Maven Shade support

java/ql/src/semmle/code/java/frameworks/SnakeYaml.qll

@@ -6,13 +6,14 @@ import java
 import semmle.code.java.dataflow.DataFlow
 import semmle.code.java.dataflow.DataFlow2
 import semmle.code.java.dataflow.DataFlow3
+import semmle.code.xml.MavenPom
 
 /**
  * The class `org.yaml.snakeyaml.constructor.SafeConstructor`.
  */
 class SnakeYamlSafeConstructor extends RefType {
   SnakeYamlSafeConstructor() {
-    this.hasQualifiedName("org.yaml.snakeyaml.constructor", "SafeConstructor")
+    this.hasQualifiedName(getAShadedPackage("org.yaml.snakeyaml.constructor"), "SafeConstructor")
   }
 }
 
@@ -27,7 +28,7 @@ class SafeSnakeYamlConstruction extends ClassInstanceExpr {
  * The class `org.yaml.snakeyaml.Yaml`.
  */
 class Yaml extends RefType {
-  Yaml() { this.getASupertype*().hasQualifiedName("org.yaml.snakeyaml", "Yaml") }
+  Yaml() { this.getASupertype*().hasQualifiedName(getAShadedPackage("org.yaml.snakeyaml"), "Yaml") }
 }
 
 private class SafeYamlConstructionFlowConfig extends DataFlow2::Configuration {

java/ql/src/semmle/code/xml/MavenPom.qll

@@ -485,3 +485,80 @@ class MavenRepoJar extends File {
     else getVersion().matches(pom.getVersionString() + "%")
   }
 }
+
+/**
+ * A `<plugin>` element in a Maven POM file.
+ */
+class MavenPlugin extends ProtoPom {
+  MavenPlugin() { this.hasName("plugin") }
+}
+
+/**
+ * A `maven-shade-plugin` plugin element in a Maven POM file.
+ */
+class MavenShadePlugin extends MavenPlugin {
+  MavenShadePlugin() {
+    (
+      this.getGroup().getValue() = "org.apache.maven.plugins" or
+      not exists(this.getGroup()) // org.apache.maven.plugins is the default
+    ) and
+    this.getArtifact().getValue() = "maven-shade-plugin"
+  }
+
+  MavenShadeRelocation getARelocation() { result.getPlugin() = this }
+}
+
+/**
+ * A `<relocation>` specification within a `maven-shade-plugin` configuration.
+ */
+class MavenShadeRelocation extends XMLElement {
+  MavenShadePlugin plugin;
+
+  MavenShadeRelocation() {
+    this =
+      [plugin, plugin.getAChild("executions").getAChild("execution")]
+          .getAChild("configuration")
+          .getAChild("relocations")
+          .getAChild("relocation")
+  }
+
+  /**
+   * Gets the `<plugin>` ancestor of this relocation.
+   */
+  MavenShadePlugin getPlugin() { result = plugin }
+
+  /**
+   * Gets the pattern this relocation replaces (e.g. `org.foo`)
+   */
+  string getPattern() { result = this.getAChild("pattern").getTextValue() }
+
+  /**
+   * Gets the shaded package that replaces `getPattern()` (e.g. `org.bar.shaded.org.foo`).
+   */
+  string getShadedPattern() { result = this.getAChild("shadedPattern").getTextValue() }
+
+  /**
+   * Holds if this `<relocation>` specification relocates `fromPackage` to `toPackage`.
+   */
+  predicate relocates(string fromPackage, string toPackage) {
+    this.getPattern() = fromPackage and this.getShadedPattern() = toPackage
+  }
+}
+
+/**
+ * Gets a package name that may be used to refer to `package` after shading, including `package`
+ * itself.
+ *
+ * For example, if `package` is `org.foo.sub` and we have a `<relocation>` specification relocating
+ * `org.foo` to `org.bar.shaded.org.foo` then the results will be `{"org.foo.sub", "org.bar.shaded.org.foo.sub"}`.
+ */
+bindingset[package]
+string getAShadedPackage(string package) {
+  result = package
+  or
+  exists(string originalPackage, string shadedPackage, MavenShadeRelocation relocDirective |
+    relocDirective.relocates(originalPackage, shadedPackage)
+  |
+    result = package.regexpReplaceAll("^" + originalPackage, shadedPackage)
+  )
+}

java/ql/test/library-tests/maven/shade-relocations/ShadeRelocations.expected

@@ -0,0 +1,3 @@
+| org.codehaus.plexus.abc | org.shaded.plexus.abc |
+| org.codehaus.plexus.def | org.shaded.plexus.def |
+| org.codehaus.plexus.util | org.shaded.plexus.util |

java/ql/test/library-tests/maven/shade-relocations/ShadeRelocations.ql

@@ -0,0 +1,6 @@
+import java
+import semmle.code.xml.MavenPom
+
+from string pkgFrom, string pkgTo, MavenShadeRelocation reloc
+where reloc.relocates(pkgFrom, pkgTo)
+select pkgFrom, pkgTo

java/ql/test/library-tests/maven/shade-relocations/pom.xml

@@ -0,0 +1,49 @@
+<project>
+  <modelVersion>4.0.0</modelVersion>
+
+  <groupId>MYGROUP</groupId>
+  <artifactId>MYARTIFACT</artifactId>
+  <version>0.1-SNAPSHOT</version>  
+
+  <build>
+    <plugins>
+      <plugin>
+        <groupId>org.apache.maven.plugins</groupId>
+        <artifactId>maven-shade-plugin</artifactId>
+        <version>3.2.4</version>
+        <configuration>
+          <relocations>
+            <relocation>
+              <pattern>org.codehaus.plexus.abc</pattern>
+              <shadedPattern>org.shaded.plexus.abc</shadedPattern>
+            </relocation>
+            <relocation>
+              <pattern>org.codehaus.plexus.def</pattern>
+              <shadedPattern>org.shaded.plexus.def</shadedPattern>
+            </relocation>
+          </relocations>
+        </configuration>
+        <executions>
+          <execution>
+            <phase>package</phase>
+            <goals>
+              <goal>shade</goal>
+            </goals>
+            <configuration>
+              <relocations>
+                <relocation>
+                  <pattern>org.codehaus.plexus.util</pattern>
+                  <shadedPattern>org.shaded.plexus.util</shadedPattern>
+                  <excludes>
+                    <exclude>org.codehaus.plexus.util.xml.Xpp3Dom</exclude>
+                    <exclude>org.codehaus.plexus.util.xml.pull.*</exclude>
+                  </excludes>
+                </relocation>
+              </relocations>
+            </configuration>
+          </execution>
+        </executions>
+      </plugin>
+    </plugins>
+  </build>
+</project>

java/ql/test/library-tests/maven/shade-relocations/src/main/java/somepackage/Test.java

@@ -0,0 +1,3 @@
+package somepackage;
+
+public class Test { } // Nothing to see here; the real test is in pom.xml; this is just to avoid a warning that the extractor didn't find any Java code.