Merge pull request #21149 from aschackmull/java/typeflow-partially-unbound

Java: Add TypeFlow base case for partially unbound types.

java/ql/lib/semmle/code/java/dataflow/TypeFlow.qll

@@ -202,6 +202,13 @@ private module Input implements TypeFlowInput<Location> {
       t1e = t2e and
       unbound(t2) and
       not unbound(t1)
+      or
+      t1e = t2e and
+      exists(int pos |
+        partiallyUnbound(t2, pos) and
+        not partiallyUnbound(t1, pos) and
+        not unbound(t1)
+      )
     )
   }
 
@@ -370,6 +377,11 @@ private module Input implements TypeFlowInput<Location> {
     )
   }
 
+  /** Holds if `t` is a parameterised type with unrestricted type argument at position `pos`. */
+  private predicate partiallyUnbound(ParameterizedType t, int pos) {
+    unconstrained(t.getTypeArgument(pos))
+  }
+
   Type getErasure(Type t) { result = t.getErasure() }
 
   Type getAnAncestor(Type sub) { result = sub.getAnAncestor() }

java/ql/test/library-tests/typeflow/A.java

@@ -118,4 +118,12 @@ public class A extends ArrayList<Long> {
       default -> { }
     }
   }
+
+  private static <T> T lookupFoo(Map<String, T> m) {
+    return m.get("foo");
+  }
+
+  public void m11(Map<String, String> m) {
+    lookupFoo(m);
+  }
 }

java/ql/test/library-tests/typeflow/typeflow.expected

@@ -18,5 +18,6 @@
 | A.java:112:23:112:24 | cs | String | false |
 | A.java:116:13:116:14 | o2 | String | false |
 | A.java:117:49:117:50 | cs | String | false |
+| A.java:123:12:123:12 | m | Map<String,String> | false |
 | UnionTypes.java:45:7:45:7 | x | Inter | false |
 | UnionTypes.java:48:23:48:23 | x | Inter | false |