fix: reject concrete type args against wildcard pattern

A pattern like `ResponseEntity<?>` previously matched concrete
parameterizations such as `ResponseEntity<String>` because wildcards
were lowered to an unconstrained "any class" matcher at the
type-argument slot. Introduce a dedicated wildcard representation —
`TypeNamePattern.WildcardType` in the query language and
`SerializedTypeNameMatcher.Wildcard` in the serialized matcher — so a
wildcard slot in the pattern matches only a `JIRUnboundWildcard` at the
same slot in code.

Author: misonijnik

core/opentaint-configuration-rules/configuration-rules-jvm/src/main/kotlin/org/opentaint/dataflow/configuration/jvm/SerializedTypeMatching.kt

@@ -30,6 +30,8 @@ fun SerializedTypeNameMatcher.matchType(
     type: JIRType,
     erasedMatch: SerializedTypeNameMatcher.(String) -> Boolean,
 ): Boolean = when {
+    this is SerializedTypeNameMatcher.Wildcard -> type is JIRUnboundWildcard
+
     this is SerializedTypeNameMatcher.ClassPattern && typeArgs.isEmpty() && type is JIRClassType ->
         erasedMatch(type.erasedName()) && type.isRawLike()
 

core/opentaint-configuration-rules/configuration-rules-jvm/src/main/kotlin/org/opentaint/dataflow/configuration/jvm/serialized/SerializedNameMatcher.kt

@@ -24,6 +24,14 @@ sealed interface SerializedTypeNameMatcher {
 
     @Serializable
     data class Array(val element: SerializedTypeNameMatcher) : SerializedTypeNameMatcher
+
+    /**
+     * Matches only an unbounded Java wildcard (`?`) at a type-argument slot.
+     * Distinct from an "any" [ClassPattern] so a pattern like `Foo<?>` does not
+     * match a concrete parameterization like `Foo<String>`.
+     */
+    @Serializable
+    data object Wildcard : SerializedTypeNameMatcher
 }
 
 @Serializable(with = SimpleNameMatcherSerializer::class)

core/opentaint-dataflow-core/opentaint-jvm-dataflow/src/main/kotlin/org/opentaint/dataflow/jvm/ap/ifds/taint/JIRBasicAtomEvaluator.kt

@@ -400,6 +400,9 @@ class JIRBasicAtomEvaluator(
             val nameWithout = name.removeSuffix("[]")
             name != nameWithout && element.matchErasedName(nameWithout)
         }
+        // A wildcard matcher is only meaningful at a type-argument slot; it has
+        // no erased-name projection to compare against a string.
+        is SerializedTypeNameMatcher.Wildcard -> false
     }
 
     private fun ConditionNameMatcher.match(name: String): Boolean = when (this) {

core/opentaint-java-querylang/samples/src/main/java/example/RuleWithWildcardGeneric.java

@@ -32,11 +32,10 @@ public void entrypoint() {
     }
 
     /**
-     * ResponseEntity<String> is a concrete parameterized form. In many
-     * semgrep engines a wildcard <?> is considered to match any concrete
-     * type; keeping this as a Positive documents current engine behavior.
+     * ResponseEntity&lt;String&gt; is a concrete parameterized form and must not
+     * match a wildcard &lt;?&gt; type argument in the rule pattern.
      */
-    final static class PositiveConcreteAlsoMatches extends RuleWithWildcardGeneric {
+    final static class NegativeConcreteDoesNotMatch extends RuleWithWildcardGeneric {
         @Override
         public void entrypoint() {
             String data = "tainted";

core/opentaint-java-querylang/src/main/kotlin/org/opentaint/semgrep/pattern/conversion/ParamCondition.kt

@@ -30,6 +30,16 @@ sealed interface TypeNamePattern {
         override fun toString(): String = "*"
     }
 
+    /**
+     * Java unbounded wildcard `?` as a type argument. Unlike [AnyType], which
+     * is an unconstrained matcher that subsumes any type, [WildcardType] only
+     * matches an unbounded wildcard at the corresponding type-argument slot.
+     */
+    @Serializable
+    data object WildcardType : TypeNamePattern {
+        override fun toString(): String = "?"
+    }
+
     @Serializable
     data class ArrayType(val element: TypeNamePattern) : TypeNamePattern {
         override fun toString(): String = "${element}[]"

core/opentaint-java-querylang/src/main/kotlin/org/opentaint/semgrep/pattern/conversion/PatternToActionListConverter.kt

@@ -219,7 +219,7 @@ class PatternToActionListConverter: ActionListBuilder {
             val elementTypePattern = transformTypeName(typeName.elementType)
             TypeNamePattern.ArrayType(elementTypePattern)
         }
-        is TypeName.WildcardTypeName -> TypeNamePattern.AnyType
+        is TypeName.WildcardTypeName -> TypeNamePattern.WildcardType
     }
 
     private fun transformSimpleTypeName(typeName: TypeName.SimpleTypeName): TypeNamePattern {

core/opentaint-java-querylang/src/main/kotlin/org/opentaint/semgrep/pattern/conversion/taint/AutomataToTaintRuleConversion.kt

@@ -628,6 +628,10 @@ private fun TaintRuleGenerationCtx.evaluateFormulaSignature(
             is Pattern -> {
                 TODO("Signature class name pattern")
             }
+
+            is SerializedTypeNameMatcher.Wildcard -> {
+                TODO("Signature class is a wildcard")
+            }
         }
 
         builders.mapTo(buildersWithClass) { builder ->
@@ -899,6 +903,10 @@ private fun TaintRuleGenerationCtx.typeMatcher(
 
         is TypeNamePattern.AnyType -> null
 
+        is TypeNamePattern.WildcardType -> MetaVarConstraintFormula.Constraint(
+            SerializedTypeNameMatcher.Wildcard
+        )
+
         is TypeNamePattern.MetaVar -> {
             val constraints = metaVarInfo.constraints[typeName.metaVar]
             val constraint = when (constraints) {

core/opentaint-java-querylang/src/main/kotlin/org/opentaint/semgrep/pattern/conversion/taint/MethodFormulaSimplifier.kt

@@ -794,13 +794,18 @@ private fun unifyTypeName(
     when (left) {
         TypeNamePattern.AnyType -> return right
 
+        // WildcardType only unifies with itself (already handled by the
+        // `left == right` short-circuit above). Anything else is incompatible.
+        TypeNamePattern.WildcardType -> return null
+
         is TypeNamePattern.PrimitiveName -> return null
 
         is TypeNamePattern.ClassName -> when (right) {
             TypeNamePattern.AnyType -> return left
 
             is TypeNamePattern.ArrayType,
-            is TypeNamePattern.PrimitiveName -> return null
+            is TypeNamePattern.PrimitiveName,
+            TypeNamePattern.WildcardType -> return null
 
             is TypeNamePattern.ClassName -> {
                 if (left.name != right.name) return null
@@ -826,7 +831,8 @@ private fun unifyTypeName(
             TypeNamePattern.AnyType -> return left
 
             is TypeNamePattern.ArrayType,
-            is TypeNamePattern.PrimitiveName -> return null
+            is TypeNamePattern.PrimitiveName,
+            TypeNamePattern.WildcardType -> return null
 
             is TypeNamePattern.ClassName -> {
                 if (left.name.endsWith(right.name)) {
@@ -853,7 +859,8 @@ private fun unifyTypeName(
             TypeNamePattern.AnyType -> return left
 
             is TypeNamePattern.ArrayType,
-            is TypeNamePattern.PrimitiveName -> return null
+            is TypeNamePattern.PrimitiveName,
+            TypeNamePattern.WildcardType -> return null
 
             is TypeNamePattern.ClassName -> {
                 if (!stringMatches(right.name, metaVarInfo.metaVarConstraints[left.metaVar])) return null
@@ -885,7 +892,8 @@ private fun unifyTypeName(
             is TypeNamePattern.ClassName,
             is TypeNamePattern.FullyQualified,
             is TypeNamePattern.MetaVar,
-            is TypeNamePattern.PrimitiveName -> return null
+            is TypeNamePattern.PrimitiveName,
+            TypeNamePattern.WildcardType -> return null
         }
     }
 }

core/opentaint-java-querylang/src/main/kotlin/org/opentaint/semgrep/pattern/conversion/taint/TaintAutomataGeneration.kt

@@ -995,7 +995,8 @@ private fun EdgeCondition.isDummyCondition(metaVarInfo: ResolvedMetaVarInfo): Bo
             is TypeNamePattern.ArrayType,
             is TypeNamePattern.ClassName,
             is TypeNamePattern.FullyQualified,
-            is TypeNamePattern.PrimitiveName -> return false
+            is TypeNamePattern.PrimitiveName,
+            TypeNamePattern.WildcardType -> return false
         }
     }
 

core/opentaint-java-querylang/src/main/kotlin/org/opentaint/semgrep/pattern/conversion/taint/TaintEdgesGeneration.kt

@@ -363,6 +363,7 @@ private fun MetaVarCtx.typeNameMetaVars(typeName: TypeNamePattern, metaVars: Bit
         }
 
         TypeNamePattern.AnyType,
+        TypeNamePattern.WildcardType,
         is TypeNamePattern.PrimitiveName -> {
             // no metavars
         }