C#: Flow summary for Nullable<T>

Author: tamasvajk

csharp/ql/src/semmle/code/csharp/dataflow/LibraryTypeDataFlow.qll

@@ -339,7 +339,7 @@ abstract class LibraryTypeDataFlow extends Type {
    * Holds if data may flow from `source` to `sink` when calling callable `c`.
    *
    * `sourceAp` describes the contents of `source` that flows to `sink`
-   * (if any), and `sinkContent` describes the contents of `sink` that it
+   * (if any), and `sinkAp` describes the contents of `sink` that it
    * flows to (if any).
    */
   pragma[nomagic]
@@ -728,6 +728,49 @@ class SystemLazyFlow extends LibraryTypeDataFlow, SystemLazyClass {
   }
 }
 
+/** Data flow for `System.Nullable<>`. */
+class SystemNullableFlow extends LibraryTypeDataFlow, SystemNullableStruct {
+  override predicate callableFlow(
+    CallableFlowSource source, AccessPath sourceAp, CallableFlowSink sink, AccessPath sinkAp,
+    SourceDeclarationCallable c, boolean preservesValue
+  ) {
+    preservesValue = true and
+    c.(Constructor).getDeclaringType() = this and
+    source = getFlowSourceArg(c, 0, sourceAp) and
+    sourceAp = AccessPath::empty() and
+    sink = TCallableFlowSinkReturn() and
+    sinkAp = AccessPath::property(this.getValueProperty())
+    or
+    preservesValue = true and
+    c = this.getAGetValueOrDefaultMethod() and
+    source = TCallableFlowSourceQualifier() and
+    sourceAp = AccessPath::property(this.getValueProperty()) and
+    sink = TCallableFlowSinkReturn() and
+    sinkAp = AccessPath::empty()
+    or
+    preservesValue = false and
+    c = this.getHasValueProperty().getGetter() and
+    source = TCallableFlowSourceQualifier() and
+    sourceAp = AccessPath::property(this.getValueProperty()) and
+    sink = TCallableFlowSinkReturn() and
+    sinkAp = AccessPath::empty()
+    or
+    preservesValue = true and
+    c = this.getAGetValueOrDefaultMethod() and
+    source = getFlowSourceArg(c, 0, _) and
+    sourceAp = AccessPath::empty() and
+    sink = TCallableFlowSinkReturn() and
+    sinkAp = AccessPath::empty()
+    or
+    preservesValue = false and
+    c = this.getValueProperty().getGetter() and
+    source = TCallableFlowSourceQualifier() and
+    sourceAp = AccessPath::empty() and
+    sink = TCallableFlowSinkReturn() and
+    sinkAp = AccessPath::empty()
+  }
+}
+
 /** Data flow for `System.Collections.IEnumerable` (and sub types). */
 class IEnumerableFlow extends LibraryTypeDataFlow, RefType {
   IEnumerableFlow() { this.getABaseType*() instanceof SystemCollectionsIEnumerableInterface }

csharp/ql/src/semmle/code/csharp/frameworks/System.qll

@@ -21,6 +21,11 @@ class SystemUnboundGenericClass extends UnboundGenericClass {
   SystemUnboundGenericClass() { this.getNamespace() instanceof SystemNamespace }
 }
 
+/** An unbound generic struct in the `System` namespace. */
+class SystemUnboundGenericStruct extends UnboundGenericStruct {
+  SystemUnboundGenericStruct() { this.getNamespace() instanceof SystemNamespace }
+}
+
 /** An interface in the `System` namespace. */
 class SystemInterface extends Interface {
   SystemInterface() { this.getNamespace() instanceof SystemNamespace }
@@ -215,6 +220,35 @@ class SystemLazyClass extends SystemUnboundGenericClass {
   }
 }
 
+/** The `System.Nullable<T>` struct. */
+class SystemNullableStruct extends SystemUnboundGenericStruct {
+  SystemNullableStruct() {
+    this.hasName("Nullable<>") and
+    this.getNumberOfTypeParameters() = 1
+  }
+
+  /** Gets the `Value` property. */
+  Property getValueProperty() {
+    result.getDeclaringType() = this and
+    result.hasName("Value") and
+    result.getType() = getTypeParameter(0)
+  }
+
+  /** Gets the `HasValue` property. */
+  Property getHasValueProperty() {
+    result.getDeclaringType() = this and
+    result.hasName("HasValue") and
+    result.getType() instanceof BoolType
+  }
+
+  /** Gets a `GetValueOrDefault()` method. */
+  Method getAGetValueOrDefaultMethod() {
+    result.getDeclaringType() = this and
+    result.hasName("GetValueOrDefault") and
+    result.getReturnType() = getTypeParameter(0)
+  }
+}
+
 /** The `System.NullReferenceException` class. */
 class SystemNullReferenceExceptionClass extends SystemClass {
   SystemNullReferenceExceptionClass() { this.hasName("NullReferenceException") }

csharp/ql/test/library-tests/dataflow/library/LibraryTypeDataFlow.expected

@@ -494,6 +494,8 @@ callableFlow
 | System.Net.WebUtility.HtmlEncode(string) | argument 0 -> return | false |
 | System.Net.WebUtility.HtmlEncode(string, TextWriter) | argument 0 -> return | false |
 | System.Net.WebUtility.UrlEncode(string) | argument 0 -> return | false |
+| System.Nullable<>.GetValueOrDefault(T) | argument 0 -> return | true |
+| System.Nullable<>.get_Value() | qualifier -> return | false |
 | System.Security.Cryptography.CryptoStream.BeginRead(Byte[], int, int, AsyncCallback, object) | qualifier -> argument 0 | false |
 | System.Security.Cryptography.CryptoStream.BeginWrite(Byte[], int, int, AsyncCallback, object) | argument 0 -> qualifier | false |
 | System.Security.Cryptography.CryptoStream.Read(Byte[], int, int) | qualifier -> argument 0 | false |
@@ -1848,6 +1850,10 @@ callableFlowAccessPath
 | System.Net.NetworkInformation.IPAddressCollection.Add(IPAddress) | argument 0 [<empty>] -> qualifier [[]] | true |
 | System.Net.NetworkInformation.IPAddressCollection.CopyTo(IPAddress[], int) | qualifier [[]] -> argument 0 [[]] | true |
 | System.Net.NetworkInformation.IPAddressCollection.GetEnumerator() | qualifier [[]] -> return [Current] | true |
+| System.Nullable<>.GetValueOrDefault() | qualifier [Value] -> return [<empty>] | true |
+| System.Nullable<>.GetValueOrDefault(T) | qualifier [Value] -> return [<empty>] | true |
+| System.Nullable<>.Nullable(T) | argument 0 [<empty>] -> return [Value] | true |
+| System.Nullable<>.get_HasValue() | qualifier [Value] -> return [<empty>] | false |
 | System.Resources.ResourceReader.GetEnumerator() | qualifier [[]] -> return [Current] | true |
 | System.Resources.ResourceSet.GetEnumerator() | qualifier [[]] -> return [Current] | true |
 | System.Runtime.CompilerServices.ConditionalWeakTable<,>.GetEnumerator() | qualifier [[]] -> return [Current] | true |