Java: Add proper types for capture nodes.

Author: aschackmull

java/ql/lib/semmle/code/java/dataflow/internal/DataFlowNodes.qll

@@ -503,14 +503,21 @@ module Private {
    * captured variables.
    */
   class CaptureNode extends Node, TCaptureNode {
-    CaptureFlow::SynthesizedCaptureNode getSynthesizedCaptureNode() { this = TCaptureNode(result) }
+    private CaptureFlow::SynthesizedCaptureNode cn;
 
-    override Location getLocation() { result = this.getSynthesizedCaptureNode().getLocation() }
+    CaptureNode() { this = TCaptureNode(cn) }
 
-    override string toString() { result = this.getSynthesizedCaptureNode().toString() }
+    CaptureFlow::SynthesizedCaptureNode getSynthesizedCaptureNode() { result = cn }
 
-    // TODO: expose hasTypeProxy(var / callable)
-    Type getTypeImpl() { result instanceof TypeObject }
+    override Location getLocation() { result = cn.getLocation() }
+
+    override string toString() { result = cn.toString() }
+
+    Type getTypeImpl() {
+      exists(Variable v | cn.isVariableAccess(v) and result = v.getType())
+      or
+      cn.isInstanceAccess() and result = cn.getEnclosingCallable().getDeclaringType()
+    }
   }
 }
 

shared/dataflow/codeql/dataflow/VariableCapture.qll

@@ -167,6 +167,12 @@ signature module OutputSig<InputSig I> {
 
     /** Gets the enclosing callable. */
     I::Callable getEnclosingCallable();
+
+    /** Holds if this node is a synthesized access of `v`. */
+    predicate isVariableAccess(I::CapturedVariable v);
+
+    /** Holds if this node is a synthesized instance access. */
+    predicate isInstanceAccess();
   }
 
   /** A data flow node for an expression. */
@@ -740,6 +746,22 @@ module Flow<InputSig Input> implements OutputSig<Input> {
         this = TSynthPhi(phi) and phi.definesAt(_, bb, _, _) and result = bb.getEnclosingCallable()
       )
     }
+
+    predicate isVariableAccess(CapturedVariable v) {
+      this = TSynthRead(v, _, _, _)
+      or
+      exists(CaptureSsa::DefinitionExt phi |
+        this = TSynthPhi(phi) and phi.definesAt(TVariable(v), _, _, _)
+      )
+    }
+
+    predicate isInstanceAccess() {
+      this instanceof TSynthThisQualifier
+      or
+      exists(CaptureSsa::DefinitionExt phi |
+        this = TSynthPhi(phi) and phi.definesAt(TThis(_), _, _, _)
+      )
+    }
   }
 
   class ExprNode extends ClosureNode, TExprNode {