Swift: Add detail to the swift/summary/summary-statistics query.

Author: geoffw0

swift/ql/src/queries/Summary/SummaryStats.ql

@@ -23,14 +23,19 @@ class TaintReachConfig extends TaintTracking::Configuration {
   override predicate isSink(DataFlow::Node node) { any() }
 }
 
-float taintReach() {
-  exists(TaintReachConfig config, int tainted, int total |
-    tainted = count(DataFlow::Node n | config.hasFlowTo(n)) and
-    total = count(DataFlow::Node n) and
-    result = (tainted * 1000000.0) / total
-  )
+/**
+ * Gets the total number of dataflow nodes that taint reaches (from any source).
+ */
+int taintedNodesCount() {
+  exists(TaintReachConfig config | result = count(DataFlow::Node n | config.hasFlowTo(n)))
 }
 
+/**
+ * Gets the proportion of dataflow nodes that taint reaches (from any source),
+ * expressed as a count per million nodes.
+ */
+float taintReach() { result = (taintedNodesCount() * 1000000.0) / count(DataFlow::Node n) }
+
 predicate statistic(string what, string value) {
   what = "Files" and value = count(File f).toString()
   or
@@ -42,6 +47,10 @@ predicate statistic(string what, string value) {
   or
   what = "Sensitive expressions" and value = count(SensitiveExpr e).toString()
   or
+  what = "Dataflow nodes (total)" and value = count(DataFlow::Node n).toString()
+  or
+  what = "Dataflow nodes (tainted)" and value = taintedNodesCount().toString()
+  or
   what = "Taint reach (per million nodes)" and value = taintReach().toString()
 }