unified: Allow self-return via receiver parameter

Author: asgerf

unified/ql/lib/codeql/unified/internal/dataflow/DataFlowInstantiation.qll

@@ -272,6 +272,8 @@ module DataFlowInput implements InputSig<Location> {
   predicate isUnreachableInCall(NodeRegion nr, DataFlowCall call) { none() } // TODO
 
   predicate allowParameterReturnInSelf(ParameterNode p) {
+    p.isReceiverParameter(_)
+    or
     captureSsaAllowParameterReturnInSelf(p)
     or
     exists(DataFlowCallable c, ParameterPosition pos |

unified/ql/test/library-tests/dataflow/accessors_instance.swift

@@ -86,5 +86,5 @@ func t8() {
     var c = C()
     c.field = source("t8.1")
     c.x = "safe"  // trigger the setter
-    sink(c.otherField)  // $ MISSING: hasTaintFlow=t8.1
+    sink(c.otherField)  // $ hasTaintFlow=t8.1
 }

unified/ql/test/library-tests/dataflow/test.expected

@@ -18,6 +18,13 @@ edges
 | accessors_instance.swift:73:15:73:28 | source(...) | accessors_instance.swift:73:5:73:11 | ... .field | provenance |  |
 | accessors_instance.swift:74:10:74:10 | c [field] | accessors_instance.swift:69:25:69:28 | self [field] | provenance |  |
 | accessors_instance.swift:74:10:74:10 | c [field] | accessors_instance.swift:74:10:74:12 | ... .x | provenance |  |
+| accessors_instance.swift:83:32:83:36 | field | accessors_instance.swift:83:19:83:28 | otherField | provenance |  |
+| accessors_instance.swift:87:5:87:5 | [post] c [field] | accessors_instance.swift:88:5:88:5 | c [field] | provenance |  |
+| accessors_instance.swift:87:5:87:11 | ... .field | accessors_instance.swift:87:5:87:5 | [post] c [field] | provenance |  |
+| accessors_instance.swift:87:15:87:28 | source(...) | accessors_instance.swift:87:5:87:11 | ... .field | provenance |  |
+| accessors_instance.swift:88:5:88:5 | c [field] | accessors_instance.swift:83:32:83:36 | field | provenance |  |
+| accessors_instance.swift:88:5:88:5 | c [field] | accessors_instance.swift:89:10:89:10 | c [otherField] | provenance |  |
+| accessors_instance.swift:89:10:89:10 | c [otherField] | accessors_instance.swift:89:10:89:21 | ... .otherField | provenance |  |
 | accessors_local.swift:7:21:7:34 | source(...) | accessors_local.swift:8:10:8:10 | x | provenance |  |
 | accessors_local.swift:15:15:15:28 | source(...) | accessors_local.swift:17:10:17:10 | x | provenance |  |
 | accessors_local.swift:22:15:22:28 | source(...) | accessors_local.swift:25:10:25:10 | x | provenance |  |
@@ -531,6 +538,14 @@ nodes
 | accessors_instance.swift:73:15:73:28 | source(...) | semmle.label | source(...) |
 | accessors_instance.swift:74:10:74:10 | c [field] | semmle.label | c [field] |
 | accessors_instance.swift:74:10:74:12 | ... .x | semmle.label | ... .x |
+| accessors_instance.swift:83:19:83:28 | otherField | semmle.label | otherField |
+| accessors_instance.swift:83:32:83:36 | field | semmle.label | field |
+| accessors_instance.swift:87:5:87:5 | [post] c [field] | semmle.label | [post] c [field] |
+| accessors_instance.swift:87:5:87:11 | ... .field | semmle.label | ... .field |
+| accessors_instance.swift:87:15:87:28 | source(...) | semmle.label | source(...) |
+| accessors_instance.swift:88:5:88:5 | c [field] | semmle.label | c [field] |
+| accessors_instance.swift:89:10:89:10 | c [otherField] | semmle.label | c [otherField] |
+| accessors_instance.swift:89:10:89:21 | ... .otherField | semmle.label | ... .otherField |
 | accessors_local.swift:7:21:7:34 | source(...) | semmle.label | source(...) |
 | accessors_local.swift:8:10:8:10 | x | semmle.label | x |
 | accessors_local.swift:15:15:15:28 | source(...) | semmle.label | source(...) |
@@ -1133,6 +1148,7 @@ nodes
 | test.swift:274:10:274:12 | f(...) | semmle.label | f(...) |
 subpaths
 | accessors_instance.swift:74:10:74:10 | c [field] | accessors_instance.swift:69:25:69:28 | self [field] | accessors_instance.swift:69:25:69:34 | ... .field | accessors_instance.swift:74:10:74:12 | ... .x |
+| accessors_instance.swift:88:5:88:5 | c [field] | accessors_instance.swift:83:32:83:36 | field | accessors_instance.swift:83:19:83:28 | otherField | accessors_instance.swift:89:10:89:10 | c [otherField] |
 | accessors_local.swift:45:9:45:9 | y | accessors_local.swift:46:21:46:21 | y | accessors_local.swift:46:21:46:21 | y | accessors_local.swift:47:10:47:10 | x |
 | accessors_local.swift:54:5:54:5 | y | accessors_local.swift:52:21:52:21 | y | accessors_local.swift:52:21:52:21 | y | accessors_local.swift:55:10:55:10 | x |
 | calls.swift:31:17:31:30 | source(...) | calls.swift:28:19:28:19 | x | calls.swift:29:16:29:24 | ... + ... | calls.swift:31:10:31:31 | target(...) |
@@ -1161,6 +1177,7 @@ testFailures
 | accessors_instance.swift:60:18:60:23 | ... .x | accessors_instance.swift:57:25:57:38 | source(...) | accessors_instance.swift:60:18:60:23 | ... .x | $@ | accessors_instance.swift:57:25:57:38 | source(...) | source(...) |
 | accessors_instance.swift:61:18:61:18 | x | accessors_instance.swift:57:25:57:38 | source(...) | accessors_instance.swift:61:18:61:18 | x | $@ | accessors_instance.swift:57:25:57:38 | source(...) | source(...) |
 | accessors_instance.swift:74:10:74:12 | ... .x | accessors_instance.swift:73:15:73:28 | source(...) | accessors_instance.swift:74:10:74:12 | ... .x | $@ | accessors_instance.swift:73:15:73:28 | source(...) | source(...) |
+| accessors_instance.swift:89:10:89:21 | ... .otherField | accessors_instance.swift:87:15:87:28 | source(...) | accessors_instance.swift:89:10:89:21 | ... .otherField | $@ | accessors_instance.swift:87:15:87:28 | source(...) | source(...) |
 | accessors_local.swift:8:10:8:10 | x | accessors_local.swift:7:21:7:34 | source(...) | accessors_local.swift:8:10:8:10 | x | $@ | accessors_local.swift:7:21:7:34 | source(...) | source(...) |
 | accessors_local.swift:17:10:17:10 | x | accessors_local.swift:15:15:15:28 | source(...) | accessors_local.swift:17:10:17:10 | x | $@ | accessors_local.swift:15:15:15:28 | source(...) | source(...) |
 | accessors_local.swift:25:10:25:10 | x | accessors_local.swift:22:15:22:28 | source(...) | accessors_local.swift:25:10:25:10 | x | $@ | accessors_local.swift:22:15:22:28 | source(...) | source(...) |