/**
 * Provides predicates and classes for working with string operations.
 */
overlay[local?]
module;

import go

/** Provides predicates and classes for working with string operations. */
module StringOps {
  /**
   * An expression that is equivalent to `strings.HasPrefix(A, B)` or `!strings.HasPrefix(A, B)`.
   *
   * Extend this class to refine existing API models. If you want to model new APIs,
   * extend `StringOps::HasPrefix::Range` instead.
   */
  class HasPrefix extends DataFlow::Node instanceof HasPrefix::Range {
    /**
     * Gets the `A` in `strings.HasPrefix(A, B)`.
     */
    DataFlow::Node getBaseString() { result = super.getBaseString() }

    /**
     * Gets the `B` in `strings.HasPrefix(A, B)`.
     */
    DataFlow::Node getSubstring() { result = super.getSubstring() }

    /**
     * Gets the polarity of the check.
     *
     * If the polarity is `false` the check returns `true` if the string does not start
     * with the given substring.
     */
    boolean getPolarity() { result = super.getPolarity() }
  }

  class StartsWith = HasPrefix;

  /** Provides predicates and classes for working with prefix checks. */
  module HasPrefix {
    /**
     * An expression that is equivalent to `strings.HasPrefix(A, B)` or `!strings.HasPrefix(A, B)`.
     *
     * Extend this class to model new APIs. If you want to refine existing API models, extend
     * `StringOps::HasPrefix` instead.
     */
    abstract class Range extends DataFlow::Node {
      /**
       * Gets the `A` in `strings.HasPrefix(A, B)`.
       */
      abstract DataFlow::Node getBaseString();

      /**
       * Gets the `B` in `strings.HasPrefix(A, B)`.
       */
      abstract DataFlow::Node getSubstring();

      /**
       * Gets the polarity of the check.
       *
       * If the polarity is `false` the check returns `true` if the string does not start
       * with the given substring.
       */
      boolean getPolarity() { result = true }
    }

    /**
     * An expression of the form `strings.HasPrefix(A, B)`.
     */
    private class StringsHasPrefix extends Range, DataFlow::CallNode {
      StringsHasPrefix() { this.getTarget().hasQualifiedName("strings", "HasPrefix") }

      override DataFlow::Node getBaseString() { result = this.getArgument(0) }

      override DataFlow::Node getSubstring() { result = this.getArgument(1) }
    }

    /**
     * Holds if `eq` is of the form `nd == 0` or `nd != 0`.
     */
    pragma[noinline]
    private predicate comparesToZero(DataFlow::EqualityTestNode eq, DataFlow::Node nd) {
      exists(DataFlow::Node zero |
        eq.hasOperands(globalValueNumber(nd).getANode(), zero) and
        zero.getIntValue() = 0
      )
    }

    /**
     * An expression of the form `strings.Index(A, B) == 0`.
     */
    private class HasPrefix_IndexOfEquals extends Range, DataFlow::EqualityTestNode {
      DataFlow::CallNode indexOf;

      HasPrefix_IndexOfEquals() {
        comparesToZero(this, indexOf) and
        indexOf.getTarget().hasQualifiedName("strings", "Index")
      }

      override DataFlow::Node getBaseString() { result = indexOf.getArgument(0) }

      override DataFlow::Node getSubstring() { result = indexOf.getArgument(1) }

      override boolean getPolarity() { result = expr.getPolarity() }
    }

    pragma[noinline]
    private DataFlow::ElementReadNode getReadOfFirstChar(DataFlow::Node str) {
      pragma[only_bind_into](result).getIndex().getIntValue() = 0 and
      str = result.getBase() and
      str.getType().getUnderlyingType() instanceof StringType
    }

    /**
     * Holds if `eq` is of the form `str[0] == rhs` or `str[0] != rhs`.
     */
    pragma[noinline]
    private predicate comparesFirstCharacter(
      DataFlow::EqualityTestNode eq, DataFlow::Node str, DataFlow::Node rhs
    ) {
      eq.hasOperands(globalValueNumber(pragma[only_bind_out](getReadOfFirstChar(str))).getANode(),
        rhs)
    }

    /**
     * A comparison of the form `x[0] == 'k'` for some rune literal `k`.
     */
    private class HasPrefix_FirstCharacter extends Range, DataFlow::EqualityTestNode {
      DataFlow::Node base;
      DataFlow::Node runeLiteral;

      HasPrefix_FirstCharacter() { comparesFirstCharacter(this, base, runeLiteral) }

      override DataFlow::Node getBaseString() { result = base }

      override DataFlow::Node getSubstring() { result = runeLiteral }

      override boolean getPolarity() { result = expr.getPolarity() }
    }

    /**
     * A comparison of the form `x[:len(y)] == y`.
     */
    private class HasPrefix_Substring extends Range, DataFlow::EqualityTestNode {
      DataFlow::SliceNode slice;
      DataFlow::Node substring;

      HasPrefix_Substring() {
        this.eq(_, slice, substring) and
        slice.getLow().getIntValue() = 0 and
        (
          exists(DataFlow::CallNode len |
            len = Builtin::len().getACall() and
            len.getArgument(0) = globalValueNumber(substring).getANode() and
            slice.getHigh() = globalValueNumber(len).getANode()
          )
          or
          substring.getStringValue().length() = slice.getHigh().getIntValue()
        )
      }

      override DataFlow::Node getBaseString() { result = slice.getBase() }

      override DataFlow::Node getSubstring() { result = substring }

      override boolean getPolarity() { result = expr.getPolarity() }
    }
  }

  /**
   * An expression that is equivalent to `strings.ReplaceAll(s, old, new)`.
   *
   * Extend this class to refine existing API models. If you want to model new APIs,
   * extend `StringOps::ReplaceAll::Range` instead.
   */
  class ReplaceAll extends DataFlow::Node instanceof ReplaceAll::Range {
    /**
     * Gets the `old` in `strings.ReplaceAll(s, old, new)`.
     */
    string getReplacedString() { result = super.getReplacedString() }
  }

  /** Provides predicates and classes for working with prefix checks. */
  module ReplaceAll {
    /**
     * An expression that is equivalent to `strings.ReplaceAll(s, old, new)`.
     *
     * Extend this class to model new APIs. If you want to refine existing API models, extend
     * `StringOps::ReplaceAll` instead.
     */
    abstract class Range extends DataFlow::Node {
      /**
       * Gets the `old` in `strings.ReplaceAll(s, old, new)`.
       */
      abstract string getReplacedString();
    }

    /**
     * A call to `strings.ReplaceAll`  or `strings.Replace` with a negative `n`
     * so that all instances are replaced.
     */
    private class StringsReplaceAll extends Range, DataFlow::CallNode {
      StringsReplaceAll() {
        exists(string name | this.getTarget().hasQualifiedName("strings", name) |
          name = "ReplaceAll"
          or
          name = "Replace" and
          this.getArgument(3).getNumericValue() < 0
        )
      }

      override string getReplacedString() { result = this.getArgument(1).getStringValue() }
    }

    /**
     * A call to `strings.NewReplacer`.
     */
    private class StringsNewReplacerCall extends DataFlow::CallNode {
      StringsNewReplacerCall() { this.getTarget().hasQualifiedName("strings", "NewReplacer") }

      /**
       * Gets an argument to this call corresponding to a string that will be
       * replaced.
       */
      DataFlow::Node getAReplacedArgument() {
        exists(int n | n % 2 = 0 and result = this.getSyntacticArgument(n))
      }
    }

    private module StringsNewReplacerConfig implements DataFlow::ConfigSig {
      predicate isSource(DataFlow::Node source) { source instanceof StringsNewReplacerCall }

      predicate isSink(DataFlow::Node sink) {
        exists(DataFlow::MethodCallNode call |
          sink = call.getReceiver() and
          call.getTarget().hasQualifiedName("strings", "Replacer", ["Replace", "WriteString"])
        )
      }
    }

    /**
     * Tracks data flow from a call to `strings.NewReplacer` to the receiver of
     * a call to `strings.Replacer.Replace` or `strings.Replacer.WriteString`.
     */
    private module StringsNewReplacerFlow = DataFlow::Global<StringsNewReplacerConfig>;

    /**
     * A call to `strings.Replacer.Replace` or `strings.Replacer.WriteString`.
     */
    private class StringsReplacerReplaceOrWriteString extends Range {
      string replacedString;

      StringsReplacerReplaceOrWriteString() {
        exists(StringsNewReplacerCall source, DataFlow::Node sink, DataFlow::MethodCallNode call |
          StringsNewReplacerFlow::flow(source, sink) and
          sink = call.getReceiver() and
          replacedString = source.getAReplacedArgument().getStringValue() and
          (
            call.getTarget().hasQualifiedName("strings", "Replacer", "Replace") and
            this = call.getResult()
            or
            call.getTarget().hasQualifiedName("strings", "Replacer", "WriteString") and
            this = call.getArgument(1)
          )
        )
      }

      override string getReplacedString() { result = replacedString }
    }
  }

  /** Provides predicates and classes for working with Printf-style formatters. */
  module Formatting {
    /**
     * Gets a regular expression for matching simple format-string components, including flags,
     * width and precision specifiers, not including explicit argument indices.
     */
    pragma[noinline]
    private string getFormatComponentRegex() {
      exists(
        string literal, string opt_flag, string width, string prec, string opt_width_and_prec,
        string operator, string verb
      |
        literal = "([^%]|%%)+" and
        opt_flag = "[-+ #0]?" and
        width = "\\d+|\\*" and
        prec = "\\.(\\d+|\\*)" and
        opt_width_and_prec = "(" + width + ")?(" + prec + ")?" and
        operator = "[bcdeEfFgGoOpqstTxXUv]" and
        verb = "(%" + opt_flag + opt_width_and_prec + operator + ")"
      |
        result = "(" + literal + "|" + verb + ")"
      )
    }

    /**
     * A function that performs string formatting in the same manner as `fmt.Printf` etc.
     */
    abstract class Range extends Function {
      /**
       * Gets the parameter index of the format string.
       */
      abstract int getFormatStringIndex();
    }

    /**
     * A call to a `fmt.Printf`-style string formatting function.
     */
    class StringFormatCall extends DataFlow::CallNode {
      string fmt;

      StringFormatCall() {
        exists(Range f |
          this = f.getACall() and
          fmt = this.getArgument(f.getFormatStringIndex()).getStringValue()
        ) and
        fmt.regexpMatch(getFormatComponentRegex() + "*")
      }

      /**
       * Gets the `n`th component of this format string.
       */
      string getComponent(int n) { result = fmt.regexpFind(getFormatComponentRegex(), n, _) }

      /**
       * Gets the `n`th argument formatted by this format call, where `formatDirective` specifies how it will be formatted.
       */
      DataFlow::Node getOperand(int n, string formatDirective) {
        formatDirective = this.getComponent(n) and
        formatDirective.charAt(0) = "%" and
        formatDirective.charAt(1) != "%" and
        result = this.getImplicitVarargsArgument(n / 2)
      }
    }
  }

  /**
   * A data-flow node that performs string concatenation.
   *
   * Extend this class to refine existing API models. If you want to model new APIs,
   * extend `StringOps::Concatenation::Range` instead.
   */
  class Concatenation extends DataFlow::Node instanceof Concatenation::Range {
    /**
     * Gets the `n`th operand of this string concatenation, if there is a data-flow node for it.
     */
    DataFlow::Node getOperand(int n) { result = super.getOperand(n) }

    /**
     * Gets the string value of the `n`th operand of this string concatenation, if it is a constant.
     */
    string getOperandStringValue(int n) { result = super.getOperandStringValue(n) }

    /**
     * Gets the number of operands of this string concatenation.
     */
    int getNumOperand() { result = super.getNumOperand() }
  }

  /** Provides predicates and classes for working with string concatenations. */
  module Concatenation {
    /**
     * A data-flow node that performs string concatenation.
     *
     * Extend this class to model new APIs. If you want to refine existing API models,
     * extend `StringOps::Concatenation` instead.
     */
    abstract class Range extends DataFlow::Node {
      /**
       * Gets the `n`th operand of this string concatenation, if there is a data-flow node for it.
       */
      abstract DataFlow::Node getOperand(int n);

      /**
       * Gets the string value of the `n`th operand of this string concatenation, if it is
       * a constant.
       */
      string getOperandStringValue(int n) { result = this.getOperand(n).getStringValue() }

      /**
       * Gets the number of operands of this string concatenation.
       */
      int getNumOperand() { result = count(this.getOperand(_)) }
    }

    /** A string concatenation using the `+` or `+=` operator. */
    private class PlusConcat extends Range, DataFlow::BinaryOperationNode {
      PlusConcat() {
        this.getType() instanceof StringType and
        this.getOperator() = "+"
      }

      override DataFlow::Node getOperand(int n) {
        n = 0 and result = this.getLeftOperand()
        or
        n = 1 and result = this.getRightOperand()
      }
    }

    /**
     * A call to `fmt.Sprintf`, considered as a string concatenation.
     *
     * Only calls with simple format strings (no `*` specifiers, no explicit argument indices)
     * are supported. Such format strings can be viewed as sequences of alternating literal and
     * non-literal components. A literal component contains no `%` characters except `%%` pairs,
     * while a non-literal component consists of `%`, a verb, and possibly flags and specifiers.
     * Each non-literal component consumes exactly one argument.
     *
     * Literal components give rise to concatenation operands that have a string value but no
     * data-flow node; non-literal `%s` or `%v` components give rise to concatenation operands
     * that do have an associated data-flow node but possibly no string value; any other non-literal
     * components give rise to concatenation operands that have neither an associated data-flow
     * node nor a string value. This is because verbs like `%q` perform additional string
     * transformations that we cannot easily represent.
     */
    private class SprintfConcat extends Range instanceof Formatting::StringFormatCall {
      SprintfConcat() { this = any(Function f | f.hasQualifiedName("fmt", "Sprintf")).getACall() }

      override DataFlow::Node getOperand(int n) {
        result = Formatting::StringFormatCall.super.getOperand(n, ["%s", "%v"])
      }

      override string getOperandStringValue(int n) {
        result = Range.super.getOperandStringValue(n)
        or
        exists(string cmp | cmp = Formatting::StringFormatCall.super.getComponent(n) |
          (cmp.charAt(0) != "%" or cmp.charAt(1) = "%") and
          result = cmp.replaceAll("%%", "%")
        )
      }

      override int getNumOperand() {
        result = max(int i | exists(Formatting::StringFormatCall.super.getComponent(i))) + 1
      }
    }

    /**
     * Holds if `src` flows to `dst` through the `n`th operand of the given concatenation operator.
     */
    predicate taintStep(DataFlow::Node src, DataFlow::Node dst, Concatenation cat, int n) {
      src = cat.getOperand(n) and
      dst = cat
    }

    /**
     * Holds if there is a taint step from `src` to `dst` through string concatenation.
     */
    predicate taintStep(DataFlow::Node src, DataFlow::Node dst) { taintStep(src, dst, _, _) }
  }

  private newtype TConcatenationElement =
    /** A root concatenation element that is not itself an operand of a string concatenation. */
    MkConcatenationRoot(Concatenation cat) { not cat = any(Concatenation parent).getOperand(_) } or
    /** A concatenation element that is an operand of a string concatenation. */
    MkConcatenationOperand(Concatenation parent, int i) { i in [0 .. parent.getNumOperand() - 1] }

  /**
   * An element of a string concatenation, which either itself performs a string concatenation or
   * occurs as an operand in a string concatenation.
   *
   * For example, the expression `x + y + z` contains the following concatenation
   * elements:
   *
   * - The leaf elements `x`, `y`, and `z`
   * - The intermediate element `x + y`, which is both a concatenation and an operand
   * - The root element `x + y + z`
   */
  class ConcatenationElement extends TConcatenationElement {
    /**
     * Gets the data-flow node corresponding to this concatenation element, if any.
     */
    DataFlow::Node asNode() {
      this = MkConcatenationRoot(result)
      or
      exists(Concatenation parent, int i | this = MkConcatenationOperand(parent, i) |
        result = parent.getOperand(i)
      )
    }

    /**
     * Gets the string value of this concatenation element if it is a constant.
     */
    string getStringValue() {
      result = this.asNode().getStringValue()
      or
      exists(Concatenation parent, int i | this = MkConcatenationOperand(parent, i) |
        result = parent.getOperandStringValue(i)
      )
    }

    /**
     * Gets the `n`th operand of this string concatenation.
     */
    ConcatenationOperand getOperand(int n) { result = MkConcatenationOperand(this.asNode(), n) }

    /**
     * Gets an operand of this string concatenation.
     */
    ConcatenationOperand getAnOperand() { result = this.getOperand(_) }

    /**
     * Gets the number of operands of this string concatenation.
     */
    int getNumOperand() { result = count(this.getAnOperand()) }

    /**
     * Gets the first operand of this string concatenation.
     *
     * For example, the first operand of `(x + y) + z` is `(x + y)`.
     */
    ConcatenationOperand getFirstOperand() { result = this.getOperand(0) }

    /**
     * Gets the last operand of this string concatenation.
     *
     * For example, the last operand of `x + (y + z)` is `(y + z)`.
     */
    ConcatenationOperand getLastOperand() { result = this.getOperand(this.getNumOperand() - 1) }

    /**
     * Gets the root of the concatenation tree to which this element belongs.
     */
    ConcatenationRoot getConcatenationRoot() { this = result.getAnOperand*() }

    /**
     * Gets a leaf in the concatenation tree that this element is the root of.
     */
    ConcatenationLeaf getALeaf() { result = this.getAnOperand*() }

    /**
     * Gets the first leaf in this concatenation tree.
     *
     * For example, the first leaf of `(x + y) + z` is `x`.
     */
    ConcatenationLeaf getFirstLeaf() { result = this.getFirstOperand*() }

    /**
     * Gets the last leaf in this concatenation tree.
     *
     * For example, the last leaf of `x + (y + z)` is `z`.
     */
    ConcatenationLeaf getLastLeaf() { result = this.getLastOperand*() }

    /** Gets a textual representation of this concatenation element. */
    string toString() {
      if exists(this.asNode())
      then result = this.asNode().toString()
      else
        if exists(this.getStringValue())
        then result = this.getStringValue()
        else result = "concatenation element"
    }

    /** Gets the location of this element. */
    Location getLocation() { result = this.asNode().getLocation() }

    /**
     * DEPRECATED: Use `getLocation()` instead.
     *
     * Holds if this element is at the specified location.
     * The location spans column `startcolumn` of line `startline` to
     * column `endcolumn` of line `endline` in file `filepath`.
     * For more information, see
     * [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
     */
    deprecated predicate hasLocationInfo(
      string filepath, int startline, int startcolumn, int endline, int endcolumn
    ) {
      this.getLocation().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
      or
      // use dummy location for elements that don't have a corresponding node
      not exists(this.getLocation()) and
      filepath = "" and
      startline = 0 and
      startcolumn = 0 and
      endline = 0 and
      endcolumn = 0
    }
  }

  /**
   * An operand in a string concatenation.
   *
   * See `ConcatenationElement` for more information.
   */
  class ConcatenationOperand extends ConcatenationElement, MkConcatenationOperand { }

  /**
   * A data-flow node that performs a string concatenation, and is not an
   * immediate operand in a larger string concatenation.
   *
   * See `ConcatenationElement` for more information.
   */
  class ConcatenationRoot extends ConcatenationElement, MkConcatenationRoot { }

  /**
   * An operand to a concatenation that is not itself a concatenation.
   *
   * See `ConcatenationElement` for more information.
   */
  class ConcatenationLeaf extends ConcatenationOperand {
    ConcatenationLeaf() { not exists(this.getAnOperand()) }

    /**
     * Gets the operand immediately preceding this one in its parent concatenation.
     *
     * For example, in `(x + y) + z`, the previous leaf for `z` is `y`.
     */
    ConcatenationLeaf getPreviousLeaf() {
      exists(ConcatenationElement parent, int i |
        result = parent.getOperand(i - 1).getLastLeaf() and
        this = parent.getOperand(i).getFirstLeaf()
      )
    }

    /**
     * Gets the operand immediately succeeding this one in its parent concatenation.
     *
     * For example, in `(x + y) + z`, the previous leaf for `y` is `z`.
     */
    ConcatenationLeaf getNextLeaf() { this = result.getPreviousLeaf() }
  }
}