Add foreach dataflow tests

Author: tamasvajk

java/ql/test/kotlin/library-tests/dataflow/foreach/C1.java

@@ -0,0 +1,22 @@
+public final class C1 {
+   public final String taint(String t) {
+      return t;
+   }
+
+   public final void sink(Object a) {
+   }
+
+   public final void test() {
+      String[] l = new String[]{this.taint("a"), ""};
+      this.sink(l);
+      this.sink(l[0]);
+
+      for(int i = 0; i < l.length; i++) {
+         this.sink(l[i]);
+      }
+
+      for (String s : l) {
+         this.sink(s);
+      }
+   }
+}

java/ql/test/kotlin/library-tests/dataflow/foreach/C2.kt

@@ -0,0 +1,18 @@
+class C2 {
+    fun taint(t: String): String {
+        return t
+    }
+
+    fun sink(a: Any?) {}
+    fun test() {
+        val l = arrayOf(taint("a"), "")
+        sink(l)
+        sink(l[0])
+        for (i in l.indices) {
+            sink(l[i])
+        }
+        for (s in l) {
+            sink(s)
+        }
+    }
+}

java/ql/test/kotlin/library-tests/dataflow/foreach/test.expected

@@ -0,0 +1,7 @@
+| C1.java:10:44:10:46 | "a" | C1.java:11:17:11:17 | l |
+| C1.java:10:44:10:46 | "a" | C1.java:12:17:12:20 | ...[...] |
+| C1.java:10:44:10:46 | "a" | C1.java:15:20:15:23 | ...[...] |
+| C1.java:10:44:10:46 | "a" | C1.java:19:20:19:20 | s |
+| C2.kt:8:32:8:32 | a | C2.kt:9:14:9:14 | l |
+| C2.kt:8:32:8:32 | a | C2.kt:10:14:10:17 | ...[...] |
+| C2.kt:8:32:8:32 | a | C2.kt:12:18:12:21 | ...[...] |

java/ql/test/kotlin/library-tests/dataflow/foreach/test.ql

@@ -0,0 +1,19 @@
+import java
+import semmle.code.java.dataflow.TaintTracking
+import semmle.code.java.dataflow.ExternalFlow
+
+class Conf extends TaintTracking::Configuration {
+  Conf() { this = "qltest:foreach-array-iterator" }
+
+  override predicate isSource(DataFlow::Node n) {
+    n.asExpr().(Argument).getCall().getCallee().hasName("taint")
+  }
+
+  override predicate isSink(DataFlow::Node n) {
+    n.asExpr().(Argument).getCall().getCallee().hasName("sink")
+  }
+}
+
+from DataFlow::Node src, DataFlow::Node sink, Conf conf
+where conf.hasFlow(src, sink)
+select src, sink