Merge pull request #200 from github/hvitved/dataflow/call-sensitivity

Data flow: Call-sensitive resolution of lambda/block calls

Author: hvitved

codeql

@@ -249,7 +249,7 @@ module ExprNodes {
   class CallCfgNode extends ExprCfgNode {
     override CallExprChildMapping e;
 
-    final override Call getExpr() { result = ExprCfgNode.super.getExpr() }
+    override Call getExpr() { result = super.getExpr() }
 
     /** Gets the `n`th argument of this call. */
     final ExprCfgNode getArgument(int n) { e.hasCfgChild(e.getArgument(n), this, result) }
@@ -270,7 +270,9 @@ module ExprNodes {
 
   /** A control-flow node that wraps a `MethodCall` AST expression. */
   class MethodCallCfgNode extends CallCfgNode {
-    MethodCallCfgNode() { this.getExpr() instanceof MethodCall }
+    MethodCallCfgNode() { super.getExpr() instanceof MethodCall }
+
+    final override MethodCall getExpr() { result = super.getExpr() }
   }
 
   /** A control-flow node that wraps a `CaseExpr` AST expression. */

ql/src/codeql_ruby/controlflow/CfgNodes.qll

@@ -282,7 +282,10 @@ private DataFlow::LocalSourceNode trackModule(Module tp) {
 }
 
 /** Gets a viable run-time target for the call `call`. */
-DataFlowCallable viableCallable(DataFlowCall call) { result = call.getTarget() }
+DataFlowCallable viableCallable(DataFlowCall call) {
+  result = call.getTarget() and
+  not call.getExpr() instanceof YieldCall // handled by `lambdaCreation`/`lambdaCall`
+}
 
 /**
  * Holds if the set of viable implementations that can be called by `call`