unified: Be more precise about writebacks

Author: asgerf

unified/ql/lib/codeql/unified/internal/dataflow/DataFlowPlugin.qll

@@ -5,6 +5,8 @@
 private import unified
 private import AllDataFlow
 private import codeql.util.Unit
+private import codeql.unified.internal.ExprPositions
+private import codeql.unified.internal.typeinference.TypeInference as T
 
 private module Plugins {
   private import DataFlowPluginSwift
@@ -34,7 +36,37 @@ class DataFlowPlugin extends Unit {
    * `expr` is an expression in getter position, such as a member access.
    */
   bindingset[expr]
-  predicate mayWriteBackViaSetterCall(Expr expr) { none() }
+  predicate mayWriteBackViaSetterCall(Expr expr) {
+    isInWriteBackPosition(expr)
+    // TODO: Check that 'expr' has a value type. Reference types don't cause writebacks.
+  }
+}
+
+/**
+ * Holds if `expr` is target of an assignment or 'inout' argument,
+ * or the base of such an expression, e.g. `x` in `x.f1.f2 = foo()`
+ */
+private predicate isInWriteBackPosition(Expr expr) {
+  isInAssignmentContext(expr, _)
+  or
+  // Arguments to an 'inout' parameter must be prefixed with '&'
+  exists(UnaryExpr unary |
+    unary.getOperator().(PrefixOperator).getValue() = "&" and
+    unary.getOperand() = expr
+    // TODO: support custom operators with an 'inout' parameter, which lack the '&' indicator
+  )
+  or
+  // The receiver of a call to a 'mutating' function counts as an 'inout' argument
+  exists(CallExpr call, Callable target |
+    target = T::resolveCallTarget(call) and
+    target.hasModifier("mutating") and
+    expr = call.getCallee().(MemberAccessExpr).getBase()
+  )
+  or
+  exists(MemberAccessExpr member |
+    isInWriteBackPosition(member) and
+    expr = member.getBase()
+  )
 }
 
 /**