Merge pull request github#4695 from tamasvajk/feature/csharp9-with-expr

C#: Extract 'with' expressions

Author: tamasvajk

csharp/change-notes/2021-02-12-with-expression.md

@@ -0,0 +1,4 @@
+lgtm,codescanning
+* C# 9 `with` expressions are now extracted. Data flow support has been added to
+handle flow through `with` expressions and also from `record` constructor arguments
+to its properties.

csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Factory.cs

@@ -250,6 +250,9 @@ internal static Expression Create(ExpressionNodeInfo info)
                     case SyntaxKind.SuppressNullableWarningExpression:
                         return PostfixUnary.Create(info.SetKind(ExprKind.SUPPRESS_NULLABLE_WARNING), ((PostfixUnaryExpressionSyntax)info.Node).Operand);
 
+                    case SyntaxKind.WithExpression:
+                        return WithExpression.Create(info);
+
                     default:
                         info.Context.ModelError(info.Node, $"Unhandled expression '{info.Node}' of kind '{info.Node.Kind()}'");
                         return new Unknown(info);

csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Initializer.cs

@@ -12,7 +12,7 @@ internal abstract class Initializer : Expression<InitializerExpressionSyntax>
         protected Initializer(ExpressionNodeInfo info) : base(info) { }
     }
 
-    internal class ArrayInitializer : Expression<InitializerExpressionSyntax>
+    internal class ArrayInitializer : Initializer
     {
         private ArrayInitializer(ExpressionNodeInfo info) : base(info.SetType(null).SetKind(ExprKind.ARRAY_INIT)) { }
 

csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/WithExpression.cs

@@ -0,0 +1,20 @@
+using Microsoft.CodeAnalysis.CSharp.Syntax;
+using Semmle.Extraction.Kinds;
+using System.IO;
+
+namespace Semmle.Extraction.CSharp.Entities.Expressions
+{
+    internal class WithExpression : Expression<WithExpressionSyntax>
+    {
+        private WithExpression(ExpressionNodeInfo info) : base(info.SetKind(ExprKind.WITH)) { }
+
+        public static Expression Create(ExpressionNodeInfo info) => new WithExpression(info).TryPopulate();
+
+        protected override void PopulateExpression(TextWriter trapFile)
+        {
+            Create(cx, Syntax.Expression, this, 0);
+
+            ObjectInitializer.Create(new ExpressionNodeInfo(cx, Syntax.Initializer, this, 1).SetType(Type));
+        }
+    }
+}

csharp/extractor/Semmle.Extraction.CSharp/Kinds/ExprKind.cs

@@ -124,7 +124,7 @@ public enum ExprKind
         AND_PATTERN = 127,
         OR_PATTERN = 128,
         FUNCTION_POINTER_INVOCATION = 129,
-
+        WITH = 130,
         DEFINE_SYMBOL = 999
     }
 }

csharp/ql/src/semmle/code/csharp/Callable.qll

@@ -461,6 +461,15 @@ class Operator extends Callable, Member, Attributable, @operator {
   override Parameter getRawParameter(int i) { result = getParameter(i) }
 }
 
+/** A clone method on a record. */
+class RecordCloneMethod extends Method, DotNet::RecordCloneCallable {
+  override Constructor getConstructor() {
+    result = DotNet::RecordCloneCallable.super.getConstructor()
+  }
+
+  override string toString() { result = Method.super.toString() }
+}
+
 /**
  * A user-defined unary operator - an operator taking one operand.
  *

csharp/ql/src/semmle/code/csharp/Type.qll

@@ -748,6 +748,9 @@ class Class extends RefType, @class_type {
 class Record extends Class {
   Record() { this.isRecord() }
 
+  /** Gets the clone method of this record. */
+  RecordCloneMethod getCloneMethod() { result = this.getAMember() }
+
   override string getAPrimaryQlClass() { result = "Record" }
 }
 

csharp/ql/src/semmle/code/csharp/dataflow/LibraryTypeDataFlow.qll

@@ -2416,3 +2416,22 @@ class StringValuesFlow extends LibraryTypeDataFlow, Struct {
     preservesValue = false
   }
 }
+
+private class RecordConstructorFlow extends SummarizedCallable {
+  RecordConstructorFlow() { this = any(Record r).getAMember().(Constructor) }
+
+  override predicate propagatesFlow(
+    SummaryInput input, ContentList inputContents, SummaryOutput output, ContentList outputContents,
+    boolean preservesValue
+  ) {
+    exists(int i, Property p, string name |
+      this.getParameter(i).getName() = name and
+      this.getDeclaringType().getAMember(name) = p and
+      input = SummaryInput::parameter(i) and
+      inputContents = ContentList::empty() and
+      output = SummaryOutput::return() and
+      outputContents = ContentList::property(p) and
+      preservesValue = true
+    )
+  }
+}

csharp/ql/src/semmle/code/csharp/dataflow/internal/ControlFlowReachability.qll

@@ -61,7 +61,7 @@ abstract class ControlFlowReachabilityConfiguration extends string {
   /**
    * Holds if `e1` and `e2` are expressions for which we want to find a
    * control-flow path that follows control flow successors (resp.
-   * predecessors, as specified by `isSuccesor`) inside the syntactic scope
+   * predecessors, as specified by `isSuccessor`) inside the syntactic scope
    * `scope`. The Boolean `exactScope` indicates whether a transitive child
    * of `scope` is allowed (`exactScope = false`).
    */
@@ -74,7 +74,7 @@ abstract class ControlFlowReachabilityConfiguration extends string {
   /**
    * Holds if `e` and `def` are elements for which we want to find a
    * control-flow path that follows control flow successors (resp.
-   * predecessors, as specified by `isSuccesor`) inside the syntactic scope
+   * predecessors, as specified by `isSuccessor`) inside the syntactic scope
    * `scope`. The Boolean `exactScope` indicates whether a transitive child
    * of `scope` is allowed (`exactScope = false`).
    */

csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll

@@ -209,6 +209,17 @@ module LocalFlow {
         e1 = e2.(SwitchExpr).getACase().getBody() and
         scope = e2 and
         isSuccessor = true
+        or
+        exists(WithExpr we |
+          scope = we and
+          isSuccessor = true
+        |
+          e1 = we.getExpr() and
+          e2 = we.getInitializer()
+          or
+          e1 = we.getInitializer() and
+          e2 = we
+        )
       )
     }
 
@@ -451,10 +462,23 @@ private predicate fieldOrPropertyStore(Expr e, Content c, Expr src, Expr q, bool
       postUpdate = true
     )
     or
+    // `with` expression initializer, `x with { f = src }`
+    e =
+      any(WithExpr we |
+        exists(MemberInitializer mi |
+          q = we and
+          mi = we.getInitializer().getAMemberInitializer() and
+          f = mi.getInitializedMember() and
+          src = mi.getRValue() and
+          postUpdate = false
+        )
+      )
+    or
     // Object initializer, `new C() { f = src }`
     exists(MemberInitializer mi |
       e = q and
       mi = q.(ObjectInitializer).getAMemberInitializer() and
+      q.getParent() instanceof ObjectCreation and
       f = mi.getInitializedMember() and
       src = mi.getRValue() and
       postUpdate = false
@@ -792,6 +816,13 @@ private module Cached {
       input = SummaryInput::parameter(i) and
       n.(ArgumentNode).argumentOf(call, i)
     )
+    or
+    exists(WithExpr we, ObjectInitializer oi, FieldOrProperty f |
+      oi = we.getInitializer() and
+      n.asExpr() = oi and
+      f = oi.getAMemberInitializer().getInitializedMember() and
+      c = f.getContent()
+    )
   }
 
   /**
@@ -885,6 +916,8 @@ private module Cached {
     n instanceof SummaryNodeImpl
     or
     n instanceof ParamsArgumentNode
+    or
+    n.asExpr() = any(WithExpr we).getInitializer()
   }
 }