unified: Add getStaticBindingTarget

Author: asgerf

unified/ql/lib/codeql/Definitions.qll

@@ -10,7 +10,7 @@ private import codeql.unified.internal.StaticNameBinding
  */
 cached
 predicate definitionOf(Identifier reference, NameDeclaration definition, string kind) {
-  reference = trackNameDeclaration(definition).asIdentifier() and
+  definition = getStaticBindingTarget(reference) and
   not reference instanceof NameDeclaration and
   kind = "name"
 }

unified/ql/lib/codeql/unified/internal/StaticNameBinding.qll

@@ -640,3 +640,13 @@ class UnqualifiedMemberAccess extends Identifier {
   /** Holds if this is an instance access on the accessing class. */
   predicate isInstanceAccess() { instanceAccess = true }
 }
+
+/** Gets the declaration being accessed by `access`, as determined by static name binding. */
+NameDeclaration getStaticBindingTarget(Identifier access) {
+  // For unqualified accesses, use the shadowing-aware lookup
+  result = access.(UnqualifiedMemberAccess).getTarget()
+  or
+  // For others, just follow the name binding graph
+  not access instanceof UnqualifiedMemberAccess and
+  trackNameDeclaration(result).asIdentifier() = access
+}

unified/ql/test/library-tests/static-name-binding/implicit-instance-field-access.swift

@@ -0,0 +1,13 @@
+private class A {
+    let x = 123 // name=A.instance.x
+
+    func getX() {
+        return x // $ access=A.instance.x
+    }
+}
+
+private class B : A { // $ access=A
+    func getX2() {
+        return x // $ access=A.instance.x
+    }
+}

unified/ql/test/library-tests/static-name-binding/test.ql

@@ -8,7 +8,7 @@ module StaticDeclAccess implements TestSig {
 
   predicate hasActualResult(Location location, string element, string tag, string value) {
     exists(NameDeclaration decl, Identifier access |
-      access = trackNameDeclaration(decl).asIdentifier() and
+      decl = getStaticBindingTarget(access) and
       not access instanceof NameDeclaration and
       location = access.getLocation() and
       element = access.toString() and

unified/ql/test/library-tests/static-name-binding/unqualified-access.swift

@@ -10,7 +10,7 @@ class ASub : A { // $ access=A
 
     class BSub : B { // $ access=A.B
         let x3: B = nil; // $ access=A.B
-        let x4: C = nil; // $ access=A.B.C SPURIOUS: access=Target3.C // spurious result from folder-based heuristic
+        let x4: C = nil; // $ access=A.B.C // spurious result from folder-based heuristic
     }
 
     class BSub2 : B { // $ access=A.B