C++: Add a class that models wrapped pointer types.

Author: MathiasVP

cpp/ql/src/semmle/code/cpp/exprs/Call.qll

@@ -350,6 +350,53 @@ class OverloadedPointerDereferenceExpr extends FunctionCall {
   }
 }
 
+/**
+ * An instance of a call to a _user-defined_ `operator->`.
+ * ```
+ * struct T2 { T1 b; };
+ * struct T3 { T2* operator->(); };
+ * T3 a;
+ * T1 x = a->b;
+ * ```
+ */
+class OverloadedArrowExpr extends FunctionCall {
+  OverloadedArrowExpr() { getTarget().hasName("operator->") }
+
+  override string getAPrimaryQlClass() { result = "OverloadedArrowExpr" }
+
+  /** Gets the expression this `operator->` applies to. */
+  Expr getExpr() { result = this.getQualifier() }
+
+  /** Gets the field accessed by this call to `operator->`, if any. */
+  FieldAccess getFieldAccess() { result.getQualifier() = this }
+
+  override predicate mayBeImpure() {
+    FunctionCall.super.mayBeImpure() and
+    (
+      this.getExpr().mayBeImpure()
+      or
+      not exists(Class declaring |
+        this.getTarget().getDeclaringType().isConstructedFrom*(declaring)
+      |
+        declaring.getNamespace() instanceof StdNamespace
+      )
+    )
+  }
+
+  override predicate mayBeGloballyImpure() {
+    FunctionCall.super.mayBeGloballyImpure() and
+    (
+      this.getExpr().mayBeGloballyImpure()
+      or
+      not exists(Class declaring |
+        this.getTarget().getDeclaringType().isConstructedFrom*(declaring)
+      |
+        declaring.getNamespace() instanceof StdNamespace
+      )
+    )
+  }
+}
+
 /**
  * An instance of a _user-defined_ binary `operator[]` applied to its arguments.
  * ```

cpp/ql/src/semmle/code/cpp/models/Models.qll

@@ -33,3 +33,4 @@ private import implementations.Recv
 private import implementations.Accept
 private import implementations.Poll
 private import implementations.Select
+private import implementations.PointerWrapper

cpp/ql/src/semmle/code/cpp/models/implementations/PointerWrapper.qll

@@ -0,0 +1,26 @@
+/** Provides classes for modeling pointer wrapper types and expressions. */
+
+private import cpp
+
+/** A class that wraps a pointer type. For example, `std::unique_ptr` and `std::shared_ptr`. */
+class PointerWrapper extends Class {
+  PointerWrapper() { this.hasQualifiedName(["std", "bsl", "boost"], ["shared_ptr", "unique_ptr"]) }
+}
+
+/** An expression of a `PointerWrapper` type. */
+class PointerWrapperExpr extends Expr {
+  PointerWrapperExpr() { this.getUnspecifiedType() instanceof PointerWrapper }
+
+  /** Gets a dereference of the wrapped pointer. */
+  Expr getADereference() { result.(OverloadedPointerDereferenceExpr).getExpr() = this }
+
+  /** Gets an access to the wrapped pointer. */
+  Expr getAPointerAccess() {
+    result.(OverloadedArrowExpr).getExpr() = this
+    or
+    exists(FunctionCall call | call = result |
+      call.getQualifier() = this and
+      call.getTarget().hasName("get")
+    )
+  }
+}