Fix isImplicitInit; use it in empty-container query

smowton · smowton · commit 9035ba1f30e5 · 2023-11-30T11:24:01.000Z
diff --git a/java/ql/lib/semmle/code/java/Expr.qll b/java/ql/lib/semmle/code/java/Expr.qll
@@ -1657,22 +1657,41 @@ class LocalVariableDeclExpr extends Expr, @localvariabledeclexpr {
 
   /**
    * Gets the switch statement or expression whose pattern declares this identifier, if any.
-   *
-   * Note this only applies to a direct binding pattern, such as `case T t`, not a record pattern.
    */
-  StmtParent getAssociatedSwitch() { result = this.getParent().(PatternCase).getParent() }
+  StmtParent getAssociatedSwitch() {
+    exists(PatternCase pc |
+      pc = result.(SwitchStmt).getAPatternCase()
+      or
+      pc = result.(SwitchExpr).getAPatternCase()
+    |
+      this = pc.getPattern().getAChildExpr*()
+    )
+  }
 
   /** Holds if this is a declaration stemming from a pattern switch case. */
   predicate hasAssociatedSwitch() { exists(this.getAssociatedSwitch()) }
 
+  /**
+   * Gets the instanceof expression whose pattern declares this identifier, if any.
+   */
+  InstanceOfExpr getAssociatedInstanceOfExpr() {
+    result.getPattern().getAChildExpr*() = this
+  }
+
+  /** Holds f this is a declaration stemming from a pattern instanceof expression. */
+  predicate hasAssociatedInstanceOfExpr() {
+    exists(this.getAssociatedInstanceOfExpr())
+  }
+
   /** Gets the initializer expression of this local variable declaration expression, if any. */
   Expr getInit() { result.isNthChildOf(this, 0) }
 
   /** Holds if this variable declaration implicitly initializes the variable. */
   predicate hasImplicitInit() {
     exists(CatchClause cc | cc.getVariable() = this) or
     exists(EnhancedForStmt efs | efs.getVariable() = this) or
-    this.hasAssociatedSwitch()
+    this.hasAssociatedSwitch() or
+    this.hasAssociatedInstanceOfExpr()
   }
 
   /** Gets a printable representation of this expression. */
diff --git a/java/ql/src/Likely Bugs/Collections/ReadOnlyContainer.ql b/java/ql/src/Likely Bugs/Collections/ReadOnlyContainer.ql
@@ -40,6 +40,6 @@ where
   ) and
   // Also, any value that `v` is initialized to is a fresh container,
   forall(Expr e | e = v.getAnAssignedValue() | e instanceof FreshContainer) and
-  // and `v` is not implicitly initialized by a for-each loop.
-  not exists(EnhancedForStmt efs | efs.getVariable().getVariable() = v)
+  // and `v` is not implicitly initialized.
+  not v.(LocalVariableDecl).getDeclExpr().hasImplicitInit()
 select v, "The contents of this container are never initialized."
