C++: Improve non-member iterator operator detection

Robert Marsh · Robert Marsh · commit d4cf92e3745a · 2020-08-31T14:52:29.000-07:00
diff --git a/cpp/ql/src/semmle/code/cpp/models/implementations/Iterator.qll b/cpp/ql/src/semmle/code/cpp/models/implementations/Iterator.qll
@@ -59,21 +59,27 @@ class Iterator extends Type {
 
 private predicate calledWithIteratorArgument(Operator op, int index) {
   exists(Type t |
-    t = op.getACallToThisFunction().getArgument(index).getUnspecifiedType()
-    |
-  t instanceof Iterator
-  or
-  t.(ReferenceType).getBaseType() instanceof Iterator
+    t =
+      op
+          .getACallToThisFunction()
+          .getArgument(index)
+          .getExplicitlyConverted()
+          .getType()
+          .stripTopLevelSpecifiers()
+  |
+    t instanceof Iterator
+    or
+    t.(ReferenceType).getBaseType() instanceof Iterator
   )
 }
+
 /**
  * A non-member prefix `operator*` function for an iterator type.
  */
 class IteratorPointerDereferenceOperator extends Operator, TaintFunction {
   IteratorPointerDereferenceOperator() {
     this.hasName("operator*") and
-    this.getACallToThisFunction().getArgument(0).getFullyConverted().getUnderlyingType() instanceof
-      Iterator
+    calledWithIteratorArgument(this, 0)
   }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
