Maven Shade support

java/ql/src/semmle/code/java/frameworks/SnakeYaml.qll

@@ -6,13 +6,14 @@ import java
 import semmle.code.java.dataflow.DataFlow
 import semmle.code.java.dataflow.DataFlow2
 import semmle.code.java.dataflow.DataFlow3
+import semmle.code.xml.MavenPom
 
 /**
  * The class `org.yaml.snakeyaml.constructor.SafeConstructor`.
  */
 class SnakeYamlSafeConstructor extends RefType {
   SnakeYamlSafeConstructor() {
-    this.hasQualifiedName("org.yaml.snakeyaml.constructor", "SafeConstructor")
+    this.hasQualifiedName(getAShadedPackage("org.yaml.snakeyaml.constructor"), "SafeConstructor")
   }
 }
 
@@ -27,7 +28,10 @@ class SafeSnakeYamlConstruction extends ClassInstanceExpr {
  * The class `org.yaml.snakeyaml.Yaml`.
  */
 class Yaml extends RefType {
-  Yaml() { this.getASupertype*().hasQualifiedName("org.yaml.snakeyaml", "Yaml") }
+  Yaml() {
+    this.getASupertype*()
+        .hasQualifiedName(getAShadedPackage("org.yaml.snakeyaml.constructor"), "Yaml")
+  }
 }
 
 private class SafeYamlConstructionFlowConfig extends DataFlow2::Configuration {

java/ql/src/semmle/code/xml/MavenPom.qll

@@ -485,3 +485,85 @@ class MavenRepoJar extends File {
     else getVersion().matches(pom.getVersionString() + "%")
   }
 }
+
+/**
+ * A `<plugin>` element in a Maven POM file.
+ */
+class MavenPlugin extends ProtoPom {
+  MavenPlugin() { this.hasName("plugin") }
+}
+
+/**
+ * A `maven-shade-plugin` plugin element in a Maven POM file.
+ */
+class MavenShadePlugin extends MavenPlugin {
+  MavenShadePlugin() {
+    (
+      this.getGroup().getValue() = "org.apache.maven.plugins" or
+      not exists(this.getGroup()) // org.apache.maven.plugins is the default
+    ) and
+    this.getArtifact().getValue() = "maven-shade-plugin"
+  }
+
+  MavenShadeRelocation getARelocation() { result.getPlugin() = this }
+}
+
+/**
+ * A `<relocation>` specification within a `maven-shade-plugin` configuration.
+ */
+class MavenShadeRelocation extends XMLElement {
+  MavenShadePlugin plugin;
+
+  MavenShadeRelocation() {
+    this.getParent().(XMLElement).getParent().(XMLElement).getParent() = plugin and
+    this.hasName("relocation")
+  }
+
+  /**
+   * Gets the `<plugin>` ancestor of this relocation.
+   */
+  MavenShadePlugin getPlugin() { result = plugin }
+
+  /**
+   * Gets the pattern this relocation replaces (e.g. `org.foo`)
+   */
+  string getPattern() {
+    exists(XMLElement el | el.getName() = "pattern" and el.getParent() = this |
+      result = el.getTextValue()
+    )
+  }
+
+  /**
+   * Gets the shaded package that replaces `getPattern()` (e.g. `org.bar.shaded.org.foo`).
+   */
+  string getShadedPattern() {
+    exists(XMLElement el | el.getName() = "shadedPattern" and el.getParent() = this |
+      result = el.getTextValue()
+    )
+  }
+
+  /**
+   * Holds if this `<relocation>` specification relocates `fromPackage` to `toPackage`.
+   */
+  predicate relocates(string fromPackage, string toPackage) {
+    this.getPattern() = fromPackage and this.getShadedPattern() = toPackage
+  }
+}
+
+/**
+ * Returns a package name that may be used to refer to `package` after shading, including `package`
+ * itself.
+ *
+ * For example, if `package` is `org.foo.sub` and we have a `<relocation>` specification relocating
+ * `org.foo` to `org.bar.shaded.org.foo` then this will return `{"org.foo.sub", "org.bar.shaded.org.foo.sub"}`.
+ */
+bindingset[package]
+string getAShadedPackage(string package) {
+  result = package
+  or
+  exists(string originalPackage, string shadedPackage, MavenShadeRelocation relocDirective |
+    relocDirective.relocates(originalPackage, shadedPackage)
+  |
+    result = package.regexpReplaceAll("^" + originalPackage, shadedPackage)
+  )
+}