Improve Java audit queries metadata

Author: Alvaro Muñoz

java/src/audit/.gitkeep

@@ -2,8 +2,9 @@
  * @name External dependencies
  * @description Count the number of dependencies that a Java project has on external packages.
  * @kind treemap
- * @id java/external-dependencies
+ * @id githubsecuritylab/external-dependencies
  * @metricType externalDependency
+ * @tags audit
  */
 
 import java

java/src/audit/explore/Dependencies.ql

@@ -1,4 +1,13 @@
+/**
+ * @name Files
+ * @description List of all files in the repository
+ * @kind table
+ * @id githubsecuritylab/files
+ * @tags audit
+ */
+
 import java
-from File f 
+
+from File f
 where f.getExtension() = "java" and not f.getRelativePath().matches("%/src/test/%")
 select f.getRelativePath()

java/src/audit/explore/ExternalAPIsUsedWithUntrustedData.ql

@@ -1,10 +1,8 @@
 /**
  * @name Attack Surface
  * @description Application attack surface
- * @kind problem
- * @precision low
- * @problem.severity error
- * @id seclab/attack-surface
+ * @kind table
+ * @id githubsecuritylab/attack-surface
  * @tags audit
  */
 

java/src/audit/explore/Files.ql

@@ -1,11 +1,9 @@
 /**
  * @name Backwards Partial Dataflow
  * @description Backwards Partial Dataflow
- * @kind problem
- * @precision low
- * @problem.severity error
- * @id seclab/backwards-partial-dataflow
- * @tags audit
+ * @kind table
+ * @id githubsecuritylab/backwards-partial-dataflow
+ * @tags template
  */
 
 import java

java/src/audit/explore/RemoteFlowSources.ql

@@ -4,8 +4,8 @@
  * @kind path-problem
  * @precision low
  * @problem.severity error
- * @id seclab/dataflow-query
- * @tags audit
+ * @id githubsecuritylab/dataflow-query
+ * @tags template
  */
 
 import java

java/src/audit/explore/UntrustedDataToExternalAPI.ql

@@ -1,11 +1,9 @@
 /**
  * @name Forward Partial Dataflow
  * @description Forward Partial Dataflow
- * @kind problem
- * @precision low
- * @problem.severity error
- * @id seclab/forward-partial-dataflow
- * @tags audit
+ * @kind table
+ * @id githubsecuritylab/forward-partial-dataflow
+ * @tags template
  */
 
 import java
@@ -23,13 +21,13 @@ private module MyConfig implements DataFlow::ConfigSig {
     none()
   }
 
-  predicate isSink(DataFlow::Node sink) {
-    none()
-  }
+  predicate isSink(DataFlow::Node sink) { none() }
 }
 
 private module MyFlow = TaintTracking::Global<MyConfig>; // or DataFlow::Global<..>
+
 int explorationLimit() { result = 10 }
+
 private module PartialFlow = MyFlow::FlowExploration<explorationLimit/0>;
 
 from PartialFlow::PartialPathNode n, int dist

java/src/audit/templates/BackwardsPartialDataFlow.ql

@@ -1,21 +1,17 @@
 /**
  * @name Sink Hoisting to method parameter
  * @description Hoist a sink using partial dataflow
- * @kind problem
- * @precision low
- * @problem.severity error
- * @id seclab/sink-hoister
- * @tags audit
+ * @kind table
+ * @id githubsecuritylab/sink-hoister
+ * @tags template
  */
 
 import java
 import semmle.code.java.dataflow.TaintTracking
 import PartialFlow::PartialPathGraph
 
 private module MyConfig implements DataFlow::ConfigSig {
-  predicate isSource(DataFlow::Node source) {
-    none()
-  }
+  predicate isSource(DataFlow::Node source) { none() }
 
   predicate isSink(DataFlow::Node sink) {
     // Define the sink to be hoisted here. Eg:
@@ -29,10 +25,13 @@ private module MyConfig implements DataFlow::ConfigSig {
 }
 
 private module MyFlow = TaintTracking::Global<MyConfig>; // or DataFlow::Global<..>
+
 int explorationLimit() { result = 10 }
+
 private module PartialFlow = MyFlow::FlowExploration<explorationLimit/0>;
 
 from PartialFlow::PartialPathNode n, int dist
-where PartialFlow::partialFlowRev(n, _, dist) and
-   n.getNode() instanceof DataFlow::ExplicitParameterNode
+where
+  PartialFlow::partialFlowRev(n, _, dist) and
+  n.getNode() instanceof DataFlow::ExplicitParameterNode
 select dist, n