Java: Support for MaD barriers and barrier guards.

[aschackmull]

This adds models-as-data support for Java barriers and barrier guards. There's still some uncertainty about how to best structure the values in the kind column, hence no change-note for now.

[Copilot]

Pull request overview

This PR adds Models-as-Data (MaD) support for Java barriers and barrier guards, enabling external specification of sanitizers that prevent taint flow. The implementation includes shared dataflow infrastructure, Java-specific implementation, and conversion of existing hardcoded sanitizers to MaD models.

Key changes:

• Added AcceptingValue class and barrier-related predicates to the shared dataflow framework
• Implemented Java-specific barrier and barrier guard support with parameterized guard checking
• Converted hardcoded sanitizers (ESAPI validators, Pattern.quote, URI.isAbsolute, File.getName, hudson.Util.escape) to MaD models in YAML files

Reviewed changes

Copilot reviewed 24 out of 24 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
shared/dataflow/codeql/dataflow/internal/FlowSummaryImpl.qll	Adds core infrastructure: AcceptingValue class, barrierElement/barrierGuardElement predicates, isBarrierNode/isBarrierGuardNode predicates, and barrier access path interpretation
shared/mad/codeql/mad/ModelValidation.qll	Updates validation error message to include barrier models
swift/ql/lib/codeql/swift/dataflow/internal/FlowSummaryImpl.qll	Adds stub barrier predicates (returns none()) for Swift
go/ql/lib/semmle/go/dataflow/internal/FlowSummaryImpl.qll	Adds stub barrier predicates (returns none()) for Go
csharp/ql/lib/semmle/code/csharp/dataflow/internal/FlowSummaryImpl.qll	Adds stub barrier predicates (returns none()) for C#
cpp/ql/lib/semmle/code/cpp/dataflow/internal/FlowSummaryImpl.qll	Adds stub barrier predicates (returns none()) for C++
java/ql/lib/semmle/code/java/dataflow/internal/FlowSummaryImpl.qll	Implements barrierElement and barrierGuardElement predicates for Java
java/ql/lib/semmle/code/java/dataflow/internal/ExternalFlowExtensions.qll	Declares extensible barrierModel and barrierGuardModel predicates
java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll	Implements barrierNode predicate with barrier guard checking, validation, and model interpretation
java/ql/lib/semmle/code/java/dataflow/internal/DataFlowUtil.qll	Adds ParameterizedBarrierGuard module for parameterized guard checking
java/ql/lib/semmle/code/java/dataflow/internal/SsaImpl.qll	Adds SSA-level ParameterizedBarrierGuard module
java/ql/lib/semmle/code/java/security/regexp/RegexInjection.qll	Replaces PatternQuoteCall sanitizer with DefaultRegexInjectionSanitizer using barrierNode
java/ql/lib/semmle/code/java/security/XSS.qll	Refactors DefaultXssSanitizer to use barrierNode, splits primitives and HtmlUtils.htmlEscape into separate classes
java/ql/lib/semmle/code/java/security/TrustBoundaryViolationQuery.qll	Replaces EsapiValidatedInputSanitizer with DefaultTrustBoundaryValidationSanitizer using barrierNode
java/ql/lib/semmle/code/java/security/RequestForgery.qll	Replaces RelativeUrlSanitizer with DefaultRequestForgerySanitizer using barrierNode
java/ql/lib/semmle/code/java/security/PathSanitizer.qll	Replaces FileGetNameSanitizer with DefaultPathInjectionSanitizer using barrierNode
java/ql/lib/semmle/code/java/frameworks/owasp/Esapi.qll	Deletes entire file (ESAPI classes now defined in MaD models)
java/ql/lib/semmle/code/java/frameworks/hudson/Hudson.qll	Removes HudsonUtilXssSanitizer class (now a MaD barrier model)
java/ql/lib/ext/org.owasp.esapi.model.yml	Adds barrierGuardModel entries for ESAPI Validator.isValid* methods and barrierModel entries for Validator.getValid* methods
java/ql/lib/ext/java.util.regex.model.yml	Adds barrierModel for Pattern.quote method
java/ql/lib/ext/java.net.model.yml	Adds barrierGuardModel for URI.isAbsolute method
java/ql/lib/ext/java.io.model.yml	Adds barrierModel for File.getName method
java/ql/lib/ext/hudson.model.yml	Adds barrierModel for hudson.Util.escape method
java/ql/lib/ext/empty.model.yml	Adds empty barrierModel and barrierGuardModel extensible declarations

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[owen-mc]

LGTM

[aschackmull]

Copilot is correct about the minor naming issue (which it repeats 5 times). I've pushed the small rename.