Merge pull request #1555 from calumgrant/cs/typemention-fixes

C#: Fix various extraction errors

Author: hvitved

change-notes/1.23/analysis-csharp.md

@@ -0,0 +1,21 @@
+# Improvements to C# analysis
+
+The following changes in version 1.23 affect C# analysis in all applications.
+
+## Changes to existing queries
+
+| **Query**                    | **Expected impact**    | **Change**                        |
+|------------------------------|------------------------|-----------------------------------|
+
+## Removal of old queries
+
+## Changes to code extraction
+
+* `nameof` expressions are now extracted correctly when the name is a namespace.
+
+## Changes to QL libraries
+
+* The new class `NamespaceAccess` models accesses to namespaces, for example in `nameof` expressions.
+
+## Changes to autobuilder
+

csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Access.cs

@@ -33,6 +33,9 @@ static ExprKind AccessKind(Context cx, ISymbol symbol)
                 case SymbolKind.Parameter:
                     return ExprKind.PARAMETER_ACCESS;
 
+                case SymbolKind.Namespace:
+                    return ExprKind.NAMESPACE_ACCESS;
+
                 default:
                     cx.ModelError(symbol, $"Unhandled access kind '{symbol.Kind}'");
                     return ExprKind.UNKNOWN;

csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Name.cs

@@ -59,6 +59,9 @@ public static Expression Create(ExpressionNodeInfo info)
                 case SymbolKind.Parameter:
                     return Access.Create(info, target, false, Parameter.GetAlreadyCreated(info.Context, (IParameterSymbol)target));
 
+                case SymbolKind.Namespace:
+                    return Access.Create(info, target, false, Namespace.Create(info.Context, (INamespaceSymbol)target));
+
                 default:
                     throw new InternalError(info.Node, $"Unhandled identifier kind '{target.Kind}'");
             }

csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/ForEach.cs

@@ -26,10 +26,7 @@ protected override void Populate()
 
             var location = cx.Create(Stmt.Identifier.GetLocation());
 
-            if (typeSymbol.Name != "_")
-                Expressions.VariableDeclaration.Create(cx, typeSymbol, type, Stmt.Type, location, location, Stmt.Type.IsVar, this, 0);
-            else
-                TypeMention.Create(cx, Stmt.Type, this, type);
+            Expressions.VariableDeclaration.Create(cx, typeSymbol, type, Stmt.Type, location, location, Stmt.Type.IsVar, this, 0);
 
             Statement.Create(cx, Stmt.Statement, this, 2);
         }

csharp/extractor/Semmle.Extraction.CSharp/Entities/TypeMention.cs

@@ -22,15 +22,39 @@ class TypeMention : FreshEntity
             Loc = loc;
         }
 
+        static TypeSyntax GetElementType(TypeSyntax type)
+        {
+            switch (type)
+            {
+                case ArrayTypeSyntax ats:
+                    return GetElementType(ats.ElementType);
+                case NullableTypeSyntax nts:
+                    return GetElementType(nts.ElementType);
+                default:
+                    return type;
+            }
+        }
+
+        static Type GetElementType(Type type)
+        {
+            switch (type)
+            {
+                case ArrayType at:
+                    return GetElementType(at.ElementType.Type);
+                case NamedType nt when nt.symbol.IsBoundNullable():
+                    return nt.TypeArguments.Single();
+                default:
+                    return type;
+            }
+        }
+
         void Populate()
         {
             switch (Syntax.Kind())
             {
                 case SyntaxKind.ArrayType:
-                    var ats = (ArrayTypeSyntax)Syntax;
-                    var at = (ArrayType)Type;
                     Emit(Loc ?? Syntax.GetLocation(), Parent, Type);
-                    Create(cx, ats.ElementType, this, at.ElementType);
+                    Create(cx, GetElementType(Syntax), this, GetElementType(Type));
                     return;
                 case SyntaxKind.NullableType:
                     var nts = (NullableTypeSyntax)Syntax;

csharp/extractor/Semmle.Extraction.CSharp/Kinds/ExprKind.cs

@@ -114,6 +114,7 @@ public enum ExprKind
         POSITIONAL_PATTERN = 117,
         SWITCH_CASE = 118,
         ASSIGN_COALESCE = 119,
-        SUPPRESS_NULLABLE_WARNING = 120
+        SUPPRESS_NULLABLE_WARNING = 120,
+        NAMESPACE_ACCESS = 121
     }
 }

csharp/ql/src/semmle/code/csharp/Namespace.qll

@@ -18,7 +18,7 @@ class TypeContainer extends DotNet::NamedElement, Element, @type_container { }
  * }
  * ```
  */
-class Namespace extends DotNet::Namespace, TypeContainer, @namespace {
+class Namespace extends DotNet::Namespace, TypeContainer, Declaration, @namespace {
   /** Gets the simple name of this namespace, for example `IO` in `System.IO`. */
   override string getName() { namespaces(this, result) }
 
@@ -117,6 +117,10 @@ class Namespace extends DotNet::Namespace, TypeContainer, @namespace {
   NamespaceDeclaration getADeclaration() { result.getNamespace() = this }
 
   override Location getALocation() { result = this.getADeclaration().getALocation() }
+
+  override string toString() { result = DotNet::Namespace.super.toString() }
+
+  override predicate hasQualifiedName(string a, string b) { DotNet::Namespace.super.hasQualifiedName(a, b) }
 }
 
 /**

csharp/ql/src/semmle/code/csharp/exprs/Access.qll

@@ -826,3 +826,12 @@ class ArrayRead extends ArrayAccess, AssignableRead { }
  * ```
  */
 class ArrayWrite extends ArrayAccess, AssignableWrite { }
+
+/**
+ * An access to a namespace, for example `System` in `nameof(System)`.
+ */
+class NamespaceAccess extends Access, @namespace_access_expr {
+  override Namespace getTarget() { expr_access(this, result) }
+
+  override string toString() { result = "access to namespace " + this.getTarget().getName() }
+}

csharp/ql/src/semmle/code/dotnet/Namespace.qll

@@ -2,10 +2,10 @@
  * Provides the `Namespace` class to represent .Net namespaces.
  */
 
-private import Element
+private import Declaration
 
 /** A namespace. */
-class Namespace extends NamedElement, @namespace {
+class Namespace extends Declaration, @namespace {
   /**
    * Gets the parent namespace, if any. For example the parent namespace of `System.IO`
    * is `System`. The parent namespace of `System` is the global namespace.

csharp/ql/src/semmlecode.csharp.dbscheme

@@ -214,7 +214,7 @@ tokens(
          | @using_directive | @type_parameter_constraints | @external_element
          | @xmllocatable | @asp_element | @namespace;
 
-@declaration = @callable | @generic | @assignable;
+@declaration = @callable | @generic | @assignable | @namespace;
 
 @named_element = @namespace | @declaration;
 
@@ -982,6 +982,7 @@ case @expr.kind of
 | 118 = @switch_case_expr
 | 119 = @assign_coalesce_expr
 | 120 = @suppress_nullable_warning_expr
+| 121 = @namespace_access_expr
 ;
 
 @switch = @switch_stmt | @switch_expr;
@@ -1004,7 +1005,7 @@ case @expr.kind of
 
 @member_access_expr = @field_access_expr | @property_access_expr | @indexer_access_expr | @event_access_expr
                     | @method_access_expr | @type_access_expr | @dynamic_member_access_expr;
-@access_expr = @member_access_expr | @this_access_expr | @base_access_expr | @assignable_access_expr;
+@access_expr = @member_access_expr | @this_access_expr | @base_access_expr | @assignable_access_expr | @namespace_access_expr;
 @element_access_expr = @indexer_access_expr | @array_access_expr | @dynamic_element_access_expr;
 
 @local_variable_access = @local_variable_access_expr | @local_var_decl_expr;
@@ -1084,7 +1085,7 @@ expr_access(
   unique int accesser_id: @access_expr ref,
   int target_id: @accessible ref);
 
-@accessible = @method | @assignable | @local_function;
+@accessible = @method | @assignable | @local_function | @namespace;
 
 expr_location(
   unique int id: @expr ref,