Data flow: Remove allowParameterReturnInSelf restriction

Author: hvitved

cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowPrivate.qll

@@ -296,15 +296,6 @@ predicate knownSinkModel(Node sink, string model) { none() }
 
 class DataFlowSecondLevelScope = Unit;
 
-/**
- * Holds if flow is allowed to pass from parameter `p` and back to itself as a
- * side-effect, resulting in a summary from `p` to itself.
- *
- * One example would be to allow flow like `p.foo = p.bar;`, which is disallowed
- * by default as a heuristic.
- */
-predicate allowParameterReturnInSelf(ParameterNode p) { none() }
-
 /** An approximated `Content`. */
 class ContentApprox = Unit;
 

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll

@@ -1342,23 +1342,6 @@ predicate knownSourceModel(Node source, string model) { External::sourceNode(sou
 
 predicate knownSinkModel(Node sink, string model) { External::sinkNode(sink, _, model) }
 
-/**
- * Holds if flow is allowed to pass from parameter `p` and back to itself as a
- * side-effect, resulting in a summary from `p` to itself.
- *
- * One example would be to allow flow like `p.foo = p.bar;`, which is disallowed
- * by default as a heuristic.
- */
-predicate allowParameterReturnInSelf(ParameterNode p) {
-  p instanceof IndirectParameterNode
-  or
-  // models-as-data summarized flow
-  exists(DataFlowCallable c, ParameterPosition pos |
-    p.isParameterOf(c, pos) and
-    FlowSummaryImpl::Private::summaryAllowParameterReturnInSelf(c.asSummarizedCallable(), pos)
-  )
-}
-
 private predicate fieldHasApproxName(Field f, string s) {
   s = f.getName().charAt(0) and
   // Reads and writes of union fields are tracked using `UnionContent`.

csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll

@@ -3084,23 +3084,6 @@ predicate knownSinkModel(Node sink, string model) { sinkNode(sink, _, model) }
 
 class DataFlowSecondLevelScope = Unit;
 
-/**
- * Holds if flow is allowed to pass from parameter `p` and back to itself as a
- * side-effect, resulting in a summary from `p` to itself.
- *
- * One example would be to allow flow like `p.foo = p.bar;`, which is disallowed
- * by default as a heuristic.
- */
-predicate allowParameterReturnInSelf(ParameterNode p) {
-  exists(DataFlowCallable c, ParameterPosition pos |
-    parameterNode(p, c, pos) and
-    FlowSummaryImpl::Private::summaryAllowParameterReturnInSelf(c.asSummarizedCallable(), pos)
-  )
-  or
-  VariableCapture::Flow::heuristicAllowInstanceParameterReturnInSelf(p.(DelegateSelfReferenceNode)
-        .getCallable())
-}
-
 /** An approximated `Content`. */
 class ContentApprox extends TContentApprox {
   /** Gets a textual representation of this approximated `Content`. */

go/ql/lib/semmle/go/dataflow/internal/DataFlowPrivate.qll

@@ -438,20 +438,6 @@ predicate knownSinkModel(Node sink, string model) { sinkNode(sink, _, model) }
 
 class DataFlowSecondLevelScope = Unit;
 
-/**
- * Holds if flow is allowed to pass from parameter `p` and back to itself as a
- * side-effect, resulting in a summary from `p` to itself.
- *
- * One example would be to allow flow like `p.foo = p.bar;`, which is disallowed
- * by default as a heuristic.
- */
-predicate allowParameterReturnInSelf(ParameterNode p) {
-  exists(DataFlowCallable c, int pos |
-    p.isParameterOf(c, pos) and
-    FlowSummaryImpl::Private::summaryAllowParameterReturnInSelf(c.asSummarizedCallable(), pos)
-  )
-}
-
 /** An approximated `Content`. */
 class ContentApprox = Unit;
 

java/ql/lib/semmle/code/java/dataflow/internal/DataFlowPrivate.qll

@@ -695,22 +695,6 @@ private Expr getRelatedExpr(Node n) {
 /** Gets the second-level scope containing the node `n`, if any. */
 DataFlowSecondLevelScope getSecondLevelScope(Node n) { result.getANode() = n }
 
-/**
- * Holds if flow is allowed to pass from parameter `p` and back to itself as a
- * side-effect, resulting in a summary from `p` to itself.
- *
- * One example would be to allow flow like `p.foo = p.bar;`, which is disallowed
- * by default as a heuristic.
- */
-predicate allowParameterReturnInSelf(ParameterNode p) {
-  exists(DataFlowCallable c, ParameterPosition pos |
-    parameterNode(p, c, pos) and
-    FlowSummaryImpl::Private::summaryAllowParameterReturnInSelf(c.asSummarizedCallable(), pos)
-  )
-  or
-  CaptureFlow::heuristicAllowInstanceParameterReturnInSelf(p.(InstanceParameterNode).getCallable())
-}
-
 /** An approximated `Content`. */
 class ContentApprox extends TContentApprox {
   /** Gets a textual representation of this approximated `Content`. */

python/ql/lib/semmle/python/dataflow/new/internal/DataFlowPrivate.qll

@@ -1096,25 +1096,6 @@ predicate knownSinkModel(Node sink, string model) {
 
 class DataFlowSecondLevelScope = Unit;
 
-/**
- * Holds if flow is allowed to pass from parameter `p` and back to itself as a
- * side-effect, resulting in a summary from `p` to itself.
- *
- * One example would be to allow flow like `p.foo = p.bar;`, which is disallowed
- * by default as a heuristic.
- */
-predicate allowParameterReturnInSelf(ParameterNode p) {
-  exists(DataFlowCallable c, ParameterPosition pos |
-    p.(ParameterNodeImpl).isParameterOf(c, pos) and
-    FlowSummaryImpl::Private::summaryAllowParameterReturnInSelf(c.asLibraryCallable(), pos)
-  )
-  or
-  exists(Function f |
-    VariableCapture::Flow::heuristicAllowInstanceParameterReturnInSelf(f) and
-    p = TSynthCapturedVariablesParameterNode(f)
-  )
-}
-
 /** An approximated `Content`. */
 class ContentApprox = Unit;
 

ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowPrivate.qll

@@ -2107,23 +2107,6 @@ predicate knownSinkModel(Node sink, string model) {
 
 class DataFlowSecondLevelScope = Unit;
 
-/**
- * Holds if flow is allowed to pass from parameter `p` and back to itself as a
- * side-effect, resulting in a summary from `p` to itself.
- *
- * One example would be to allow flow like `p.foo = p.bar;`, which is disallowed
- * by default as a heuristic.
- */
-predicate allowParameterReturnInSelf(ParameterNodeImpl p) {
-  exists(DataFlowCallable c, ParameterPosition pos |
-    p.isParameterOf(c, pos) and
-    FlowSummaryImpl::Private::summaryAllowParameterReturnInSelf(c.asLibraryCallable(), pos)
-  )
-  or
-  VariableCapture::Flow::heuristicAllowInstanceParameterReturnInSelf(p.(LambdaSelfReferenceNode)
-        .getCallable())
-}
-
 /** An approximated `Content`. */
 class ContentApprox extends TContentApprox {
   string toString() {

rust/ql/lib/codeql/rust/dataflow/internal/DataFlowImpl.qll

@@ -990,20 +990,6 @@ module RustDataFlow implements InputSig<Location> {
    */
   predicate isUnreachableInCall(NodeRegion nr, DataFlowCall call) { none() }
 
-  /**
-   * Holds if flow is allowed to pass from parameter `p` and back to itself as a
-   * side-effect, resulting in a summary from `p` to itself.
-   *
-   * One example would be to allow flow like `p.foo = p.bar;`, which is disallowed
-   * by default as a heuristic.
-   */
-  predicate allowParameterReturnInSelf(ParameterNode p) {
-    exists(DataFlowCallable c, ParameterPosition pos |
-      p.isParameterOf(c, pos) and
-      FlowSummaryImpl::Private::summaryAllowParameterReturnInSelf(c.asLibraryCallable(), pos)
-    )
-  }
-
   /**
    * Holds if the value of `node2` is given by `node1`.
    *

shared/dataflow/codeql/dataflow/DataFlow.qll

@@ -267,15 +267,6 @@ signature module InputSig<LocationSig Location> {
 
   default int accessPathLimit() { result = 5 }
 
-  /**
-   * Holds if flow is allowed to pass from parameter `p` and back to itself as a
-   * side-effect, resulting in a summary from `p` to itself.
-   *
-   * One example would be to allow flow like `p.foo = p.bar;`, which is disallowed
-   * by default as a heuristic.
-   */
-  predicate allowParameterReturnInSelf(ParameterNode p);
-
   /**
    * Holds if the value of `node2` is given by `node1`.
    *

shared/dataflow/codeql/dataflow/VariableCapture.qll

@@ -245,9 +245,6 @@ signature module OutputSig<LocationSig Location, InputSig<Location> I> {
   /** Holds if there is a read step from `node1` to `node2`. */
   predicate readStep(ClosureNode node1, I::CapturedVariable v, ClosureNode node2);
 
-  /** Holds if this-to-this summaries are expected for `c`. */
-  predicate heuristicAllowInstanceParameterReturnInSelf(I::Callable c);
-
   /** Holds if captured variable `v` is cleared at `node`. */
   predicate clearsContent(ClosureNode node, I::CapturedVariable v);
 }
@@ -579,18 +576,6 @@ module Flow<LocationSig Location, InputSig<Location> Input> implements OutputSig
     exists(Callable c | ce.hasBody(c) and captureAccess(v, c))
   }
 
-  predicate heuristicAllowInstanceParameterReturnInSelf(Callable c) {
-    // If multiple variables are captured, then we should allow flow from one to
-    // another, which entails a this-to-this summary.
-    2 <= strictcount(CapturedVariable v | captureAccess(v, c))
-    or
-    // Constructors that capture a variable may assign it to a field, which also
-    // entails a this-to-this summary. If there are multiple constructors, then
-    // they might call each other, so if one constructor captures a variable we
-    // allow this-to-this summaries for all of them.
-    exists(ClosureExpr ce | ce.hasBody(c) and c.isConstructor() and hasConstructorCapture(ce, _))
-  }
-
   /** Holds if a constructor, if any, for the closure defined by `ce` captures `v`. */
   private predicate hasConstructorCapture(ClosureExpr ce, CapturedVariable v) {
     exists(Callable c | ce.hasBody(c) and c.isConstructor() and captureAccess(v, c))