C#: Remove false positive for out params

Author: calumgrant

csharp/ql/src/Likely Bugs/DangerousNonShortCircuitLogic.ql

@@ -27,7 +27,8 @@ class DangerousExpression extends Expr {
       e instanceof MethodCall
       or
       e instanceof ArrayAccess
-    )
+    ) and
+    not exists(Expr e | this = e.getParent*() | e.(Call).getTarget().getAParameter().isOutOrRef())
   }
 }
 

csharp/ql/test/query-tests/Likely Bugs/DangerousNonShortCircuitLogic/DangerousNonShortCircuitLogic.cs

@@ -21,7 +21,8 @@ void M()
         b &= c.Method(); // GOOD
         b |= c[0]; // GOOD
 
-        if (c == null | c.Method(out _)) ; // GOOD (false positive)
+        if (c == null | c.Method(out _)) ; // GOOD
+        if (c == null | (c.Method() | c.Method(out _))) ; // GOOD
     }
 
     class C

csharp/ql/test/query-tests/Likely Bugs/DangerousNonShortCircuitLogic/DangerousNonShortCircuitLogic.expected

@@ -2,4 +2,3 @@
 | DangerousNonShortCircuitLogic.cs:16:13:16:40 | ... \| ... | Potentially dangerous use of non-short circuit logic. |
 | DangerousNonShortCircuitLogic.cs:17:13:17:28 | ... \| ... | Potentially dangerous use of non-short circuit logic. |
 | DangerousNonShortCircuitLogic.cs:18:13:18:34 | ... \| ... | Potentially dangerous use of non-short circuit logic. |
-| DangerousNonShortCircuitLogic.cs:24:13:24:39 | ... \| ... | Potentially dangerous use of non-short circuit logic. |