C#: Add default taint step from an implicit operator call to its argument.

[michaelnebel]

Consider this flow source row:

extensions:
  - addsTo:
      pack: codeql/csharp-all
      extensible: sourceModel
    data:
      - ["System.Net.WebSockets", "WebSocket", True, "ReceiveAsync", "", "", "Argument[0]", "remote", "manual"]

and this snippet:

var buffer = new byte[1024];
var result = await webSocket.ReceiveAsync(buffer, System.Threading.CancellationToken.None);

On the second line there's a call to operator an implicit conversion which means that buffer is not an argument to webSocket.ReceiveAsync, but rather an argument to the call to an implicit conversion (which is then an argument to ReceiveAsync). However, we would like buffer to be tainted after the call to ReceiveAsync.

This is solved by adding a reverse update default taint step for post-update nodes for implicit conversion calls.
That is, for f(implicit_conv(x)) we add a step from the post-update of implicit_conv(x) to x.

DCA looks good.

[michaelnebel]

@hvitved : Is this an acceptable approach for solving the problem?

[hvitved]

LGTM, just one minor suggestion.

[Copilot]

Pull request overview

This PR updates C# taint tracking to handle implicit conversion operator calls in method arguments by adding a default reverse taint step from the post-update node of an implicit conversion to its argument, and adds a regression test plus changelog entry.

Changes:

• Add a default reverse taint step for post-update nodes of implicit conversion operator calls.
• Add a new library-test (QL + C# source) and corresponding .expected output to cover the new flow behavior.
• Add a changelog entry documenting the analysis improvement.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
csharp/ql/lib/semmle/code/csharp/dataflow/internal/TaintTrackingPrivate.qll	Adds the new default reverse taint step logic for implicit conversion operator post-update nodes.
csharp/ql/test/library-tests/dataflow/operators/implicitConversionOperatorFlow.ql	New taint path-problem test that treats the post-update node as a source and checks flow to the original argument.
csharp/ql/test/library-tests/dataflow/operators/implicitConversionOperatorFlow.expected	Expected path output for the new test.
csharp/ql/test/library-tests/dataflow/operators/ImplicitConversionOperator.cs	C# fixture exercising implicit conversion from byte[] to ArraySegment<byte>.
csharp/ql/lib/change-notes/2026-03-03-implicit-conversion-reverse-flow.md	Change note for the new reverse taint flow behavior.

---

You can also share your feedback on Copilot code review. Take the survey.

[Copilot]

The new comment says "reverse update flow" but this predicate is adding a default taint step. Consider rewording to "reverse taint flow" (and/or explicitly mentioning post-update nodes) to avoid confusion with the data-flow reverse-step logic in DataFlowPrivate.

Suggested change

	// Allow reverse update flow for implicit conversion operator calls.
	// This is needed to support flow out of method call arguments, where an implicit conversion is applied
	// to a call argument.
	// Allow reverse taint flow between post-update and pre-update nodes for implicit conversion operator calls.
	// This is needed to support taint flow out of method call arguments where an implicit conversion is applied
	// to the argument expression.