Merge branch 'main' into codex/issue-5163-wikimedia-links

Author: jketema

BUILD.bazel

@@ -3,3 +3,11 @@ exports_files([
     "Cargo.lock",
     "Cargo.toml",
 ])
+
+constraint_setting(name = "swift_runtime_linkage")
+
+constraint_value(
+    name = "static_swift_runtime",
+    constraint_setting = ":swift_runtime_linkage",
+    visibility = ["//visibility:public"],
+)

MODULE.bazel

@@ -31,7 +31,7 @@ bazel_dep(name = "gazelle", version = "0.50.0")
 bazel_dep(name = "rules_dotnet", version = "0.21.5-codeql.1")
 bazel_dep(name = "googletest", version = "1.17.0.bcr.2")
 bazel_dep(name = "rules_rust", version = "0.69.0")
-bazel_dep(name = "rules_swift", version = "4.0.0-rc5-codeql.1")
+bazel_dep(name = "rules_swift", version = "4.0.0-rc5-codeql.2")
 bazel_dep(name = "swift-syntax", version = "603.0.2")
 bazel_dep(name = "zstd", version = "1.5.7.bcr.1")
 
@@ -228,7 +228,7 @@ use_repo(
 # `unified/swift-syntax-rs` package is not loadable in that context. Keep this
 # in sync with `unified/swift-syntax-rs/.swift-version` (used by the `cargo`
 # build) and the `swift-syntax` release in `swift/Package.swift`.
-swift = use_extension("@rules_swift//swift:extensions.bzl", "swift")
+swift = use_extension("@rules_swift//swift:extensions.bzl", "swift", dev_dependency = True)
 swift.toolchain(
     name = "swift_toolchain",
     swift_version = "6.3.3",
@@ -243,6 +243,7 @@ use_repo(
 register_toolchains(
     "@swift_toolchain//:swift_toolchain_exec_ubuntu22.04",
     "@swift_toolchain//:swift_toolchain_exec_xcode",
+    dev_dependency = True,
 )
 
 node = use_extension("@rules_nodejs//nodejs:extensions.bzl", "node")

cpp/ql/lib/change-notes/2026-08-19-access-paths-for-sources-and-sinks.md

@@ -0,0 +1,4 @@
+---
+category: feature
+---
+* Sources and sinks defined using models-as-data now support access paths with fields. For example, the path `ReturnValue.Field[S::f]` makes the field `S::f` a flow source when it is returned by a call.

cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll

@@ -113,6 +113,7 @@
 import cpp
 private import new.DataFlow
 private import semmle.code.cpp.controlflow.IRGuards
+private import semmle.code.cpp.ir.dataflow.internal.DataFlowNodes as Nodes
 private import semmle.code.cpp.ir.dataflow.internal.DataFlowPrivate as Private
 private import semmle.code.cpp.ir.dataflow.internal.DataFlowUtil
 private import internal.FlowSummaryImpl
@@ -952,9 +953,7 @@ private module Cached {
    */
   cached
   predicate sourceNode(DataFlow::Node node, string kind, string model) {
-    exists(SourceSinkInterpretationInput::InterpretNode n |
-      isSourceNode(n, kind, model) and n.asNode() = node
-    )
+    node.(Nodes::FlowSummaryNode).isSource(kind, model)
   }
 
   /**
@@ -963,9 +962,7 @@ private module Cached {
    */
   cached
   predicate sinkNode(DataFlow::Node node, string kind, string model) {
-    exists(SourceSinkInterpretationInput::InterpretNode n |
-      isSinkNode(n, kind, model) and n.asNode() = node
-    )
+    node.(Nodes::FlowSummaryNode).isSink(kind, model)
   }
 
   private newtype TKindModelPair =

cpp/ql/lib/semmle/code/cpp/dataflow/internal/FlowSummaryImpl.qll

@@ -17,11 +17,9 @@ module Input implements InputSig<Location, DataFlowImplSpecific::CppDataFlow> {
 
   class SummarizedCallableBase = Function;
 
-  class SourceBase extends Void {
-    Location getLocation() { none() }
-  }
+  class SourceBase = Function;
 
-  class SinkBase = SourceBase;
+  class SinkBase = Function;
 
   class FlowSummaryCallBase = CallInstruction;
 
@@ -134,15 +132,192 @@ module Input implements InputSig<Location, DataFlowImplSpecific::CppDataFlow> {
 
 private import Make<Location, DataFlowImplSpecific::CppDataFlow, Input> as Impl
 
+private class ConversionCall extends Call {
+  ConversionCall() { this.getTarget() instanceof ConversionOperator }
+}
+
 private module Input2 implements Impl::Private::InputSig2 {
   private import codeql.util.Void
 
-  class SourceSinkReportingElement extends Void {
-    Location getLocation() { none() }
+  pragma[nomagic]
+  private predicate hasFunctionAndIndirectionIndex(
+    Function f, int indirectionIndex, Ssa::ExplicitDefinition def
+  ) {
+    def.getFunction() = f and
+    def.getSourceVariable().getIRVariable() instanceof IRReturnVariable and
+    def.getIndirectionIndex() = indirectionIndex
+  }
+
+  /** Holds if `def` defines `e` as a returned value with return kind `rk`. */
+  bindingset[rk, e]
+  private predicate isReturnExpr(Function f, ReturnKind rk, Expr e) {
+    exists(Ssa::ExplicitDefinition def |
+      hasFunctionAndIndirectionIndex(f, rk.getIndirectionIndex(), def) and
+      e =
+        def.getAssignedInstruction()
+            .(StoreInstruction)
+            .getSourceValue()
+            .getUnconvertedResultExpression()
+    )
+  }
+
+  private MemberFunction getFunctionFromType(Expr e) {
+    result.getClassAndName("operator()").getADerivedClass*() = e.getUnspecifiedType()
+  }
+
+  private Function getFunctionFromExpr(Expr e) {
+    result = e.(FunctionAccess).getTarget()
+    or
+    result = e.(ConversionCall).getQualifier().(LambdaExpression).getLambdaFunction()
+  }
+
+  class SourceSinkReportingElement extends Element {
+    SourceSinkReportingElement() { this instanceof Expr or this instanceof Parameter }
+
+    DataFlowCallable getEnclosingCallable() {
+      result.asSourceCallable() =
+        [this.(Expr).getEnclosingFunction(), this.(Parameter).getFunction()]
+    }
+
+    /** Gets the function invoked when this element is used as a callback. */
+    private Function getCallable() {
+      // The expression is a struct which implements `operator()`.
+      result = getFunctionFromType(this)
+      or
+      // The expression is a function pointer
+      result = getFunctionFromExpr(this)
+      or
+      // The expression is an SSA read of an assignment of a callable
+      exists(Ssa::Definition def |
+        def.getAUse().getDef().getUnconvertedResultExpression() = this and
+        result =
+          getFunctionFromExpr(def.getAnUltimateDefinition()
+                .(Ssa::DirectExplicitDefinition)
+                .getAssignedInstruction()
+                .(StoreInstruction)
+                .getSourceValue()
+                .getUnconvertedResultExpression())
+      )
+    }
+
+    SourceSinkReportingElement getASuccessor(Impl::Private::SummaryComponent sc) {
+      exists(Function f | f = this.getCallable() |
+        exists(ParameterPosition pos | sc = Impl::Private::SummaryComponent::parameter(pos) |
+          result = pos.getParameter(f)
+        )
+        or
+        exists(ReturnKind rk |
+          sc = Impl::Private::SummaryComponent::return(rk) and
+          isReturnExpr(f, rk, result)
+        )
+      )
+    }
+  }
+
+  bindingset[source, sc]
+  SourceSinkReportingElement getASourceReportingElement(
+    Input::SourceBase source, Impl::Private::SummaryComponent sc
+  ) {
+    exists(Call call | call.getTarget() = source |
+      sc = Impl::Private::SummaryComponent::return(_) and
+      result = call
+      or
+      exists(ArgumentPosition pos |
+        sc = Impl::Private::SummaryComponent::argument(pos) and
+        result = pos.getArgument(call)
+      )
+    )
+    or
+    exists(ParameterPosition pos |
+      sc = Impl::Private::SummaryComponent::parameter(pos) and
+      result = pos.getParameter(source)
+    )
+  }
+
+  pragma[nomagic]
+  private IndirectReturnOutNode getIndirectReturn(CallInstruction call, NormalReturnKind rk) {
+    result.getCallInstruction() = call and
+    pragma[only_bind_out](result.getIndirectionIndex()) =
+      pragma[only_bind_out](rk.getIndirectionIndex())
+  }
+
+  pragma[nomagic]
+  private predicate hasKindAndEnclosingFunction(Function f, ReturnKind rk, ReturnNode r) {
+    r.getEnclosingCallable().asSourceCallable() = f and
+    r.getKind() = rk
+  }
 
-    DataFlowCallable getEnclosingCallable() { none() }
+  pragma[nomagic]
+  private predicate hasParameterAndIndirectionIndex(
+    Parameter p, int indirectionIndex, ParameterNode n
+  ) {
+    n.getParameter() = p and
+    n.getIndirectionIndex() = indirectionIndex
+  }
 
-    SourceSinkReportingElement getASuccessor(Impl::Private::SummaryComponent sc) { none() }
+  bindingset[e, sc]
+  Node getSourceDataFlowNode(SourceSinkReportingElement e, Impl::Private::SummaryComponent sc) {
+    exists(DataFlowCall call |
+      exists(ArgumentPosition pos |
+        sc = Impl::Private::SummaryComponent::argument(pos) and
+        pos.getArgument(call.asCallInstruction().getUnconvertedResultExpression()) = e
+      |
+        pos.getIndirectionIndex() = 0 and
+        result.(PostUpdateNode).getPreUpdateNode().asExpr() = e
+        or
+        result.(PostUpdateNode).getPreUpdateNode().asIndirectExpr(pos.getIndirectionIndex()) = e
+      )
+      or
+      exists(ReturnKind rk |
+        sc = Impl::Private::SummaryComponent::return(rk) and
+        // When `e` is a call the node becomes an `OutNode`.
+        e = call.asCallInstruction().getUnconvertedResultExpression()
+      |
+        rk.getIndirectionIndex() = 0 and
+        simpleOutNode(result, call.asCallInstruction())
+        or
+        result = getIndirectReturn(call.asCallInstruction(), rk)
+      )
+    )
+    or
+    exists(ParameterPosition pos |
+      sc = Impl::Private::SummaryComponent::parameter(pos) and
+      hasParameterAndIndirectionIndex(e, pos.getIndirectionIndex(), result)
+    )
+    or
+    exists(Function f, ReturnKind rk |
+      sc = Impl::Private::SummaryComponent::return(rk) and
+      // When `e` is the returned expression from a function the node is
+      // the `ReturnNode`.
+      isReturnExpr(f, rk, e) and
+      hasKindAndEnclosingFunction(f, rk, result)
+    )
+  }
+
+  bindingset[sink, sc]
+  SourceSinkReportingElement getASinkReportingElement(
+    Input::SinkBase sink, Impl::Private::SummaryComponent sc
+  ) {
+    exists(Call call, ArgumentPosition pos |
+      call.getTarget() = sink and
+      sc = Impl::Private::SummaryComponent::argument(pos) and
+      result = pos.getArgument(call)
+    )
+  }
+
+  bindingset[e, sc]
+  Node getSinkDataFlowNode(SourceSinkReportingElement e, Impl::Private::SummaryComponent sc) {
+    exists(ArgumentPosition pos, CallInstruction call |
+      sc = Impl::Private::SummaryComponent::argument(pos) and
+      pos.getArgument(call.getUnconvertedResultExpression()) = e and
+      result.(ArgumentNode).sourceArgumentOf(call, pos)
+    )
+    or
+    exists(Function f, ReturnKind rk |
+      sc = Impl::Private::SummaryComponent::return(rk) and
+      isReturnExpr(f, rk, e) and
+      hasKindAndEnclosingFunction(f, rk, result)
+    )
   }
 }
 
@@ -319,3 +494,41 @@ module Private {
 }
 
 module Public = Impl::Public;
+
+private class SourceModelFunction extends Public::SourceElement instanceof Function {
+  private string namespace;
+  private string type;
+  private boolean subtypes;
+  private string name;
+  private string signature;
+  private string ext;
+
+  SourceModelFunction() {
+    sourceModel(namespace, type, subtypes, name, signature, ext, _, _, _, _) and
+    this = interpretElement(namespace, type, subtypes, name, signature, ext)
+  }
+
+  override predicate isSource(
+    string output, string kind, Public::Provenance provenance, string model
+  ) {
+    sourceModel(namespace, type, subtypes, name, signature, ext, output, kind, provenance, model)
+  }
+}
+
+private class SinkModelFunction extends Public::SinkElement instanceof Function {
+  private string namespace;
+  private string type;
+  private boolean subtypes;
+  private string name;
+  private string signature;
+  private string ext;
+
+  SinkModelFunction() {
+    sinkModel(namespace, type, subtypes, name, signature, ext, _, _, _, _) and
+    this = interpretElement(namespace, type, subtypes, name, signature, ext)
+  }
+
+  override predicate isSink(string input, string kind, Public::Provenance provenance, string model) {
+    sinkModel(namespace, type, subtypes, name, signature, ext, input, kind, provenance, model)
+  }
+}

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImplConsistency.qll

@@ -6,6 +6,8 @@
 private import cpp
 private import DataFlowImplSpecific
 private import TaintTrackingImplSpecific
+private import DataFlowNodes as Nodes
+private import semmle.code.cpp.dataflow.internal.FlowSummaryImpl as FlowSummaryImpl
 private import codeql.dataflow.internal.DataFlowImplConsistency
 
 private module Input implements InputSig<Location, CppDataFlow> {
@@ -14,6 +16,12 @@ private module Input implements InputSig<Location, CppDataFlow> {
     // complex to model here.
     any()
   }
+
+  predicate postWithInFlowExclude(CppDataFlow::Node n) {
+    n instanceof Nodes::FlowSummaryNode
+    or
+    FlowSummaryImpl::Private::Steps::summaryLocalStep(_, n, _, _)
+  }
 }
 
 module Consistency = MakeConsistency<Location, CppDataFlow, CppTaintTracking, Input>;