PS: Make the implementation of 'getExtraNodeFromType' more complete. This is still not good enough, but it's enough to get the flow we need for now.

Author: MathiasVP

powershell/ql/lib/semmle/code/powershell/ast/internal/TypeExpression.qll

@@ -25,6 +25,11 @@ class TypeNameExpr extends Expr, TTypeNameExpr {
   override string toString() { result = this.getName() }
 
   predicate isQualified() { this.getNamespace() != "" }
+
+  predicate hasQualifiedName(string namespace, string typename) {
+    this.isQualified() and
+    this.parseName(namespace, typename)
+  }
 }
 
 class QualifiedTypeNameExpr extends TypeNameExpr {

powershell/ql/lib/semmle/code/powershell/controlflow/CfgNodes.qll

@@ -685,14 +685,24 @@ module ExprNodes {
     string getPossiblyQualifiedName() { result = e.getPossiblyQualifiedName() }
 
     predicate isQualified() { e.isQualified() }
+
+    predicate hasQualifiedName(string namespace, string typename) {
+      e.hasQualifiedName(namespace, typename)
+    }
+  }
+
+  private class QualifiedTypeNameExprChildMapping extends TypeNameExprChildMapping,
+    QualifiedTypeNameExpr
+  {
+    override predicate relevantChild(Ast child) { super.relevantChild(child) }
   }
 
   class QualifiedTypeNameExprCfgNode extends TypeNameExprCfgNode {
-    QualifiedTypeNameExprCfgNode() { e.isQualified() }
+    override QualifiedTypeNameExprChildMapping e;
 
-    override string getAPrimaryQlClass() { result = "QualifiedTypeNameExprCfgNode" }
+    override TypeNameExpr getExpr() { result = e }
 
-    override QualifiedTypeNameExpr getExpr() { result = e }
+    override string getAPrimaryQlClass() { result = "QualifiedTypeNameExprCfgNode" }
   }
 
   private class ErrorExprChildMapping extends ExprChildMapping, ErrorExpr {

powershell/ql/lib/semmle/code/powershell/dataflow/internal/DataFlowPublic.qll

@@ -544,6 +544,10 @@ class TypeNameNode extends ExprNode {
 
   predicate isQualified() { n.isQualified() }
 
+  predicate hasQualifiedName(string namespace, string typename) {
+    n.hasQualifiedName(namespace, typename)
+  }
+
   string getNamespace() { result = n.getNamespace() }
 
   string getPossiblyQualifiedName() { result = n.getPossiblyQualifiedName() }

powershell/ql/lib/semmle/code/powershell/frameworks/data/internal/ApiGraphModelsSpecific.qll

@@ -69,12 +69,23 @@ API::Node getExtraNodeFromPath(string type, AccessPath path, int n) {
 }
 
 /** Gets a Powershell-specific interpretation of the given `type`. */
-API::Node getExtraNodeFromType(string type) {
-  exists(string consts, string suffix | parseRelevantType(type, consts, suffix) |
-    none() // TODO
+API::Node getExtraNodeFromType(string rawType) {
+  exists(
+    string type, string suffix, DataFlow::QualifiedTypeNameNode qualifiedTypeName, string namespace,
+    string typename
+  |
+    parseRelevantType(rawType, type, suffix) and
+    qualifiedTypeName.hasQualifiedName(namespace, typename) and
+    namespace + "." + typename = type
+  |
+    suffix = "!" and
+    result = qualifiedTypeName.(DataFlow::LocalSourceNode).track()
+    or
+    suffix = "" and
+    result = qualifiedTypeName.(DataFlow::LocalSourceNode).track().getInstance()
   )
   or
-  type = "" and
+  rawType = "" and
   result = API::root()
 }