Java: replace the dead String.valueOf(CharSequence) summary with a synthetic callable - #22315

java.lang.String has no valueOf(CharSequence) overload — string- and CharSequence-typed arguments compile to valueOf(Object), which is modelled as neutral. The summary row therefore matched no call site, leaving no propagating valueOf model for string-typed arguments:

String data = req.getParameter("cmd");  // source
String s1 = String.valueOf(data);       // taint lost: resolves to valueOf(Object)
Runtime.getRuntime().exec(s1);          // sink, not reported

Changes

• java/ql/lib/ext/java.lang.model.yml: removed the ["java.lang", "String", False, "valueOf", "(CharSequence)", ...] row, which matched nothing.
• java/ql/lib/semmle/code/java/frameworks/Strings.qll (new): a SyntheticCallable that propagates taint Argument[0] → ReturnValue for String.valueOf(Object) calls whose argument's static type is a CharSequence (String, CharSequence, StringBuilder, …), where the call is equivalent to the documented CharSequence.toString(). Registered in the SyntheticCallables module in FlowSummary.qll.
• The valueOf(Object) neutral model is kept, so arguments of arbitrary types — whose toString() may not expose tainted state — remain unaffected.
• Tests: java/ql/test/library-tests/dataflow/string-valueof covers String, CharSequence, StringBuilder, char[] and char arguments (flow expected) and an Object-typed argument (no flow expected). Change note added.

• Fixes java.lang.String: the valueOf(CharSequence) summary row matches no call site, leaving no propagating valueOf model for a string-typed argument #22295