Merge branch 'main' into js-sails-action2-inputs

Author: theinfosecguy

go/extractor/go.mod

@@ -9,7 +9,7 @@ toolchain go1.26.4
 // when adding or removing dependencies, run
 //    bazel mod tidy
 require (
-	golang.org/x/mod v0.37.0
+	golang.org/x/mod v0.38.0
 	golang.org/x/tools v0.47.0
 )
 

go/extractor/go.sum

@@ -6,8 +6,8 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
-golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
+golang.org/x/mod v0.38.0 h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk=
+golang.org/x/mod v0.38.0/go.mod h1:V6Xz0pq8TQ3dGqVQ1FVHuelZpAL0uNhSkk9ogYP3c40=
 golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM=
 golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=

java/ql/lib/change-notes/2026-07-01-org.apache.poi-mads.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Added summary and LLM-generated source and sink models for `org.apache.poi`.

java/ql/lib/ext/generated/llmgenerator/org.apache.poi.common.model.yml

@@ -0,0 +1,8 @@
+# THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT.
+# Generated from https://github.com/apache/poi#bd97feb849ab86670fe5b5513d4066c46b599797 by codeql-mads-via-llm
+extensions:
+  - addsTo:
+      pack: codeql/java-all
+      extensible: summaryModel
+    data:
+      - ["org.apache.poi.common", "Duplicatable", True, "copy", "()", "", "Argument[this]", "ReturnValue", "value", "dfc-generated"]

java/ql/lib/ext/generated/llmgenerator/org.apache.poi.common.usermodel.fonts.model.yml

@@ -0,0 +1,15 @@
+# THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT.
+# Generated from https://github.com/apache/poi#bd97feb849ab86670fe5b5513d4066c46b599797 by codeql-mads-via-llm
+extensions:
+  - addsTo:
+      pack: codeql/java-all
+      extensible: summaryModel
+    data:
+      - ["org.apache.poi.common.usermodel.fonts", "FontHeader", True, "getFamilyName", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"]
+      - ["org.apache.poi.common.usermodel.fonts", "FontHeader", True, "getFullName", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"]
+      - ["org.apache.poi.common.usermodel.fonts", "FontHeader", True, "getStyleName", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"]
+      - ["org.apache.poi.common.usermodel.fonts", "FontHeader", True, "getVersionName", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"]
+      - ["org.apache.poi.common.usermodel.fonts", "FontHeader", True, "init", "(LittleEndianInput)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"]
+      - ["org.apache.poi.common.usermodel.fonts", "FontHeader", True, "init", "(byte[],int,int)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"]
+      - ["org.apache.poi.common.usermodel.fonts", "FontInfo", True, "getPanose", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"]
+      - ["org.apache.poi.common.usermodel.fonts", "FontInfo", True, "getTypeface", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"]

java/ql/lib/ext/generated/llmgenerator/org.apache.poi.common.usermodel.model.yml

@@ -0,0 +1,8 @@
+# THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT.
+# Generated from https://github.com/apache/poi#bd97feb849ab86670fe5b5513d4066c46b599797 by codeql-mads-via-llm
+extensions:
+  - addsTo:
+      pack: codeql/java-all
+      extensible: summaryModel
+    data:
+      - ["org.apache.poi.common.usermodel", "GenericRecord", True, "getGenericChildren", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"]

java/ql/lib/ext/generated/llmgenerator/org.apache.poi.ddf.model.yml

@@ -0,0 +1,39 @@
+# THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT.
+# Generated from https://github.com/apache/poi#bd97feb849ab86670fe5b5513d4066c46b599797 by codeql-mads-via-llm
+extensions:
+  - addsTo:
+      pack: codeql/java-all
+      extensible: sinkModel
+    data:
+      - ["org.apache.poi.extractor", "ExtractorFactory", True, "createExtractor", "(File)", "", "Argument[0]", "path-injection", "ai-generated"]
+      - ["org.apache.poi.extractor", "ExtractorFactory", True, "createExtractor", "(File,String)", "", "Argument[0]", "path-injection", "ai-generated"]
+      - ["org.apache.poi.extractor", "ExtractorProvider", True, "create", "(File,String)", "", "Argument[0]", "path-injection", "ai-generated"]
+      - ["org.apache.poi.extractor", "MainExtractorFactory", True, "create", "(File,String)", "", "Argument[0]", "path-injection", "ai-generated"]
+  - addsTo:
+      pack: codeql/java-all
+      extensible: sourceModel
+    data:
+      - ["org.apache.poi.extractor", "ExtractorFactory", True, "createExtractor", "(File)", "", "ReturnValue", "file", "ai-generated"]
+      - ["org.apache.poi.extractor", "ExtractorFactory", True, "createExtractor", "(File,String)", "", "ReturnValue", "file", "ai-generated"]
+      - ["org.apache.poi.extractor", "MainExtractorFactory", True, "create", "(File,String)", "", "ReturnValue", "file", "ai-generated"]
+  - addsTo:
+      pack: codeql/java-all
+      extensible: summaryModel
+    data:
+      - ["org.apache.poi.extractor", "ExtractorFactory", False, "createExtractor", "(DirectoryNode)", "", "Argument[0].Element", "ReturnValue", "taint", "df-generated"]
+      - ["org.apache.poi.extractor", "ExtractorFactory", False, "createExtractor", "(DirectoryNode,String)", "", "Argument[0].Element", "ReturnValue", "taint", "df-generated"]
+      - ["org.apache.poi.extractor", "ExtractorFactory", False, "createExtractor", "(DirectoryNode,String)", "", "Argument[1]", "ReturnValue", "taint", "df-generated"]
+      - ["org.apache.poi.extractor", "ExtractorFactory", False, "createExtractor", "(File,String)", "", "Argument[1]", "ReturnValue", "taint", "df-generated"]
+      - ["org.apache.poi.extractor", "ExtractorFactory", False, "createExtractor", "(InputStream,String)", "", "Argument[1]", "ReturnValue", "taint", "df-generated"]
+      - ["org.apache.poi.extractor", "ExtractorFactory", False, "createExtractor", "(POIFSFileSystem)", "", "Argument[0]", "ReturnValue", "taint", "df-generated"]
+      - ["org.apache.poi.extractor", "ExtractorFactory", False, "createExtractor", "(POIFSFileSystem,String)", "", "Argument[0]", "ReturnValue", "taint", "df-generated"]
+      - ["org.apache.poi.extractor", "ExtractorFactory", False, "createExtractor", "(POIFSFileSystem,String)", "", "Argument[1]", "ReturnValue", "taint", "df-generated"]
+      - ["org.apache.poi.extractor", "ExtractorProvider", True, "create", "(File,String)", "", "Argument[1]", "ReturnValue", "taint", "df-generated"]
+      - ["org.apache.poi.extractor", "ExtractorProvider", True, "create", "(InputStream,String)", "", "Argument[1]", "ReturnValue", "taint", "df-generated"]
+      - ["org.apache.poi.extractor", "MainExtractorFactory", True, "create", "(DirectoryNode,String)", "", "Argument[0].SyntheticField[org.apache.poi.poifs.filesystem.DirectoryNode._filesystem]", "ReturnValue.SyntheticField[org.apache.poi.hssf.extractor.OldExcelExtractor.toClose]", "value", "dfc-generated"]
+      - ["org.apache.poi.extractor", "POIOLE2TextExtractor", True, "getDocSummaryInformation", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"]
+      - ["org.apache.poi.extractor", "POIOLE2TextExtractor", True, "getRoot", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"]
+      - ["org.apache.poi.extractor", "POIOLE2TextExtractor", True, "getSummaryInformation", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"]
+      - ["org.apache.poi.extractor", "POITextExtractor", True, "getDocument", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"]
+      - ["org.apache.poi.extractor", "POITextExtractor", True, "getMetadataTextExtractor", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"]
+      - ["org.apache.poi.extractor", "POITextExtractor", True, "getText", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"]

java/ql/lib/ext/generated/llmgenerator/org.apache.poi.extractor.model.yml

@@ -0,0 +1,12 @@
+# THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT.
+# Generated from https://github.com/apache/poi#bd97feb849ab86670fe5b5513d4066c46b599797 by codeql-mads-via-llm
+extensions:
+  - addsTo:
+      pack: codeql/java-all
+      extensible: summaryModel
+    data:
+      - ["org.apache.poi.hpsf.extractor", "HPSFPropertiesExtractor", True, "HPSFPropertiesExtractor", "(POIDocument)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hpsf.extractor.HPSFPropertiesExtractor.document]", "value", "dfc-generated"]
+      - ["org.apache.poi.hpsf.extractor", "HPSFPropertiesExtractor", True, "HPSFPropertiesExtractor", "(POIFSFileSystem)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"]
+      - ["org.apache.poi.hpsf.extractor", "HPSFPropertiesExtractor", True, "HPSFPropertiesExtractor", "(POIOLE2TextExtractor)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"]
+      - ["org.apache.poi.hpsf.extractor", "HPSFPropertiesExtractor", True, "getDocument", "()", "", "Argument[this].SyntheticField[org.apache.poi.hpsf.extractor.HPSFPropertiesExtractor.document]", "ReturnValue", "value", "dfc-generated"]
+      - ["org.apache.poi.hpsf.extractor", "HPSFPropertiesExtractor", True, "getFilesystem", "()", "", "Argument[this].SyntheticField[org.apache.poi.hpsf.extractor.HPSFPropertiesExtractor.document]", "ReturnValue", "value", "dfc-generated"]