Swift: Create ArgumentNodes and OutNodes for MaD.

MathiasVP · MathiasVP · commit 9d069b32b0e6 · 2022-10-06T10:29:59.000+01:00
diff --git a/swift/ql/lib/codeql/swift/dataflow/internal/DataFlowDispatch.qll b/swift/ql/lib/codeql/swift/dataflow/internal/DataFlowDispatch.qll
@@ -229,7 +229,9 @@ class SummaryCall extends DataFlowCall, TSummaryCall {
 cached
 private module Cached {
   cached
-  newtype TDataFlowCallable = TDataFlowFunc(CfgScope scope)
+  newtype TDataFlowCallable =
+    TDataFlowFunc(CfgScope scope) or
+    TSummarizedCallable(FlowSummary::SummarizedCallable c)
 
   /** Gets a viable run-time target for the call `call`. */
   cached
@@ -241,6 +243,8 @@ private module Cached {
     result = TDataFlowFunc(call.(PropertySetterCall).getAccessorDecl())
     or
     result = TDataFlowFunc(call.(PropertyObserverCall).getAccessorDecl())
+    or
+    result = TSummarizedCallable(call.asCall().getStaticTarget())
   }
 
   cached
diff --git a/swift/ql/lib/codeql/swift/dataflow/internal/DataFlowPrivate.qll b/swift/ql/lib/codeql/swift/dataflow/internal/DataFlowPrivate.qll
@@ -340,6 +340,14 @@ private module ArgumentNodes {
       )
     }
   }
+
+  class SummaryArgumentNode extends SummaryNode, ArgumentNode {
+    SummaryArgumentNode() { FlowSummaryImpl::Private::summaryArgumentNode(_, this, _) }
+
+    override predicate argumentOf(DataFlowCall call, ArgumentPosition pos) {
+      FlowSummaryImpl::Private::summaryArgumentNode(call, this, pos)
+    }
+  }
 }
 
 import ArgumentNodes
@@ -410,6 +418,12 @@ private module OutNodes {
     }
   }
 
+  class SummaryOutNode extends OutNode, SummaryNode {
+    override DataFlowCall getCall(ReturnKind kind) {
+      FlowSummaryImpl::Private::summaryOutNode(result, this, kind)
+    }
+  }
+
   class InOutUpdateArgNode extends OutNode, ExprPostUpdateNode {
     Argument arg;
 
@@ -596,6 +610,9 @@ predicate lambdaCreation(Node creation, LambdaCallKind kind, DataFlowCallable c)
 predicate lambdaCall(DataFlowCall call, LambdaCallKind kind, Node receiver) {
   kind = TLambdaCallKind() and
   receiver.asExpr() = call.asCall().getExpr().(ApplyExpr).getFunction()
+  or
+  kind = TLambdaCallKind() and
+  receiver = call.(SummaryCall).getReceiver()
 }
 
 /** Extra data-flow steps needed for lambda flow analysis. */

Original file line number	Diff line number	Diff line change
`@@ -340,6 +340,14 @@ private module ArgumentNodes {`
`340`	`340`	`)`
`341`	`341`	`}`
`342`	`342`	`}`
	`343`	`+`
	`344`	`+ class SummaryArgumentNode extends SummaryNode, ArgumentNode {`
	`345`	`+ SummaryArgumentNode() { FlowSummaryImpl::Private::summaryArgumentNode(_, this, _) }`
	`346`	`+`
	`347`	`+ override predicate argumentOf(DataFlowCall call, ArgumentPosition pos) {`
	`348`	`+ FlowSummaryImpl::Private::summaryArgumentNode(call, this, pos)`
	`349`	`+ }`
	`350`	`+ }`
`343`	`351`	`}`
`344`	`352`
`345`	`353`	`import ArgumentNodes`
`@@ -410,6 +418,12 @@ private module OutNodes {`
`410`	`418`	`}`
`411`	`419`	`}`
`412`	`420`
	`421`	`+ class SummaryOutNode extends OutNode, SummaryNode {`
	`422`	`+ override DataFlowCall getCall(ReturnKind kind) {`
	`423`	`+ FlowSummaryImpl::Private::summaryOutNode(result, this, kind)`
	`424`	`+ }`
	`425`	`+ }`
	`426`	`+`
`413`	`427`	`class InOutUpdateArgNode extends OutNode, ExprPostUpdateNode {`
`414`	`428`	`Argument arg;`
`415`	`429`
`@@ -596,6 +610,9 @@ predicate lambdaCreation(Node creation, LambdaCallKind kind, DataFlowCallable c)`
`596`	`610`	`predicate lambdaCall(DataFlowCall call, LambdaCallKind kind, Node receiver) {`
`597`	`611`	`kind = TLambdaCallKind() and`
`598`	`612`	`receiver.asExpr() = call.asCall().getExpr().(ApplyExpr).getFunction()`
	`613`	`+ or`
	`614`	`+ kind = TLambdaCallKind() and`
	`615`	`+ receiver = call.(SummaryCall).getReceiver()`
`599`	`616`	`}`
`600`	`617`
`601`	`618`	`/** Extra data-flow steps needed for lambda flow analysis. */`