From 3bf191f80eea3882795fac564dc8461f0fdf22c7 Mon Sep 17 00:00:00 2001 From: Asger F Date: Fri, 30 Oct 2026 13:14:27 +0100 Subject: [PATCH 1/2] unified: Add test --- .../ql/test/library-tests/mad/test.expected | 2 ++ .../ql/test/library-tests/mad/test.ext.yml | 11 ++++++++++ unified/ql/test/library-tests/mad/test.swift | 20 +++++++++++++++++++ 3 files changed, 33 insertions(+) create mode 100644 unified/ql/test/library-tests/mad/test.ext.yml diff --git a/unified/ql/test/library-tests/mad/test.expected b/unified/ql/test/library-tests/mad/test.expected index b8648a61054a..23e21494651a 100644 --- a/unified/ql/test/library-tests/mad/test.expected +++ b/unified/ql/test/library-tests/mad/test.expected @@ -16,6 +16,7 @@ isSink | test.swift:101:18:101:24 | fileURL | path-injection | | test.swift:107:23:107:34 | seedFilePath | path-injection | | test.swift:119:29:119:34 | string | path-injection | +| test.swift:138:9:138:14 | string | shorthand-sink | isSource | test.swift:4:5:4:27 | String(...) | remote | | test.swift:5:5:5:44 | String(...) | remote | @@ -25,3 +26,4 @@ isSource | test.swift:10:5:12:24 | String(...) | local | | test.swift:13:5:15:28 | String(...) | local | | test.swift:29:29:29:32 | text | local | +| test.swift:130:11:130:11 | x | shorthand-source | diff --git a/unified/ql/test/library-tests/mad/test.ext.yml b/unified/ql/test/library-tests/mad/test.ext.yml new file mode 100644 index 000000000000..ff54290568d7 --- /dev/null +++ b/unified/ql/test/library-tests/mad/test.ext.yml @@ -0,0 +1,11 @@ +extensions: + - addsTo: + pack: codeql/unified-all + extensible: legacySourceModel + data: # namespace, type, subtypes, name, signature, ext, output, kind, provenance + - ["", "ShorthandTest", true, "sourceParams(_:)", "", "", "Parameter[self,0]", "shorthand-source", "manual"] + - addsTo: + pack: codeql/unified-all + extensible: legacySinkModel + data: # namespace, type, subtypes, name, signature, ext, input, kind, provenance + - ["", "ShorthandTest", true, "sinkArgs(_:)", "", "", "Argument[self,0]", "shorthand-sink", "manual"] diff --git a/unified/ql/test/library-tests/mad/test.swift b/unified/ql/test/library-tests/mad/test.swift index fd1af8f38351..8153ae626acd 100644 --- a/unified/ql/test/library-tests/mad/test.swift +++ b/unified/ql/test/library-tests/mad/test.swift @@ -118,3 +118,23 @@ class Connection { func testConnectionLocation(string: String) { Connection.Location.uri(string, parameters: "") // $ isSink=path-injection } + +class ShorthandTest { + func sourceParams(_ x: String) {} + + func sinkArgs(_ x: String) {} +} + +class ShorthandTestSub: ShorthandTest { + override func sourceParams( + _ x: String // $ isSource=shorthand-source + ) { + _ = self + } // $ MISSING: isSource=shorthand-source +} + +func testShorthandTokens(obj: ShorthandTest, string: String) { + obj.sinkArgs( + string // $ isSink=shorthand-sink + ) // $ MISSING: isSink=shorthand-sink +} From 75373ee829aaa75953321e8eaf2fddc294dacbfd Mon Sep 17 00:00:00 2001 From: Asger F Date: Fri, 30 Oct 2026 13:15:40 +0100 Subject: [PATCH 2/2] unified: Use proper accessor when accessing operand of token --- unified/ql/lib/codeql/unified/internal/mad/LegacyMaD.qll | 6 ++++-- unified/ql/test/library-tests/mad/test.expected | 2 ++ unified/ql/test/library-tests/mad/test.swift | 4 ++-- 3 files changed, 8 insertions(+), 4 deletions(-) diff --git a/unified/ql/lib/codeql/unified/internal/mad/LegacyMaD.qll b/unified/ql/lib/codeql/unified/internal/mad/LegacyMaD.qll index a09dc88aef59..09da505b7d0b 100644 --- a/unified/ql/lib/codeql/unified/internal/mad/LegacyMaD.qll +++ b/unified/ql/lib/codeql/unified/internal/mad/LegacyMaD.qll @@ -224,7 +224,8 @@ private DataFlow::Node getSinkFromCall(CallExpr call, AccessPathToken token) { arg.getName() + ":" = token.getAnArgument() ) or - token = "Argument[self]" and + token.getName() = "Argument" and + token.getAnArgument() = "self" and result.isReceiverArgument(call) } @@ -263,7 +264,8 @@ private DataFlow::Node getSourceFromCallable(Callable callable, AccessPathToken param.getExternalName() + ":" = token.getAnArgument() ) or - token = "Parameter[self]" and + token.getName() = "Parameter" and + token.getAnArgument() = "self" and result.isReceiverParameter(callable) } diff --git a/unified/ql/test/library-tests/mad/test.expected b/unified/ql/test/library-tests/mad/test.expected index 23e21494651a..aaa07763e1e3 100644 --- a/unified/ql/test/library-tests/mad/test.expected +++ b/unified/ql/test/library-tests/mad/test.expected @@ -16,6 +16,7 @@ isSink | test.swift:101:18:101:24 | fileURL | path-injection | | test.swift:107:23:107:34 | seedFilePath | path-injection | | test.swift:119:29:119:34 | string | path-injection | +| test.swift:137:5:139:5 | [self arg] ... .sinkArgs(...) | shorthand-sink | | test.swift:138:9:138:14 | string | shorthand-sink | isSource | test.swift:4:5:4:27 | String(...) | remote | @@ -26,4 +27,5 @@ isSource | test.swift:10:5:12:24 | String(...) | local | | test.swift:13:5:15:28 | String(...) | local | | test.swift:29:29:29:32 | text | local | +| test.swift:129:5:133:5 | [self param] func ShorthandTestSub.sourceParams | shorthand-source | | test.swift:130:11:130:11 | x | shorthand-source | diff --git a/unified/ql/test/library-tests/mad/test.swift b/unified/ql/test/library-tests/mad/test.swift index 8153ae626acd..ff6c6975bfac 100644 --- a/unified/ql/test/library-tests/mad/test.swift +++ b/unified/ql/test/library-tests/mad/test.swift @@ -130,11 +130,11 @@ class ShorthandTestSub: ShorthandTest { _ x: String // $ isSource=shorthand-source ) { _ = self - } // $ MISSING: isSource=shorthand-source + } // $ isSource=shorthand-source } func testShorthandTokens(obj: ShorthandTest, string: String) { obj.sinkArgs( string // $ isSink=shorthand-sink - ) // $ MISSING: isSink=shorthand-sink + ) // $ isSink=shorthand-sink }