Merge pull request #22662 from asgerf/unified/mad-approx

Unified: Port old MaD models from swift

Author: asgerf

unified/ql/lib/codeql/unified/internal/AnalysisQuality.qll

@@ -108,3 +108,28 @@ module CallGraphStats implements EntityStatsSig {
 }
 
 module CallGraphStatsReport = EntityReportStats<CallGraphStats>;
+
+/**
+ * Gets summary statistics about taint.
+ */
+predicate taintStats(string key, int value) {
+  // The keys must match those in DCA summary profiles
+  key = "Taint sources - active" and value = count(DataFlow::Node n | Models::isSource(n, "remote"))
+  or
+  key = "Taint sources - disabled" and
+  value = count(DataFlow::Node n | Models::isSource(n, any(string s | s != "remote")))
+  or
+  key = "Taint sources - sensitive data" and none()
+  or
+  key = "Taint edges - number of edges" and none()
+  or
+  key = "Taint reach - nodes tainted" and none()
+  or
+  key = "Taint reach - total non-summary nodes" and none()
+  or
+  key = "Taint reach - per million nodes" and none()
+  or
+  key = "Taint sinks - query sinks" and value = count(DataFlow::Node n | Models::isSink(n, _))
+  or
+  key = "Taint sinks - cryptographic operations" and none()
+}

unified/ql/lib/codeql/unified/internal/FacadeAst.qll

@@ -5,6 +5,7 @@ overlay[local?]
 module;
 
 private import codeql.files.FileSystem
+private import codeql.unified.internal.NameBinding as NameBinding
 
 module Unified {
   private import Ast::Unified as G
@@ -145,6 +146,13 @@ module Unified {
   class ClassLikeDeclaration extends G::ClassLikeDeclaration {
     /** Gets the name of this declaration. */
     string getName() { result = this.getNameNode().getValue() }
+
+    /** Gets a direct base class of this class. */
+    ClassLikeDeclaration getABaseClass() {
+      result.getNameNode() =
+        NameBinding::getStaticBindingTarget(NameBinding::getIdentifierFromRef(this.getABaseType()
+                .getType()))
+    }
   }
 
   class ConstructorDeclaration extends G::ConstructorDeclaration {
@@ -260,5 +268,10 @@ module Unified {
 
     /** Gets the number of arguments passed to this call, not counting implicit arguments like receiver. */
     int getNumberOfArguments() { result = count(this.getAnArgument()) }
+
+    /** Gets the number of positional arguments passed to this call. */
+    int getNumberOfPositionalArguments() {
+      result = count(Argument arg | arg = this.getAnArgument() and arg.isPositional())
+    }
   }
 }

unified/ql/lib/codeql/unified/internal/dataflow/DataFlowGraph.qll

@@ -148,7 +148,7 @@ module DebugGraph<relevantNodeSig/1 relevantNode> {
         if isUseStep = true then value = "use-use" else value = "def-use"
       )
       or
-      node2 = getPostUpdateNode(node1) and
+      node2 = node1.getPostUpdateNode() and
       value = "post-update"
     )
   }

unified/ql/lib/codeql/unified/internal/dataflow/DataFlowInstantiation.qll

@@ -101,9 +101,9 @@ module DataFlowInput implements InputSig<Location> {
   // Post-update nodes
   //
   class PostUpdateNode extends Node {
-    PostUpdateNode() { this = getPostUpdateNode(_) }
+    PostUpdateNode() { this = any(Node n).getPostUpdateNode() }
 
-    Node getPreUpdateNode() { this = getPostUpdateNode(result) }
+    Node getPreUpdateNode() { this = result.getPostUpdateNode() }
   }
 
   //

unified/ql/lib/codeql/unified/internal/dataflow/DataFlowNode.qll

@@ -315,21 +315,27 @@ class Node extends TDataFlowNode {
 
   /** Gets the basic block associated with this data flow node, if any. */
   BasicBlock getBasicBlock() { this.hasControlFlowPosition(result, _) }
-}
 
-Node getPostUpdateNode(Node pre) {
-  exists(Expr expr |
-    pre.isResultValue(expr) and
-    result.isPostUpdate(expr)
-  )
-  or
-  exists(Expr expr, LocalVariable var |
-    pre.isLocalVariableRead(expr, var) and
-    result.isLocalVariablePostUpdate(expr, var)
-  )
-  or
-  exists(DataFlowCall call |
-    pre.isReceiverArgumentEx(call) and
-    result.isReceiverPostUpdateEx(call)
-  )
+  /**
+   * Gets the post-update node for this node, if any.
+   *
+   * The post-update node represents the updated state of the value held in this node, after it has been mutated by the surrounding assignment or call.
+   */
+  pragma[nomagic]
+  Node getPostUpdateNode() {
+    exists(Expr expr |
+      this.isResultValue(expr) and
+      result.isPostUpdate(expr)
+    )
+    or
+    exists(Expr expr, LocalVariable var |
+      this.isLocalVariableRead(expr, var) and
+      result.isLocalVariablePostUpdate(expr, var)
+    )
+    or
+    exists(DataFlowCall call |
+      this.isReceiverArgumentEx(call) and
+      result.isReceiverPostUpdateEx(call)
+    )
+  }
 }

unified/ql/lib/codeql/unified/internal/dataflow/LocalSsa.qll

@@ -95,7 +95,7 @@ Node getNodeFromLocalSsaNode(Ssa::Node n) {
   result = n.(Ssa::ExprNode).getExpr() and
   not postUpdateReadNode(n)
   or
-  result = getPostUpdateNode(n.(Ssa::ExprPostUpdateNode).getExpr())
+  result = n.(Ssa::ExprPostUpdateNode).getExpr().(Node).getPostUpdateNode()
   or
   exists(LocalVariable v, BasicBlock bb, int i, AstNode repr |
     n.(Ssa::WriteDefSourceNode).getDefinition().definesAt(v, bb, i) and