use the explicit super type to resolve calls

erik-krogh · erik-krogh · commit f08f02ed6672 · 2022-06-19T20:38:16.000+02:00
diff --git a/ql/ql/src/codeql_ql/ast/internal/Predicate.qll b/ql/ql/src/codeql_ql/ast/internal/Predicate.qll
@@ -95,15 +95,24 @@ private module Cached {
     )
     or
     // super calls - and `this.method()` calls in charpreds. (Basically: in charpreds there is no difference between super and this.)
-    exists(AstNode sup, ClassType type, Type supertype |
+    exists(AstNode sup, Type supertype |
       sup instanceof Super
       or
       sup.(ThisAccess).getEnclosingPredicate() instanceof CharPred
     |
       mc.getBase() = sup and
-      sup.getEnclosingPredicate().getParent().(Class).getType() = type and
-      supertype in [type.getASuperType(), type.getAnInstanceofType()] and
-      p = supertype.getClassPredicate(mc.getMemberName(), mc.getNumberOfArguments())
+      p = supertype.getClassPredicate(mc.getMemberName(), mc.getNumberOfArguments()) and
+      (
+        // super.method()
+        not exists(mc.getSuperType()) and
+        exists(ClassType type |
+          sup.getEnclosingPredicate().getParent().(Class).getType() = type and
+          supertype in [type.getASuperType(), type.getAnInstanceofType()]
+        )
+        or
+        // Class.super.method()
+        supertype = mc.getSuperType().getResolvedType()
+      )
     )
   }
 
diff --git a/ql/ql/test/callgraph/MultiResolve.qll b/ql/ql/test/callgraph/MultiResolve.qll
@@ -24,3 +24,19 @@ module MyMod {
     }
   }
 }
+
+class Super1 extends int {
+  Super1() { this = 42 }
+
+  predicate foo() { any() }
+}
+
+class Super2 extends int {
+  Super2() { this = 42 }
+
+  predicate foo() { none() }
+}
+
+class Sub extends Super1, Super2 {
+  override predicate foo() { Super1.super.foo() } // <- should resolve to Super1::foo()
+}
diff --git a/ql/ql/test/callgraph/callgraph.expected b/ql/ql/test/callgraph/callgraph.expected
@@ -16,7 +16,8 @@ getTarget
 | Foo.qll:38:39:38:67 | MemberCall | file://:0:0:0:0 | regexpCapture |
 | MultiResolve.qll:14:25:14:35 | PredicateCall | MultiResolve.qll:1:1:4:1 | ClasslessPredicate foo |
 | MultiResolve.qll:14:25:14:35 | PredicateCall | MultiResolve.qll:12:1:12:24 | ClasslessPredicate myFoo |
-| MultiResolve.qll:25:7:25:18 | PredicateCall | MultiResolve.qll:17:3:19:3 | ClasslessPredicate bar |
+| MultiResolve.qll:23:7:23:18 | PredicateCall | MultiResolve.qll:17:3:17:27 | ClasslessPredicate bar |
+| MultiResolve.qll:41:30:41:47 | MemberCall | MultiResolve.qll:31:3:31:27 | ClassPredicate foo |
 | Overrides.qll:8:30:8:39 | MemberCall | Overrides.qll:6:3:6:29 | ClassPredicate bar |
 | Overrides.qll:16:39:16:48 | MemberCall | Overrides.qll:6:3:6:29 | ClassPredicate bar |
 | Overrides.qll:16:39:16:48 | MemberCall | Overrides.qll:14:12:14:43 | ClassPredicate bar |
