Java: Merge TaintPreservingMethod with TaintTransferringMethod

Author: joefarebrother

java/ql/src/semmle/code/java/dataflow/FlowSteps.qll

@@ -32,31 +32,23 @@ class AdditionalTaintStep extends Unit {
 }
 
 /**
- * A method that returns tainted data when one of its inputs (an argument or the qualifier) is tainted.
+ * A method that preserves taint.
  *
- * Extend this class to add additional taint steps through a method that should
- * apply to all taint configurations.
+ * Extend this class and override at least one of `returnsTaint` or `transfersTaint`
+ * to add additional taint steps through a method that should apply to all taint configurations.
  */
 abstract class TaintPreservingMethod extends Method {
   /**
    * Holds if this method returns tainted data when `arg` tainted.
    * `arg` is a parameter index, or is -1 to indicate the qualifier.
    */
-  abstract predicate returnsTaint(int arg);
-}
+  predicate returnsTaint(int arg) { none() }
 
-/**
- * A method that transfers taint from one of its inputs (an argument or the qualifier) to another.
- *
- * Extend this class to add additional taint steps through a method that should
- * apply to all taint configurations.
- */
-abstract class TaintTransferringMethod extends Method {
   /**
    * Holds if this method writes tainted data to `sink` when `src` is tainted.
    * `src` and `sink` are parameter indices, or -1 to indicate the qualifier.
    */
-  abstract predicate transfersTaint(int src, int sink);
+  predicate transfersTaint(int src, int sink) { none() }
 }
 
 private class StringTaintPreservingMethod extends TaintPreservingMethod {

java/ql/src/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll

@@ -296,7 +296,7 @@ private predicate taintPreservingQualifierToArgument(Method m, int arg) {
   m.hasName("read") and
   arg = 0
   or
-  m.(TaintTransferringMethod).transfersTaint(-1, arg)
+  m.(TaintPreservingMethod).transfersTaint(-1, arg)
 }
 
 /** Access to a method that passes taint from the qualifier. */
@@ -571,7 +571,7 @@ private predicate taintPreservingArgToArg(Method method, int input, int output)
   input = 0 and
   output = 2
   or
-  method.(TaintTransferringMethod).transfersTaint(input, output)
+  method.(TaintPreservingMethod).transfersTaint(input, output)
 }
 
 /**
@@ -610,7 +610,7 @@ private predicate taintPreservingArgumentToQualifier(Method method, int arg) {
     append.getDeclaringType().hasQualifiedName("java.io", "StringWriter")
   )
   or
-  method.(TaintTransferringMethod).transfersTaint(arg, -1)
+  method.(TaintPreservingMethod).transfersTaint(arg, -1)
 }
 
 /** A comparison or equality test with a constant. */
@@ -734,7 +734,7 @@ private class TypeFormatter extends Class {
   TypeFormatter() { this.hasQualifiedName("java.util", "Formatter") }
 }
 
-private class FormatterMethod extends TaintPreservingMethod, TaintTransferringMethod {
+private class FormatterMethod extends TaintPreservingMethod {
   FormatterMethod() {
     getDeclaringType() instanceof TypeFormatter and
     hasName(["format", "out", "toString"])

java/ql/src/semmle/code/java/frameworks/android/SQLite.qll

@@ -256,7 +256,7 @@ private class QueryBuilderBuildMethod extends TaintPreservingMethod {
   override predicate returnsTaint(int arg) { argument = arg }
 }
 
-private class QueryBuilderAppendMethod extends TaintTransferringMethod {
+private class QueryBuilderAppendMethod extends TaintPreservingMethod {
   QueryBuilderAppendMethod() {
     this.getDeclaringType().getASourceSupertype*() instanceof TypeSQLiteQueryBuilder and
     // setProjectionMap(Map<String, String> columnMap)

java/ql/src/semmle/code/java/frameworks/jackson/JacksonSerializability.qll

@@ -28,7 +28,7 @@ abstract class JacksonSerializableType extends Type { }
  * A method used for serializing objects using Jackson. The final parameter is the object to be
  * serialized.
  */
-library class JacksonWriteValueMethod extends TaintPreservingMethod, TaintTransferringMethod {
+library class JacksonWriteValueMethod extends TaintPreservingMethod {
   JacksonWriteValueMethod() {
     (
       getDeclaringType().hasQualifiedName("com.fasterxml.jackson.databind", "ObjectWriter") or