better type resolution of add expressions

Author: erik-krogh

ql/src/codeql_ql/ast/Ast.qll

@@ -1794,6 +1794,7 @@ class Negation extends TNegation, Formula {
 
 /** An expression, such as `x+4`. */
 class Expr extends TExpr, AstNode {
+  cached
   Type getType() { none() }
 }
 
@@ -1874,15 +1875,14 @@ class AddSubExpr extends TAddSubExpr, BinOpExpr {
     result = this.getLeftOperand().getType() and
     result = this.getRightOperand().getType()
     or
-    // Both operands are subtypes of `int`
-    result.getName() = "int" and
-    result = this.getLeftOperand().getType().getASuperType*() and
-    result = this.getRightOperand().getType().getASuperType*()
+    // Both operands are subtypes of `int` / `string` / `float`
+    exprOfPrimitiveAddType(result) = this.getLeftOperand() and
+    exprOfPrimitiveAddType(result) = this.getRightOperand()
     or
     // Coercion to from `int` to `float`
     exists(PrimitiveType i | result.getName() = "float" and i.getName() = "int" |
       this.getAnOperand().getType() = result and
-      this.getAnOperand().getType().getASuperType*() = i
+      this.getAnOperand() = exprOfPrimitiveAddType(i)
     )
     or
     // Coercion to `string`
@@ -1899,6 +1899,18 @@ class AddSubExpr extends TAddSubExpr, BinOpExpr {
   }
 }
 
+pragma[noinline]
+private Expr exprOfPrimitiveAddType(PrimitiveType t) {
+  result.getType() = getASubTypeOfAddPrimitive(t)
+}
+
+private Type getASubTypeOfAddPrimitive(PrimitiveType prim) {
+  result = prim and
+  result.getName() = ["int", "string", "float"]
+  or
+  result.getASuperType() = getASubTypeOfAddPrimitive(prim)
+}
+
 /**
  * An addition expression, such as `x + y`.
  */

ql/test/type/type.expected

@@ -28,7 +28,9 @@
 | Test.qll:8:67:8:69 | Float | file://:0:0:0:0 | float |
 | Test.qll:11:37:11:42 | result | file://:0:0:0:0 | string |
 | Test.qll:11:46:11:46 | a | Test.qll:3:1:5:1 | Strings |
+| Test.qll:11:46:11:50 | AddExpr | file://:0:0:0:0 | string |
 | Test.qll:11:50:11:50 | b | Test.qll:3:1:5:1 | Strings |
 | Test.qll:13:36:13:41 | result | file://:0:0:0:0 | float |
 | Test.qll:13:45:13:45 | a | Test.qll:7:1:9:1 | Floats |
+| Test.qll:13:45:13:49 | AddExpr | file://:0:0:0:0 | float |
 | Test.qll:13:49:13:49 | b | Test.qll:7:1:9:1 | Floats |