Java: Fix types of summary parameter nodes.

Author: aschackmull

java/ql/lib/semmle/code/java/dataflow/internal/DataFlowNodes.qll

@@ -127,8 +127,6 @@ module Public {
       or
       result = this.(ImplicitPostUpdateNode).getPreUpdateNode().getType()
       or
-      result = this.(SummaryParameterNode).getTypeImpl()
-      or
       result = this.(FieldValueNode).getField().getType()
     }
 
@@ -492,10 +490,6 @@ module Private {
     override predicate isParameterOf(DataFlowCallable c, int pos) {
       c.asSummarizedCallable() = this.getSummarizedCallable() and pos = this.getPosition()
     }
-
-    Type getTypeImpl() {
-      result = this.getSummarizedCallable().getParameterType(this.getPosition())
-    }
   }
 }
 

java/ql/lib/semmle/code/java/dataflow/internal/FlowSummaryImpl.qll

@@ -505,6 +505,9 @@ module Private {
     or
     // Add the post-update node corresponding to the requested argument node
     outputState(c, s) and isCallbackParameter(s)
+    or
+    // Add the parameter node for parameter side-effects
+    outputState(c, s) and s = SummaryComponentStack::argument(_)
   }
 
   private newtype TSummaryNodeState =
@@ -713,6 +716,11 @@ module Private {
           head = TSyntheticGlobalSummaryComponent(sg) and
           result = getSyntheticGlobalType(sg)
         )
+        or
+        exists(ParameterPosition pos |
+          head = TArgumentSummaryComponent(pos) and
+          result = getParameterType(c, pos)
+        )
       )
       or
       n = summaryNodeOutputState(c, s) and

java/ql/lib/semmle/code/java/dataflow/internal/FlowSummaryImplSpecific.qll

@@ -32,6 +32,11 @@ SummaryCall summaryDataFlowCall(SummaryNode receiver) { result.getReceiver() = r
 /** Gets the type of content `c`. */
 DataFlowType getContentType(Content c) { result = c.getType() }
 
+/** Gets the type of the parameter at the given position. */
+DataFlowType getParameterType(SummarizedCallable c, ParameterPosition pos) {
+  result = getErasedRepr(c.getParameterType(pos))
+}
+
 /** Gets the return type of kind `rk` for callable `c`. */
 DataFlowType getReturnType(SummarizedCallable c, ReturnKind rk) {
   result = getErasedRepr(c.getReturnType()) and