/** Gets the enclosing callable of the basic block. */

Callable basicBlockGetEnclosingCallable(BasicBlock bb);

/** A variable that is captured in a closure. */

class CapturedVariable {

/** Gets a textual representation of this variable. */

string toString();

/** Gets the callable that defines this variable. */

Callable getCallable();

/** Gets the location of this variable. */

Location getLocation();

}

/** A parameter that is captured in a closure. */

class CapturedParameter extends CapturedVariable;

/**

class Expr {

/** Gets a textual representation of this expression. */

string toString();

/** Gets the location of this expression. */

Location getLocation();

/** Holds if the `i`th node of basic block `bb` evaluates this expression. */

predicate hasCfgNode(BasicBlock bb, int i);

}

/** A write to a captured variable. */

class VariableWrite {

/** Gets the variable that is the target of this write. */

CapturedVariable getVariable();

/** Gets the location of this write. */

Location getLocation();

/** Holds if the `i`th node of basic block `bb` evaluates this expression. */

predicate hasCfgNode(BasicBlock bb, int i);

}

/** A read of a captured variable. */

class VariableRead extends Expr {

/** Gets the variable that this expression reads. */

CapturedVariable getVariable();

}

/**

class ClosureExpr extends Expr {

/**

predicate hasBody(Callable body);

/**

predicate hasAliasedAccess(Expr f);

}

class Callable {

/** Gets a textual representation of this callable. */

string toString();

/** Gets the location of this callable. */

Location getLocation();

/** Holds if this callable is a constructor. */

predicate isConstructor();

}

LocationSig Location, BasicBlockSig BasicBlock, InputSig<Location, BasicBlock> I>

/**

class ClosureNode;

/**

class SynthesizedCaptureNode extends ClosureNode {

/** Gets a textual representation of this node. */

string toString();

/** Gets the location of this node. */

Location getLocation();

/** Gets the enclosing callable. */

I::Callable getEnclosingCallable();

/** Holds if this node is a synthesized access of `v`. */

predicate isVariableAccess(I::CapturedVariable v);

/** Holds if this node is a synthesized instance access. */

predicate isInstanceAccess();

}

/** A data flow node for an expression. */

class ExprNode extends ClosureNode {

/** Gets the expression corresponding to this node. */

I::Expr getExpr();

}

/** A data flow node for the `PostUpdateNode` of an expression. */

class ExprPostUpdateNode extends ClosureNode {

/** Gets the expression corresponding to this node. */

I::Expr getExpr();

}

/** A data flow node for a parameter. */

class ParameterNode extends ClosureNode {

/** Gets the parameter corresponding to this node. */

I::CapturedParameter getParameter();

}

/** A data flow node for an instance parameter. */

class ThisParameterNode extends ClosureNode {

/** Gets the callable this instance parameter belongs to. */

I::Callable getCallable();

}

/** A data flow node for the instance parameter argument of a constructor call. */

class MallocNode extends ClosureNode {

/** Gets the closure construction that is the post-update of this node. */

I::ClosureExpr getClosureExpr();

}

/**

class VariableWriteSourceNode extends ClosureNode {

/** Gets the variable write for which this node is the incoming value being written to the variable. */

I::VariableWrite getVariableWrite();

}

/** Holds if `post` is a `PostUpdateNode` for `pre`. */

predicate capturePostUpdateNode(SynthesizedCaptureNode post, SynthesizedCaptureNode pre);

/** Holds if there is a local flow step from `node1` to `node2`. */

predicate localFlowStep(ClosureNode node1, ClosureNode node2);

/** Holds if there is a store step from `node1` to `node2`. */

predicate storeStep(ClosureNode node1, I::CapturedVariable v, ClosureNode node2);

/** Holds if there is a read step from `node1` to `node2`. */

predicate readStep(ClosureNode node1, I::CapturedVariable v, ClosureNode node2);

/** Holds if this-to-this summaries are expected for `c`. */

predicate heuristicAllowInstanceParameterReturnInSelf(I::Callable c);

/** Holds if captured variable `v` is cleared at `node`. */

predicate clearsContent(ClosureNode node, I::CapturedVariable v);

LocationSig Location, BB::CfgSig<Location> Cfg, InputSig<Location, Cfg::BasicBlock> Input>

implements OutputSig<Location, Cfg::BasicBlock, Input>

private import Input

final private class CfgBb = Cfg::BasicBlock;

private class BasicBlock extends CfgBb {

Callable getEnclosingCallable() { result = basicBlockGetEnclosingCallable(this) }

}

additional module ConsistencyChecks {

final private class FinalExpr = Expr;

private class RelevantExpr extends FinalExpr {

RelevantExpr() {

this instanceof VariableRead or

this instanceof ClosureExpr or

any(ClosureExpr ce).hasAliasedAccess(this)

}

}

final private class FinalBasicBlock = BasicBlock;

private class RelevantBasicBlock extends FinalBasicBlock {

RelevantBasicBlock() {

exists(RelevantExpr e | e.hasCfgNode(this, _))

or

exists(VariableWrite vw | vw.hasCfgNode(this, _))

}

}

final private class FinalCallable = Callable;

private class RelevantCallable extends FinalCallable {

RelevantCallable() {

exists(RelevantBasicBlock bb | bb.getEnclosingCallable() = this)

or

exists(CapturedVariable v | v.getCallable() = this)

or

exists(ClosureExpr ce | ce.hasBody(this))

}

}

query predicate uniqueToString(string msg, int n) {

exists(string elem |

n = strictcount(RelevantBasicBlock bb | not exists(bb.toString())) and

elem = "BasicBlock"

or

n = strictcount(CapturedVariable v | not exists(v.toString())) and elem = "CapturedVariable"

or

n = strictcount(RelevantExpr e | not exists(e.toString())) and elem = "Expr"

or

n = strictcount(RelevantCallable c | not exists(c.toString())) and

elem = "Callable"

|

msg = n + " " + elem + "(s) are missing toString"

)

or

exists(string elem |

n = strictcount(RelevantBasicBlock bb | 2 <= strictcount(bb.toString())) and

elem = "BasicBlock"

or

n = strictcount(CapturedVariable v | 2 <= strictcount(v.toString())) and

elem = "CapturedVariable"

or

n = strictcount(RelevantExpr e | 2 <= strictcount(e.toString())) and

elem = "Expr"

or

n = strictcount(RelevantCallable c | 2 <= strictcount(c.toString())) and

elem = "Callable"

|

msg = n + " " + elem + "(s) have multiple toStrings"

)

}

query predicate uniqueEnclosingCallable(RelevantBasicBlock bb, string msg) {

msg = "BasicBlock has no enclosing callable" and not exists(bb.getEnclosingCallable())

or

msg = "BasicBlock has multiple enclosing callables" and

2 <= strictcount(bb.getEnclosingCallable())

}

query predicate uniqueDominator(RelevantBasicBlock bb, string msg) {

msg = "BasicBlock has multiple immediate dominators" and

2 <= strictcount(bb.getImmediateDominator())

}

query predicate localDominator(RelevantBasicBlock bb, string msg) {

msg = "BasicBlock has non-local dominator" and

bb.getEnclosingCallable() != bb.getImmediateDominator().(BasicBlock).getEnclosingCallable()

}

query predicate localSuccessor(RelevantBasicBlock bb, string msg) {

msg = "BasicBlock has non-local successor" and

bb.getEnclosingCallable() != bb.getASuccessor().(BasicBlock).getEnclosingCallable()

}

query predicate uniqueDefiningScope(CapturedVariable v, string msg) {

msg = "CapturedVariable has no defining callable" and not exists(v.getCallable())

or

msg = "CapturedVariable has multiple defining callables" and 2 <= strictcount(v.getCallable())

}

query predicate variableIsCaptured(CapturedVariable v, string msg) {

msg = "CapturedVariable is not captured" and

not captureAccess(v, _)

}

query predicate uniqueLocation(RelevantExpr e, string msg) {

msg = "Expr has no location" and not exists(e.getLocation())

or

msg = "Expr has multiple locations" and 2 <= strictcount(e.getLocation())

}

query predicate uniqueCfgNode(RelevantExpr e, string msg) {

msg = "Expr has no cfg node" and not e.hasCfgNode(_, _)

or

msg = "Expr has multiple cfg nodes" and

2 <= strictcount(BasicBlock bb, int i | e.hasCfgNode(bb, i))

}

private predicate uniqueWriteTarget(VariableWrite vw, string msg) {

msg = "VariableWrite has no target variable" and not exists(vw.getVariable())

or

msg = "VariableWrite has multiple target variables" and 2 <= strictcount(vw.getVariable())

}

query predicate uniqueWriteTarget(string msg) { uniqueWriteTarget(_, msg) }

private predicate uniqueWriteCfgNode(VariableWrite vw, string msg) {

msg = "VariableWrite has no cfg node" and not vw.hasCfgNode(_, _)

or

msg = "VariableWrite has multiple cfg nodes" and

2 <= strictcount(BasicBlock bb, int i | vw.hasCfgNode(bb, i))

}

query predicate uniqueWriteCfgNode(string msg) { uniqueWriteCfgNode(_, msg) }

query predicate uniqueReadVariable(VariableRead vr, string msg) {

msg = "VariableRead has no source variable" and not exists(vr.getVariable())

or

msg = "VariableRead has multiple source variables" and 2 <= strictcount(vr.getVariable())

}

query predicate closureMustHaveBody(ClosureExpr ce, string msg) {

msg = "ClosureExpr has no body" and not ce.hasBody(_)

}

query predicate closureAliasMustBeInSameScope(ClosureExpr ce, Expr access, string msg) {

exists(BasicBlock bb1, BasicBlock bb2 |

ce.hasAliasedAccess(access) and

ce.hasCfgNode(bb1, _) and

access.hasCfgNode(bb2, _) and

not bb1.getEnclosingCallable() = callableGetEnclosingCallable*(bb2.getEnclosingCallable()) and

msg =

"ClosureExpr has an alias outside the scope of its enclosing callable - these are ignored"

)

}

private predicate astClosureParent(Callable closure, Callable parent) {

exists(ClosureExpr ce, BasicBlock bb |

ce.hasBody(closure) and ce.hasCfgNode(bb, _) and parent = bb.getEnclosingCallable()

)

}

query predicate variableAccessAstNesting(CapturedVariable v, Callable c, string msg) {

exists(BasicBlock bb, Callable parent |

captureRead(v, bb, _, false, _) or captureWrite(v, bb, _, false, _)

|

bb.getEnclosingCallable() = c and

v.getCallable() = parent and

not astClosureParent+(c, parent) and

msg = "CapturedVariable access is not nested in the defining callable"

)

}

query predicate uniqueCallableLocation(RelevantCallable c, string msg) {

msg = "Callable has no location" and not exists(c.getLocation())

or

msg = "Callable has multiple locations" and 2 <= strictcount(c.getLocation())

}

query predicate consistencyOverview(string msg, int n) {

uniqueToString(msg, n) or

n = strictcount(BasicBlock bb | uniqueEnclosingCallable(bb, msg)) or

n = strictcount(BasicBlock bb | uniqueDominator(bb, msg)) or

n = strictcount(BasicBlock bb | localDominator(bb, msg)) or

n = strictcount(BasicBlock bb | localSuccessor(bb, msg)) or

n = strictcount(CapturedVariable v | uniqueDefiningScope(v, msg)) or

n = strictcount(CapturedVariable v | variableIsCaptured(v, msg)) or

n = strictcount(Expr e | uniqueLocation(e, msg)) or

n = strictcount(Expr e | uniqueCfgNode(e, msg)) or

n = strictcount(VariableWrite vw | uniqueWriteTarget(vw, msg)) or

n = strictcount(VariableWrite vw | uniqueWriteCfgNode(vw, msg)) or

n = strictcount(VariableRead vr | uniqueReadVariable(vr, msg)) or

n = strictcount(ClosureExpr ce | closureMustHaveBody(ce, msg)) or

n = strictcount(ClosureExpr ce, Expr access | closureAliasMustBeInSameScope(ce, access, msg)) or

n = strictcount(CapturedVariable v, Callable c | variableAccessAstNesting(v, c, msg)) or

n = strictcount(Callable c | uniqueCallableLocation(c, msg))

}

}

/*

/**

private predicate captureRead(

CapturedVariable v, BasicBlock bb, int i, boolean topScope, VariableRead vr

) {

vr.getVariable() = v and

vr.hasCfgNode(bb, i) and

if v.getCallable() != bb.getEnclosingCallable() then topScope = false else topScope = true

}

/**

private predicate captureWrite(

CapturedVariable v, BasicBlock bb, int i, boolean topScope, VariableWrite vw

) {

vw.getVariable() = v and

vw.hasCfgNode(bb, i) and

if v.getCallable() != bb.getEnclosingCallable() then topScope = false else topScope = true

}

/** Gets the enclosing callable of `ce`. */

private Callable closureExprGetEnclosingCallable(ClosureExpr ce) {

exists(BasicBlock bb | ce.hasCfgNode(bb, _) and result = bb.getEnclosingCallable())

}

/** Gets the enclosing callable of `inner`. */

pragma[nomagic]

private Callable callableGetEnclosingCallable(Callable inner) {

exists(ClosureExpr closure |

closure.hasBody(inner) and

result = closureExprGetEnclosingCallable(closure)

)

}

/**

private Callable closureExprGetAReferencingCallable(ClosureExpr ce) {

result = closureExprGetEnclosingCallable(ce)

or

exists(Expr expr, BasicBlock bb |

ce.hasAliasedAccess(expr) and

expr.hasCfgNode(bb, _) and

result = bb.getEnclosingCallable() and

// The reference to `ce` is allowed to occur in a more deeply nested context

closureExprGetEnclosingCallable(ce) = callableGetEnclosingCallable*(result)

)

}

/**

private predicate captureAccess(CapturedVariable v, Callable c) {

exists(BasicBlock bb | captureRead(v, bb, _, _, _) or captureWrite(v, bb, _, _, _) |

c = bb.getEnclosingCallable() and

c != v.getCallable()

)

or

exists(ClosureExpr ce |

c = closureExprGetAReferencingCallable(ce) and

closureCaptures(ce, v) and

c != v.getCallable()

)

}

/** Holds if the closure defined by `ce` captures `v`. */

private predicate closureCaptures(ClosureExpr ce, CapturedVariable v) {

exists(Callable c | ce.hasBody(c) and captureAccess(v, c))

}

predicate heuristicAllowInstanceParameterReturnInSelf(Callable c) {

// If multiple variables are captured, then we should allow flow from one to

// another, which entails a this-to-this summary.

2 <= strictcount(CapturedVariable v | captureAccess(v, c))

or

// Constructors that capture a variable may assign it to a field, which also

// entails a this-to-this summary. If there are multiple constructors, then

// they might call each other, so if one constructor captures a variable we

// allow this-to-this summaries for all of them.

exists(ClosureExpr ce | ce.hasBody(c) and c.isConstructor() and hasConstructorCapture(ce, _))

}

/** Holds if a constructor, if any, for the closure defined by `ce` captures `v`. */

private predicate hasConstructorCapture(ClosureExpr ce, CapturedVariable v) {

exists(Callable c | ce.hasBody(c) and c.isConstructor() and captureAccess(v, c))

}

/**

private predicate localOrNestedClosureAccess(ClosureExpr ce, Expr access, BasicBlock bb, int i) {

ce.hasAliasedAccess(access) and

access.hasCfgNode(bb, i) and

pragma[only_bind_out](bb.getEnclosingCallable()) =

pragma[only_bind_out](closureExprGetAReferencingCallable(ce))

}

/**

private predicate synthRead(

CapturedVariable v, BasicBlock bb, int i, boolean topScope, Expr closure, boolean alias

) {

exists(ClosureExpr ce | closureCaptures(ce, v) |

ce.hasCfgNode(bb, i) and ce = closure and alias = false

or

localOrNestedClosureAccess(ce, closure, bb, i) and alias = true

) and

if v.getCallable() != bb.getEnclosingCallable() then topScope = false else topScope = true

}

private predicate synthRead(

CapturedVariable v, BasicBlock bb, int i, boolean topScope, Expr closure

) {

synthRead(v, bb, i, topScope, closure, _)

}

/**

private predicate synthThisQualifier(BasicBlock bb, int i) {

synthRead(_, bb, i, false, _) or

captureRead(_, bb, i, false, _) or

captureWrite(_, bb, i, false, _)

}

private newtype TCaptureContainer =

TVariable(CapturedVariable v) or

TThis(Callable c) { captureAccess(_, c) }

/**

private class CaptureContainer extends TCaptureContainer {

string toString() {

exists(CapturedVariable v | this = TVariable(v) and result = v.toString())

or

result = "this" and this = TThis(_)

}

Location getLocation() {

exists(CapturedVariable v | this = TVariable(v) and result = v.getLocation())

or

exists(Callable c | this = TThis(c) and result = c.getLocation())

}

}

/** Holds if `cc` needs a definition at the entry of its callable scope. */

private predicate entryDef(CaptureContainer cc, BasicBlock bb, int i) {

exists(Callable c |

bb instanceof Cfg::EntryBasicBlock and

pragma[only_bind_out](bb.getEnclosingCallable()) = c and

i =

min(int j |

j = 1 or

captureRead(_, bb, j, _, _) or

captureWrite(_, bb, j, _, _) or

synthRead(_, bb, j, _, _)

) - 1

|

cc = TThis(c)

or

exists(CapturedParameter p | cc = TVariable(p) and p.getCallable() = c)

)

}

private module CaptureSsaInput implements Ssa::InputSig<Location, Cfg::BasicBlock> {

class SourceVariable = CaptureContainer;

predicate variableWrite(Cfg::BasicBlock bb, int i, SourceVariable cc, boolean certain) {

Cached::ref() and

(

exists(CapturedVariable v | cc = TVariable(v) and captureWrite(v, bb, i, true, _))

or

entryDef(cc, bb, i)

) and

certain = true

}

predicate variableRead(Cfg::BasicBlock bb, int i, SourceVariable cc, boolean certain) {

(

synthThisQualifier(bb, i) and cc = TThis(bb.(BasicBlock).getEnclosingCallable())

or

exists(CapturedVariable v | cc = TVariable(v) |

captureRead(v, bb, i, true, _) or synthRead(v, bb, i, true, _)

)

) and

certain = true

}

}

private module CaptureSsa = Ssa::Make<Location, Cfg, CaptureSsaInput>;

private module DataFlowIntegrationInput implements CaptureSsa::DataFlowIntegrationInputSig {

private import codeql.util.Void

class Expr instanceof Cfg::ControlFlowNode {

string toString() { result = super.toString() }

predicate hasCfgNode(Cfg::BasicBlock bb, int i) { bb.getNode(i) = this }

}

class GuardValue = Void;

class Guard extends Void {

predicate hasValueBranchEdge(Cfg::BasicBlock bb1, Cfg::BasicBlock bb2, GuardValue val) {

none()

}

predicate valueControlsBranchEdge(Cfg::BasicBlock bb1, Cfg::BasicBlock bb2, GuardValue val) {

none()

}

}

predicate guardDirectlyControlsBlock(Guard guard, Cfg::BasicBlock bb, GuardValue val) { none() }

predicate includeWriteDefsInFlowStep() { none() }

predicate supportBarrierGuardsOnPhiEdges() { none() }

}

private module SsaFlow = CaptureSsa::DataFlowIntegration<DataFlowIntegrationInput>;

cached

private module Cached {

cached

predicate ref() { any() }

cached

predicate backref() { localFlowStep(_, _) implies any() }

cached

newtype TClosureNode =

TSynthRead(CapturedVariable v, BasicBlock bb, int i, Boolean isPost) {

synthRead(v, bb, i, _, _)

} or

TSynthThisQualifier(BasicBlock bb, int i, Boolean isPost) { synthThisQualifier(bb, i) } or

TSynthSsa(SsaFlow::SsaNode n) or

TExprNode(Expr expr, Boolean isPost) {

expr instanceof VariableRead

or

synthRead(_, _, _, _, expr)

} or

TParamNode(CapturedParameter p) or

TThisParamNode(Callable c) { captureAccess(_, c) } or

TMallocNode(ClosureExpr ce) { hasConstructorCapture(ce, _) } or

TVariableWriteSourceNode(VariableWrite write)

}

private import Cached

class ClosureNode extends TClosureNode {

/** Gets a textual representation of this node. */

string toString() {

exists(CapturedVariable v | this = TSynthRead(v, _, _, _) and result = v.toString())

or

result = "this" and this = TSynthThisQualifier(_, _, _)

or

exists(SsaFlow::SsaNode n | this = TSynthSsa(n) and result = n.toString())

or

exists(Expr expr, boolean isPost | this = TExprNode(expr, isPost) |

isPost = false and result = expr.toString()

or

isPost = true and result = expr.toString() + " [postupdate]"

)

or

exists(CapturedParameter p | this = TParamNode(p) and result = p.toString())

or

result = "this" and this = TThisParamNode(_)

or

result = "malloc" and this = TMallocNode(_)

or

exists(VariableWrite write |

this = TVariableWriteSourceNode(write) and

result = "Source of write to " + write.getVariable().toString()

)

}

/** Gets the location of this node. */

Location getLocation() {

exists(CapturedVariable v, BasicBlock bb, int i, Expr closure |

this = TSynthRead(v, bb, i, _) and

synthRead(v, bb, i, _, closure) and

result = closure.getLocation()

)

or

exists(BasicBlock bb, int i | this = TSynthThisQualifier(bb, i, _) |

synthRead(_, bb, i, false, any(Expr closure | result = closure.getLocation())) or

captureRead(_, bb, i, false, any(VariableRead vr | result = vr.getLocation())) or

captureWrite(_, bb, i, false, any(VariableWrite vw | result = vw.getLocation()))

)

or

exists(SsaFlow::SsaNode n | this = TSynthSsa(n) and result = n.getLocation())

or

exists(Expr expr | this = TExprNode(expr, _) and result = expr.getLocation())

or

exists(CapturedParameter p | this = TParamNode(p) and result = p.getCallable().getLocation())

or

exists(Callable c | this = TThisParamNode(c) and result = c.getLocation())

or

exists(ClosureExpr ce | this = TMallocNode(ce) and result = ce.getLocation())

or

exists(VariableWrite write |

this = TVariableWriteSourceNode(write) and result = write.getLocation()

)

}

}

private class TSynthesizedCaptureNode = TSynthRead or TSynthThisQualifier or TSynthSsa;

class SynthesizedCaptureNode extends ClosureNode, TSynthesizedCaptureNode {

BasicBlock getBasicBlock() {

this = TSynthRead(_, result, _, _)

or

this = TSynthThisQualifier(result, _, _)

or

exists(SsaFlow::SsaNode n | this = TSynthSsa(n) and n.getBasicBlock() = result)

}

Callable getEnclosingCallable() { result = this.getBasicBlock().getEnclosingCallable() }

predicate isVariableAccess(CapturedVariable v) {

this = TSynthRead(v, _, _, _)

or

exists(SsaFlow::SsaNode n | this = TSynthSsa(n) and n.getSourceVariable() = TVariable(v))

}

predicate isInstanceAccess() {

this instanceof TSynthThisQualifier

or

exists(SsaFlow::SsaNode n | this = TSynthSsa(n) and n.getSourceVariable() = TThis(_))

}

}

class ExprNode extends ClosureNode, TExprNode {

ExprNode() { this = TExprNode(_, false) }

Expr getExpr() { this = TExprNode(result, _) }

}

class ExprPostUpdateNode extends ClosureNode, TExprNode {

ExprPostUpdateNode() { this = TExprNode(_, true) }

Expr getExpr() { this = TExprNode(result, _) }

}

class ParameterNode extends ClosureNode, TParamNode {

CapturedParameter getParameter() { this = TParamNode(result) }

}

class ThisParameterNode extends ClosureNode, TThisParamNode {

Callable getCallable() { this = TThisParamNode(result) }

}

class MallocNode extends ClosureNode, TMallocNode {

ClosureExpr getClosureExpr() { this = TMallocNode(result) }

}

class VariableWriteSourceNode extends ClosureNode, TVariableWriteSourceNode {

VariableWrite getVariableWrite() { this = TVariableWriteSourceNode(result) }

}

predicate capturePostUpdateNode(SynthesizedCaptureNode post, SynthesizedCaptureNode pre) {

exists(CapturedVariable v, BasicBlock bb, int i |

pre = TSynthRead(v, bb, i, false) and post = TSynthRead(v, bb, i, true)

)

or

exists(BasicBlock bb, int i |

pre = TSynthThisQualifier(bb, i, false) and post = TSynthThisQualifier(bb, i, true)