Data flow: Rework reverse flow through parameters

Author: hvitved

shared/dataflow/codeql/dataflow/internal/DataFlowImpl.qll

@@ -241,7 +241,7 @@ module MakeImpl<LocationSig Location, InputSig<Location> Lang> {
 
     private predicate inBarrier(NodeEx node) {
       exists(Node n |
-        node.asNode() = n and
+        [node.asNode(), node.asNodeReverse()] = n and
         Config::isBarrierIn(n) and
         isRelevantSource(n, _)
       )
@@ -250,15 +250,15 @@ module MakeImpl<LocationSig Location, InputSig<Location> Lang> {
     pragma[nomagic]
     private predicate inBarrier(NodeEx node, FlowState state) {
       exists(Node n |
-        node.asNode() = n and
+        [node.asNode(), node.asNodeReverse()] = n and
         Config::isBarrierIn(n, state) and
         isRelevantSource(n, state)
       )
     }
 
     private predicate outBarrier(NodeEx node) {
       exists(Node n |
-        node.asNodeOrImplicitRead() = n and
+        [node.asNodeOrImplicitRead(), node.asNodeReverse()] = n and
         Config::isBarrierOut(n)
       |
         isRelevantSink(n, _)
@@ -270,7 +270,7 @@ module MakeImpl<LocationSig Location, InputSig<Location> Lang> {
     pragma[nomagic]
     private predicate outBarrier(NodeEx node, FlowState state) {
       exists(Node n |
-        node.asNodeOrImplicitRead() = n and
+        [node.asNodeOrImplicitRead(), node.asNodeReverse()] = n and
         Config::isBarrierOut(n, state)
       |
         isRelevantSink(n, state)
@@ -281,7 +281,7 @@ module MakeImpl<LocationSig Location, InputSig<Location> Lang> {
 
     pragma[nomagic]
     private predicate fullBarrier(NodeEx node) {
-      exists(Node n | node.asNode() = n |
+      exists(Node n | [node.asNode(), node.asNodeReverse()] = n |
         Config::isBarrier(n)
         or
         Config::isBarrierIn(n) and
@@ -295,7 +295,7 @@ module MakeImpl<LocationSig Location, InputSig<Location> Lang> {
 
     pragma[nomagic]
     private predicate stateBarrier(NodeEx node, FlowState state) {
-      exists(Node n | node.asNode() = n |
+      exists(Node n | [node.asNode(), node.asNodeReverse()] = n |
         Config::isBarrier(n, state)
         or
         Config::isBarrierIn(n, state) and
@@ -506,8 +506,8 @@ module MakeImpl<LocationSig Location, InputSig<Location> Lang> {
      */
     bindingset[p, kind]
     private predicate parameterFlowThroughAllowed(ParamNodeEx p, ReturnKindExt kind) {
-      exists(ParameterPosition pos | p.isParameterOf(_, pos) |
-        not kind.(ParamUpdateReturnKind).getPosition() = pos
+      exists(ParameterPositionEx pos | p.isParameterOf(_, pos) |
+        not kind.(ParamUpdateReturnKind).getPosition() = pos.asParameterPosition()
         or
         allowParameterReturnInSelfEx(p)
       )
@@ -1143,7 +1143,9 @@ module MakeImpl<LocationSig Location, InputSig<Location> Lang> {
       |
         scope = getSecondLevelScopeEx(ret)
         or
-        ret = TParamReturnNode(_, scope)
+        // ret = TParamReturnNode(_, scope)
+        ret = TParamReturnNode(_) and
+        scope.isNone() // todo
       )
     }
 
@@ -2651,8 +2653,9 @@ module MakeImpl<LocationSig Location, InputSig<Location> Lang> {
             FlowCheckNode() {
               revFlow(this, _, _) and
               (
-                flowCheckNode(this) or
-                Config::neverSkip(this.asNode())
+                flowCheckNode(this)
+                or
+                Config::neverSkip([this.asNode(), this.asNodeReverse()])
               )
             }
           }
@@ -5445,23 +5448,23 @@ module MakeImpl<LocationSig Location, InputSig<Location> Lang> {
 
       pragma[noinline]
       private predicate partialPathIntoArg(
-        PartialPathNodeFwd mid, ParameterPosition ppos, FlowState state, CallContext cc,
+        PartialPathNodeFwd mid, ParameterPositionEx ppos, FlowState state, CallContext cc,
         DataFlowCall call, DataFlowType t, PartialAccessPath ap
       ) {
-        exists(ArgNode arg, ArgumentPosition apos |
-          arg = mid.getNodeEx().asNode() and
+        exists(ArgNodeEx arg, ArgumentPositionEx apos |
+          arg = mid.getNodeEx() and
           state = mid.getState() and
           cc = mid.getCallContext() and
           arg.argumentOf(call, apos) and
           t = mid.getType() and
           ap = mid.getAp() and
-          parameterMatch(ppos, apos)
+          parameterMatchEx(ppos, apos)
         )
       }
 
       pragma[nomagic]
       private predicate partialPathIntoCallable0(
-        PartialPathNodeFwd mid, DataFlowCallable callable, ParameterPosition pos, FlowState state,
+        PartialPathNodeFwd mid, DataFlowCallable callable, ParameterPositionEx pos, FlowState state,
         CallContext outercc, DataFlowCall call, DataFlowType t, PartialAccessPath ap
       ) {
         partialPathIntoArg(mid, pos, state, outercc, call, t, ap) and
@@ -5473,7 +5476,7 @@ module MakeImpl<LocationSig Location, InputSig<Location> Lang> {
         CallContextCall innercc, TSummaryCtx1 sc1, TSummaryCtx2 sc2, TSummaryCtx3 sc3,
         TSummaryCtx4 sc4, DataFlowCall call, DataFlowType t, PartialAccessPath ap
       ) {
-        exists(ParameterPosition pos, DataFlowCallable callable |
+        exists(ParameterPositionEx pos, DataFlowCallable callable |
           partialPathIntoCallable0(mid, callable, pos, state, outercc, call, t, ap) and
           p.isParameterOf(callable, pos) and
           sc1 = TSummaryCtx1Param(p) and
@@ -5708,24 +5711,24 @@ module MakeImpl<LocationSig Location, InputSig<Location> Lang> {
 
       pragma[nomagic]
       private predicate revPartialPathFlowsThrough(
-        ArgumentPosition apos, FlowState state, TRevSummaryCtx1Some sc1, TRevSummaryCtx2Some sc2,
+        ArgumentPositionEx apos, FlowState state, TRevSummaryCtx1Some sc1, TRevSummaryCtx2Some sc2,
         TRevSummaryCtx3Some sc3, PartialAccessPath ap
       ) {
-        exists(PartialPathNodeRev mid, ParamNodeEx p, ParameterPosition ppos |
+        exists(PartialPathNodeRev mid, ParamNodeEx p, ParameterPositionEx ppos |
           mid.getNodeEx() = p and
           mid.getState() = state and
           p.getPosition() = ppos and
           sc1 = mid.getSummaryCtx1() and
           sc2 = mid.getSummaryCtx2() and
           sc3 = mid.getSummaryCtx3() and
           ap = mid.getAp() and
-          parameterMatch(ppos, apos)
+          parameterMatchEx(ppos, apos)
         )
       }
 
       pragma[nomagic]
       private predicate revPartialPathThroughCallable0(
-        DataFlowCall call, PartialPathNodeRev mid, ArgumentPosition pos, FlowState state,
+        DataFlowCall call, PartialPathNodeRev mid, ArgumentPositionEx pos, FlowState state,
         PartialAccessPath ap
       ) {
         exists(TRevSummaryCtx1Some sc1, TRevSummaryCtx2Some sc2, TRevSummaryCtx3Some sc3 |
@@ -5738,7 +5741,7 @@ module MakeImpl<LocationSig Location, InputSig<Location> Lang> {
       private predicate revPartialPathThroughCallable(
         PartialPathNodeRev mid, ArgNodeEx node, FlowState state, PartialAccessPath ap
       ) {
-        exists(DataFlowCall call, ArgumentPosition pos |
+        exists(DataFlowCall call, ArgumentPositionEx pos |
           revPartialPathThroughCallable0(call, mid, pos, state, ap) and
           node.argumentOf(call, pos)
         )