Swift: Replace getABaseOrAliasedType with slightly more sophisticated getABaseType.

geoffw0 · geoffw0 · commit 8a805bb7a3ad · 2023-03-31T14:16:42.000+01:00
diff --git a/swift/ql/lib/codeql/swift/elements/type/NominalType.qll b/swift/ql/lib/codeql/swift/elements/type/NominalType.qll
@@ -3,7 +3,7 @@ private import codeql.swift.elements.decl.NominalTypeDecl
 private import codeql.swift.elements.type.Type
 
 class NominalType extends Generated::NominalType {
-  Type getABaseType() { result = this.getDeclaration().(NominalTypeDecl).getABaseType() }
+  override Type getABaseType() { result = this.getDeclaration().(NominalTypeDecl).getABaseType() }
 
   NominalType getADerivedType() { result.getABaseType() = this }
 
diff --git a/swift/ql/lib/codeql/swift/elements/type/Type.qll b/swift/ql/lib/codeql/swift/elements/type/Type.qll
@@ -15,20 +15,16 @@ class Type extends Generated::Type {
   Type getUnderlyingType() { result = this }
 
   /**
-   * Gets any base type of this type, or the result of resolving a typedef. For
-   * example in the following code, `C` has base type `B` which has underlying
-   * type `A`. Thus, `getABaseOrAliasedType*` can be used to discover the
-   * relationship between `C` and `A`.
+   * Gets any base type of this type. For a `typealias`, this is a base type
+   * of the aliased type. For example in the following code, both `B` and
+   * `B_alias` have base type `A`.
    * ```
    * class A {}
    *
-   * typealias B = A
+   * class B : A {}
    *
-   * class C : B {}
+   * typealias B_alias = B
    * ```
    */
-  Type getABaseOrAliasedType() {
-    result = this.(NominalType).getABaseType() or
-    result = this.(TypeAliasType).getAliasedType()
-  }
+  Type getABaseType() { none() }
 }
diff --git a/swift/ql/lib/codeql/swift/elements/type/TypeAliasType.qll b/swift/ql/lib/codeql/swift/elements/type/TypeAliasType.qll
@@ -13,4 +13,6 @@ class TypeAliasType extends Generated::TypeAliasType {
   Type getAliasedType() { result = this.getDecl().getAliasedType() }
 
   override Type getUnderlyingType() { result = this.getAliasedType().getUnderlyingType() }
+
+  override Type getABaseType() { result = getAliasedType().getABaseType() }
 }
diff --git a/swift/ql/lib/codeql/swift/security/CleartextStorageDatabaseExtensions.qll b/swift/ql/lib/codeql/swift/security/CleartextStorageDatabaseExtensions.qll
@@ -49,7 +49,7 @@ private class CoreDataStore extends CleartextStorageDatabaseSink {
     // with `coreDataObj.data` is a sink.
     // (ideally this would be only members with the `@NSManaged` attribute)
     exists(NominalType t, Expr e |
-      t.getABaseOrAliasedType*().getName() = "NSManagedObject" and
+      t.getABaseType*().getUnderlyingType().getName() = "NSManagedObject" and
       this.(DataFlow::PostUpdateNode).getPreUpdateNode().asExpr() = e and
       e.getFullyConverted().getType() = t and
       not e.(DeclRefExpr).getDecl() instanceof SelfParamDecl
@@ -67,7 +67,7 @@ private class RealmStore extends CleartextStorageDatabaseSink instanceof DataFlo
     // example in `realmObj.data = sensitive` the post-update node corresponding
     // with `realmObj.data` is a sink.
     exists(NominalType t, Expr e |
-      t.getABaseOrAliasedType*().getName() = "RealmSwiftObject" and
+      t.getABaseType*().getUnderlyingType().getName() = "RealmSwiftObject" and
       this.getPreUpdateNode().asExpr() = e and
       e.getFullyConverted().getType() = t and
       not e.(DeclRefExpr).getDecl() instanceof SelfParamDecl
diff --git a/swift/ql/lib/codeql/swift/security/CleartextStorageDatabaseQuery.qll b/swift/ql/lib/codeql/swift/security/CleartextStorageDatabaseQuery.qll
@@ -38,7 +38,7 @@ class CleartextStorageConfig extends TaintTracking::Configuration {
     // for example in `realmObj.data = sensitive`.
     isSink(node) and
     exists(NominalTypeDecl d, Decl cx |
-      d.getType().getABaseOrAliasedType*().getName() = ["NSManagedObject", "RealmSwiftObject"] and
+      d.getType().getABaseType*().getUnderlyingType().getName() = ["NSManagedObject", "RealmSwiftObject"] and
       cx.asNominalTypeDecl() = d and
       c.getAReadContent().(DataFlow::Content::FieldContent).getField() = cx.getAMember()
     )
diff --git a/swift/ql/test/library-tests/elements/type/nominaltype/nominaltype.expected b/swift/ql/test/library-tests/elements/type/nominaltype/nominaltype.expected
@@ -1,13 +1,13 @@
 | nominaltype.swift:35:6:35:6 | a | A | A |  |
-| nominaltype.swift:36:6:36:6 | a_alias | A_alias | A | getABaseOrAliasedType:A, getAliasedType:A |
-| nominaltype.swift:37:6:37:6 | a_optional_alias | A_optional_alias | Optional<A> | getABaseOrAliasedType:Optional<A>, getAliasedType:Optional<A> |
-| nominaltype.swift:38:6:38:6 | b1 | B1 | B1 | getABaseOrAliasedType:A, getABaseType:A |
-| nominaltype.swift:39:6:39:6 | b2 | B2 | B2 | getABaseOrAliasedType:A_alias, getABaseType:A_alias |
-| nominaltype.swift:40:6:40:6 | b1_alias | B1_alias | B1 | getABaseOrAliasedType:B1, getAliasedType:B1 |
-| nominaltype.swift:41:6:41:6 | b2_alias | B2_alias | B2 | getABaseOrAliasedType:B2, getAliasedType:B2 |
+| nominaltype.swift:36:6:36:6 | a_alias | A_alias | A | getAliasedType:A |
+| nominaltype.swift:37:6:37:6 | a_optional_alias | A_optional_alias | Optional<A> | getAliasedType:Optional<A> |
+| nominaltype.swift:38:6:38:6 | b1 | B1 | B1 | getABaseType:A |
+| nominaltype.swift:39:6:39:6 | b2 | B2 | B2 | getABaseType:A_alias |
+| nominaltype.swift:40:6:40:6 | b1_alias | B1_alias | B1 | getABaseType:A, getAliasedType:B1 |
+| nominaltype.swift:41:6:41:6 | b2_alias | B2_alias | B2 | getABaseType:A_alias, getAliasedType:B2 |
 | nominaltype.swift:42:6:42:6 | p | P | P |  |
 | nominaltype.swift:43:6:43:6 | p_alias | P_alias | P_alias |  |
-| nominaltype.swift:44:6:44:6 | c1 | C1 | C1 | getABaseOrAliasedType:P, getABaseType:P |
-| nominaltype.swift:45:6:45:6 | c2 | C2 | C2 | getABaseOrAliasedType:P_alias, getABaseType:P_alias |
-| nominaltype.swift:46:6:46:6 | c1_alias | C1_alias | C1 | getABaseOrAliasedType:C1, getAliasedType:C1 |
-| nominaltype.swift:47:6:47:6 | c2_alias | C2_alias | C2 | getABaseOrAliasedType:C2, getAliasedType:C2 |
+| nominaltype.swift:44:6:44:6 | c1 | C1 | C1 | getABaseType:P |
+| nominaltype.swift:45:6:45:6 | c2 | C2 | C2 | getABaseType:P_alias |
+| nominaltype.swift:46:6:46:6 | c1_alias | C1_alias | C1 | getABaseType:P, getAliasedType:C1 |
+| nominaltype.swift:47:6:47:6 | c2_alias | C2_alias | C2 | getABaseType:P_alias, getAliasedType:C2 |
diff --git a/swift/ql/test/library-tests/elements/type/nominaltype/nominaltype.ql b/swift/ql/test/library-tests/elements/type/nominaltype/nominaltype.ql
@@ -3,9 +3,7 @@ import swift
 string describe(Type t) {
   result = "getAliasedType:" + t.(TypeAliasType).getAliasedType()
   or
-  result = "getABaseType:" + t.(NominalType).getABaseType()
-  or
-  result = "getABaseOrAliasedType:" + t.getABaseOrAliasedType()
+  result = "getABaseType:" + t.getABaseType()
 }
 
 from VarDecl v, Type t

Original file line number	Diff line number	Diff line change
`@@ -13,4 +13,6 @@ class TypeAliasType extends Generated::TypeAliasType {`
`13`	`13`	`Type getAliasedType() { result = this.getDecl().getAliasedType() }`
`14`	`14`
`15`	`15`	`override Type getUnderlyingType() { result = this.getAliasedType().getUnderlyingType() }`
	`16`	`+`
	`17`	`+ override Type getABaseType() { result = getAliasedType().getABaseType() }`
`16`	`18`	`}`
Original file line number	Diff line number	Diff line change
`@@ -38,7 +38,7 @@ class CleartextStorageConfig extends TaintTracking::Configuration {`
`38`	`38`	// for example in `realmObj.data = sensitive`.
`39`	`39`	`isSink(node) and`
`40`	`40`	`exists(NominalTypeDecl d, Decl cx \|`
`41`		`- d.getType().getABaseOrAliasedType*().getName() = ["NSManagedObject", "RealmSwiftObject"] and`
	`41`	`+ d.getType().getABaseType*().getUnderlyingType().getName() = ["NSManagedObject", "RealmSwiftObject"] and`
`42`	`42`	`cx.asNominalTypeDecl() = d and`
`43`	`43`	`c.getAReadContent().(DataFlow::Content::FieldContent).getField() = cx.getAMember()`
`44`	`44`	`)`