[Java] How to generate models automatically ("df-generated")

[intrigus-lgtm]

From different PRs, e.g. #17547 I know that GitHub has different generators to automatically generate models instead of having to manually create models via the model editor.

I've found https://github.com/github/codeql/tree/main/java/ql/automodel/src, but this appears to not be usable without being GitHub staff due to it using internal repositories like https://github.com/github/codeml-automodel.
I'm also not sure whether codeml-automodel is what I'm looking for; I don't think it is.

I'd appreciate if someone could shine some light on whether it is possible as an external user to automatically model dependencies.

EDIT: After searching for "df-generated" (and restricting results to CodeQL), I've found

codeql/shared/mad/codeql/mad/modelgenerator/internal/ModelGeneratorImpl.qll

Line 336 in b622c6e

string getProvenance() { result = "df-generated" }

which brought me to

codeql/java/ql/src/utils/modelgenerator/internal/CaptureModels.qll

Line 19 in b622c6e

private import codeql.mad.modelgenerator.internal.ModelGeneratorImpl

(via searching for ModelGeneratorImpl) which ultimately brought me to this:
https://github.com/github/codeql/tree/b622c6e9cafa4d95f536646a0fea3ee38aee4680/java/ql/src/utils/modelgenerator
However there is no (explicit) documentation.
Given a CodeQL db, how can I generate models for it automatically using the queries in the folder?

[michaelnebel]

Hi @intrigus-lgtm

Yes, we do have such a tool, which is mostly for internal use, but you are more than welcome to use it (feedback is also highly appreciated).
There has been made some recent improvements to the (summary model) generation, which means that "field aware" models are also generated (they have provenance dfc-generated) and the "heuristic" models still have provenance df-generated.
The tool is located in java/ql/src/utils/modelgenerator in the CodeQL repo: https://github.com/github/codeql/blob/main/java/ql/src/utils/modelgenerator/GenerateFlowModel.py

You can use the tool in the following way (it requires that you have python3 installed):

python3 GenerateFlowModel.py --with-mixed-summaries --with-sources --with-sinks <path to db>

The above command generates summaries, but also tries to extrapolate sources and sinks (from existing sources and sink).
Also, there is a built-in help as well

python3 GenerateFlowModel.py --help