Swift: only read ArrayContent from subscript keypaths

rdmarsh2 · rdmarsh2 · commit 093c6905ddd5 · 2023-07-18T19:42:54.000Z
diff --git a/swift/ql/lib/codeql/swift/dataflow/internal/DataFlowPrivate.qll b/swift/ql/lib/codeql/swift/dataflow/internal/DataFlowPrivate.qll
@@ -764,7 +764,8 @@ predicate readStep(Node node1, ContentSet c, Node node2) {
     (
       c.isSingleton(any(Content::FieldContent ct | ct.getField() = component.getDeclRef()))
       or
-      c.isSingleton(any(Content::ArrayContent ac))
+      c.isSingleton(any(Content::ArrayContent ac)) and
+      component.isSubscript()
     )
   |
     // the next node is either the next element in the chain

Original file line number	Diff line number	Diff line change
`@@ -764,7 +764,8 @@ predicate readStep(Node node1, ContentSet c, Node node2) {`
`764`	`764`	`(`
`765`	`765`	`c.isSingleton(any(Content::FieldContent ct \| ct.getField() = component.getDeclRef()))`
`766`	`766`	`or`
`767`		`- c.isSingleton(any(Content::ArrayContent ac))`
	`767`	`+ c.isSingleton(any(Content::ArrayContent ac)) and`
	`768`	`+ component.isSubscript()`
`768`	`769`	`)`
`769`	`770`	`\|`
`770`	`771`	`// the next node is either the next element in the chain`