Merge pull request #168 from github/aibaars/typetrack-method

Call graph

Author: aibaars

ql/src/codeql_ruby/ast/Module.qll

@@ -20,6 +20,10 @@ class Module extends TModule {
   /** Gets an `include`d module. */
   Module getAnIncludedModule() { result = getAnIncludedModule(this) }
 
+  /** Holds if this module is a class. */
+  pragma[noinline]
+  predicate isClass() { this.getADeclaration() instanceof ClassDeclaration }
+
   /** Gets a textual representation of this module. */
   string toString() {
     this = TResolved(result)

ql/src/codeql_ruby/ast/internal/Module.qll

@@ -8,7 +8,13 @@ private import codeql_ruby.ast.Operation
 private import codeql_ruby.ast.Scope
 
 // Names of built-in modules and classes
-private string builtin() { result = ["Object", "Kernel", "BasicObject", "Class", "Module"] }
+private string builtin() {
+  result =
+    [
+      "Object", "Kernel", "BasicObject", "Class", "Module", "NilClass", "FalseClass", "TrueClass",
+      "Numeric", "Integer", "Float", "Rational", "Complex", "Array", "Hash", "Symbol", "Proc"
+    ]
+}
 
 cached
 private module Cached {
@@ -39,9 +45,14 @@ private module Cached {
   Module getSuperClass(Module cls) {
     cls = TResolved("Object") and result = TResolved("BasicObject")
     or
-    cls = TResolved("Module") and result = TResolved("Object")
+    cls = TResolved(["Module", "Numeric", "Array", "Hash", "FalseClass", "TrueClass", "NilClass"]) and
+    result = TResolved("Object")
+    or
+    cls = TResolved(["Integer", "Float", "Rational", "Complex"]) and
+    result = TResolved("Numeric")
     or
-    cls = TResolved("Class") and result = TResolved("Module")
+    cls = TResolved("Class") and
+    result = TResolved("Module")
     or
     not cls = TResolved(builtin()) and
     (
@@ -86,6 +97,39 @@ private module Cached {
       result = resolveScopeExpr(c.getAnArgument())
     )
   }
+
+  /**
+   * Resolve constant read access (typically a scope expression) to a qualified module name.
+   * `resolveScopeExpr/1` picks the best (lowest priority number) result of
+   * `resolveScopeExpr/2` that resolves to a constant definition. If the constant
+   * definition is a Namespace then it is returned, if it's a constant assignment then
+   * the right-hand side of the assignment is resolved.
+   */
+  cached
+  TResolved resolveScopeExpr(ConstantReadAccess r) {
+    exists(string qname |
+      qname =
+        min(string qn, int p |
+          isDefinedConstant(qn) and
+          qn = resolveScopeExpr(r, p) and
+          // prevent classes/modules that contain/extend themselves
+          not exists(ConstantWriteAccess w | qn = constantDefinition0(w) |
+            r = w.getScopeExpr()
+            or
+            r = w.(ClassDeclaration).getSuperclassExpr()
+          )
+        |
+          qn order by p
+        )
+    |
+      result = TResolved(qname)
+      or
+      exists(ConstantAssignment a |
+        qname = constantDefinition0(a) and
+        result = resolveScopeExpr(a.getParent().(Assignment).getRightOperand())
+      )
+    )
+  }
 }
 
 import Cached
@@ -103,38 +147,6 @@ private predicate isDefinedConstant(string qualifiedModuleName) {
   qualifiedModuleName = [builtin(), constantDefinition0(_)]
 }
 
-/**
- * Resolve constant read access (typically a scope expression) to a qualified module name.
- * `resolveScopeExpr/1` picks the best (lowest priority number) result of
- * `resolveScopeExpr/2` that resolves to a constant definition. If the constant
- * definition is a Namespace then it is returned, if it's a constant assignment then
- * the right-hand side of the assignment is resolved.
- */
-private TResolved resolveScopeExpr(ConstantReadAccess r) {
-  exists(string qname |
-    qname =
-      min(string qn, int p |
-        isDefinedConstant(qn) and
-        qn = resolveScopeExpr(r, p) and
-        // prevent classes/modules that contain/extend themselves
-        not exists(ConstantWriteAccess w | qn = constantDefinition0(w) |
-          r = w.getScopeExpr()
-          or
-          r = w.(ClassDeclaration).getSuperclassExpr()
-        )
-      |
-        qn order by p
-      )
-  |
-    result = TResolved(qname)
-    or
-    exists(ConstantAssignment a |
-      qname = constantDefinition0(a) and
-      result = resolveScopeExpr(a.getParent().(Assignment).getRightOperand())
-    )
-  )
-}
-
 private int maxDepth() { result = 1 + max(int level | exists(enclosing(_, level))) }
 
 private ModuleBase enclosing(ModuleBase m, int level) {

ql/src/codeql_ruby/controlflow/CfgNodes.qll

@@ -123,15 +123,9 @@ abstract private class ExprChildMapping extends Expr {
    */
   abstract predicate relevantChild(Expr child);
 
-  private AstNode getAChildStar() {
-    result = this
-    or
-    result.getParent() = this.getAChildStar()
-  }
-
   pragma[noinline]
   private BasicBlock getABasicBlockInScope() {
-    result.getANode() = TAstCfgNode(this.getAChildStar(), _)
+    result.getANode() = TAstCfgNode(this.getAChild*(), _)
   }
 
   pragma[nomagic]
@@ -231,9 +225,23 @@ module ExprNodes {
     final ExprCfgNode getRightOperand() { e.hasCfgChild(e.getRightOperand(), this, result) }
   }
 
+  private class BlockArgumentChildMapping extends ExprChildMapping, BlockArgument {
+    override predicate relevantChild(Expr e) { e = this.getValue() }
+  }
+
+  /** A control-flow node that wraps a `BlockArgument` AST expression. */
+  class BlockArgumentCfgNode extends ExprCfgNode {
+    override BlockArgumentChildMapping e;
+
+    final override BlockArgument getExpr() { result = ExprCfgNode.super.getExpr() }
+
+    /** Gets the value of this block argument. */
+    final ExprCfgNode getValue() { e.hasCfgChild(e.getValue(), this, result) }
+  }
+
   private class CallExprChildMapping extends ExprChildMapping, Call {
     override predicate relevantChild(Expr e) {
-      e = [this.getAnArgument(), this.(MethodCall).getReceiver()]
+      e = [this.getAnArgument(), this.(MethodCall).getReceiver(), this.(MethodCall).getBlock()]
     }
   }
 
@@ -248,6 +256,9 @@ module ExprNodes {
 
     /** Gets the receiver of this call. */
     final ExprCfgNode getReceiver() { e.hasCfgChild(e.(MethodCall).getReceiver(), this, result) }
+
+    /** Gets the block of this call. */
+    final ExprCfgNode getBlock() { e.hasCfgChild(e.(MethodCall).getBlock(), this, result) }
   }
 
   private class CaseExprChildMapping extends ExprChildMapping, CaseExpr {