unified: Add language hook for inheritance restriction

Author: asgerf

unified/ql/lib/codeql/unified/internal/NameBindingPlugin.qll

@@ -25,6 +25,15 @@ class NameBindingPlugin extends Unit {
    */
   bindingset[member, binding]
   predicate isPrivateToLocalScope(Stmt member, AstNode binding) { none() }
+
+  /**
+   * Holds if `member` can be inherited by subclasses of `cls`.
+   *
+   * The caller has already restricted `member` to be a member of `cls`, and
+   * ensured that `member` is a `VariableDeclaration` or `FunctionDeclaration`.
+   */
+  bindingset[cls, member]
+  predicate isInheritableMember(ClassLikeDeclaration cls, Member member) { none() }
 }
 
 /** Holds if `member` is an instance member. */
@@ -35,6 +44,24 @@ predicate isInstanceMember(Member member) {
   )
 }
 
+/**
+ * Holds if `member` is a non-instance member declared in the context of a class or top-level.
+ */
+predicate isStaticMember(Member member) {
+  exists(ClassLikeDeclaration cls | cls.getAMember() = member |
+    not any(NameBindingPlugin p).isInstanceMember(cls, member)
+  )
+  or
+  member = any(TopLevel t).getBody().getAStmt()
+}
+
+/** Holds if `member` is an inheritable member. */
+predicate isInheritableMember(Member member) {
+  exists(ClassLikeDeclaration cls | cls.getAMember() = member |
+    any(NameBindingPlugin p).isInheritableMember(cls, member)
+  )
+}
+
 /** Holds if `binding` is only visible in its local scope. */
 pragma[nomagic]
 predicate isPrivateToLocalScope(AstNode binding) {

unified/ql/lib/codeql/unified/internal/NameBindingPluginSwift.qll

@@ -29,6 +29,12 @@ class NameBindingPluginSwift extends NameBindingPlugin {
     // Note: Private class members can be seen within type-extensions in the same file,
     // so we can't declare those private to their local scope.
   }
+
+  bindingset[cls, member]
+  override predicate isInheritableMember(ClassLikeDeclaration cls, Member member) {
+    exists(cls) and
+    not member.hasModifier("private")
+  }
 }
 
 private predicate predefinedSourceFolders(string folder, int ordering) {

unified/ql/lib/codeql/unified/internal/StaticNameBinding.qll

@@ -314,6 +314,15 @@ private predicate derivedStoreReadStep(NameBindingNode node1, NameBindingNode no
   )
 }
 
+/** Holds if the member represented by `node` cannot be inherited. */
+pragma[nomagic]
+private predicate isInheritableMemberNode(NameBindingNode node) {
+  exists(NameDeclaration decl |
+    node.isIdentifier(decl) and
+    isInheritableMember(decl.getDeclaration())
+  )
+}
+
 /** A name-binding node that has members. */
 class NamespaceNode extends NameBindingNode {
   NamespaceNode() {
@@ -363,7 +372,8 @@ class NamespaceNode extends NameBindingNode {
     result = this.getOwnMember(name)
     or
     not this.hasOwnMember(name) and
-    result = this.getAnInheritanceParent().getMember(name)
+    result = this.getAnInheritanceParent().getMember(name) and
+    isInheritableMemberNode(result)
   }
 }