Merge pull request #6085 from tamasvajk/feature/unsafe

C#: Fix `Modifiable::isUnsafe` to handle declarations extracted from assemblies

csharp/change-notes/2021-06-15-unsafe-non-source-code.md

@@ -0,0 +1,2 @@
+lgtm,codescanning
+* The `Modifiable::isUnsafe` predicate has been fixed to handle symbols that are not extracted from source code.

csharp/ql/src/semmle/code/csharp/Member.qll

@@ -86,7 +86,12 @@ class Modifiable extends Declaration, @modifiable {
   predicate isConst() { this.hasModifier("const") }
 
   /** Holds if this declaration is `unsafe`. */
-  predicate isUnsafe() { this.hasModifier("unsafe") }
+  predicate isUnsafe() {
+    this.hasModifier("unsafe") or
+    this.(Parameterizable).getAParameter().getType() instanceof PointerType or
+    this.(Property).getType() instanceof PointerType or
+    this.(Callable).getReturnType() instanceof PointerType
+  }
 
   /** Holds if this declaration is `async`. */
   predicate isAsync() { this.hasModifier("async") }

csharp/ql/test/library-tests/unsafe/unsafe4.ql

@@ -1,3 +1,3 @@
 import csharp
 
-select any(Modifiable m | m.isUnsafe())
+select any(Modifiable m | m.isUnsafe() and m.fromSource())