Kotlin: cover companion blocks and extensions

Add focused coverage for a companion-block function and companion extension
function and property. Check declaration ownership, property accessors,
resolved calls, and data flow.

The existing extractor handles the lowered declarations and calls correctly.
This commit adds coverage only and requires no extractor change.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: andersfugmann

java/ql/test-kotlin2/library-tests/companion-extensions/test.expected

@@ -0,0 +1,11 @@
+declarations
+| test.kt:5:9:5:29 | empty | test.kt:3:1:7:1 | Box | Method | empty() |
+| test.kt:9:11:9:52 | create | test.kt:0:0:0:0 | TestKt | Method | create(java.lang.String) |
+| test.kt:12:5:12:19 | getDefault | test.kt:0:0:0:0 | TestKt | Method | getDefault() |
+calls
+| test.kt:19:14:19:29 | create(...) | test.kt:18:1:21:1 | test | test.kt:9:11:9:52 | create | test.kt:19:14:19:29 | TestKt |
+| test.kt:20:14:20:20 | getDefault(...) | test.kt:18:1:21:1 | test | test.kt:12:5:12:19 | getDefault | test.kt:20:14:20:20 | TestKt |
+properties
+| test.kt:11:11:12:19 | default | test.kt:0:0:0:0 | TestKt | test.kt:12:5:12:19 | getDefault |
+#select
+| test.kt:19:21:19:28 | source(...) | test.kt:19:14:19:35 | getValue(...) |

java/ql/test-kotlin2/library-tests/companion-extensions/test.kt

@@ -0,0 +1,21 @@
+// codeql-extractor-kotlin-options: -language-version 2.4 -Xcompanion-blocks-and-extensions
+
+class Box(val value: String) {
+    companion {
+        fun empty() = Box("")
+    }
+}
+
+companion fun Box.create(value: String) = Box(value)
+
+companion val Box.default: Box
+    get() = Box("")
+
+fun source(): String = ""
+
+fun sink(value: String) {}
+
+fun test() {
+    sink(Box.create(source()).value)
+    sink(Box.default.value)
+}

java/ql/test-kotlin2/library-tests/companion-extensions/test.ql

@@ -0,0 +1,43 @@
+import java
+import semmle.code.java.dataflow.TaintTracking
+
+predicate isCompanionCallable(Callable callable) {
+  callable.getName() = ["empty", "create", "getDefault"]
+}
+
+query predicate declarations(
+  Callable callable, RefType declaringType, string primaryClass, string signature
+) {
+  isCompanionCallable(callable) and
+  callable.fromSource() and
+  declaringType = callable.getDeclaringType() and
+  primaryClass = callable.getAPrimaryQlClass() and
+  signature = callable.getSignature()
+}
+
+query predicate calls(MethodCall call, Callable caller, Method target, Expr qualifier) {
+  caller.fromSource() and
+  call.getEnclosingCallable() = caller and
+  target = call.getMethod() and
+  isCompanionCallable(target) and
+  qualifier = call.getQualifier()
+}
+
+query predicate properties(Property property, RefType declaringType, Method getter) {
+  property.hasName("default") and
+  property.fromSource() and
+  getter = property.getGetter() and
+  declaringType = getter.getDeclaringType()
+}
+
+module Config implements DataFlow::ConfigSig {
+  predicate isSource(DataFlow::Node n) { n.asExpr().(MethodCall).getMethod().hasName("source") }
+
+  predicate isSink(DataFlow::Node n) { n.asExpr().(Argument).getCall().getCallee().hasName("sink") }
+}
+
+module Flow = TaintTracking::Global<Config>;
+
+from DataFlow::Node source, DataFlow::Node sink
+where Flow::flow(source, sink)
+select source, sink

java/ql/test-kotlin2/library-tests/companion-extensions/test.qlref

@@ -0,0 +1 @@
+test.ql