Java models-as-data: infer Kotlin $default models from that of its parent function

java/ql/lib/semmle/code/java/Member.qll

@@ -306,7 +306,9 @@ class Callable extends StmtParent, Member, @callable {
    */
   Callable getKotlinParameterDefaultsProxy() {
     this.getDeclaringType() = result.getDeclaringType() and
-    exists(int proxyNParams, int extraLeadingParams, RefType lastParamType |
+    exists(
+      int proxyNParams, int extraLeadingParams, int regularParamsStartIdx, RefType lastParamType
+    |
       proxyNParams = result.getNumberOfParameters() and
       extraLeadingParams = (proxyNParams - this.getNumberOfParameters()) - 2 and
       extraLeadingParams >= 0 and
@@ -316,16 +318,28 @@ class Callable extends StmtParent, Member, @callable {
         this instanceof Constructor and
         result instanceof Constructor and
         extraLeadingParams = 0 and
+        regularParamsStartIdx = 0 and
         lastParamType.hasQualifiedName("kotlin.jvm.internal", "DefaultConstructorMarker")
         or
         this instanceof Method and
         result instanceof Method and
         this.getName() + "$default" = result.getName() and
-        extraLeadingParams <= 2 and
+        extraLeadingParams <= 1 and
+        (
+          if ktExtensionFunctions(this, _, _)
+          then
+            // Both extension receivers are expected to occur at arg0, with any
+            // dispatch receiver inserted afterwards in the $default proxy's parameter list.
+            // Check the extension receiver matches here, and note regular args
+            // are bumped one position to the right.
+            regularParamsStartIdx = extraLeadingParams + 1 and
+            this.getParameterType(0).getErasure() = eraseRaw(result.getParameterType(0))
+          else regularParamsStartIdx = extraLeadingParams
+        ) and
         lastParamType instanceof TypeObject
       )
     |
-      forall(int paramIdx | paramIdx in [extraLeadingParams .. proxyNParams - 3] |
+      forall(int paramIdx | paramIdx in [regularParamsStartIdx .. proxyNParams - 3] |
         this.getParameterType(paramIdx - extraLeadingParams).getErasure() =
           eraseRaw(result.getParameterType(paramIdx))
       )

java/ql/lib/semmle/code/java/dataflow/internal/FlowSummaryImplSpecific.qll

@@ -65,6 +65,61 @@ private boolean isGenerated(string provenance) {
   provenance != "generated" and result = false
 }
 
+private predicate relatedArgSpec(Callable c, string spec) {
+  exists(
+    string namespace, string type, boolean subtypes, string name, string signature, string ext
+  |
+    summaryModel(namespace, type, subtypes, name, signature, ext, spec, _, _, _) or
+    summaryModel(namespace, type, subtypes, name, signature, ext, _, spec, _, _) or
+    sourceModel(namespace, type, subtypes, name, signature, ext, spec, _, _) or
+    sinkModel(namespace, type, subtypes, name, signature, ext, spec, _, _)
+  |
+    c = interpretElement(namespace, type, subtypes, name, signature, ext)
+  )
+}
+
+/**
+ * Holds if `defaultsCallable` is a Kotlin default-parameter proxy for `originalCallable`, and
+ * `originalCallable` has a model, and `defaultsArgSpec` is `originalArgSpec` adjusted to account
+ * for the additional dispatch receiver parameter that occurs in the default-parameter proxy's argument
+ * list. When no adjustment is required (e.g. for constructors, or non-argument-based specs), `defaultArgsSpec`
+ * equals `originalArgSpec`.
+ */
+private predicate correspondingKotlinParameterDefaultsArgSpec(
+  Callable originalCallable, Callable defaultsCallable, string originalArgSpec,
+  string defaultsArgSpec
+) {
+  relatedArgSpec(originalCallable, originalArgSpec) and
+  defaultsCallable = originalCallable.getKotlinParameterDefaultsProxy() and
+  (
+    originalCallable instanceof Constructor and originalArgSpec = defaultsArgSpec
+    or
+    originalCallable instanceof Method and
+    exists(string regex |
+      // Note I use a regex and not AccessPathToken because this feeds summaryElement et al,
+      // which would introduce mutual recursion with the definition of AccessPathToken.
+      regex = "Argument\\[([0-9]+)\\](.*)" and
+      (
+        exists(string oldArgNumber, string rest, int paramOffset |
+          oldArgNumber = originalArgSpec.regexpCapture(regex, 1) and
+          rest = originalArgSpec.regexpCapture(regex, 2) and
+          paramOffset =
+            (
+              defaultsCallable.getNumberOfParameters() -
+                (originalCallable.getNumberOfParameters() + 2)
+            ) and
+          if ktExtensionFunctions(originalCallable, _, _) and oldArgNumber = "0"
+          then defaultsArgSpec = originalArgSpec
+          else defaultsArgSpec = "Argument[" + (oldArgNumber.toInt() + paramOffset) + "]" + rest
+        )
+        or
+        not originalArgSpec.regexpMatch(regex) and
+        defaultsArgSpec = originalArgSpec
+      )
+    )
+  )
+}
+
 /**
  * Holds if an external flow summary exists for `c` with input specification
  * `input`, output specification `output`, kind `kind`, and a flag `generated`
@@ -75,11 +130,19 @@ predicate summaryElement(
 ) {
   exists(
     string namespace, string type, boolean subtypes, string name, string signature, string ext,
-    string provenance
+    string provenance, string originalInput, string originalOutput, Callable baseCallable
   |
-    summaryModel(namespace, type, subtypes, name, signature, ext, input, output, kind, provenance) and
+    summaryModel(namespace, type, subtypes, name, signature, ext, originalInput, originalOutput,
+      kind, provenance) and
     generated = isGenerated(provenance) and
-    c.asCallable() = interpretElement(namespace, type, subtypes, name, signature, ext)
+    baseCallable = interpretElement(namespace, type, subtypes, name, signature, ext) and
+    (
+      c.asCallable() = baseCallable and input = originalInput and output = originalOutput
+      or
+      correspondingKotlinParameterDefaultsArgSpec(baseCallable, c.asCallable(), originalInput, input) and
+      correspondingKotlinParameterDefaultsArgSpec(baseCallable, c.asCallable(), originalOutput,
+        output)
+    )
   )
 }
 
@@ -149,11 +212,16 @@ class SourceOrSinkElement = Top;
 predicate sourceElement(SourceOrSinkElement e, string output, string kind, boolean generated) {
   exists(
     string namespace, string type, boolean subtypes, string name, string signature, string ext,
-    string provenance
+    string provenance, SourceOrSinkElement baseSource, string originalOutput
   |
-    sourceModel(namespace, type, subtypes, name, signature, ext, output, kind, provenance) and
+    sourceModel(namespace, type, subtypes, name, signature, ext, originalOutput, kind, provenance) and
     generated = isGenerated(provenance) and
-    e = interpretElement(namespace, type, subtypes, name, signature, ext)
+    baseSource = interpretElement(namespace, type, subtypes, name, signature, ext) and
+    (
+      e = baseSource and output = originalOutput
+      or
+      correspondingKotlinParameterDefaultsArgSpec(baseSource, e, originalOutput, output)
+    )
   )
 }
 
@@ -165,11 +233,16 @@ predicate sourceElement(SourceOrSinkElement e, string output, string kind, boole
 predicate sinkElement(SourceOrSinkElement e, string input, string kind, boolean generated) {
   exists(
     string namespace, string type, boolean subtypes, string name, string signature, string ext,
-    string provenance
+    string provenance, SourceOrSinkElement baseSink, string originalInput
   |
-    sinkModel(namespace, type, subtypes, name, signature, ext, input, kind, provenance) and
+    sinkModel(namespace, type, subtypes, name, signature, ext, originalInput, kind, provenance) and
     generated = isGenerated(provenance) and
-    e = interpretElement(namespace, type, subtypes, name, signature, ext)
+    baseSink = interpretElement(namespace, type, subtypes, name, signature, ext) and
+    (
+      e = baseSink and originalInput = input
+      or
+      correspondingKotlinParameterDefaultsArgSpec(baseSink, e, originalInput, input)
+    )
   )
 }