Merge pull request #11270 from geoffw0/optionals2

Swift: Dataflow through ?? and ? :

Author: geoffw0

swift/ql/.generated.list

@@ -184,7 +184,6 @@ ql/lib/codeql/swift/elements/expr/OverloadedDeclRefExprConstructor.qll 2cf79b483
 ql/lib/codeql/swift/elements/expr/ParenExprConstructor.qll 6baaa592db57870f5ecd9be632bd3f653c44d72581efd41e8a837916e1590f9e 6f28988d04b2cb69ddcb63fba9ae3166b527803a61c250f97e48ff39a28379f6
 ql/lib/codeql/swift/elements/expr/PointerToPointerExpr.qll 921645a373443d050dbc29b9f6bc4a734163c75aeffce453a4f8334b34077d30 54089de77845f6b0e623c537bc25a010ecf1b5c7630b1b4060d2b378abc07f4e
 ql/lib/codeql/swift/elements/expr/PointerToPointerExprConstructor.qll 95cc8003b9a3b2101afb8f110ec4cbd29e380fc048ee080f5047bcf0e14a06c7 114d487a1bb2cd33b27a9c3a47ad1d7254766e169512642f8b09b9c32cf3dc86
-ql/lib/codeql/swift/elements/expr/PostfixUnaryExpr.qll a67abdf379f04f1aeee0795cd3ebeb28ed8dfe0efad15b128d44cc9e30b32cbd cbb2b2d54c8e316dc71388ea4ff6bb5d0a6204b4e9d9ce2888e1877a54e85e8f
 ql/lib/codeql/swift/elements/expr/PostfixUnaryExprConstructor.qll c26326e2703b9a8b077ea9f132ae86a76b4010a108b8dcde29864f4206096231 70e45fbe365b63226d0132158cdd453e2e00d740a31c1fb0f7bfb3b2dedfd928
 ql/lib/codeql/swift/elements/expr/PrefixUnaryExprConstructor.qll 6d4c915baf460691cc22681154b1129852c26f1bd9fe3e27b4e162f819d934f5 7971698433bc03dbff2fec34426a96a969fab1a5a575aaf91f10044819e16f6d
 ql/lib/codeql/swift/elements/expr/PropertyWrapperValuePlaceholderExpr.qll 35a61a7f68e71165690127b445fff39780028cb6be5e7b5eadaafa8aeb6b2321 f9e32f65e6d453d3fa857a4d3ca19700be1f8ea2f3d13534656bc21a2fc5f0b0

swift/ql/lib/codeql/swift/dataflow/internal/DataFlowPrivate.qll

@@ -148,11 +148,29 @@ private module Cached {
     // flow through `!`
     nodeFrom.asExpr() = nodeTo.asExpr().(ForceValueExpr).getSubExpr()
     or
-    // flow through `?`
+    // flow through `?` and `?.`
     nodeFrom.asExpr() = nodeTo.asExpr().(BindOptionalExpr).getSubExpr()
     or
     nodeFrom.asExpr() = nodeTo.asExpr().(OptionalEvaluationExpr).getSubExpr()
     or
+    // flow through nil-coalescing operator `??`
+    exists(BinaryExpr nco |
+      nco.getOperator().(FreeFunctionDecl).getName() = "??(_:_:)" and
+      nodeTo.asExpr() = nco
+    |
+      // value argument
+      nodeFrom.asExpr() = nco.getAnOperand()
+      or
+      // unpack closure (the second argument is an `AutoClosureExpr` argument)
+      nodeFrom.asExpr() = nco.getAnOperand().(AutoClosureExpr).getExpr()
+    )
+    or
+    // flow through ternary operator `? :`
+    exists(IfExpr ie |
+      nodeTo.asExpr() = ie and
+      nodeFrom.asExpr() = ie.getBranch(_)
+    )
+    or
     // flow through a flow summary (extension of `SummaryModelCsv`)
     FlowSummaryImpl::Private::Steps::summaryLocalStep(nodeFrom, nodeTo, true)
   }

swift/ql/lib/codeql/swift/elements/expr/AutoClosureExpr.qll

@@ -1,9 +1,29 @@
 private import codeql.swift.generated.expr.AutoClosureExpr
 private import codeql.swift.elements.stmt.ReturnStmt
+private import codeql.swift.elements.expr.Expr
 
+/**
+ * A Swift autoclosure expression, that is, a closure automatically generated
+ * around an argument when the parameter has the `@autoclosure` attribute. For
+ * example, there is an `AutoClosureExpr` around the value `0` in:
+ * ```
+ * func myFunction(_ expr: @autoclosure () -> Int) {
+ *   ...
+ * }
+ *
+ * myFunction(0)
+ * ```
+ */
 class AutoClosureExpr extends Generated::AutoClosureExpr {
-  /** Gets the implicit return statement generated by this autoclosure expression. */
+  /**
+   * Gets the implicit return statement generated by this autoclosure expression.
+   */
   ReturnStmt getReturn() { result = unique( | | this.getBody().getAnElement()) }
 
+  /**
+   * Gets the expression returned by this autoclosure expression.
+   */
+  Expr getExpr() { result = this.getReturn().getResult() }
+
   override string toString() { result = this.getBody().toString() }
 }

swift/ql/lib/codeql/swift/elements/expr/BinaryExpr.qll

@@ -1,11 +1,33 @@
 private import codeql.swift.generated.expr.BinaryExpr
 private import codeql.swift.elements.expr.Expr
+private import codeql.swift.elements.decl.AbstractFunctionDecl
 
+/**
+ * A Swift binary expression, that is, an expression that appears between its
+ * two operands. For example:
+ * ```
+ * x + y
+ * ```
+ */
 class BinaryExpr extends Generated::BinaryExpr {
+  /**
+   * Gets the left operand (left expression) of this binary expression.
+   */
   Expr getLeftOperand() { result = this.getArgument(0).getExpr() }
 
+  /**
+   * Gets the right operand (right expression) of this binary expression.
+   */
   Expr getRightOperand() { result = this.getArgument(1).getExpr() }
 
+  /**
+   * Gets the operator of this binary expression (the function that is called).
+   */
+  AbstractFunctionDecl getOperator() { result = this.getStaticTarget() }
+
+  /**
+   * Gets an operand of this binary expression (left or right).
+   */
   Expr getAnOperand() { result = [this.getLeftOperand(), this.getRightOperand()] }
 
   override string toString() { result = "... " + this.getFunction().toString() + " ..." }

swift/ql/lib/codeql/swift/elements/expr/PostfixUnaryExpr.qll

@@ -1,4 +1,22 @@
-// generated by codegen/codegen.py, remove this comment if you wish to edit this file
 private import codeql.swift.generated.expr.PostfixUnaryExpr
+private import codeql.swift.elements.expr.Expr
+private import codeql.swift.elements.decl.AbstractFunctionDecl
 
-class PostfixUnaryExpr extends Generated::PostfixUnaryExpr { }
+/**
+ * A Swift postfix unary expression, that is, a unary expression that appears
+ * after its operand. For example:
+ * ```
+ * x!
+ * ```
+ */
+class PostfixUnaryExpr extends Generated::PostfixUnaryExpr {
+  /**
+   *  Gets the operand (expression) of this postfix unary expression.
+   */
+  Expr getOperand() { result = this.getAnArgument().getExpr() }
+
+  /**
+   * Gets the operator of this postfix unary expression (the function that is called).
+   */
+  AbstractFunctionDecl getOperator() { result = this.getStaticTarget() }
+}

swift/ql/lib/codeql/swift/elements/expr/PrefixUnaryExpr.qll

@@ -1,6 +1,22 @@
 private import codeql.swift.generated.expr.PrefixUnaryExpr
 private import codeql.swift.elements.expr.Expr
+private import codeql.swift.elements.decl.AbstractFunctionDecl
 
+/**
+ * A Swift prefix unary expression, that is, a unary expression that appears
+ * before its operand. For example:
+ * ```
+ * -x
+ * ```
+ */
 class PrefixUnaryExpr extends Generated::PrefixUnaryExpr {
+  /**
+   *  Gets the operand (expression) of this prefix unary expression.
+   */
   Expr getOperand() { result = this.getAnArgument().getExpr() }
+
+  /**
+   * Gets the operator of this prefix unary expression (the function that is called).
+   */
+  AbstractFunctionDecl getOperator() { result = this.getStaticTarget() }
 }