C#: Implement new lambda flow interface

Author: hvitved

csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowDispatch.qll

@@ -76,7 +76,8 @@ private module Cached {
     } or
     TSummaryCall(FlowSummary::SummarizedCallable c, FlowSummaryImpl::Private::SummaryNode receiver) {
       FlowSummaryImpl::Private::summaryCallbackRange(c, receiver)
-    }
+    } or
+    TLambdaSynthCall(Node creation) { lambdaCreation(creation, _, _) }
 
   /** Gets a viable run-time target for the call `call`. */
   cached
@@ -497,6 +498,24 @@ class SummaryCall extends DelegateDataFlowCall, TSummaryCall {
   override Location getLocation() { result = c.getLocation() }
 }
 
+class LambdaSynthCall extends DataFlowCall, TLambdaSynthCall {
+  private NodeImpl creation;
+
+  LambdaSynthCall() { this = TLambdaSynthCall(creation) }
+
+  override DataFlowCallable getARuntimeTarget() { none() }
+
+  override ControlFlow::Nodes::ElementNode getControlFlowNode() { none() }
+
+  override DataFlow::Node getNode() { none() }
+
+  override DataFlowCallable getEnclosingCallable() { result = creation.getEnclosingCallableImpl() }
+
+  override string toString() { result = "[lambda] call to " + creation }
+
+  override Location getLocation() { result = creation.getLocation() }
+}
+
 /** A parameter position. */
 class ParameterPosition extends TParameterPosition {
   /** Gets the underlying integer position, if any. */

csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll

@@ -767,6 +767,8 @@ predicate simpleLocalFlowStep(Node nodeFrom, Node nodeTo, string model) {
     VariableCapture::valueStep(nodeFrom, nodeTo)
     or
     nodeTo = nodeFrom.(LocalFunctionCreationNode).getAnAccess(true)
+    or
+    delegateCreationStep(nodeFrom, nodeTo)
   ) and
   model = ""
   or
@@ -1150,6 +1152,8 @@ private module Cached {
     TCapturedVariableContent(VariableCapture::CapturedVariable v) or
     TDelegateCallArgumentContent(int i) {
       i = [0 .. max(any(DelegateLikeCall dc).getNumberOfArguments()) - 1]
+      or
+      i = -1
     } or
     TDelegateCallReturnContent()
 
@@ -2928,6 +2932,38 @@ predicate lambdaCreation(Node creation, LambdaCallKind kind, DataFlowCallable c)
   exists(kind)
 }
 
+/** Holds if `creation` is an expression that creates a delegate for `c`. */
+predicate lambdaCreation(
+  Node creation, LambdaCallKind kind, DataFlowCallable c, DataFlowCall synthCall
+) {
+  lambdaCreation(creation, kind, c) and
+  synthCall = TLambdaSynthCall(creation)
+}
+
+Content getLambdaReturnContent(LambdaCallKind kind, ReturnKind rk) {
+  result = TDelegateCallReturnContent() and
+  exists(kind) and
+  rk = TNormalReturnKind()
+}
+
+Content getLambdaArgumentContent(LambdaCallKind kind, ArgumentPosition pos) {
+  (
+    result = TDelegateCallArgumentContent(pos.getPosition())
+    or
+    result = TDelegateCallArgumentContent(-1) and
+    pos.isDelegateSelf()
+  ) and
+  exists(kind)
+}
+
+predicate isLambdaInstanceParameter(ParameterNode p) {
+  exists(DataFlowCallable c, ParameterPosition ppos |
+    lambdaCreation(_, _, c) and
+    isParameterNode(p, c, ppos) and
+    ppos.isDelegateSelf()
+  )
+}
+
 private predicate isLocalFunctionCallReceiver(
   LocalFunctionCall call, LocalFunctionAccess receiver, LocalFunction f
 ) {