Merge pull request github#6900 from Marcono1234/marcono1234/MemberRefExpr-receiver-type

Java: Add `MemberRefExpr.getReceiverType()`

Author: aschackmull

java/ql/lib/semmle/code/java/Expr.qll

@@ -1227,6 +1227,28 @@ class MemberRefExpr extends FunctionalExpr, @memberref {
    */
   override Method asMethod() { result = this.getAnonymousClass().getAMethod() }
 
+  /**
+   * Gets the receiver type whose member this expression refers to. The result might not be
+   * the type which actually declares the member. For example, for the member reference `ArrayList::toString`,
+   * this predicate has the result `java.util.ArrayList`, the type explicitly referred to, while
+   * `getReferencedCallable` will have `java.util.AbstractCollection.toString` as result, which `ArrayList` inherits.
+   */
+  RefType getReceiverType() {
+    exists(Stmt stmt, Expr resultExpr |
+      stmt = asMethod().getBody().(SingletonBlock).getStmt() and
+      (
+        resultExpr = stmt.(ReturnStmt).getResult()
+        or
+        // Note: Currently never an ExprStmt, but might change once https://github.com/github/codeql/issues/3605 is fixed
+        resultExpr = stmt.(ExprStmt).getExpr()
+      )
+    |
+      result = resultExpr.(MethodAccess).getReceiverType() or
+      result = resultExpr.(ClassInstanceExpr).getConstructedType() or
+      result = resultExpr.(ArrayCreationExpr).getType()
+    )
+  }
+
   /**
    * Gets the method or constructor referenced by this member reference expression.
    */

java/ql/test/library-tests/MemberRefExpr/MemberRefExpr.expected

@@ -0,0 +1,14 @@
+| Test.java:24:26:24:51 | ...::... | Inner<>.Inner<> | Test$Generic$Inner.class:0:0:0:0 | Inner<> |
+| Test.java:38:29:38:42 | ...::... | Object.toString | Test.java:1:7:1:10 | Test |
+| Test.java:39:29:39:42 | ...::... | Object.hashCode | Test.java:1:7:1:10 | Test |
+| Test.java:40:29:40:39 | ...::... | Object.clone | Test.java:1:7:1:10 | Test |
+| Test.java:41:40:41:64 | ...::... | Object.toString | Test$Generic.class:0:0:0:0 | Generic<String> |
+| Test.java:43:23:43:36 | ...::... | Object.toString | Test.java:1:7:1:10 | Test |
+| Test.java:44:23:44:36 | ...::... | Object.hashCode | Test.java:1:7:1:10 | Test |
+| Test.java:45:23:45:33 | ...::... | Object.clone | Test.java:1:7:1:10 | Test |
+| Test.java:48:22:48:35 | ...::... | Object.toString | Test.java:1:7:1:10 | Test |
+| Test.java:51:13:51:21 | ...::... | Test.Test | Test.java:1:7:1:10 | Test |
+| Test.java:52:13:52:32 | ...::... | Generic<String>.Generic<String> | Test$Generic.class:0:0:0:0 | Generic<String> |
+| Test.java:56:13:56:22 | ...::... |  | file://:0:0:0:0 | int[] |
+| Test.java:57:13:57:26 | ...::... |  | file://:0:0:0:0 | Generic<>[] |
+| Test.java:61:31:61:47 | ...::... | Test.doSomething | Test.java:1:7:1:10 | Test |

java/ql/test/library-tests/MemberRefExpr/MemberRefExpr.ql

@@ -0,0 +1,10 @@
+import java
+
+string getReferencedCallable(MemberRefExpr e) {
+  if exists(e.getReferencedCallable())
+  then result = e.getReferencedCallable().getQualifiedName()
+  else result = ""
+}
+
+from MemberRefExpr e
+select e, getReferencedCallable(e), e.getReceiverType()

java/ql/test/library-tests/MemberRefExpr/Test.java

@@ -0,0 +1,63 @@
+class Test {
+    interface Function<T> {
+        Object apply(T o) throws Exception;
+    }
+
+    interface IntFunction {
+        Object apply(int i);
+    }
+
+    interface Supplier {
+        Object get() throws Exception;
+    }
+
+    public Test() { }
+
+    static class Generic<T> {
+        public Generic() { }
+
+        class Inner {
+            public Inner() { }
+        }
+
+        void test() {
+            Supplier s = Generic<Number>.Inner::new;
+        }
+    }
+
+    void doSomething() { }
+
+    static class Sub extends Test {
+    }
+
+    interface SubtypeConsumer {
+        void consume(Sub s);
+    }
+
+    void test() {
+        Function<Test> f0 = Test::toString;
+        Function<Test> f1 = Test::hashCode;
+        Function<Test> f2 = Test::clone;
+        Function<Generic<String>> f3 = Generic<String>::toString;
+
+        Supplier s0 = this::toString;
+        Supplier s1 = this::hashCode;
+        Supplier s2 = this::clone;
+
+        // Discards result of method call
+        Runnable r = this::toString;
+
+        Supplier[] classInstances = {
+            Test::new,
+            Generic<String>::new,
+        };
+
+        IntFunction[] arrays = {
+            int[]::new,
+            Generic[]::new,
+        };
+
+        // SubtypeConsumer has `Sub` as parameter type, but receiver here is `Test` (supertype)
+        SubtypeConsumer sub = Test::doSomething;
+    }
+}