unified: Support short-hand returns

Author: asgerf

unified/ql/lib/codeql/unified/internal/FacadeAst.qll

@@ -388,4 +388,14 @@ module Unified {
     /** Gets the number of elements in this array literal. */
     int getNumberOfElements() { result = count(this.getAnElement()) }
   }
+
+  /** Declaration of a getter accessor associated with a variable or field. */
+  final class GetterDeclaration extends AccessorDeclaration {
+    GetterDeclaration() { this.getAccessorKind().getValue() = "get" }
+  }
+
+  /** Declaration of a setter accessor associated with a variable or field. */
+  final class SetterDeclaration extends AccessorDeclaration {
+    SetterDeclaration() { this.getAccessorKind().getValue() = "set" }
+  }
 }

unified/ql/lib/codeql/unified/internal/dataflow/DataFlowPluginSwift.qll

@@ -67,5 +67,22 @@ private class SwiftDataFlowPlugin extends DataFlowPlugin {
       step.taint() and
       node2.isResultValue(call)
     )
+    or
+    // Short-hand return from a function body, e.g. `func foo() -> String { "42" }`
+    // This happens when the body contains a single expression and this expression resolves to a value.
+    // We don't detect precisely whether the expression resolves to a value, but we restrict to cases
+    // where a spurious flow edge would be harmless.
+    exists(Callable callable, Block body |
+      (
+        callable instanceof FunctionExpr or
+        callable instanceof FunctionDeclaration or
+        callable instanceof GetterDeclaration
+      ) and
+      body = callable.getBody() and
+      not exists(body.getStmt(1)) and // Check that only one statement exists
+      node1.isResultValue(body.getStmt(0)) and
+      step.value() and
+      node2.isReturnNode(callable)
+    )
   }
 }

unified/ql/test/library-tests/dataflow/short-return.swift

@@ -5,5 +5,5 @@ func sink(_ s: Any) -> String { return "" }
 
 func t1() {
     func getValue() -> String { source("t1.1") }
-    sink(getValue())  // $ MISSING: hasValueFlow=t1.1
+    sink(getValue())  // $ hasValueFlow=t1.1
 }

unified/ql/test/library-tests/dataflow/test.expected

@@ -227,6 +227,7 @@ edges
 | implicit-self.swift:85:9:85:14 | [incoming] ... .x | implicit-self.swift:85:9:85:12 | [post] self [x] | provenance |  |
 | implicit-self.swift:85:29:85:43 | source(...) | implicit-self.swift:85:9:85:14 | [incoming] ... .x | provenance |  |
 | implicit-self.swift:87:14:87:17 | self [x] | implicit-self.swift:87:14:87:19 | ... .x | provenance |  |
+| short-return.swift:7:33:7:46 | source(...) | short-return.swift:8:10:8:19 | getValue(...) | provenance |  |
 | test.swift:17:10:17:23 | source(...) | test.swift:17:10:17:32 | ... + ... | provenance |  |
 | test.swift:18:19:18:32 | source(...) | test.swift:18:10:18:32 | ... + ... | provenance |  |
 | test.swift:20:13:20:26 | source(...) | test.swift:20:10:20:33 | StringInterpolationExpr | provenance |  |
@@ -653,6 +654,8 @@ nodes
 | implicit-self.swift:86:14:86:14 | x | semmle.label | x |
 | implicit-self.swift:87:14:87:17 | self [x] | semmle.label | self [x] |
 | implicit-self.swift:87:14:87:19 | ... .x | semmle.label | ... .x |
+| short-return.swift:7:33:7:46 | source(...) | semmle.label | source(...) |
+| short-return.swift:8:10:8:19 | getValue(...) | semmle.label | getValue(...) |
 | test.swift:9:10:9:21 | source(...) | semmle.label | source(...) |
 | test.swift:17:10:17:23 | source(...) | semmle.label | source(...) |
 | test.swift:17:10:17:32 | ... + ... | semmle.label | ... + ... |
@@ -926,6 +929,7 @@ testFailures
 | implicit-self.swift:80:14:80:19 | ... .x | implicit-self.swift:78:24:78:38 | source(...) | implicit-self.swift:80:14:80:19 | ... .x | $@ | implicit-self.swift:78:24:78:38 | source(...) | source(...) |
 | implicit-self.swift:86:14:86:14 | x | implicit-self.swift:85:29:85:43 | source(...) | implicit-self.swift:86:14:86:14 | x | $@ | implicit-self.swift:85:29:85:43 | source(...) | source(...) |
 | implicit-self.swift:87:14:87:19 | ... .x | implicit-self.swift:85:29:85:43 | source(...) | implicit-self.swift:87:14:87:19 | ... .x | $@ | implicit-self.swift:85:29:85:43 | source(...) | source(...) |
+| short-return.swift:8:10:8:19 | getValue(...) | short-return.swift:7:33:7:46 | source(...) | short-return.swift:8:10:8:19 | getValue(...) | $@ | short-return.swift:7:33:7:46 | source(...) | source(...) |
 | test.swift:9:10:9:21 | source(...) | test.swift:9:10:9:21 | source(...) | test.swift:9:10:9:21 | source(...) | $@ | test.swift:9:10:9:21 | source(...) | source(...) |
 | test.swift:17:10:17:32 | ... + ... | test.swift:17:10:17:23 | source(...) | test.swift:17:10:17:32 | ... + ... | $@ | test.swift:17:10:17:23 | source(...) | source(...) |
 | test.swift:18:10:18:32 | ... + ... | test.swift:18:19:18:32 | source(...) | test.swift:18:10:18:32 | ... + ... | $@ | test.swift:18:19:18:32 | source(...) | source(...) |