Swift: Model .base, withUTF8(_:).

Author: geoffw0

swift/ql/lib/codeql/swift/frameworks/StandardLibrary/String.qll

@@ -125,6 +125,9 @@ private class StringSummaries extends SummaryModelCsv {
         ";String;true;enumerated();;;Argument[-1];ReturnValue;taint",
         ";String;true;encode(to:);;;Argument[-1];Argument[0];taint",
         ";LosslessStringConvertible;true;init(_:);;;Argument[0];ReturnValue;taint",
+        ";Substring;true;withUTF8(_:);;;Argument[-1];Argument[0].Parameter[0].CollectionElement;taint",
+        ";Substring;true;withUTF8(_:);;;Argument[0].Parameter[0].CollectionElement;Argument[-1];taint",
+        ";Substring;true;withUTF8(_:);;;Argument[0].ReturnValue;ReturnValue;value",
       ]
   }
 }
@@ -154,6 +157,9 @@ private class StringFieldsInheritTaint extends TaintInheritingContent,
         or
         namedTypeDecl.getFullName() = "CustomDebugStringConvertible" and
         fieldDecl.getName() = "debugDescription"
+        or
+        namedTypeDecl.getFullName() = "Substring" and
+        fieldDecl.getName() = "base"
       ) and
       declaringDecl.getAMember() = fieldDecl and
       declaringDecl.asNominalTypeDecl() = namedTypeDecl.getADerivedTypeDecl*() and

swift/ql/test/library-tests/dataflow/taint/libraries/string.swift

@@ -655,7 +655,7 @@ func testSubstringMembers() {
 
   let sub1 = tainted[..<tainted.index(tainted.endIndex, offsetBy: -5)]
   sink(arg: sub1) // $ tainted=654
-  sink(arg: sub1.base) // $ MISSING: tainted=
+  sink(arg: sub1.base) // $ tainted=654
   sink(arg: sub1.utf8) // $ tainted=654
   sink(arg: sub1.capitalized) // $ tainted=654
   sink(arg: sub1.description) // $ tainted=654
@@ -664,10 +664,10 @@ func testSubstringMembers() {
   sink(arg: sub2) // $ tainted=654
   let result1 = sub2.withUTF8({
     buffer in
-    sink(arg: buffer[0]) // $ MISSING: tainted=
+    sink(arg: buffer[0]) // $ tainted=654
     return source()
   })
-  sink(arg: result1) // $ MISSING: tainted=
+  sink(arg: result1) // $ tainted=668
 
   let sub3 = Substring(sub2.utf8)
   sink(arg: sub3) // $ tainted=654