Java: Add MaDs for java.crypto.KDF

[IdrissRio]

Updates Java MaDs forjava.crypto.KDF.

Java Docs - KDF: https://docs.oracle.com/en/java/javase/24/docs/api/java.base/javax/crypto/KDF.html
Java Docs - HKDFParameterSpec: https://docs.oracle.com/en/java/javase/24/docs/api/java.base/javax/crypto/spec/HKDFParameterSpec.html

Java release note: https://jdk.java.net/25/release-notes#510

[github-actions]

⚠️ The head of this PR and the base branch were compared for differences in the framework coverage reports. The generated reports are available in the artifacts of this workflow run. The differences will be picked up by the nightly job after the PR gets merged.

Click to show differences in coverage

java

Generated file changes for java

• Changes to framework-coverage-java.rst:

-    Java extensions,"``javax.*``, ``jakarta.*``",87,4159,90,10,4,2,1,1,4
+    Java extensions,"``javax.*``, ``jakarta.*``",87,4185,90,10,4,2,1,1,4
-    Totals,,330,26328,2656,404,16,128,33,1,409
+    Totals,,330,26354,2656,404,16,128,33,1,409

• Changes to framework-coverage-java.csv:

- javax.crypto,19,,114,,,12,3,,2,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,61,53
+ javax.crypto,19,,140,,,12,3,,2,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,76,64

[Copilot]

Pull Request Overview

This PR adds Model as Data (MaD) support for the java.crypto.KDF API, enabling taint tracking through Key Derivation Function operations. The changes include comprehensive taint flow models for KDF operations and HKDF parameter specifications.

• Adds taint flow models for javax.crypto.KDF class methods
• Adds taint flow models for javax.crypto.spec.HKDFParameterSpec and its builder pattern
• Includes comprehensive test coverage for various KDF usage patterns

Reviewed Changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
java/ql/lib/ext/javax.crypto.model.yml	Adds summary models for KDF class methods including deriveKey and deriveData
java/ql/lib/ext/javax.crypto.spec.model.yml	Adds taint flow models for HKDF parameter specification builder methods and constructors
java/ql/test/library-tests/dataflow/kdf/test.ql	Test query for verifying taint flow through KDF operations
java/ql/test/library-tests/dataflow/kdf/KDFDataflowTest.java	Comprehensive test cases covering various KDF usage patterns
java/ql/test/library-tests/dataflow/kdf/options	Compilation options enabling Java 25 preview features
java/ql/lib/change-notes/2025-09-02-kdf-api.md	Release notes documenting the new KDF taint flow support

[aschackmull]

This line looks suspicious. It suggests that getProvider() is implemented as return this. Should this have been a taint model rather than a value-preserving step?