C#: Add property label patterns as dynamic members (without an access) and add read steps.

Author: michaelnebel

csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll

@@ -1990,16 +1990,22 @@ class FieldOrProperty extends Assignable, Modifiable {
   }
 }
 
-/** A string that is a reference to a late-bound target of a dynamic member access. */
+/** A member name used by a dynamic access or a property pattern without type information. */
 class DynamicProperty extends string {
-  private DynamicMemberAccess dma;
-
-  DynamicProperty() { this = dma.getLateBoundTargetName() }
+  DynamicProperty() {
+    this = any(DynamicMemberAccess dma).getLateBoundTargetName()
+    or
+    exists(PatternExpr qualifier, LabeledPatternExpr label |
+      propertyPatternQualifier(qualifier, label) and
+      qualifier.getType() instanceof NullType and
+      this = label.getLabel()
+    )
+  }
 
   ContentSet getContentSet() { result.isDynamicProperty(this) }
 
   /** Gets an access of this dynamic property. */
-  DynamicMemberAccess getAnAccess() { result = dma }
+  DynamicMemberAccess getAnAccess() { result.getLateBoundTargetName() = this }
 }
 
 private class InstanceFieldOrProperty extends FieldOrProperty {
@@ -2308,19 +2314,33 @@ private predicate readStepDelegateCall(Node node1, ContentSet c, OutNode node2)
   )
 }
 
+private predicate propertyPatternQualifier(PatternExpr qualifier, LabeledPatternExpr label) {
+  qualifier.(RecursivePatternExpr).getPropertyPatterns().getPattern(_) = label
+  or
+  qualifier instanceof LabeledPatternExpr and
+  qualifier.(PropertyPatternExpr).getPattern(_) = label
+}
+
 /**
  * Holds if data can flow from `node1` to `node2` via a property pattern.
  */
 private predicate fieldOrPropertyPatternRead(Node node1, ContentSet c, Node node2) {
-  exists(PatternExpr pattern, LabeledPatternExpr label, FieldOrProperty f |
+  exists(PatternExpr pattern, LabeledPatternExpr label |
     node1.asExpr() = pattern and
-    pattern.(RecursivePatternExpr).getPropertyPatterns().getPattern(_) = label and
-    c = f.getContentSet() and
-    f.getName() = label.getLabel() and
-    pattern.getType().(ValueOrRefType).hasMember(f)
+    propertyPatternQualifier(pattern, label) and
+    if pattern.getType() instanceof NullType
+    then c.isDynamicProperty(label.getLabel())
+    else
+      exists(FieldOrProperty f |
+        c = f.getContentSet() and
+        f.getName() = label.getLabel() and
+        pattern.getType().(ValueOrRefType).hasMember(f)
+      )
   |
     node2.asExpr() = label.(RecursivePatternExpr)
     or
+    node2.asExpr() = label.(PropertyPatternExpr)
+    or
     exists(AssignableDefinitions::PatternDefinition lvd |
       node2.(AssignableDefinitionNode).getDefinition() = lvd and
       label.(BindingPatternExpr).getVariableDeclExpr() = lvd.getDeclaration()