unified: Fix handling of unscoped imports

An `import X` declaration now does two things:
- X becomes a local name binding
- X is bulk-imported into the local scope

The AST mapping now maps it to X with a bulk-importing pattern as a sub-pattern.

Module names can no longer be referenced anywhere except as the leading qualifier of an import statement.

Author: asgerf

unified/extractor/ast_types.yml

@@ -413,6 +413,7 @@ named:
   name_pattern:
     modifier*: modifier
     identifier: identifier
+    sub_pattern?: pattern
 
   # A pattern matching anything, binding no variables, usually using the syntax "_"
   ignore_pattern:

unified/extractor/src/languages/swift/swift.rs

@@ -1023,13 +1023,12 @@ fn translation_rules() -> Vec<Rule<SwiftContext>> {
                 path: (importPathComponent name: @@parts)*)
             =>
             import_declaration {
-                let pattern = match kind {
-                    Some(_) => {
-                        let last = *parts.last().ok_or("import has no path")?;
-                        tree!((name_pattern identifier: (identifier #{last})))
-                    }
-                    None => tree!((bulk_importing_pattern)),
+                let bulk_import = match kind {
+                    None => Some(tree!((bulk_importing_pattern))),
+                    Some(_) => None, // scoped import, no bulk import
                 };
+                let last = *parts.last().ok_or("import has no path")?;
+                let pattern = tree!((name_pattern identifier: (identifier #{last}) sub_pattern: {bulk_import}));
                 tree!((import_declaration
                     modifier: (modifier #{kind})?
                     modifier: {attrs}

unified/extractor/tests/corpus/swift/desugar/import-with-deeply-nested-path-three-parts.output

@@ -37,4 +37,7 @@ top_level
                       identifier: identifier "Foundation"
                   member: identifier "Networking"
               member: identifier "URLSession"
-          pattern: bulk_importing_pattern "import Foundation.Networking.URLSession"
+          pattern:
+            name_pattern
+              identifier: identifier "URLSession"
+              sub_pattern: bulk_importing_pattern "import Foundation.Networking.URLSession"

unified/extractor/tests/corpus/swift/desugar/import-with-dotted-path-two-parts.output

@@ -31,4 +31,7 @@ top_level
                 name_expr
                   identifier: identifier "Foundation"
               member: identifier "Networking"
-          pattern: bulk_importing_pattern "import Foundation.Networking"
+          pattern:
+            name_pattern
+              identifier: identifier "Networking"
+              sub_pattern: bulk_importing_pattern "import Foundation.Networking"

unified/extractor/tests/corpus/swift/desugar/simple-import-with-single-name.output

@@ -25,4 +25,7 @@ top_level
           imported_expr:
             name_expr
               identifier: identifier "Foundation"
-          pattern: bulk_importing_pattern "import Foundation"
+          pattern:
+            name_pattern
+              identifier: identifier "Foundation"
+              sub_pattern: bulk_importing_pattern "import Foundation"

unified/ql/lib/codeql/unified/internal/Ast.qll

@@ -1078,9 +1078,14 @@ module Unified {
     /** Gets the node corresponding to the field `modifier`. */
     final F::Modifier getAModifier() { result = this.getModifier(_) }
 
+    /** Gets the node corresponding to the field `sub_pattern`. */
+    final F::Pattern getSubPattern() { unified_name_pattern_sub_pattern(this, result) }
+
     /** Gets a field or child node of this node. */
     final override F::AstNode getAFieldOrChild() {
-      unified_name_pattern_def(this, result) or unified_name_pattern_modifier(this, _, result)
+      unified_name_pattern_def(this, result) or
+      unified_name_pattern_modifier(this, _, result) or
+      unified_name_pattern_sub_pattern(this, result)
     }
   }
 
@@ -1895,6 +1900,8 @@ module Unified {
       or
       result = node.(NamePattern).getModifier(i) and name = "getModifier"
       or
+      result = node.(NamePattern).getSubPattern() and i = -1 and name = "getSubPattern"
+      or
       result = node.(NamedTypeExpr).getName() and i = -1 and name = "getName"
       or
       result = node.(NamedTypeExpr).getQualifier() and i = -1 and name = "getQualifier"

unified/ql/lib/codeql/unified/internal/LocalNameBinding.qll

@@ -323,8 +323,6 @@ private module LocalNameBindingInput implements LocalNameBindingInputSig<Locatio
     //   because the associated uncertain scope is a Member, from which we can check static-ness.
     scope = any(ClassLikeDeclaration cls).getAMember()
     or
-    scope = any(TopLevel t) // Global module names are in scope here
-    or
     scope = any(TopLevel t).getBody() // Imported names are in scope here
     or
     // Scopes with a bulk-import have uncertain members

unified/ql/lib/codeql/unified/internal/NameBindingPlugin.qll

@@ -54,7 +54,8 @@ abstract class ModuleScopeRepr extends AstNode {
   predicate shouldInclude(Container c, string path) { none() }
 
   /**
-   * Holds if this module scope can be referenced by an unqualified identifier `name`.
+   * Holds if this module scope can be referenced by an identifier `name`
+   * appearing as the leading identifier of an import path.
    */
   predicate hasImportableName(string name) { none() }
 

unified/ql/lib/codeql/unified/internal/StaticNameBinding.qll

@@ -12,8 +12,7 @@ private newtype TNameBindingNode =
   TLocalName(LocalName local) or
   TExportedNamespace(ClassLikeDeclaration cls) or
   TLocalNamespace(AstNode n) {
-    n = any(TopLevel t) or // Module names come in scope here
-    n = any(TopLevel t).getBody() or // Imported names come in scope here (shadowing module names)
+    n = any(TopLevel t).getBody() or // Imported names come in scope here
     n instanceof ClassLikeDeclaration
   } or
   TModuleScope(ModuleScopeRepr repr) or
@@ -129,6 +128,13 @@ predicate readStep(NameBindingNode node1, string name, NameBindingNode node2) {
     node1 = getNodeFromUncertainScope(LocalNameBindingOutput::getAnUncertainScope(access, name)) and
     node2.isIdentifier(access)
   )
+  or
+  exists(NameExpr expr |
+    isImportPrefix(expr) and
+    node1.isModuleRoot() and
+    name = expr.getIdentifier().getValue() and
+    node2 = getNodeFromRef(expr)
+  )
 }
 
 predicate storeStep(NameBindingNode node1, string name, NameBindingNode node2) {
@@ -181,9 +187,6 @@ predicate valueStep(NameBindingNode node1, NameBindingNode node2) {
   )
   or
   exists(TopLevel top |
-    node1.isModuleRoot() and
-    node2.isLocalNamespace(top) // module names in outermost scope
-    or
     node1 = getModuleNodeFromFile(top.getFile()) and
     node2.isLocalNamespace(top.getBody()) // implicitly import own module
   )
@@ -206,6 +209,20 @@ predicate valueStep(NameBindingNode node1, NameBindingNode node2) {
       node2 = getModuleNodeFromFile(top.getFile())
     )
   )
+  or
+  exists(NamePattern p |
+    node1 = getNodeFromRef(p) and
+    node2 = getNodeFromRef(p.getSubPattern())
+  )
+}
+
+private predicate isImportPrefix(Expr e) {
+  e = any(ImportDeclaration impr).getImportedExpr()
+  or
+  exists(MemberAccessExpr member |
+    isImportPrefix(member) and
+    e = member.getBase()
+  )
 }
 
 predicate inheritanceStep(NameBindingNode supertype, NameBindingNode subtype) {

unified/ql/lib/unified.dbscheme

@@ -687,6 +687,11 @@ unified_name_pattern_modifier(
   unique int modifier: @unified_token_modifier ref
 );
 
+unified_name_pattern_sub_pattern(
+  unique int unified_name_pattern: @unified_name_pattern ref,
+  unique int sub_pattern: @unified_pattern ref
+);
+
 unified_name_pattern_def(
   unique int id: @unified_name_pattern,
   int identifier: @unified_token_identifier ref