Java: Disregard heap parameter in any-argument and any-parameter specs.

aschackmull · aschackmull · commit a23e77ca580c · 2023-08-03T10:04:05.000+02:00
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/FlowSummaryImpl.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/FlowSummaryImpl.qll
@@ -1222,14 +1222,18 @@ module Private {
           node.asNode().(PostUpdateNode).getPreUpdateNode().(ArgNode).argumentOf(mid.asCall(), apos) and
           parameterMatch(ppos, apos)
         |
-          c = "Argument" or parseArg(c, ppos)
+          c = "Argument" and not heapParameter(ppos)
+          or
+          parseArg(c, ppos)
         )
         or
         exists(ArgumentPosition apos, ParameterPosition ppos |
           node.asNode().(ParamNode).isParameterOf(mid.asCallable(), ppos) and
           parameterMatch(ppos, apos)
         |
-          c = "Parameter" or parseParam(c, apos)
+          c = "Parameter" and not heapParameter(ppos)
+          or
+          parseParam(c, apos)
         )
         or
         c = "ReturnValue" and
@@ -1259,7 +1263,9 @@ module Private {
           node.asNode().(ArgNode).argumentOf(mid.asCall(), apos) and
           parameterMatch(ppos, apos)
         |
-          c = "Argument" or parseArg(c, ppos)
+          c = "Argument" and not heapParameter(ppos)
+          or
+          parseArg(c, ppos)
         )
         or
         exists(ReturnNodeExt ret |
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/FlowSummaryImplSpecific.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/FlowSummaryImplSpecific.qll
@@ -300,6 +300,12 @@ predicate interpretInputSpecific(string c, InterpretNode mid, InterpretNode n) {
   )
 }
 
+/**
+ * Holds if `pos` is the position of the `heap` parameter, and thus should not
+ * be included by models that specify "any argument" or "any parameter".
+ */
+predicate heapParameter(ParameterPosition pos) { none() }
+
 /** Gets the argument position obtained by parsing `X` in `Parameter[X]`. */
 bindingset[s]
 ArgumentPosition parseParamBody(string s) {
diff --git a/go/ql/lib/semmle/go/dataflow/internal/FlowSummaryImpl.qll b/go/ql/lib/semmle/go/dataflow/internal/FlowSummaryImpl.qll
@@ -1222,14 +1222,18 @@ module Private {
           node.asNode().(PostUpdateNode).getPreUpdateNode().(ArgNode).argumentOf(mid.asCall(), apos) and
           parameterMatch(ppos, apos)
         |
-          c = "Argument" or parseArg(c, ppos)
+          c = "Argument" and not heapParameter(ppos)
+          or
+          parseArg(c, ppos)
         )
         or
         exists(ArgumentPosition apos, ParameterPosition ppos |
           node.asNode().(ParamNode).isParameterOf(mid.asCallable(), ppos) and
           parameterMatch(ppos, apos)
         |
-          c = "Parameter" or parseParam(c, apos)
+          c = "Parameter" and not heapParameter(ppos)
+          or
+          parseParam(c, apos)
         )
         or
         c = "ReturnValue" and
@@ -1259,7 +1263,9 @@ module Private {
           node.asNode().(ArgNode).argumentOf(mid.asCall(), apos) and
           parameterMatch(ppos, apos)
         |
-          c = "Argument" or parseArg(c, ppos)
+          c = "Argument" and not heapParameter(ppos)
+          or
+          parseArg(c, ppos)
         )
         or
         exists(ReturnNodeExt ret |
diff --git a/go/ql/lib/semmle/go/dataflow/internal/FlowSummaryImplSpecific.qll b/go/ql/lib/semmle/go/dataflow/internal/FlowSummaryImplSpecific.qll
@@ -251,6 +251,12 @@ predicate interpretInputSpecific(string c, InterpretNode mid, InterpretNode n) {
   )
 }
 
+/**
+ * Holds if `pos` is the position of the `heap` parameter, and thus should not
+ * be included by models that specify "any argument" or "any parameter".
+ */
+predicate heapParameter(ParameterPosition pos) { none() }
+
 /**
  * Holds if specification component `c` parses as return value `n` or a range
  * containing `n`.
diff --git a/java/ql/lib/semmle/code/java/dataflow/internal/FlowSummaryImpl.qll b/java/ql/lib/semmle/code/java/dataflow/internal/FlowSummaryImpl.qll
@@ -1222,14 +1222,18 @@ module Private {
           node.asNode().(PostUpdateNode).getPreUpdateNode().(ArgNode).argumentOf(mid.asCall(), apos) and
           parameterMatch(ppos, apos)
         |
-          c = "Argument" or parseArg(c, ppos)
+          c = "Argument" and not heapParameter(ppos)
+          or
+          parseArg(c, ppos)
         )
         or
         exists(ArgumentPosition apos, ParameterPosition ppos |
           node.asNode().(ParamNode).isParameterOf(mid.asCallable(), ppos) and
           parameterMatch(ppos, apos)
         |
-          c = "Parameter" or parseParam(c, apos)
+          c = "Parameter" and not heapParameter(ppos)
+          or
+          parseParam(c, apos)
         )
         or
         c = "ReturnValue" and
@@ -1259,7 +1263,9 @@ module Private {
           node.asNode().(ArgNode).argumentOf(mid.asCall(), apos) and
           parameterMatch(ppos, apos)
         |
-          c = "Argument" or parseArg(c, ppos)
+          c = "Argument" and not heapParameter(ppos)
+          or
+          parseArg(c, ppos)
         )
         or
         exists(ReturnNodeExt ret |
diff --git a/java/ql/lib/semmle/code/java/dataflow/internal/FlowSummaryImplSpecific.qll b/java/ql/lib/semmle/code/java/dataflow/internal/FlowSummaryImplSpecific.qll
@@ -319,6 +319,12 @@ predicate interpretInputSpecific(string c, InterpretNode mid, InterpretNode n) {
   )
 }
 
+/**
+ * Holds if `pos` is the position of the `heap` parameter, and thus should not
+ * be included by models that specify "any argument" or "any parameter".
+ */
+predicate heapParameter(ParameterPosition pos) { pos = -2 }
+
 /** Gets the argument position obtained by parsing `X` in `Parameter[X]`. */
 bindingset[s]
 ArgumentPosition parseParamBody(string s) {
diff --git a/python/ql/lib/semmle/python/dataflow/new/internal/FlowSummaryImpl.qll b/python/ql/lib/semmle/python/dataflow/new/internal/FlowSummaryImpl.qll
@@ -1222,14 +1222,18 @@ module Private {
           node.asNode().(PostUpdateNode).getPreUpdateNode().(ArgNode).argumentOf(mid.asCall(), apos) and
           parameterMatch(ppos, apos)
         |
-          c = "Argument" or parseArg(c, ppos)
+          c = "Argument" and not heapParameter(ppos)
+          or
+          parseArg(c, ppos)
         )
         or
         exists(ArgumentPosition apos, ParameterPosition ppos |
           node.asNode().(ParamNode).isParameterOf(mid.asCallable(), ppos) and
           parameterMatch(ppos, apos)
         |
-          c = "Parameter" or parseParam(c, apos)
+          c = "Parameter" and not heapParameter(ppos)
+          or
+          parseParam(c, apos)
         )
         or
         c = "ReturnValue" and
@@ -1259,7 +1263,9 @@ module Private {
           node.asNode().(ArgNode).argumentOf(mid.asCall(), apos) and
           parameterMatch(ppos, apos)
         |
-          c = "Argument" or parseArg(c, ppos)
+          c = "Argument" and not heapParameter(ppos)
+          or
+          parseArg(c, ppos)
         )
         or
         exists(ReturnNodeExt ret |
diff --git a/python/ql/lib/semmle/python/dataflow/new/internal/FlowSummaryImplSpecific.qll b/python/ql/lib/semmle/python/dataflow/new/internal/FlowSummaryImplSpecific.qll
@@ -241,6 +241,12 @@ private module UnusedSourceSinkInterpretation {
 
   /** Provides additional source specification logic. */
   predicate interpretInputSpecific(string c, InterpretNode mid, InterpretNode node) { none() }
+
+  /**
+   * Holds if `pos` is the position of the `heap` parameter, and thus should not
+   * be included by models that specify "any argument" or "any parameter".
+   */
+  predicate heapParameter(ParameterPosition pos) { none() }
 }
 
 import UnusedSourceSinkInterpretation
diff --git a/ruby/ql/lib/codeql/ruby/dataflow/internal/FlowSummaryImpl.qll b/ruby/ql/lib/codeql/ruby/dataflow/internal/FlowSummaryImpl.qll
@@ -1222,14 +1222,18 @@ module Private {
           node.asNode().(PostUpdateNode).getPreUpdateNode().(ArgNode).argumentOf(mid.asCall(), apos) and
           parameterMatch(ppos, apos)
         |
-          c = "Argument" or parseArg(c, ppos)
+          c = "Argument" and not heapParameter(ppos)
+          or
+          parseArg(c, ppos)
         )
         or
         exists(ArgumentPosition apos, ParameterPosition ppos |
           node.asNode().(ParamNode).isParameterOf(mid.asCallable(), ppos) and
           parameterMatch(ppos, apos)
         |
-          c = "Parameter" or parseParam(c, apos)
+          c = "Parameter" and not heapParameter(ppos)
+          or
+          parseParam(c, apos)
         )
         or
         c = "ReturnValue" and
@@ -1259,7 +1263,9 @@ module Private {
           node.asNode().(ArgNode).argumentOf(mid.asCall(), apos) and
           parameterMatch(ppos, apos)
         |
-          c = "Argument" or parseArg(c, ppos)
+          c = "Argument" and not heapParameter(ppos)
+          or
+          parseArg(c, ppos)
         )
         or
         exists(ReturnNodeExt ret |
diff --git a/ruby/ql/lib/codeql/ruby/dataflow/internal/FlowSummaryImplSpecific.qll b/ruby/ql/lib/codeql/ruby/dataflow/internal/FlowSummaryImplSpecific.qll
@@ -289,6 +289,12 @@ private module UnusedSourceSinkInterpretation {
 
   /** Provides additional source specification logic. */
   predicate interpretInputSpecific(string c, InterpretNode mid, InterpretNode node) { none() }
+
+  /**
+   * Holds if `pos` is the position of the `heap` parameter, and thus should not
+   * be included by models that specify "any argument" or "any parameter".
+   */
+  predicate heapParameter(ParameterPosition pos) { none() }
 }
 
 import UnusedSourceSinkInterpretation
diff --git a/swift/ql/lib/codeql/swift/dataflow/internal/FlowSummaryImpl.qll b/swift/ql/lib/codeql/swift/dataflow/internal/FlowSummaryImpl.qll
@@ -1222,14 +1222,18 @@ module Private {
           node.asNode().(PostUpdateNode).getPreUpdateNode().(ArgNode).argumentOf(mid.asCall(), apos) and
           parameterMatch(ppos, apos)
         |
-          c = "Argument" or parseArg(c, ppos)
+          c = "Argument" and not heapParameter(ppos)
+          or
+          parseArg(c, ppos)
         )
         or
         exists(ArgumentPosition apos, ParameterPosition ppos |
           node.asNode().(ParamNode).isParameterOf(mid.asCallable(), ppos) and
           parameterMatch(ppos, apos)
         |
-          c = "Parameter" or parseParam(c, apos)
+          c = "Parameter" and not heapParameter(ppos)
+          or
+          parseParam(c, apos)
         )
         or
         c = "ReturnValue" and
@@ -1259,7 +1263,9 @@ module Private {
           node.asNode().(ArgNode).argumentOf(mid.asCall(), apos) and
           parameterMatch(ppos, apos)
         |
-          c = "Argument" or parseArg(c, ppos)
+          c = "Argument" and not heapParameter(ppos)
+          or
+          parseArg(c, ppos)
         )
         or
         exists(ReturnNodeExt ret |
diff --git a/swift/ql/lib/codeql/swift/dataflow/internal/FlowSummaryImplSpecific.qll b/swift/ql/lib/codeql/swift/dataflow/internal/FlowSummaryImplSpecific.qll
@@ -213,6 +213,12 @@ predicate interpretInputSpecific(string c, InterpretNode mid, InterpretNode node
   )
 }
 
+/**
+ * Holds if `pos` is the position of the `heap` parameter, and thus should not
+ * be included by models that specify "any argument" or "any parameter".
+ */
+predicate heapParameter(ParameterPosition pos) { none() }
+
 /** Gets the argument position obtained by parsing `X` in `Parameter[X]`. */
 bindingset[s]
 ArgumentPosition parseParamBody(string s) {

Original file line number	Diff line number	Diff line change
`@@ -1222,14 +1222,18 @@ module Private {`
`1222`	`1222`	`node.asNode().(PostUpdateNode).getPreUpdateNode().(ArgNode).argumentOf(mid.asCall(), apos) and`
`1223`	`1223`	`parameterMatch(ppos, apos)`
`1224`	`1224`	`\|`
`1225`		`- c = "Argument" or parseArg(c, ppos)`
	`1225`	`+ c = "Argument" and not heapParameter(ppos)`
	`1226`	`+ or`
	`1227`	`+ parseArg(c, ppos)`
`1226`	`1228`	`)`
`1227`	`1229`	`or`
`1228`	`1230`	`exists(ArgumentPosition apos, ParameterPosition ppos \|`
`1229`	`1231`	`node.asNode().(ParamNode).isParameterOf(mid.asCallable(), ppos) and`
`1230`	`1232`	`parameterMatch(ppos, apos)`
`1231`	`1233`	`\|`
`1232`		`- c = "Parameter" or parseParam(c, apos)`
	`1234`	`+ c = "Parameter" and not heapParameter(ppos)`
	`1235`	`+ or`
	`1236`	`+ parseParam(c, apos)`
`1233`	`1237`	`)`
`1234`	`1238`	`or`
`1235`	`1239`	`c = "ReturnValue" and`
`@@ -1259,7 +1263,9 @@ module Private {`
`1259`	`1263`	`node.asNode().(ArgNode).argumentOf(mid.asCall(), apos) and`
`1260`	`1264`	`parameterMatch(ppos, apos)`
`1261`	`1265`	`\|`
`1262`		`- c = "Argument" or parseArg(c, ppos)`
	`1266`	`+ c = "Argument" and not heapParameter(ppos)`
	`1267`	`+ or`
	`1268`	`+ parseArg(c, ppos)`
`1263`	`1269`	`)`
`1264`	`1270`	`or`
`1265`	`1271`	`exists(ReturnNodeExt ret \|`
Original file line number	Diff line number	Diff line change
`@@ -300,6 +300,12 @@ predicate interpretInputSpecific(string c, InterpretNode mid, InterpretNode n) {`
`300`	`300`	`)`
`301`	`301`	`}`
`302`	`302`
	`303`	`+/**`
	`304`	+ * Holds if `pos` is the position of the `heap` parameter, and thus should not
	`305`	`+ * be included by models that specify "any argument" or "any parameter".`
	`306`	`+ */`
	`307`	`+predicate heapParameter(ParameterPosition pos) { none() }`
	`308`	`+`
`303`	`309`	/** Gets the argument position obtained by parsing `X` in `Parameter[X]`. */
`304`	`310`	`bindingset[s]`
`305`	`311`	`ArgumentPosition parseParamBody(string s) {`
Original file line number	Diff line number	Diff line change
`@@ -251,6 +251,12 @@ predicate interpretInputSpecific(string c, InterpretNode mid, InterpretNode n) {`
`251`	`251`	`)`
`252`	`252`	`}`
`253`	`253`
	`254`	`+/**`
	`255`	+ * Holds if `pos` is the position of the `heap` parameter, and thus should not
	`256`	`+ * be included by models that specify "any argument" or "any parameter".`
	`257`	`+ */`
	`258`	`+predicate heapParameter(ParameterPosition pos) { none() }`
	`259`	`+`
`254`	`260`	`/**`
`255`	`261`	* Holds if specification component `c` parses as return value `n` or a range
`256`	`262`	* containing `n`.
Original file line number	Diff line number	Diff line change
`@@ -319,6 +319,12 @@ predicate interpretInputSpecific(string c, InterpretNode mid, InterpretNode n) {`
`319`	`319`	`)`
`320`	`320`	`}`
`321`	`321`
	`322`	`+/**`
	`323`	+ * Holds if `pos` is the position of the `heap` parameter, and thus should not
	`324`	`+ * be included by models that specify "any argument" or "any parameter".`
	`325`	`+ */`
	`326`	`+predicate heapParameter(ParameterPosition pos) { pos = -2 }`
	`327`	`+`
`322`	`328`	/** Gets the argument position obtained by parsing `X` in `Parameter[X]`. */
`323`	`329`	`bindingset[s]`
`324`	`330`	`ArgumentPosition parseParamBody(string s) {`