Add Maven plugin implementation Parameter queries

Author: Marcono1234

codeql-custom-queries-java/queries/maven/mojo-Parameter-defaultValue-field-value-mismatch.ql

@@ -0,0 +1,61 @@
+/**
+ * Finds Maven plugin implementations where a parameter field has an explicit initial value which
+ * differs from the default value set using `@Parameter#defaultValue`. The `defaultValue` overwrites
+ * the initial field value when the plugin is used, so the explicit field value is redundant and
+ * can cause confusion.
+ *
+ * For example:
+ * ```java
+ * @Parameter(defaultValue = "false")
+ * public boolean useCustomFeature = true; // `= true` is redundant and misleading
+ * ```
+ *
+ * @kind problem
+ * @id TODO
+ */
+
+import java
+
+predicate equalsDefaultValue(Literal l, string defaultValue) {
+  exists(string literalValue | literalValue = l.getValue() |
+    literalValue = defaultValue
+    or
+    // Or floating point value matches when removing `.0` suffix
+    l.getType() instanceof FloatingPointType and
+    literalValue.matches("%.0") and
+    literalValue.prefix(literalValue.length() - ".0".length()) = defaultValue
+  )
+}
+
+from
+  Field f, CompileTimeConstantExpr initializedFieldValue, Annotation parameterAnnotation,
+  Expr defaultValueExpr, string defaultValue
+where
+  initializedFieldValue = f.getInitializer() and
+  parameterAnnotation = f.getAnAnnotation() and
+  parameterAnnotation
+      .getType()
+      .hasQualifiedName("org.apache.maven.plugins.annotations", "Parameter") and
+  defaultValue = parameterAnnotation.getStringValue("defaultValue") and
+  // Ignore not set default value
+  defaultValue != "" and
+  defaultValueExpr = parameterAnnotation.getValue("defaultValue") and
+  (
+    initializedFieldValue instanceof Literal and
+    not equalsDefaultValue(initializedFieldValue, defaultValue)
+    or
+    exists(initializedFieldValue.getStringValue()) and
+    defaultValue != initializedFieldValue.getStringValue()
+    or
+    exists(initializedFieldValue.getBooleanValue()) and
+    defaultValue != initializedFieldValue.getBooleanValue().toString()
+    or
+    exists(initializedFieldValue.getIntValue()) and
+    defaultValue != initializedFieldValue.getIntValue().toString()
+  ) and
+  // Ignore if default value is `${...}` expression
+  // TODO: Does this work as expected when property is undefined, i.e. is field default value used then?
+  //   Or is field default value always overwritten? (in that case using `${...}` expression should not be ignored here)
+  not defaultValue.matches("${%}")
+select initializedFieldValue, "Does not match the $@ specified by @Parameter", defaultValueExpr,
+  "defaultValue"

codeql-custom-queries-java/queries/maven/mojo-not-defining-Parameter-defaultValue.ql

@@ -0,0 +1,55 @@
+/**
+ * Finds Maven plugin implementations where the implicit or explicit initial field value is
+ * not specified as `@Parameter#defaultValue`. If `defaultValue` is not specified the plugin
+ * documentation won't mention the default value, which makes the default behavior of the
+ * plugin unclear to the user.
+ *
+ * For example:
+ * ```java
+ * @Parameter
+ * // Should specify the default using `@Parameter(defaultValue = "true")` instead
+ * public boolean useCustomFeature = true;
+ * ```
+ *
+ * @kind problem
+ * @id TODO
+ */
+
+// Related to https://github.com/apache/maven-shade-plugin/pull/219
+
+import java
+
+string getDefaultValue(PrimitiveType t) {
+  t.hasName("boolean") and result = "false"
+  or
+  // TODO: Is `char` correct here or is its default value rather `\0`?
+  t.hasName(["byte", "short", "char", "int", "long", "float", "double"]) and result = "0"
+}
+
+from Field f, Annotation parameterAnnotation, string defaultValue
+where
+  parameterAnnotation = f.getAnAnnotation() and
+  parameterAnnotation
+      .getType()
+      .hasQualifiedName("org.apache.maven.plugins.annotations", "Parameter") and
+  // Does not specify a default value
+  parameterAnnotation.getStringValue("defaultValue") = "" and
+  // Only consider @Parameter usage in Mojos
+  f.getDeclaringType().getASourceSupertype+().hasQualifiedName("org.apache.maven.plugin", "Mojo") and
+  (
+    if exists(f.getInitializer())
+    then
+      // Only consider constant initial values, otherwise might not be possible to use @Parameter#defaultValue
+      exists(CompileTimeConstantExpr initalizer | initalizer = f.getInitializer() |
+        defaultValue = initalizer.(Literal).getValue() or
+        defaultValue = initalizer.getStringValue() or
+        defaultValue = initalizer.getIntValue().toString() or
+        defaultValue = initalizer.getBooleanValue().toString()
+      )
+    else defaultValue = getDefaultValue(f.getType())
+  ) and
+  // Ignore if a value is assigned outside the initializer
+  not f.getAnAssignedValue() != f.getInitializer() and
+  // Ignore if default value is empty string, because it cannot be represented with @Parameter#defaultValue (?)
+  defaultValue != ""
+select parameterAnnotation, "Should specify defaultValue: " + defaultValue