Merge pull request #14252 from geoffw0/protocol3

Swift: Improve getABaseType implementions

Author: geoffw0

swift/ql/.generated.list

@@ -0,0 +1,9 @@
+---
+category: majorAnalysis
+---
+
+* The predicates `getABaseType`, `getABaseTypeDecl`, `getADerivedType` and `getADerivedTypeDecl` on `Type` and `TypeDecl` now behave more usefully and consistently. They now explore through type aliases used in base class declarations, and include protocols added in extensions.
+
+To examine base class declarations at a low level without these enhancements, use `TypeDecl.getInheritedType`.
+
+`Type.getABaseType` (only) previously resolved a type alias it was called directly on. This behaviour no longer exists. To find any base type of a type that could be an alias, the construct `Type.getUnderlyingType().getABaseType*()` is recommended.

swift/ql/.gitattributes

@@ -417,14 +417,6 @@ private Element interpretElement0(
       subtypes = true and
       declWithMethod.asNominalTypeDecl() = namedTypeDecl.getADerivedTypeDecl*()
       or
-      // member declared in a type that's extended with a protocol that is the named type
-      exists(ExtensionDecl e |
-        e.getExtendedTypeDecl().getADerivedTypeDecl*() = declWithMethod.asNominalTypeDecl()
-      |
-        subtypes = true and
-        e.getAProtocol() = namedTypeDecl.getADerivedTypeDecl*()
-      )
-      or
       // member declared directly in the named type (or an extension of it)
       subtypes = false and
       declWithMethod.asNominalTypeDecl() = namedTypeDecl
@@ -442,14 +434,6 @@ private Element interpretElement0(
       subtypes = true and
       declWithField.asNominalTypeDecl() = namedTypeDecl.getADerivedTypeDecl*()
       or
-      // field declared in a type that's extended with a protocol that is the named type
-      exists(ExtensionDecl e |
-        e.getExtendedTypeDecl().getADerivedTypeDecl*() = declWithField.asNominalTypeDecl()
-      |
-        subtypes = true and
-        e.getAProtocol() = namedTypeDecl.getADerivedTypeDecl*()
-      )
-      or
       // field declared directly in the named type (or an extension of it)
       subtypes = false and
       declWithField.asNominalTypeDecl() = namedTypeDecl

swift/ql/lib/change-notes/2023-09-18-get-a-base-type.md

@@ -31,7 +31,7 @@ predicate defaultImplicitTaintRead(DataFlow::Node node, DataFlow::ContentSet cs)
   // So when the node is a `PostUpdateNode` we allow any sequence of implicit read steps of an appropriate
   // type to make sure we arrive at the sink with an empty access path.
   exists(NominalTypeDecl d, Decl cx |
-    node.(DataFlow::PostUpdateNode).getPreUpdateNode().asExpr().getType() =
+    node.(DataFlow::PostUpdateNode).getPreUpdateNode().asExpr().getType().getUnderlyingType() =
       d.getType().getABaseType*() and
     cx.asNominalTypeDecl() = d and
     cs.getAReadContent().(DataFlow::Content::FieldContent).getField() = cx.getAMember()

swift/ql/lib/codeql/swift/dataflow/ExternalFlow.qll

@@ -1,4 +1,9 @@
-// generated by codegen/codegen.py, remove this comment if you wish to edit this file
 private import codeql.swift.generated.decl.TypeAliasDecl
 
+/**
+ * A declaration of a type alias to another type. For example:
+ * ```
+ * typealias MyInt = Int
+ * ```
+ */
 class TypeAliasDecl extends Generated::TypeAliasDecl { }

swift/ql/lib/codeql/swift/dataflow/internal/TaintTrackingPublic.qll

@@ -35,11 +35,24 @@ class TypeDecl extends Generated::TypeDecl {
   deprecated Type getBaseType(int index) { result = this.getInheritedType(index) }
 
   /**
-   * Gets any of the base types of this type declaration.
+   * Gets any of the base types of this type declaration. Expands protocols added in
+   * extensions and expands type aliases. For example in the following code, `B` has
+   * base type `A`:
+   * ```
+   * typealias A_alias = A
+   *
+   * class B : A_alias {}
+   * ```
    */
   Type getABaseType() {
-    // TODO generalize this to resolve `TypeAliasDecl`s and consider bases added by extensions
-    result = this.getAnInheritedType()
+    // direct base type
+    result = this.getAnInheritedType().getUnderlyingType()
+    or
+    // protocol added in an extension of the type
+    exists(ExtensionDecl ed |
+      ed.getExtendedTypeDecl() = this and
+      ed.getAProtocol().getType() = result
+    )
   }
 
   /**
@@ -51,7 +64,14 @@ class TypeDecl extends Generated::TypeDecl {
   }
 
   /**
-   * Gets the declaration of any of the base types of this type declaration.
+   * Gets the declaration of any of the base types of this type declaration. Expands
+   * protocols added in extensions and expands type aliases. For example in the following
+   * code, `B` has base type `A`.
+   * ```
+   * typealias A_alias = A
+   *
+   * class B : A_alias {}
+   * ```
    */
   TypeDecl getABaseTypeDecl() { result = this.getABaseType().(AnyGenericType).getDeclaration() }
 
@@ -63,7 +83,14 @@ class TypeDecl extends Generated::TypeDecl {
   deprecated TypeDecl getDerivedTypeDecl(int i) { result.getBaseTypeDecl(i) = this }
 
   /**
-   * Gets the declaration of any type derived from this type declaration.
+   * Gets the declaration of any type derived from this type declaration. Expands protocols
+   * added in extensions and expands type aliases. For example in the following code, `B`
+   * is derived from `A`.
+   * ```
+   * typealias A_alias = A
+   *
+   * class B : A_alias {}
+   * ```
    */
   TypeDecl getADerivedTypeDecl() { result.getABaseTypeDecl() = this }
 

swift/ql/lib/codeql/swift/elements/decl/TypeAliasDecl.qll

@@ -1,9 +1,6 @@
 private import codeql.swift.generated.type.NominalType
-private import codeql.swift.elements.decl.NominalTypeDecl
-private import codeql.swift.elements.type.Type
 
-class NominalType extends Generated::NominalType {
-  override Type getABaseType() { result = this.getDeclaration().(NominalTypeDecl).getABaseType() }
-
-  NominalType getADerivedType() { result.getABaseType() = this }
-}
+/**
+ * A class, struct, enum or protocol.
+ */
+class NominalType extends Generated::NominalType { }

swift/ql/lib/codeql/swift/elements/decl/TypeDecl.qll

@@ -1,4 +1,5 @@
 private import codeql.swift.generated.type.Type
+private import codeql.swift.elements.type.AnyGenericType
 
 /**
  * A Swift type.
@@ -42,16 +43,24 @@ class Type extends Generated::Type {
   Type getUnderlyingType() { result = this }
 
   /**
-   * Gets any base type of this type. For a `typealias`, this is a base type
-   * of the aliased type. For example in the following code, both `B` and
-   * `B_alias` have base type `A`.
+   * Gets any base type of this type. Expands protocols added in extensions and expands
+   * type aliases. For example in the following code, `B` has base type `A`:
    * ```
-   * class A {}
+   * typealias A_alias = A
    *
-   * class B : A {}
+   * class B : A_alias {}
+   * ```
+   */
+  Type getABaseType() { result = this.(AnyGenericType).getDeclaration().getABaseType() }
+
+  /**
+   * Gets a type derived from this type. Expands type aliases, for example in the following
+   * code, `B` derives from type `A`.
+   * ```
+   * typealias A_alias = A
    *
-   * typealias B_alias = B
+   * class B : A_alias {}
    * ```
    */
-  Type getABaseType() { none() }
+  Type getADerivedType() { result.getABaseType() = this }
 }

swift/ql/lib/codeql/swift/elements/type/NominalType.qll

@@ -1,6 +1,12 @@
 private import codeql.swift.elements.type.Type
 private import codeql.swift.generated.type.TypeAliasType
 
+/**
+ * A type alias to another type. For example:
+ * ```
+ * typealias MyInt = Int
+ * ```
+ */
 class TypeAliasType extends Generated::TypeAliasType {
   /**
    * Gets the aliased type of this type alias type.
@@ -13,6 +19,4 @@ class TypeAliasType extends Generated::TypeAliasType {
   Type getAliasedType() { result = this.getDecl().getAliasedType() }
 
   override Type getUnderlyingType() { result = this.getAliasedType().getUnderlyingType() }
-
-  override Type getABaseType() { result = this.getAliasedType().getABaseType() }
 }