C#: Fix context-sensitive dispatch when using base qualifier

Author: hvitved

csharp/ql/lib/semmle/code/csharp/dispatch/Dispatch.qll

@@ -723,13 +723,21 @@ private module Internal {
         not this = any(AnalyzableFieldOrProperty a).getARead()
       }
 
+      /**
+       * For `base` expressions, the extractor provides the type of the base
+       * class instead of the derived class; for dispatch we need the latter.
+       */
+      private Type getBaseAdjustedType() {
+        result = this.(BaseAccess).getEnclosingCallable().getDeclaringType()
+      }
+
       Type getType(boolean isExact) {
+        result = this.getBaseAdjustedType() and
+        isExact = false
+        or
+        not exists(this.getBaseAdjustedType()) and
         result = this.getType() and
-        if
-          this instanceof ObjectCreation or
-          this instanceof BaseAccess
-        then isExact = true
-        else isExact = false
+        if this instanceof ObjectCreation then isExact = true else isExact = false
       }
     }
 

csharp/ql/test/library-tests/dataflow/call-sensitivity/CallSensitivityFlow.expected

@@ -60,8 +60,8 @@ edges
 | CallSensitivityFlow.cs:187:17:187:30 | call to method CallMOut : Object | CallSensitivityFlow.cs:187:13:187:13 | access to local variable o : Object | provenance |  |
 | CallSensitivityFlow.cs:205:40:205:40 | o : Object | CallSensitivityFlow.cs:208:18:208:18 | access to parameter o | provenance |  |
 | CallSensitivityFlow.cs:239:35:239:35 | o : Object | CallSensitivityFlow.cs:241:17:241:17 | access to parameter o : Object | provenance |  |
-| CallSensitivityFlow.cs:241:17:241:17 | access to parameter o : Object | CallSensitivityFlow.cs:244:35:244:35 | o : Object | provenance |  |
-| CallSensitivityFlow.cs:244:35:244:35 | o : Object | CallSensitivityFlow.cs:246:14:246:14 | access to parameter o | provenance |  |
+| CallSensitivityFlow.cs:241:17:241:17 | access to parameter o : Object | CallSensitivityFlow.cs:256:36:256:36 | o : Object | provenance |  |
+| CallSensitivityFlow.cs:256:36:256:36 | o : Object | CallSensitivityFlow.cs:258:14:258:14 | access to parameter o | provenance |  |
 | CallSensitivityFlow.cs:263:17:263:28 | object creation of type Object : Object | CallSensitivityFlow.cs:239:35:239:35 | o : Object | provenance |  |
 nodes
 | CallSensitivityFlow.cs:7:38:7:38 | o : Object | semmle.label | o : Object |
@@ -138,8 +138,8 @@ nodes
 | CallSensitivityFlow.cs:208:18:208:18 | access to parameter o | semmle.label | access to parameter o |
 | CallSensitivityFlow.cs:239:35:239:35 | o : Object | semmle.label | o : Object |
 | CallSensitivityFlow.cs:241:17:241:17 | access to parameter o : Object | semmle.label | access to parameter o : Object |
-| CallSensitivityFlow.cs:244:35:244:35 | o : Object | semmle.label | o : Object |
-| CallSensitivityFlow.cs:246:14:246:14 | access to parameter o | semmle.label | access to parameter o |
+| CallSensitivityFlow.cs:256:36:256:36 | o : Object | semmle.label | o : Object |
+| CallSensitivityFlow.cs:258:14:258:14 | access to parameter o | semmle.label | access to parameter o |
 | CallSensitivityFlow.cs:263:17:263:28 | object creation of type Object : Object | semmle.label | object creation of type Object : Object |
 subpaths
 | CallSensitivityFlow.cs:85:26:85:37 | object creation of type Object : Object | CallSensitivityFlow.cs:7:38:7:38 | o : Object | CallSensitivityFlow.cs:11:20:11:20 | access to parameter o : Object | CallSensitivityFlow.cs:85:14:85:44 | call to method FlowThrough |
@@ -165,4 +165,4 @@ subpaths
 | CallSensitivityFlow.cs:172:37:172:48 | object creation of type Object : Object | CallSensitivityFlow.cs:172:37:172:48 | object creation of type Object : Object | CallSensitivityFlow.cs:188:14:188:14 | access to local variable o | $@ | CallSensitivityFlow.cs:188:14:188:14 | access to local variable o | access to local variable o |
 | CallSensitivityFlow.cs:182:21:182:32 | object creation of type Object : Object | CallSensitivityFlow.cs:182:21:182:32 | object creation of type Object : Object | CallSensitivityFlow.cs:208:18:208:18 | access to parameter o | $@ | CallSensitivityFlow.cs:208:18:208:18 | access to parameter o | access to parameter o |
 | CallSensitivityFlow.cs:185:21:185:32 | object creation of type Object : Object | CallSensitivityFlow.cs:185:21:185:32 | object creation of type Object : Object | CallSensitivityFlow.cs:164:14:164:14 | access to parameter o | $@ | CallSensitivityFlow.cs:164:14:164:14 | access to parameter o | access to parameter o |
-| CallSensitivityFlow.cs:263:17:263:28 | object creation of type Object : Object | CallSensitivityFlow.cs:263:17:263:28 | object creation of type Object : Object | CallSensitivityFlow.cs:246:14:246:14 | access to parameter o | $@ | CallSensitivityFlow.cs:246:14:246:14 | access to parameter o | access to parameter o |
+| CallSensitivityFlow.cs:263:17:263:28 | object creation of type Object : Object | CallSensitivityFlow.cs:263:17:263:28 | object creation of type Object : Object | CallSensitivityFlow.cs:258:14:258:14 | access to parameter o | $@ | CallSensitivityFlow.cs:258:14:258:14 | access to parameter o | access to parameter o |