Kotlin: test companion extension extraction

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: andersfugmann

java/ql/test-kotlin2/library-tests/companion-extensions/test.expected

@@ -0,0 +1,11 @@
+declarations
+| test.kt:5:9:5:29 | empty | test.kt:3:1:7:1 | Box | Method | empty() |
+| test.kt:9:11:9:52 | create | test.kt:0:0:0:0 | TestKt | Method | create(java.lang.String) |
+| test.kt:12:5:12:19 | getDefault | test.kt:0:0:0:0 | TestKt | Method | getDefault() |
+calls
+| test.kt:19:14:19:29 | create(...) | test.kt:18:1:21:1 | test | test.kt:9:11:9:52 | create | test.kt:19:14:19:29 | TestKt |
+| test.kt:20:14:20:20 | getDefault(...) | test.kt:18:1:21:1 | test | test.kt:12:5:12:19 | getDefault | test.kt:20:14:20:20 | TestKt |
+properties
+| test.kt:11:11:12:19 | default | test.kt:0:0:0:0 | TestKt | test.kt:12:5:12:19 | getDefault |
+#select
+| test.kt:19:21:19:28 | source(...) | test.kt:19:14:19:35 | getValue(...) |

java/ql/test-kotlin2/library-tests/companion-extensions/test.kt

@@ -0,0 +1,21 @@
+// codeql-extractor-kotlin-options: -language-version 2.4 -Xcompanion-blocks-and-extensions
+
+class Box(val value: String) {
+    companion {
+        fun empty() = Box("")
+    }
+}
+
+companion fun Box.create(value: String) = Box(value)
+
+companion val Box.default: Box
+    get() = Box("")
+
+fun source(): String = ""
+
+fun sink(value: String) {}
+
+fun test() {
+    sink(Box.create(source()).value)
+    sink(Box.default.value)
+}

java/ql/test-kotlin2/library-tests/companion-extensions/test.ql

@@ -0,0 +1,43 @@
+import java
+import semmle.code.java.dataflow.TaintTracking
+
+predicate isCompanionCallable(Callable callable) {
+  callable.getName() = ["empty", "create", "getDefault"]
+}
+
+query predicate declarations(
+  Callable callable, RefType declaringType, string primaryClass, string signature
+) {
+  isCompanionCallable(callable) and
+  callable.fromSource() and
+  declaringType = callable.getDeclaringType() and
+  primaryClass = callable.getAPrimaryQlClass() and
+  signature = callable.getSignature()
+}
+
+query predicate calls(MethodCall call, Callable caller, Method target, Expr qualifier) {
+  caller.fromSource() and
+  call.getEnclosingCallable() = caller and
+  target = call.getMethod() and
+  isCompanionCallable(target) and
+  qualifier = call.getQualifier()
+}
+
+query predicate properties(Property property, RefType declaringType, Method getter) {
+  property.hasName("default") and
+  property.fromSource() and
+  getter = property.getGetter() and
+  declaringType = getter.getDeclaringType()
+}
+
+module Config implements DataFlow::ConfigSig {
+  predicate isSource(DataFlow::Node n) { n.asExpr().(MethodCall).getMethod().hasName("source") }
+
+  predicate isSink(DataFlow::Node n) { n.asExpr().(Argument).getCall().getCallee().hasName("sink") }
+}
+
+module Flow = TaintTracking::Global<Config>;
+
+from DataFlow::Node source, DataFlow::Node sink
+where Flow::flow(source, sink)
+select source, sink

java/ql/test-kotlin2/library-tests/companion-extensions/test.qlref

@@ -0,0 +1 @@
+test.ql