C#: Basic pattern match data flow support.

Author: michaelnebel

csharp/ql/lib/semmle/code/csharp/Assignable.qll

@@ -273,12 +273,20 @@ module AssignableInternal {
     def = TPatternDefinition(result)
   }
 
-  /** A local variable declaration at the top-level of a pattern. */
-  class TopLevelPatternDecl extends LocalVariableDeclExpr {
+  /** A pattern containing a local variable declaration. */
+  class LocalVariablePatternDecl extends LocalVariableDeclExpr {
     private PatternMatch pm;
 
-    TopLevelPatternDecl() { this = pm.getPattern().(BindingPatternExpr).getVariableDeclExpr() }
+    LocalVariablePatternDecl() {
+      exists(BindingPatternExpr bpe |
+        this = bpe.getVariableDeclExpr() and pm = bpe.getPatternMatch()
+      )
+    }
 
+    /** Holds if the local variable definition is at the top level of the pattern. */
+    predicate isTopLevel() { this = pm.getPattern().(BindingPatternExpr).getVariableDeclExpr() }
+
+    /** Gets the pattern match that this local variable declaration (pattern) belongs to. */
     PatternMatch getMatch() { result = pm }
   }
 
@@ -297,7 +305,7 @@ module AssignableInternal {
       TLocalVariableDefinition(LocalVariableDeclExpr lvde) {
         not lvde.hasInitializer() and
         not exists(getTupleSource(TTupleAssignmentDefinition(_, lvde))) and
-        not lvde instanceof TopLevelPatternDecl and
+        not lvde instanceof LocalVariablePatternDecl and
         not lvde.isOutArgument()
       } or
       TImplicitParameterDefinition(Parameter p) {
@@ -309,7 +317,7 @@ module AssignableInternal {
         )
       } or
       TAddressOfDefinition(AddressOfExpr aoe) or
-      TPatternDefinition(TopLevelPatternDecl tlpd)
+      TPatternDefinition(LocalVariablePatternDecl lvpd)
 
     /**
      * Gets the source expression assigned in tuple definition `def`, if any.
@@ -699,22 +707,25 @@ module AssignableDefinitions {
   }
 
   /**
-   * A local variable definition in a pattern, for example `x is int i`.
+   * A local variable definition in a pattern, for example `int i` in `x is int i`.
    */
   class PatternDefinition extends AssignableDefinition, TPatternDefinition {
-    TopLevelPatternDecl tlpd;
+    LocalVariablePatternDecl lvpd;
 
-    PatternDefinition() { this = TPatternDefinition(tlpd) }
+    PatternDefinition() { this = TPatternDefinition(lvpd) }
 
     /** Gets the element matches against this pattern. */
-    PatternMatch getMatch() { result = tlpd.getMatch() }
+    PatternMatch getMatch() { result = lvpd.getMatch() }
 
     /** Gets the underlying local variable declaration. */
-    LocalVariableDeclExpr getDeclaration() { result = tlpd }
+    LocalVariableDeclExpr getDeclaration() { result = lvpd }
 
-    override Expr getSource() { result = this.getMatch().getExpr() }
+    override Expr getSource() { this.isTopLevel() and result = this.getMatch().getExpr() }
 
     override string toString() { result = this.getDeclaration().toString() }
+
+    /** Holds if the local variable definition is at the top level of the pattern. */
+    predicate isTopLevel() { lvpd.isTopLevel() }
   }
 
   /**

csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll

@@ -605,7 +605,7 @@ module LocalFlow {
         isSuccessor = false
         or
         isSuccessor = true and
-        exists(ControlFlowElement cfe | cfe = e2.(TupleExpr).(PatternExpr).getPatternMatch() |
+        exists(ControlFlowElement cfe | cfe = e2.(TuplePatternExpr).getPatternMatch() |
           cfe.(IsExpr).getExpr() = e1 and scope = cfe
           or
           exists(Switch sw | sw.getACase() = cfe and sw.getExpr() = e1 and scope = sw)
@@ -624,18 +624,29 @@ module LocalFlow {
         scope = def.getExpr() and
         isSuccessor = true
         or
-        scope = def.(AssignableDefinitions::PatternDefinition).getMatch().(IsExpr) and
-        isSuccessor = false
-        or
-        exists(Switch s |
-          s.getACase() = def.(AssignableDefinitions::PatternDefinition).getMatch() and
-          isSuccessor = true
-        |
-          scope = s.getExpr()
+        exists(AssignableDefinitions::PatternDefinition def0 | def = def0 and def0.isTopLevel() |
+          scope = def0.getMatch().(IsExpr) and
+          isSuccessor = false
           or
-          scope = s.getACase()
+          exists(Switch s |
+            s.getACase() = def0.getMatch() and
+            isSuccessor = true
+          |
+            scope = s.getExpr()
+            or
+            scope = s.getACase()
+          )
         )
       )
+      or
+      // Needed for read steps for pattern matching involving properties.
+      scope = def.getExpr() and
+      exactScope = false and
+      isSuccessor = false and
+      def =
+        any(AssignableDefinitions::PatternDefinition apd |
+          e = apd.getDeclaration() and not apd.isTopLevel()
+        )
     }
   }
 
@@ -896,6 +907,30 @@ private predicate fieldOrPropertyStore(Expr e, ContentSet c, Expr src, Expr q, b
   )
 }
 
+private predicate patternPropertyRead0(RecursivePatternExpr rpe, ContentSet c, VariablePatternExpr e) {
+  exists(TypeAccess ta, Property prop |
+    ta = rpe.getTypeAccess() and
+    e = rpe.getPropertyPatterns().getPattern(_) and
+    prop.getDeclaringType() = ta.getType() and
+    prop.getName() = e.(LabeledPatternExpr).getLabel() and
+    c.isProperty(prop)
+  )
+}
+
+private predicate patternPropertyRead(Expr e1, ContentSet c, VariablePatternExpr e2) {
+  exists(IsExpr ie, RecursivePatternExpr rpe |
+    e1 = ie.getExpr() and
+    rpe = ie.getPattern() and
+    patternPropertyRead0(rpe, c, e2)
+  )
+  or
+  exists(Switch sw, RecursivePatternExpr rpe |
+    e1 = sw.getExpr() and
+    rpe = sw.getACase().getPattern() and
+    patternPropertyRead0(rpe, c, e2)
+  )
+}
+
 /**
  * Holds if `e2` is an expression that reads field or property `c` from
  * expression `e1`.
@@ -1124,6 +1159,8 @@ private module Cached {
           or
           dynamicPropertyRead(e, _, read)
           or
+          patternPropertyRead(e, _, read)
+          or
           arrayRead(e, read)
         )
       )
@@ -2415,6 +2452,11 @@ private class ReadStepConfiguration extends ControlFlowReachabilityConfiguration
     e2 = e1.(TupleExpr).getAnArgument() and
     scope = e1 and
     isSuccessor = false
+    or
+    exactScope = false and
+    isSuccessor = true and
+    patternPropertyRead(e1, _, e2) and
+    scope = e1
   }
 
   override predicate candidateDef(
@@ -2446,8 +2488,8 @@ private class ReadStepConfiguration extends ControlFlowReachabilityConfiguration
       )
     or
     scope =
-      any(TupleExpr te |
-        te.getAnArgument() = defTo.(AssignableDefinitions::LocalVariableDefinition).getDeclaration() and
+      any(TuplePatternExpr te |
+        te.getAnArgument() = defTo.(AssignableDefinitions::PatternDefinition).getDeclaration() and
         e = te and
         exactScope = false and
         isSuccessor = false
@@ -2496,8 +2538,8 @@ private predicate readContentStep(Node node1, Content c, Node node2) {
       )
       or
       // item = variable in node1 = (..., variable, ...) in a case/is var (..., ...)
-      te = any(PatternExpr pe).getAChildExpr*() and
-      exists(AssignableDefinitions::LocalVariableDefinition lvd |
+      te = any(TuplePatternExpr pe).getAChildExpr*() and
+      exists(AssignableDefinitions::PatternDefinition lvd |
         node2.(AssignableDefinitionNode).getDefinition() = lvd and
         lvd.getDeclaration() = item and
         hasNodePath(x, node1, node2)
@@ -2537,6 +2579,8 @@ predicate readStep(Node node1, ContentSet c, Node node2) {
     or
     dynamicPropertyRead(node1.asExpr(), c, node2.asExpr())
     or
+    patternPropertyRead(node1.asExpr(), c, node2.asExpr())
+    or
     node2.asExpr().(AwaitExpr).getExpr() = node1.asExpr() and
     c = getResultContent()
   )
@@ -2927,8 +2971,10 @@ class CastNode extends Node {
   CastNode() {
     this.asExpr() instanceof Cast
     or
-    this.(AssignableDefinitionNode).getDefinition() instanceof
-      AssignableDefinitions::PatternDefinition
+    this.(AssignableDefinitionNode)
+        .getDefinition()
+        .(AssignableDefinitions::PatternDefinition)
+        .isTopLevel()
   }
 }
 

csharp/ql/lib/semmle/code/csharp/exprs/Expr.qll

@@ -531,6 +531,13 @@ class LabeledPatternExpr extends PatternExpr {
   override string getAPrimaryQlClass() { result = "LabeledPatternExpr" }
 }
 
+/**
+ * A tuple pattern. For example, `var (x, y)`.
+ */
+class TuplePatternExpr extends TupleExpr, PatternExpr {
+  override string getAPrimaryQlClass() { result = "TuplePatternExpr" }
+}
+
 /** A positional pattern. For example, `(int x, int y)`. */
 class PositionalPatternExpr extends PatternExpr, @positional_pattern_expr {
   override string toString() { result = "( ... )" }