Merge pull request #7283 from aibaars/ruby-pattern-matching-cfg

Ruby: pattern matching: CFG

Author: aibaars

ruby/ql/lib/codeql/ruby/ast/internal/AST.qll

@@ -246,8 +246,6 @@ private module Cached {
         explicitAssignmentNode(g, _)
         or
         casePattern(g)
-        or
-        classReferencePattern(g)
       )
     } or
     TScopeResolutionMethodCall(Ruby::ScopeResolution g, Ruby::Identifier i) {
@@ -293,8 +291,6 @@ private module Cached {
       explicitAssignmentNode(g, _)
       or
       casePattern(g)
-      or
-      classReferencePattern(g)
     } or
     TTokenMethodName(MethodName::Token g) { MethodName::range(g) } or
     TTokenSuperCall(Ruby::Super g) { vcall(g) } or

ruby/ql/lib/codeql/ruby/ast/internal/Pattern.qll

@@ -48,13 +48,7 @@ predicate casePattern(Ruby::AstNode node) {
   node = any(Ruby::KeywordPattern parent).getValue()
   or
   node = any(Ruby::ParenthesizedPattern parent).getChild()
-}
-
-/**
- * Holds if `node` is a class reference used in an
- * array, find, or hash pattern.
- */
-predicate classReferencePattern(Ruby::AstNode node) {
+  or
   node = any(Ruby::ArrayPattern p).getClass()
   or
   node = any(Ruby::FindPattern p).getClass()

ruby/ql/lib/codeql/ruby/controlflow/internal/Completion.qll

@@ -6,6 +6,7 @@
 
 private import codeql.ruby.AST
 private import codeql.ruby.ast.internal.AST
+private import codeql.ruby.ast.internal.Control
 private import codeql.ruby.controlflow.ControlFlowGraph
 private import ControlFlowGraphImpl
 private import NonReturning
@@ -27,6 +28,10 @@ private newtype TCompletion =
     outer instanceof NonNestedNormalCompletion and
     nestLevel = 0
     or
+    inner instanceof TBooleanCompletion and
+    outer instanceof TMatchingCompletion and
+    nestLevel = 0
+    or
     inner instanceof NormalCompletion and
     nestedEnsureCompletion(outer, nestLevel)
   }
@@ -81,8 +86,9 @@ private predicate mayRaise(Call c) {
 
 /** A completion of a statement or an expression. */
 abstract class Completion extends TCompletion {
-  /** Holds if this completion is valid for node `n`. */
-  predicate isValidFor(AstNode n) {
+  private predicate isValidForSpecific(AstNode n) {
+    exists(AstNode other | n = other.getDesugared() and this.isValidForSpecific(other))
+    or
     this = n.(NonReturningCall).getACompletion()
     or
     completionIsValidForStmt(n, this)
@@ -98,15 +104,26 @@ abstract class Completion extends TCompletion {
     mustHaveMatchingCompletion(n) and
     this = TMatchingCompletion(_)
     or
-    n = any(RescueModifierExpr parent).getBody() and this = TRaiseCompletion()
+    n = any(RescueModifierExpr parent).getBody() and
+    this = [TSimpleCompletion().(TCompletion), TRaiseCompletion()]
     or
-    mayRaise(n) and
-    this = TRaiseCompletion()
+    (
+      mayRaise(n)
+      or
+      n instanceof CaseMatch and not exists(n.(CaseExpr).getElseBranch())
+    ) and
+    (
+      this = TRaiseCompletion()
+      or
+      this = TSimpleCompletion() and not n instanceof NonReturningCall
+    )
+  }
+
+  /** Holds if this completion is valid for node `n`. */
+  predicate isValidFor(AstNode n) {
+    this.isValidForSpecific(n)
     or
-    not n instanceof NonReturningCall and
-    not completionIsValidForStmt(n, _) and
-    not mustHaveBooleanCompletion(n) and
-    not mustHaveMatchingCompletion(n) and
+    not any(Completion c).isValidForSpecific(n) and
     this = TSimpleCompletion()
   }
 
@@ -172,6 +189,8 @@ private predicate inBooleanContext(AstNode n) {
   or
   n = any(ConditionalLoop parent).getCondition()
   or
+  n = any(InClause parent).getCondition()
+  or
   exists(LogicalAndExpr parent |
     n = parent.getLeftOperand()
     or
@@ -218,6 +237,10 @@ private predicate inMatchingContext(AstNode n) {
     w.getPattern(_) = n
   )
   or
+  n instanceof CasePattern
+  or
+  n = any(VariableReferencePattern p).getVariableAccess()
+  or
   n.(Trees::DefaultValueParameterTree).hasDefaultValue()
 }
 
@@ -241,7 +264,7 @@ class SimpleCompletion extends NonNestedNormalCompletion, TSimpleCompletion {
  * the successor. Either a Boolean completion (`BooleanCompletion`), or a matching
  * completion (`MatchingCompletion`).
  */
-abstract class ConditionalCompletion extends NonNestedNormalCompletion {
+abstract class ConditionalCompletion extends NormalCompletion {
   boolean value;
 
   bindingset[value]
@@ -255,7 +278,7 @@ abstract class ConditionalCompletion extends NonNestedNormalCompletion {
  * A completion that represents evaluation of an expression
  * with a Boolean value.
  */
-class BooleanCompletion extends ConditionalCompletion, TBooleanCompletion {
+class BooleanCompletion extends ConditionalCompletion, NonNestedNormalCompletion, TBooleanCompletion {
   BooleanCompletion() { this = TBooleanCompletion(value) }
 
   /** Gets the dual Boolean completion. */
@@ -280,10 +303,16 @@ class FalseCompletion extends BooleanCompletion {
  * A completion that represents evaluation of a matching test, for example
  * a test in a `rescue` statement.
  */
-class MatchingCompletion extends ConditionalCompletion, TMatchingCompletion {
-  MatchingCompletion() { this = TMatchingCompletion(value) }
+class MatchingCompletion extends ConditionalCompletion {
+  MatchingCompletion() {
+    this = TMatchingCompletion(value)
+    or
+    this = TNestedCompletion(_, TMatchingCompletion(value), _)
+  }
 
-  override MatchingSuccessor getAMatchingSuccessorType() { result.getValue() = value }
+  override ConditionalSuccessor getAMatchingSuccessorType() {
+    this = TMatchingCompletion(result.(MatchingSuccessor).getValue())
+  }
 
   override string toString() { if value = true then result = "match" else result = "no-match" }
 }
@@ -440,7 +469,9 @@ abstract class NestedCompletion extends Completion, TNestedCompletion {
   NestedCompletion() { this = TNestedCompletion(inner, outer, nestLevel) }
 
   /** Gets a completion that is compatible with the inner completion. */
-  abstract Completion getAnInnerCompatibleCompletion();
+  Completion getAnInnerCompatibleCompletion() {
+    result.getOuterCompletion() = this.getInnerCompletion()
+  }
 
   /** Gets the level of this nested completion. */
   final int getNestLevel() { result = nestLevel }
@@ -483,9 +514,39 @@ class NestedEnsureCompletion extends NestedCompletion {
 
   override Completion getOuterCompletion() { result = outer }
 
-  override Completion getAnInnerCompatibleCompletion() {
-    result.getOuterCompletion() = this.getInnerCompletion()
+  override SuccessorType getAMatchingSuccessorType() { none() }
+}
+
+/**
+ * A completion used for conditions in pattern matching:
+ *
+ * ```rb
+ * in x if x == 5 then puts "five"
+ * in x unless x == 4 then puts "not four"
+ * ```
+ *
+ * The outer (Matching) completion indicates whether there is a match, and
+ * the inner (Boolean) completion indicates what the condition evaluated
+ * to.
+ *
+ * For the condition `x == 5` above, `TNestedCompletion(true, true, 0)` and
+ * `TNestedCompletion(false, false, 0)` are both valid completions, while
+ * `TNestedCompletion(true, false, 0)` and `TNestedCompletion(false, true, 0)`
+ * are valid completions for `x == 4`.
+ */
+class NestedMatchingCompletion extends NestedCompletion, MatchingCompletion {
+  NestedMatchingCompletion() {
+    inner instanceof TBooleanCompletion and
+    outer instanceof TMatchingCompletion
   }
 
-  override SuccessorType getAMatchingSuccessorType() { none() }
+  override BooleanCompletion getInnerCompletion() { result = inner }
+
+  override MatchingCompletion getOuterCompletion() { result = outer }
+
+  override BooleanSuccessor getAMatchingSuccessorType() {
+    result.getValue() = this.getInnerCompletion().getValue()
+  }
+
+  override string toString() { result = NestedCompletion.super.toString() }
 }