Dataflow for implicit self argument of methods

Author: aibaars

ql/src/codeql_ruby/dataflow/internal/DataFlowPrivate.qll

@@ -116,10 +116,11 @@ private module Cached {
     TReturningNode(CfgNodes::ReturningCfgNode n) or
     TSsaDefinitionNode(Ssa::Definition def) or
     TNormalParameterNode(Parameter p) { not p instanceof BlockParameter } or
+    TSelfParameterNode(MethodBase m) or
     TBlockParameterNode(MethodBase m) or
     TExprPostUpdateNode(CfgNodes::ExprCfgNode n) { n.getNode() instanceof Argument }
 
-  class TParameterNode = TNormalParameterNode or TBlockParameterNode;
+  class TParameterNode = TNormalParameterNode or TBlockParameterNode or TSelfParameterNode;
 
   /**
    * This is the local flow predicate that is used as a building block in global
@@ -137,6 +138,9 @@ private module Cached {
     nodeTo.(ParameterNode).getParameter().(KeywordParameter).getDefaultValue() =
       nodeFrom.asExpr().getExpr()
     or
+    nodeFrom.(SelfParameterNode).getMethod() = nodeTo.asExpr().getExpr().getEnclosingMethod() and
+    nodeTo.asExpr().getExpr() instanceof Self
+    or
     nodeFrom.asExpr() = nodeTo.asExpr().(CfgNodes::ExprNodes::AssignExprCfgNode).getRhs()
     or
     nodeFrom.asExpr() = nodeTo.asExpr().(CfgNodes::ExprNodes::BlockArgumentCfgNode).getValue()
@@ -242,6 +246,26 @@ private module ParameterNodes {
     override string toStringImpl() { result = parameter.toString() }
   }
 
+  /**
+   * The value of the `self` parameter at function entry, viewed as a node in a data
+   * flow graph.
+   */
+  class SelfParameterNode extends ParameterNodeImpl, TSelfParameterNode {
+    private MethodBase method;
+
+    SelfParameterNode() { this = TSelfParameterNode(method) }
+
+    final MethodBase getMethod() { result = method }
+
+    override predicate isParameterOf(Callable c, int i) { method = c and i = -1 }
+
+    override CfgScope getCfgScope() { result = method }
+
+    override Location getLocationImpl() { result = method.getLocation() }
+
+    override string toStringImpl() { result = "self in " + method.toString() }
+  }
+
   /**
    * The value of a block parameter at function entry, viewed as a node in a data
    * flow graph.
@@ -295,11 +319,18 @@ private module ArgumentNodes {
       not this.asExpr().getExpr() instanceof BlockArgument
     }
 
+    override predicate argumentOf(DataFlowCall call, int pos) {
+      this.asExpr() = call.getArgument(pos)
+    }
+  }
+
+  /** A data-flow node that represents the `self` argument of a call. */
+  class SelfArgumentNode extends ArgumentNode {
+    SelfArgumentNode() { this.asExpr() = any(CfgNodes::ExprNodes::CallCfgNode call).getReceiver() }
+
     override predicate argumentOf(DataFlowCall call, int pos) {
       this.asExpr() = call.getReceiver() and
       pos = -1
-      or
-      this.asExpr() = call.getArgument(pos)
     }
   }
 

ql/test/library-tests/dataflow/local/DataflowStep.expected

@@ -1,3 +1,4 @@
+| local_dataflow.rb:1:1:7:3 | self in foo | local_dataflow.rb:3:8:3:10 | self |
 | local_dataflow.rb:1:9:1:9 | a | local_dataflow.rb:1:9:1:9 | a |
 | local_dataflow.rb:1:9:1:9 | a | local_dataflow.rb:2:7:2:7 | a |
 | local_dataflow.rb:2:3:2:7 | ... = ... | local_dataflow.rb:3:13:3:13 | b |

ql/test/library-tests/modules/callgraph.expected

@@ -52,6 +52,8 @@ getTarget
 | calls.rb:137:5:137:17 | call to call_block | calls.rb:67:1:69:3 | call_block |
 | calls.rb:140:1:140:28 | call to indirect | calls.rb:136:1:138:3 | indirect |
 | calls.rb:140:16:140:27 | call to bit_length | calls.rb:78:5:78:23 | bit_length |
+| calls.rb:145:9:145:17 | call to to_s | calls.rb:150:5:151:7 | to_s |
+| calls.rb:145:9:145:17 | call to to_s | calls.rb:155:5:156:7 | to_s |
 | calls.rb:159:1:159:5 | call to new | calls.rb:98:5:98:16 | new |
 | calls.rb:159:1:159:14 | call to s_method | calls.rb:144:5:146:7 | s_method |
 | calls.rb:160:1:160:5 | call to new | calls.rb:98:5:98:16 | new |
@@ -87,4 +89,3 @@ unresolvedCall
 | calls.rb:128:48:128:59 | call to capitalize |
 | calls.rb:132:28:132:39 | call to capitalize |
 | calls.rb:134:32:134:36 | call to abs |
-| calls.rb:145:9:145:17 | call to to_s |