Add handling of post-constructor-call nodes

pavgust · jbj · commit dccc0f4db10e · 2019-08-08T14:05:03.000+02:00
diff --git a/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowUtil.qll b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowUtil.qll
@@ -10,6 +10,7 @@ cached
 private newtype TNode =
   TExprNode(Expr e) or
   TPartialDefNode(PartialDefinition pd) or
+  TPostConstructorCallNode(ConstructorCall call) or
   TExplicitParameterNode(Parameter p) { exists(p.getFunction().getBlock()) } or
   TInstanceParameterNode(MemberFunction f) { exists(f.getBlock()) and not f.isStatic() } or
   TDefinitionByReferenceNode(VariableAccess va, Expr argument) {
@@ -233,13 +234,19 @@ class PartialDefNode extends PostUpdateNode, TPartialDefNode {
 
   override Node getPreUpdateNode() { result.asExpr() = pd.getDefinedExpr() }
 
-  override string toString() { result = pd.toString() }
-
   override Location getLocation() { result = pd.getLocation() }
 
   PartialDefinition getPartialDefinition() { result = pd }
 }
 
+class PostConstructorCallNode extends PostUpdateNode, TPostConstructorCallNode {
+  ConstructorCall call;
+
+  PostConstructorCallNode() { this = TPostConstructorCallNode(call) }
+
+  override Node getPreUpdateNode() { result.asExpr() = call }
+}
+
 /**
  * Gets the `Node` corresponding to `e`.
  */
@@ -310,6 +317,8 @@ predicate localFlowStep(Node nodeFrom, Node nodeTo) {
   // Expr -> Expr
   exprToExprStep_nocfg(nodeFrom.asExpr(), nodeTo.asExpr())
   or
+  exprToExprStep_nocfg(nodeFrom.(PostUpdateNode).getPreUpdateNode().asExpr(), nodeTo.asExpr())
+  or
   // Node -> FlowVar -> VariableAccess
   exists(FlowVar var |
     (
