Address review comments

Author: hvitved

csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl.qll

@@ -615,7 +615,9 @@ private newtype TNodeExt =
     exists(Configuration config |
       nodeCand1(node1, config) and
       argumentValueFlowsThrough(call, node1, TContentSome(f1), TContentSome(f2), node2) and
-      nodeCand1(node2, unbind(config))
+      nodeCand1(node2, unbind(config)) and
+      readStoreCand1(f1, unbind(config)) and
+      readStoreCand1(f2, unbind(config))
     )
   }
 

csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImplCommon.qll

@@ -383,17 +383,28 @@ private module Cached {
           contentOut = TContentNone() and
           compatibleTypes(getErasedNodeTypeBound(arg), getErasedNodeTypeBound(out))
           or
-          // getter(+setter)
+          // getter
           exists(Content fIn |
             contentIn.getContent() = fIn and
-            compatibleTypes(getErasedNodeTypeBound(arg), fIn.getContainerType())
+            contentOut = TContentNone() and
+            compatibleTypes(getErasedNodeTypeBound(arg), fIn.getContainerType()) and
+            compatibleTypes(fIn.getType(), getErasedNodeTypeBound(out))
           )
           or
           // setter
           exists(Content fOut |
             contentIn = TContentNone() and
             contentOut.getContent() = fOut and
-            compatibleTypes(getErasedNodeTypeBound(arg), fOut.getType())
+            compatibleTypes(getErasedNodeTypeBound(arg), fOut.getType()) and
+            compatibleTypes(fOut.getContainerType(), getErasedNodeTypeBound(out))
+          )
+          or
+          // getter+setter
+          exists(Content fIn, Content fOut |
+            contentIn.getContent() = fIn and
+            contentOut.getContent() = fOut and
+            compatibleTypes(getErasedNodeTypeBound(arg), fIn.getContainerType()) and
+            compatibleTypes(fOut.getContainerType(), getErasedNodeTypeBound(out))
           )
         )
       }