unified: Model ?? operator

Author: asgerf

unified/ql/lib/codeql/unified/internal/dataflow/DataFlowPluginSwift.qll

@@ -53,6 +53,13 @@ private class SwiftDataFlowPlugin extends DataFlowPlugin {
       node2.isResultValue(expr)
     )
     or
+    exists(NullCoalescingExpr expr |
+      // We bypass Optional<T> content so we add value-flow out of both operands of "??"
+      node1.isResultValue(expr.getAnOperand()) and
+      step.value() and
+      node2.isResultValue(expr)
+    )
+    or
     // Taint flow through URL(string: x). TODO: Model with MaD and flow summaries
     exists(CallExpr call |
       call.getCallee().(Identifier).getValue() = ["URL", "NSURL"] and

unified/ql/test/library-tests/dataflow/test.expected

@@ -284,6 +284,11 @@ edges
 | test.swift:247:8:247:12 | ... .some(...) | test.swift:247:12:247:12 | x | provenance |  |
 | test.swift:247:12:247:12 | x | test.swift:247:8:247:12 | ... .some(...) | provenance |  |
 | test.swift:247:12:247:12 | x | test.swift:248:14:248:14 | x | provenance |  |
+| test.swift:254:16:254:45 | ... .some(...) | test.swift:256:10:256:22 | getOptional(...) | provenance |  |
+| test.swift:254:16:254:45 | ... .some(...) | test.swift:257:20:257:32 | getOptional(...) | provenance |  |
+| test.swift:254:30:254:44 | source(...) | test.swift:254:16:254:45 | ... .some(...) | provenance |  |
+| test.swift:256:10:256:22 | getOptional(...) | test.swift:256:10:256:35 | ... ?? ... | provenance |  |
+| test.swift:257:20:257:32 | getOptional(...) | test.swift:257:10:257:32 | ... ?? ... | provenance |  |
 nodes
 | calls.swift:7:19:7:19 | x | semmle.label | x |
 | calls.swift:8:14:8:14 | x | semmle.label | x |
@@ -634,6 +639,12 @@ nodes
 | test.swift:247:12:247:12 | x | semmle.label | x |
 | test.swift:247:12:247:12 | x | semmle.label | x |
 | test.swift:248:14:248:14 | x | semmle.label | x |
+| test.swift:254:16:254:45 | ... .some(...) | semmle.label | ... .some(...) |
+| test.swift:254:30:254:44 | source(...) | semmle.label | source(...) |
+| test.swift:256:10:256:22 | getOptional(...) | semmle.label | getOptional(...) |
+| test.swift:256:10:256:35 | ... ?? ... | semmle.label | ... ?? ... |
+| test.swift:257:10:257:32 | ... ?? ... | semmle.label | ... ?? ... |
+| test.swift:257:20:257:32 | getOptional(...) | semmle.label | getOptional(...) |
 subpaths
 | calls.swift:31:17:31:30 | source(...) | calls.swift:28:19:28:19 | x | calls.swift:29:16:29:24 | ... + ... | calls.swift:31:10:31:31 | target(...) |
 | calls.swift:32:17:32:30 | source(...) | calls.swift:28:19:28:19 | x | calls.swift:29:16:29:24 | ... + ... | calls.swift:32:10:32:31 | target(...) |
@@ -734,3 +745,5 @@ testFailures
 | test.swift:229:14:229:20 | element | test.swift:227:14:227:28 | source(...) | test.swift:229:14:229:20 | element | $@ | test.swift:227:14:227:28 | source(...) | source(...) |
 | test.swift:229:14:229:20 | element | test.swift:227:31:227:45 | source(...) | test.swift:229:14:229:20 | element | $@ | test.swift:227:31:227:45 | source(...) | source(...) |
 | test.swift:248:14:248:14 | x | test.swift:243:30:243:44 | source(...) | test.swift:248:14:248:14 | x | $@ | test.swift:243:30:243:44 | source(...) | source(...) |
+| test.swift:256:10:256:35 | ... ?? ... | test.swift:254:30:254:44 | source(...) | test.swift:256:10:256:35 | ... ?? ... | $@ | test.swift:254:30:254:44 | source(...) | source(...) |
+| test.swift:257:10:257:32 | ... ?? ... | test.swift:254:30:254:44 | source(...) | test.swift:257:10:257:32 | ... ?? ... | $@ | test.swift:254:30:254:44 | source(...) | source(...) |

unified/ql/test/library-tests/dataflow/test.swift

@@ -248,3 +248,11 @@ func t27() {
         sink(x)  // $ hasValueFlow=t27.1
     }
 }
+
+func t28() {
+    func getOptional() -> String? {
+        return Optional.some(source("t28.1"))
+    }
+    sink(getOptional() ?? "default")  // $ hasValueFlow=t28.1
+    sink("safe" ?? getOptional())  // $ hasValueFlow=t28.1
+}