Unified: Add flow through calls (static calls only)

unified/extractor/src/languages/swift/swift.rs

@@ -596,26 +596,31 @@ fn translation_rules() -> Vec<Rule<SwiftContext>> {
         ),
         // A function parameter. With two names (`firstName`+`secondName`) the
         // first is the external argument label and the second the internal name;
-        // with one name it is just the internal name. The declared type is
-        // emitted; the default value is optional.
+        // with one name it is both the external and internal name.
         rule!(
             (functionParameter
                 firstName: @@first
-                secondName: _? @@second
+                secondName: @@second
                 type: @ty
                 defaultValue: (initializerClause value: @val)?)
             =>
-            parameter {
-                let (external, name) = match second {
-                    Some(second) => (Some(tree!((identifier #{first}))), second),
-                    None => (None, first),
-                };
-                tree!((parameter
-                    external_name_node: {external}
-                    pattern: (identifier #{name})
-                    type: {ty}
-                    default: {val}))
-            }
+            (parameter
+                external_name_node: (identifier #{first})
+                pattern: (identifier #{second})
+                type: {ty}
+                default: {val})
+        ),
+        rule!(
+            (functionParameter
+                firstName: @@first
+                type: @ty
+                defaultValue: (initializerClause value: @val)?)
+            =>
+            (parameter
+                external_name_node: (identifier #{first}) // duplicate the parameter name
+                pattern: (identifier #{first})
+                type: {ty}
+                default: {val})
         ),
         // Swift's `[T](...)` array-type constructor syntax is parsed as a call
         // whose callee is an `arrayExpr` containing `T`. For a generic `T`,

unified/extractor/tests/corpus/swift/functions/function-with-default-parameter-value.output

@@ -68,7 +68,8 @@ top_level source="⟨body⟩"
         function_declaration source="⟨body⟩⟨name_node⟩⟨parameter⟩"
           name_node: identifier "greet" source="greet"
           parameter:
-            parameter source="⟨pattern⟩: ⟨type⟩ = ⟨default⟩"
+            parameter source="⟨external_name_node⟩⟨pattern⟩: ⟨type⟩ = ⟨default⟩"
+              external_name_node: identifier "name" source="name"
               type: identifier "String" source="String"
               pattern: identifier "name" source="name"
               default: string_literal "\"world\"" source="\"world\""

unified/extractor/tests/corpus/swift/types/class-with-initializer.output

@@ -100,7 +100,8 @@ top_level source="⟨body⟩"
               type: identifier "Int" source="Int"
             constructor_declaration source="⟨body⟩⟨parameter⟩"
               parameter:
-                parameter source="⟨pattern⟩: ⟨type⟩"
+                parameter source="⟨external_name_node⟩⟨pattern⟩: ⟨type⟩"
+                  external_name_node: identifier "x" source="x"
                   type: identifier "Int" source="Int"
                   pattern: identifier "x" source="x"
               body:

unified/ql/consistency-queries/DataFlowConsistency.ql

@@ -2,7 +2,11 @@ private import unified
 private import codeql.unified.internal.dataflow.AllDataFlow
 private import codeql.dataflow.internal.DataFlowImplConsistency
 
-module ConsistencyInput implements InputSig<Location, DataFlowInput> { }
+module ConsistencyInput implements InputSig<Location, DataFlowInput> {
+  predicate argHasPostUpdateExclude(DataFlowInput::ArgumentNode n) {
+    not exists(n.getBasicBlock()) // ignore unreachable data flow nodes
+  }
+}
 
 module ConsistencyOutput =
   MakeConsistency<Location, DataFlowInput, TaintTrackingInput, ConsistencyInput>;

unified/ql/lib/codeql/unified/internal/AnalysisQuality.qll

@@ -1,6 +1,9 @@
 private import unified
 private import codeql.util.ReportStats
 private import codeql.unified.internal.NameBinding
+private import codeql.unified.internal.dataflow.DataFlowCall
+private import codeql.unified.internal.dataflow.DataFlowCallable
+private import codeql.unified.internal.dataflow.CallGraph
 
 /** Stats about name nodes that static name binding could resolve. */
 module StaticNameResolutionStats implements EntityStatsSig {
@@ -87,3 +90,19 @@ module FilesCoveredByModuleManifestStats implements EntityStatsSig {
 
 module FilesCoveredByModuleManifestStatsReport =
   EntityReportStats<FilesCoveredByModuleManifestStats>;
+
+module CallGraphStats implements EntityStatsSig {
+  class Candidate extends CallExpr {
+    DataFlowCall getDataFlowCall() { result.asExplicitCall() = this }
+
+    DataFlowCallable getTarget() { result = viableCallable(this.getDataFlowCall()) }
+
+    predicate isOk() { exists(this.getTarget()) }
+  }
+
+  string getOkText() { result = "calls with call target" }
+
+  string getNotOkText() { result = "calls with missing call target" }
+}
+
+module CallGraphStatsReport = EntityReportStats<CallGraphStats>;

unified/ql/lib/codeql/unified/internal/FacadeAst.qll

@@ -117,6 +117,19 @@ module Unified {
   class Argument extends G::Argument {
     /** Gets the name of this argument. */
     string getName() { result = this.getNameNode().getValue() }
+
+    /** Holds if this is a positional argument. */
+    predicate isPositional() { not exists(this.getName()) }
+
+    /** Gets the 0-based index of this argument among the positional arguments in the surrounding call or tuple. */
+    int getPositionalIndex() {
+      this =
+        rank[result + 1](Argument a |
+          a.getParent() = this.getParent() and a.isPositional()
+        |
+          a order by a.getParentIndex()
+        )
+    }
   }
 
   class AssociatedTypeDeclaration extends G::AssociatedTypeDeclaration {
@@ -172,8 +185,28 @@ module Unified {
   }
 
   class Parameter extends G::Parameter {
-    /** Gets the external name of this parameter. */
-    string getExternalName() { result = this.getExternalNameNode().getValue() }
+    /**
+     * Gets the external name of this parameter.
+     *
+     * Has no result for pseudo-names like `_` that indicate that this is actually a positional parameter.
+     */
+    string getExternalName() { result = this.getExternalNameNode().getValue() and not result = "_" }
+
+    /** Gets the callable on which this parameter appears. */
+    Callable getDeclaringCallable() { result = this.getParent() }
+
+    /** Holds if this is a positional parameter. */
+    predicate isPositional() { not exists(this.getExternalName()) }
+
+    /** Gets the 0-based index of this parameter among the positional parameters of the declaring callable. */
+    int getPositionalIndex() {
+      this =
+        rank[result + 1](Parameter p |
+          p.getDeclaringCallable() = this.getDeclaringCallable() and p.isPositional()
+        |
+          p order by p.getParentIndex()
+        )
+    }
   }
 
   class TypeAliasDeclaration extends G::TypeAliasDeclaration {

unified/ql/lib/codeql/unified/internal/LocalNameBinding.qll

@@ -474,3 +474,11 @@ class PotentialLocalNameAccess extends IdentifierExpr {
   /** Holds if this is one of the binding sites for a name, such as the `x` in `let x = 123`. */
   predicate isBindingSite() { this instanceof NameBinding }
 }
+
+/** Gets implicitly-declared variable through which the given callable refers to its receiver. */
+LocalVariable getImplicitReceiverVariable(Callable callable) {
+  exists(string name |
+    name = any(NameBindingPlugin p).getImplicitReceiverParameterName(callable) and
+    result.(LocalNameBindingOutput::ImplicitLocal).hasNameAndScope(name, callable)
+  )
+}

unified/ql/lib/codeql/unified/internal/dataflow/AllDataFlow.qll

@@ -1,11 +1,15 @@
 /** Re-exports all the files in the internal dataflow folder (except DataFlowPublic). */
 
+import CallGraph
 import Content
+import DataFlowCall
+import DataFlowCallable
 import DataFlowGraph
 import DataFlowInstantiation
 import DataFlowNode
 import DataFlowPlugin
-import Step
 import LocalSsa
+import ParameterPositions
+import Step
 import TaintTrackingInstantiation
 import VariableRefKind

unified/ql/lib/codeql/unified/internal/dataflow/CallGraph.qll

@@ -0,0 +1,16 @@
+private import unified
+private import AllDataFlow
+private import codeql.unified.internal.NameBinding as N
+
+private Callable getCallableFromNameBinding(NameBinding binding) {
+  binding = result.(FunctionDeclaration).getNameNode()
+}
+
+DataFlowCallable viableCallable(DataFlowCall c) {
+  exists(CallExpr call, Callable callable, NameBinding target |
+    c.asExplicitCall() = call and
+    target = N::getStaticBindingTarget(N::getIdentifierFromRef(call.getCallee())) and
+    callable = getCallableFromNameBinding(target) and
+    result.asSourceCallable() = callable
+  )
+}

unified/ql/lib/codeql/unified/internal/dataflow/DataFlowCall.qll

@@ -0,0 +1,30 @@
+private import unified
+private import AllDataFlow
+private import codeql.unified.internal.ExprPositions
+
+private newtype TDataFlowCall =
+  TExplicitCall(CallExpr call) {
+    not isInBindingContext(call, _) // ignore constructor patterns
+  }
+
+/**
+ * A call site, covering both explicit calls such as `foo(1,2)`, as well an implicit
+ * calls and calls derived from library models.
+ *
+ * Currently only explicit calls are implemented.
+ */
+class DataFlowCall extends TDataFlowCall {
+  /** Gets the `CallExpr` wrapped by this dataflow call, if any. */
+  CallExpr asExplicitCall() { this = TExplicitCall(result) }
+
+  /** Gets a string representation of this call. */
+  string toString() { result = this.asExplicitCall().toString() }
+
+  /** Gets the location of this call, if any. */
+  Location getLocation() { result = this.asExplicitCall().getLocation() }
+
+  /** Gets the callable containing this call. */
+  DataFlowCallable getEnclosingCallable() {
+    result.asSourceCallable() = this.asExplicitCall().getEnclosingCallable()
+  }
+}

unified/ql/lib/codeql/unified/internal/dataflow/DataFlowCallable.qll

@@ -0,0 +1,21 @@
+private import unified
+private import AllDataFlow
+
+private newtype TDataFlowCallable = TSourceCallable(Callable callable)
+
+/**
+ * A callable entity, either an function-like entity in the source code,
+ * an entity derived from a library model.
+ *
+ * Currently only callables in source code are implemented.
+ */
+class DataFlowCallable extends TDataFlowCallable {
+  /** Gets the `Callable` wrapped by this dataflow callable, if any. */
+  Callable asSourceCallable() { this = TSourceCallable(result) }
+
+  /** Gets a string representation of this call. */
+  string toString() { result = this.asSourceCallable().toString() }
+
+  /** Gets the location of this call, if any. */
+  Location getLocation() { result = this.asSourceCallable().getLocation() }
+}

unified/ql/lib/codeql/unified/internal/dataflow/DataFlowGraph.qll

@@ -1,9 +1,38 @@
 private import unified
 private import AllDataFlow
+private import codeql.unified.internal.LocalNameBinding
 
 predicate step(Node node1, Step step, Node node2) {
   any(DataFlowPlugin p).step(node1, step, node2)
   or
+  exists(Callable callable |
+    node1.isReceiverParameter(callable) and
+    step.value() and
+    node2.isLocalVariableWrite(callable, getImplicitReceiverVariable(callable))
+  )
+  or
+  exists(CallExpr call, Expr receiverExpr |
+    receiverExpr = call.getCallee().(MemberAccessExpr).getBase()
+  |
+    node1.isResultValue(receiverExpr) and
+    step.value() and
+    node2.isReceiverArgument(call)
+    or
+    node1.isReceiverPostUpdate(call) and
+    step.value() and
+    node2.isPostUpdate(receiverExpr)
+  )
+  or
+  exists(CallExpr call, UnqualifiedMemberAccess callee | callee = call.getCallee() |
+    node1.isLocalVariableRead(callee, callee.getImplicitQualifierVariable()) and
+    step.value() and
+    node2.isReceiverArgument(call)
+    or
+    node1.isReceiverPostUpdate(call) and
+    step.value() and
+    node2.isLocalVariablePostUpdate(callee, callee.getImplicitQualifierVariable())
+  )
+  or
   exists(VariableDeclaration decl |
     node1.isResultValue(decl.getValue()) and
     step.value() and