output": "reports/raw/semgrep-java-modeling/dfb-taint-java-model-summary-through-positive-unsupported.json", + "sink_anchors": [ + "DFB-SINK: model-summary-through-sink" + ], + "source_anchors": [ + "DFB-SOURCE: model-summary-through-input" + ], + "witness_checkpoints": [] + } + ], + "schema_version": 1, + "started_at_unix_seconds": 1787751490, + "tool": "semgrep", + "tool_build_identity": "semgrep-oss:1.174.0", + "tool_version": "1.174.0" +} diff --git a/scripts/probe-java-modeling-load-bearing.sh b/scripts/probe-java-modeling-load-bearing.sh new file mode 100755 index 0000000..e257d14 --- /dev/null +++ b/scripts/probe-java-modeling-load-bearing.sh @@ -0,0 +1,189 @@ +#!/usr/bin/env bash +# Load-bearing-model demonstration for the Java modeling matrix. +# +# The Java counterpart of scripts/probe-javascript-modeling-load-bearing.sh, +# and deliberately the same shape: docs/modeling-matrix.md#the-load-bearing-model-requirement +# says a modeling assertion is only evidence of activation if the tool's +# behavior *without* the model would differ, so this script runs one fixture +# twice — once against the committed modeling artifact and once against a copy +# with the single declaration under test deleted — and retains both raw +# outputs. +# +# Bifrost category S the `Config.fetchRemote` source declaration +# CodeQL category P the `Opaque.carry` propagator step +# Joern category Z the `Clean.scrub` no-flow (sanitizer) declaration +# Semgrep category S the `Audit.record` sink declaration +# +# It also runs two measurements that are not counterfactuals: +# +# * **Amendment A5's evidence.** The preregistration recorded Bifrost's +# `:unmodeled require-model` setting as *to be verified* — no committed +# policy set it and the pinned CLI's acceptance of it was unshown. The +# `bifrost-require-model-accepted.json` run is the committed policy, which +# sets it, evaluated to completion on the pinned v0.10.6. +# * **Amendment A4's evidence, extended to `javasrc2cpg`.** A4 withdrew the +# preregistration's claim that the reflective opaque-propagator body is +# unfollowable, on `jssrc2cpg`. `joern-opaque-propagator-unmodeled.json` +# runs Java's template-3 positive under the committed Java semantics — +# which, after A2, declares nothing whatsoever for category P — and shows +# the same thing for the Java frontend, so A4's correction is not +# jssrc2cpg-specific. +# +# The probe never touches a committed artifact, never writes a report, and +# never feeds a normalized outcome: it retains raw tool output beside the +# modeling evidence so the demonstration is auditable on its own. +# +# Usage: +# scripts/probe-java-modeling-load-bearing.sh \ +# --bifrost --codeql --joern --semgrep +set -euo pipefail + +BIFROST=bifrost +CODEQL=codeql +JOERN=joern +SEMGREP=semgrep +while [ $# -gt 0 ]; do + case "$1" in + --bifrost) BIFROST="$2"; shift 2 ;; + --codeql) CODEQL="$2"; shift 2 ;; + --joern) JOERN="$2"; shift 2 ;; + --semgrep) SEMGREP="$2"; shift 2 ;; + *) echo "unknown argument: $1" >&2; exit 2 ;; + esac +done + +ROOT="$(cd "$(dirname "$0")/.." && pwd)" +OUT="$ROOT/reports/raw/load-bearing-java-modeling" +SCRATCH="$(mktemp -d)" +trap 'rm -rf "$SCRATCH"' EXIT +mkdir -p "$OUT" + +# --------------------------------------------------------------------------- +# Bifrost — category S, the declared-source activation of template 1, and +# Amendment A5's `require-model` acceptance on the same run. +# --------------------------------------------------------------------------- +BF_CASE="$ROOT/cases/taint/java/model-declared-source-positive" +mkdir -p "$SCRATCH/bifrost-with" "$SCRATCH/bifrost-without" +cp "$BF_CASE"/*.java "$SCRATCH/bifrost-with/" +cp "$BF_CASE"/*.java "$SCRATCH/bifrost-without/" +cp "$ROOT/adapters/bifrost/policies/model-java.rqlp" "$SCRATCH/bifrost-with/policy.rqlp" +# Strip only the `(source :id declared-source ...)` entry, leaving the `])` +# that closes the entries vector and the endpoint-set in place — deleting the +# whole line makes the policy unparseable, which would be a probe failure +# rather than a measurement. +python3 - "$ROOT/adapters/bifrost/policies/model-java.rqlp" \ + "$SCRATCH/bifrost-without/policy.rqlp" <<'PY' +import sys +source, destination = sys.argv[1], sys.argv[2] +lines = open(source).read().splitlines(keepends=True) +for index, line in enumerate(lines): + if ":id declared-source" in line: + lines[index] = line[: line.index("(source")] + line[line.rindex("])") :] + break +else: + raise SystemExit("the declared-source entry is not where the probe expects it") +open(destination, "w").writelines(lines) +PY +for variant in with without; do + "$BIFROST" --root "$SCRATCH/bifrost-$variant" --policy-file policy.rqlp \ + --evaluation-date 2026-08-11 --format json --fail-on never \ + --output "$OUT/bifrost-declared-source-$variant-model.json" || true +done +# Amendment A5: the committed policy sets `:unmodeled require-model`, and the +# pinned CLI evaluates it rather than rejecting the setting. Retained as its +# own document so the acceptance is auditable without reading the run. +cp "$OUT/bifrost-declared-source-with-model.json" \ + "$OUT/bifrost-require-model-accepted.json" + +# --------------------------------------------------------------------------- +# CodeQL — category P, the opaque-propagator activation of template 3. The +# Java extractor has no `--build-mode=none`, so the database is built from a +# traced `javac`, exactly as the modeling runner builds it. +# --------------------------------------------------------------------------- +CQ_CASE="$ROOT/cases/taint/java/model-opaque-propagator-positive" +mkdir -p "$SCRATCH/codeql-source" +cp "$CQ_CASE"/*.java "$SCRATCH/codeql-source/" +mkdir -p "$SCRATCH/codeql-pack/queries" +cp "$ROOT/adapters/codeql/qlpack.yml" "$SCRATCH/codeql-pack/" +cp "$ROOT/adapters/codeql/codeql-pack.lock.yml" "$SCRATCH/codeql-pack/" 2>/dev/null || true +cp "$ROOT/adapters/codeql/queries/JavaModeling.ql" "$SCRATCH/codeql-pack/queries/" +# Delete the five-line `Opaque.carry` propagator clause and the `or` that joins +# it to the next one. +python3 - "$SCRATCH/codeql-pack/queries/JavaModeling.ql" <<'PY' +import sys +path = sys.argv[1] +text = open(path).read() +clause = """ exists(MethodCall call | + modelCall(call, "Opaque", "carry") and + node1.asExpr() = call.getArgument(0) and + node2.asExpr() = call + ) + or +""" +if clause not in text: + raise SystemExit("the carry propagator clause is not where the probe expects it") +open(path, "w").write(text.replace(clause, "", 1)) +PY +FIXTURES="$(cd "$SCRATCH/codeql-source" && ls ./*.java | tr '\n' ' ')" +"$CODEQL" database create "$SCRATCH/codeql-db" --language=java \ + --source-root="$SCRATCH/codeql-source" --overwrite \ + --command="javac -d classes $FIXTURES" > /dev/null +for variant in with without; do + if [ "$variant" = with ]; then + QUERY="$ROOT/adapters/codeql/queries/JavaModeling.ql" + else + QUERY="$SCRATCH/codeql-pack/queries/JavaModeling.ql" + fi + "$CODEQL" database analyze "$SCRATCH/codeql-db" "$QUERY" --format=sarif-latest \ + --output="$OUT/codeql-opaque-propagator-$variant-model.sarif.json" --rerun > /dev/null +done + +# --------------------------------------------------------------------------- +# Joern — category Z, the declared sanitizer of template 5's negative, and the +# category-P counter-example that extends Amendment A4 to `javasrc2cpg`. +# --------------------------------------------------------------------------- +SEMANTICS="$ROOT/adapters/joern/semantics/model-java.semantics" +mkdir -p "$SCRATCH/joern-run" +cp "$SEMANTICS" "$SCRATCH/with.semantics" +grep -v '^"dataflowbench.taint.Clean.scrub' "$SEMANTICS" > "$SCRATCH/no-scrub.semantics" +joern_probe() { # + rm -rf "$SCRATCH/joern-source" + mkdir -p "$SCRATCH/joern-source" + cp "$1"/*.java "$SCRATCH/joern-source/" + ( cd "$SCRATCH/joern-run" && "$JOERN" --script "$ROOT/adapters/joern/queries/modeling.sc" \ + --param "inputPath=$SCRATCH/joern-source" \ + --param language=JAVASRC \ + --param "sourceName=$3" \ + --param "sinkName=$4" \ + --param "sourceKind=$5" \ + --param "semanticsPath=$2" \ + --param "outputPath=$OUT/$6" \ + < /dev/null > /dev/null ) + rm -rf "$SCRATCH/joern-run/workspace" +} +JZ_CASE="$ROOT/cases/taint/java/model-sanitizer-kill-negative" +joern_probe "$JZ_CASE" "$SCRATCH/with.semantics" dfb_source dfb_sink call-return \ + joern-sanitizer-kill-with-model.json +joern_probe "$JZ_CASE" "$SCRATCH/no-scrub.semantics" dfb_source dfb_sink call-return \ + joern-sanitizer-kill-without-model.json +# Amendment A4, extended: category P is declared nowhere in the committed Java +# semantics either, and the reflective body is followed anyway. +joern_probe "$CQ_CASE" "$SCRATCH/with.semantics" dfb_source dfb_sink call-return \ + joern-opaque-propagator-unmodeled.json + +# --------------------------------------------------------------------------- +# Semgrep — category S, the declared-sink activation of template 2. +# --------------------------------------------------------------------------- +SG_CASE="$ROOT/cases/taint/java/model-declared-sink-positive" +mkdir -p "$SCRATCH/semgrep-source" +cp "$SG_CASE"/*.java "$SCRATCH/semgrep-source/" +cp "$ROOT/adapters/semgrep/rules/model-java.yaml" "$SCRATCH/with.yaml" +grep -v 'pattern: Audit.record' "$ROOT/adapters/semgrep/rules/model-java.yaml" \ + > "$SCRATCH/without.yaml" +for variant in with without; do + "$SEMGREP" scan --metrics=off --oss-only --disable-version-check --no-git-ignore \ + --quiet --json --config "$SCRATCH/$variant.yaml" "$SCRATCH/semgrep-source" \ + > "$OUT/semgrep-declared-sink-$variant-model.json" +done + +echo "retained load-bearing probe evidence under reports/raw/load-bearing-java-modeling/" diff --git a/src/main.rs b/src/main.rs index d2e34b3..5ebea99 100644 --- a/src/main.rs +++ b/src/main.rs @@ -838,8 +838,8 @@ fn modeling_unsupported_reason(tool: ModelingTool, template: &str) -> Result Vec<&'static str> { MODELING_TEMPLATE_IDS .into_iter() @@ -892,6 +892,14 @@ impl ModelingLanguage { /// language's existing `qlpack`, because a query outside a pack cannot /// resolve its `codeql/-all` dependency. That is a location, not a /// declaration surface: the document's `ConfigSig` encoding is unchanged. + /// + /// Java is the one language for which "that language's existing qlpack" is + /// the adapter *root*: `adapters/codeql/qlpack.yml` declares + /// `dataflowbench/codeql-java` with the `codeql/java-all` dependency, and + /// `adapters/codeql/queries/JavaKernel.ql` already sits beside it. No + /// `adapters/codeql/java/` pack exists to descend into, so a query placed + /// under one would resolve no dependency at all. Java therefore lands on + /// the schematic path, by the same rule that moved the other two off it. fn artifact(self, tool: ModelingTool) -> &'static str { match (tool, self) { (ModelingTool::Bifrost, Self::Java) => "adapters/bifrost/policies/model-java.rqlp", @@ -899,7 +907,7 @@ impl ModelingLanguage { "adapters/bifrost/policies/model-javascript.rqlp" } (ModelingTool::Bifrost, Self::Python) => "adapters/bifrost/policies/model-python.rqlp", - (ModelingTool::Codeql, Self::Java) => "adapters/codeql/java/queries/JavaModeling.ql", + (ModelingTool::Codeql, Self::Java) => "adapters/codeql/queries/JavaModeling.ql", (ModelingTool::Codeql, Self::Javascript) => { "adapters/codeql/javascript/queries/JavaScriptModeling.ql" } @@ -5661,6 +5669,22 @@ enum AnchorDialect { Cpp, Rust, Java, + /// Java as the **modeling matrix** spells it, and the exact counterpart of + /// `EcmaMember`: identical to `Java` except that a member-qualified call — + /// `Audit.record(v)`, `Config.fetchRemote()`, `alpha.get("k")` — counts as + /// a callsite of the named member. + /// + /// Java needs this more sharply than JavaScript does, because Java has no + /// free functions at all: *every* declared modeling entity is a member of + /// some type, and every callsite of one in a fixture that does not declare + /// it is therefore written through its receiver. `Java` refuses a + /// `.`-prefixed match, which is right for the kernels — their `dfb_sink` is + /// a static method called bare from the same class, and `other.dfb_sink(v)` + /// really is a different method — and wrong for a modeling declaration, + /// which binds a type and a member as one identity. Like `EcmaMember`, this + /// variant is used by the modeling runners and by nothing else, so no + /// kernel reconciliation changes. + JavaMember, Python, Ruby, Php, @@ -5678,6 +5702,7 @@ impl AnchorDialect { | Self::Cpp | Self::Rust | Self::Java + | Self::JavaMember | Self::Python | Self::Php => parameter_list_function_name(declaration, marker), Self::Ruby => ruby_declared_function_name(declaration, marker), @@ -5691,6 +5716,7 @@ impl AnchorDialect { Self::CSharp | Self::Go | Self::Java => { parameter_list_function_call(line, function_name) } + Self::JavaMember => java_member_function_call(line, function_name), Self::Cpp => cpp_function_call(line, function_name), Self::Rust => rust_function_call(line, function_name), Self::Python => python_function_call(line, function_name), @@ -5948,6 +5974,16 @@ fn parameter_list_function_call(line: &str, function_name: &str) -> bool { member_prefixed_function_call(line, function_name, &['.']) } +/// The modeling tier's Java rule: `parameter_list_function_call` with the `.` +/// exclusion lifted, so `Audit.record(v)` counts as a callsite of `record` +/// while `myRecord(v)` — an identifier that merely ends in the member's name — +/// still does not. The identifier boundary before the name and the `(` after it +/// are unchanged, which is what keeps a field access or a method reference from +/// matching. +fn java_member_function_call(line: &str, function_name: &str) -> bool { + member_prefixed_function_call(line, function_name, &[]) +} + /// Python reaches a member through `.` only, and opens a comment with `#`. fn python_function_call(line: &str, function_name: &str) -> bool { member_prefixed_call_in(line, function_name, &['.'], CommentSyntax::Hash) @@ -8681,12 +8717,9 @@ fn modeling_codeql_language(language: ModelingLanguage) -> Result Ok(CodeqlLanguage::Python), ModelingLanguage::Javascript => Ok(CodeqlLanguage::Javascript), - // Java wires its own execution arm with its own pull request, exactly - // as these two wire Python's and JavaScript's. - other => bail!( - "the CodeQL modeling execution arm for {} is not wired yet; it lands with that language's pull request (docs/modeling-matrix.md#rollout-plan)", - other.display_name() - ), + // Java runs under the same extractor its kernel does, which is what + // supplies the `--build-mode=none` handling a compiled language needs. + ModelingLanguage::Java => Ok(CodeqlLanguage::Java), } } @@ -8694,10 +8727,7 @@ fn modeling_joern_frontend(language: ModelingLanguage) -> Result<&'static str> { match language { ModelingLanguage::Python => Ok("PYTHONSRC"), ModelingLanguage::Javascript => Ok("JSSRC"), - other => bail!( - "the Joern modeling execution arm for {} is not wired yet; it lands with that language's pull request (docs/modeling-matrix.md#rollout-plan)", - other.display_name() - ), + ModelingLanguage::Java => Ok("JAVASRC"), } } @@ -8709,10 +8739,10 @@ fn modeling_anchor_dialect(language: ModelingLanguage) -> Result // reached through its receiver (`Audit.record(v)`), which the kernel // dialect deliberately does not count as a callsite of `record`. ModelingLanguage::Javascript => Ok(AnchorDialect::EcmaMember), - other => bail!( - "no modeling anchor dialect is wired for {} yet; it lands with that language's pull request (docs/modeling-matrix.md#rollout-plan)", - other.display_name() - ), + // Java for the same reason, and with no exception: the language has no + // free functions, so every declared modeling entity is reached through + // its declaring type. + ModelingLanguage::Java => Ok(AnchorDialect::JavaMember), } } @@ -13675,16 +13705,17 @@ mod tests { assert!(SCORE_TIER_ORDER.contains(&"modeling")); } - /// Wave M1's rows: Python and JavaScript each carry a balanced - /// twenty-four over exactly the preregistered twelve. Java lands with its - /// own pull request and has no modeling denominator until it does, which is - /// different from having a zero — its runs still fail fast rather than - /// writing an empty report. + /// Wave M1's rows: Python, JavaScript, and Java each carry a balanced + /// twenty-four over exactly the preregistered twelve. With Java's landing + /// the wave is complete, so every `ModelingLanguage` now has a denominator + /// — and a language with none would still be a fail-fast rather than a + /// zero. #[test] fn the_modeling_populations_are_the_balanced_twenty_four() { for (language, revision) in [ (ModelingLanguage::Python, "m3-modeling-python"), (ModelingLanguage::Javascript, "m3-modeling-javascript"), + (ModelingLanguage::Java, "m3-modeling-java"), ] { let population = select_modeling_cases(language).unwrap(); assert_eq!(population.len(), MODELING_CASE_COUNT); @@ -13714,11 +13745,6 @@ mod tests { ); } } - assert!( - select_modeling_cases(ModelingLanguage::Java) - .unwrap() - .is_empty() - ); } /// A modeling sink is reached through its receiver, so the modeling ECMA @@ -13800,6 +13826,16 @@ mod tests { "model-javascript.yaml", ["Opaque.js", "Bridge.js"], ), + // Java's Joern identities are fully qualified method full names + // rather than file-scoped ones, so the declined categories are + // named by their declaring type: `Opaque` carries category P's + // entities and `Bridge` carries category O's. + ( + ModelingLanguage::Java, + "model-java.rqlp", + "model-java.yaml", + ["dataflowbench.taint.Opaque", "dataflowbench.taint.Bridge"], + ), ] { let policy = fs::read_to_string(language.artifact(ModelingTool::Bifrost)).unwrap(); require_bifrost_modeling_load_bearing(&policy, policy_name).unwrap(); @@ -13859,22 +13895,26 @@ mod tests { /// With no population, a run fails with a clear error naming the language /// and never writes a report. + /// + /// Wave M1 is complete, so no `ModelingLanguage` variant reaches that arm + /// any more — this test used to drive it through Java, which had no + /// fixtures. What it asserts now is the arm's *precondition*: every + /// enumerated language carries the full balanced population, which is + /// exactly what makes the empty-population bail unreachable. The bail + /// itself stays, for the state the next language enters the enum in. #[test] fn a_modeling_run_without_a_population_fails_fast() { - for (tool, binary) in [ - (ModelingTool::Bifrost, "bifrost"), - (ModelingTool::Codeql, "codeql"), - (ModelingTool::Joern, "joern"), - (ModelingTool::Semgrep, "semgrep"), + for language in [ + ModelingLanguage::Python, + ModelingLanguage::Javascript, + ModelingLanguage::Java, ] { - let error = run_modeling(tool, Path::new(binary), ModelingLanguage::Java, None) - .unwrap_err() - .to_string(); - assert!( - error.starts_with("no modeling population for java"), - "{error}" + assert_eq!( + select_modeling_cases(language).unwrap().len(), + MODELING_CASE_COUNT, + "{} has no modeling population", + language.display_name() ); - assert!(!ModelingLanguage::Java.report(tool).exists()); } } @@ -13973,18 +14013,45 @@ mod tests { ModelingLanguage::Javascript.artifact(ModelingTool::Codeql), "adapters/codeql/javascript/queries/JavaScriptModeling.ql" ); + // Java's CodeQL query is the one that stays on the preregistration's + // schematic path, because the Java pack *is* the adapter root. + assert_eq!( + ModelingLanguage::Java.artifact(ModelingTool::Codeql), + "adapters/codeql/queries/JavaModeling.ql" + ); // Each artifact arrives with the language pull request that authors its - // declarations. Python's and JavaScript's four each are committed; - // Java's are not, and its runs stay hard errors until they are. + // declarations. Wave M1 is complete, so all twelve are committed. for tool in ModelingTool::ALL { - let artifact = ModelingLanguage::Java.artifact(tool); - assert!(!Path::new(artifact).exists(), "{artifact} exists already"); - for language in [ModelingLanguage::Python, ModelingLanguage::Javascript] { + for language in [ + ModelingLanguage::Python, + ModelingLanguage::Javascript, + ModelingLanguage::Java, + ] { let artifact = language.artifact(tool); assert!(Path::new(artifact).is_file(), "{artifact} is missing"); } } assert!(Path::new(JOERN_MODELING_SCRIPT).is_file()); + // A CodeQL modeling query must sit inside a resolvable pack, which is + // what makes its `codeql/-all` dependency resolvable at all. + for language in [ + ModelingLanguage::Python, + ModelingLanguage::Javascript, + ModelingLanguage::Java, + ] { + let query = PathBuf::from(language.artifact(ModelingTool::Codeql)); + let pack = query + .parent() + .and_then(Path::parent) + .expect("a modeling query lives under /queries/") + .join("qlpack.yml"); + assert!( + pack.is_file(), + "{} resolves no qlpack at {}", + query.display(), + pack.display() + ); + } } /// An absent *declared* endpoint is the content of several modeling @@ -14087,4 +14154,79 @@ mod tests { require_semgrep_modeling_load_bearing(&fs::read_to_string(rule_path).unwrap(), rule_path) .unwrap(); } + + /// The same two gates on Java's artifacts. `require-model` is the one the + /// preregistration marked *to be verified*: it recorded that no committed + /// policy sets it and that the pinned CLI's acceptance of it was unshown. + /// [Amendment A5](../docs/modeling-matrix.md#amendments) records the + /// verification; this test is what keeps it true. + #[test] + fn the_java_modeling_artifacts_are_load_bearing() { + let policy_path = ModelingLanguage::Java.artifact(ModelingTool::Bifrost); + let policy = fs::read_to_string(policy_path).unwrap(); + require_bifrost_modeling_load_bearing(&policy, policy_path).unwrap(); + assert!(policy.contains(BIFROST_MODELING_CALL_MODELING)); + let rule_path = ModelingLanguage::Java.artifact(ModelingTool::Semgrep); + let rule = fs::read_to_string(rule_path).unwrap(); + require_semgrep_modeling_load_bearing(&rule, rule_path).unwrap(); + assert!(rule.contains(SEMGREP_MODELING_ASSUME_SAFE_OPTION)); + } + + /// Java's modeling fixtures reconcile under the member-qualified variant, + /// not the kernel dialect. Java has no free functions, so every declared + /// modeling entity is reached through its declaring type; the kernel + /// dialect refuses exactly that spelling, which is right for a kernel whose + /// `dfb_sink` is called bare. + #[test] + fn java_modeling_reconciles_member_qualified_callsites() { + assert_eq!( + modeling_anchor_dialect(ModelingLanguage::Java).unwrap(), + AnchorDialect::JavaMember + ); + // The declared-entity spelling every Java modeling fixture uses. + assert!(AnchorDialect::JavaMember.is_call(" Audit.record(value);", "record")); + assert!( + AnchorDialect::JavaMember + .is_call(" dfb_sink(Config.fetchLocal());", "fetchLocal") + ); + assert!(AnchorDialect::JavaMember.is_call(" beta.get(\"k\");", "get")); + // …which the kernel dialect deliberately refuses. + assert!(!AnchorDialect::Java.is_call(" Audit.record(value);", "record")); + // Neither variant mistakes a longer identifier, a comment, or a bare + // member access with no argument list for a callsite. + assert!(!AnchorDialect::JavaMember.is_call(" myRecord(value);", "record")); + assert!(!AnchorDialect::JavaMember.is_call(" // Audit.record(value);", "record")); + assert!(!AnchorDialect::JavaMember.is_call(" dfb_sink(box.payload);", "payload")); + assert!(!AnchorDialect::JavaMember.is_call(" Audit::record;", "record")); + // The declaration side is the kernel rule unchanged: the marker sits on + // the identifier before the parameter list either way. + assert_eq!( + AnchorDialect::JavaMember + .declared_function_name( + " static void record(String value) { } // DFB-SINK: m", + "DFB-SINK: m" + ) + .unwrap(), + "record" + ); + } + + /// Every wave-M1 modeling language is wired end to end: an extractor, a + /// Joern frontend, and an anchor dialect, none of which may bail. + #[test] + fn every_wave_m1_modeling_language_has_a_wired_execution_arm() { + for language in [ + ModelingLanguage::Python, + ModelingLanguage::Javascript, + ModelingLanguage::Java, + ] { + modeling_codeql_language(language).unwrap(); + modeling_joern_frontend(language).unwrap(); + modeling_anchor_dialect(language).unwrap(); + } + assert_eq!( + modeling_joern_frontend(ModelingLanguage::Java).unwrap(), + "JAVASRC" + ); + } }