Unified: Handle self/Self

Author: hvitved

unified/ql/lib/codeql/unified/internal/LocalNameBinding.qll

@@ -323,8 +323,7 @@ private module LocalNameBindingInput implements LocalNameBindingInputSig<Locatio
   }
 
   predicate implicitDeclInScope(string name, AstNode scope) {
-    none()
-    // TODO: self
+    any(NameBindingPlugin p).implicitLocalDeclInScope(scope, name)
   }
 
   predicate accessCand(AstNode n, string name) { n.(PotentialLocalNameAccess).getName() = name }

unified/ql/lib/codeql/unified/internal/NameBindingPlugin.qll

@@ -1,4 +1,5 @@
 private import unified
+private import StaticNameBinding
 private import codeql.util.Unit
 private import codeql.unified.internal.NameBindingPluginSwift // ensure overrides are seen
 
@@ -39,6 +40,19 @@ class NameBindingPlugin extends Unit {
    */
   bindingset[cls, member]
   predicate isInheritableMember(ClassLikeDeclaration cls, Member member) { none() }
+
+  /**
+   * Holds if there is an implicit local declaration with the given `name` in the given `scope`.
+   */
+  predicate implicitLocalDeclInScope(AstNode scope, string name) { none() }
+
+  /**
+   * Holds if there is an additional store step from `node1` to `node2` with the given `name`
+   * in the name-binding graph.
+   */
+  predicate additionalStoreStep(NameBindingNode node1, string name, NameBindingNode node2) {
+    none()
+  }
 }
 
 /** Holds if `member` is an instance member. */

unified/ql/lib/codeql/unified/internal/NameBindingPluginSwift.qll

@@ -4,6 +4,7 @@
 
 private import unified
 private import codeql.unified.internal.NameBindingPlugin
+private import codeql.unified.internal.StaticNameBinding
 
 class NameBindingPluginSwift extends NameBindingPlugin {
   bindingset[e]
@@ -38,6 +39,23 @@ class NameBindingPluginSwift extends NameBindingPlugin {
     exists(cls) and
     not member.hasModifier("private")
   }
+
+  override predicate implicitLocalDeclInScope(AstNode scope, string name) {
+    exists(ClassLikeDeclaration cls, FunctionDeclaration f |
+      f = cls.getAMember() and
+      this.isInstanceMember(cls, f) and
+      scope = f.getBody() and
+      name = "self"
+    )
+  }
+
+  override predicate additionalStoreStep(NameBindingNode node1, string name, NameBindingNode node2) {
+    exists(ClassLikeDeclaration cls |
+      name = ["self", "Self"] and
+      node1.isIdentifier(cls.getNameNode()) and
+      node2.isStaticMemberNamespace(cls)
+    )
+  }
 }
 
 /** Holds if `node` is in a context where a bare name node should be seen as a reference rather than a declaration. */

unified/ql/lib/codeql/unified/internal/StaticNameBinding.qll

@@ -210,6 +210,8 @@ predicate storeStep(NameBindingNode node1, string name, NameBindingNode node2) {
   )
   or
   FolderHeuristic::storeStep(node1, name, node2)
+  or
+  any(NameBindingPlugin p).additionalStoreStep(node1, name, node2)
 }
 
 predicate valueStep(NameBindingNode node1, NameBindingNode node2) {

unified/ql/test/library-tests/local-name-binding/class_scope.swift

@@ -7,6 +7,7 @@ class A {
     }
     func instance_before() {
         print(instanceVar) // $ access=instanceVar
+        print(self.instanceVar) // $ access=self
         B(); // $ access=A.B
         let b: B = nil // $ access=A.B
         let c: C = nil // $ access=A.C
@@ -27,6 +28,7 @@ class A {
     }
     func instance_after() {
         print(instanceVar) // $ access=instanceVar
+        print(self.instanceVar) // $ access=self
         B(); // $ access=A.B
         let b: B = nil // $ access=A.B
         let c: C = nil // $ access=A.C

unified/ql/test/library-tests/static-name-binding/explicit-instance-field-access.swift

@@ -0,0 +1,47 @@
+private class A {
+    let x = 123 // name=A.instance.x
+
+    func getX() {
+        return self.x // not handled by static name binding
+    }
+
+    static let y = 456 // name=A.type.y
+
+    func getY1() {
+        return Self.y // $ access=A access=A.type.y
+    }
+
+    static func getY2() {
+        return self.y // $ access=A access=A.type.y
+    }
+
+    class func z() -> Int { // name=A.type.z
+        return 789
+    }
+
+    class func getZ() {
+        return self.z // $ access=A access=A.type.z
+    }
+}
+
+private class B : A { // $ access=A
+    func getX2() {
+        return self.x // not handled by static name binding
+    }
+
+    func getY3() {
+        return Self.y // $ access=B access=A.type.y
+    }
+
+    static func getY4() {
+        return self.y // $ access=B access=A.type.y
+    }
+
+    class func z() -> Int { // name=B.type.z
+        return 789
+    }
+
+    class func getZ2() {
+        return self.z // $ access=B access=B.type.z
+    }
+}