Merge pull request #7468 from michaelnebel/csharp-foreach-dataflow

C#: Re-factor the ForEachCapture query to use MaD flow summaries.

Author: michaelnebel

csharp/ql/lib/semmle/code/csharp/dataflow/LibraryTypeDataFlow.qll

@@ -478,25 +478,6 @@ class SystemTextStringBuilderFlow extends LibraryTypeDataFlow, SystemTextStringB
 class IEnumerableFlow extends LibraryTypeDataFlow, RefType {
   IEnumerableFlow() { this.getABaseType*() instanceof SystemCollectionsIEnumerableInterface }
 
-  override predicate callableFlow(
-    CallableFlowSource source, AccessPath sourceAp, CallableFlowSink sink, AccessPath sinkAp,
-    SourceDeclarationCallable c, boolean preservesValue
-  ) {
-    preservesValue = true and
-    exists(string name, int arity |
-      arity = c.getNumberOfParameters() and
-      c = this.getAMethod() and
-      c.getUndecoratedName() = name
-    |
-      name = "Add" and
-      arity = 1 and
-      source = TCallableFlowSourceArg(0) and
-      sourceAp = AccessPath::empty() and
-      sink instanceof CallableFlowSinkQualifier and
-      sinkAp = AccessPath::element()
-    )
-  }
-
   override predicate clearsContent(
     CallableFlowSource source, Content content, SourceDeclarationCallable callable
   ) {

csharp/ql/src/Language Abuse/ForeachCapture.ql

@@ -12,7 +12,8 @@
  */
 
 import csharp
-import semmle.code.csharp.dataflow.LibraryTypeDataFlow
+import semmle.code.csharp.dataflow.internal.FlowSummaryImpl as FlowSummaryImpl
+import semmle.code.csharp.dataflow.internal.DataFlowPrivate as DataFlowPrivate
 import semmle.code.csharp.frameworks.system.Collections
 import semmle.code.csharp.frameworks.system.collections.Generic
 
@@ -74,14 +75,9 @@ Element getAssignmentTarget(Expr e) {
 
 Element getCollectionAssignmentTarget(Expr e) {
   // Store into collection via method
-  exists(
-    MethodCall mc, Method m, LibraryTypeDataFlow ltdf, CallableFlowSource source,
-    CallableFlowSink sink
-  |
-    m = mc.getTarget().getUnboundDeclaration() and
-    ltdf.callableFlow(source, AccessPath::empty(), sink, AccessPath::element(), m, _) and
-    e = source.getSource(mc) and
-    result.(Variable).getAnAccess() = sink.getSink(mc)
+  exists(DataFlowPrivate::PostUpdateNode postNode |
+    FlowSummaryImpl::Private::Steps::summarySetterStep(DataFlow::exprNode(e), _, postNode) and
+    result.(Variable).getAnAccess() = postNode.getPreUpdateNode().asExpr()
   )
   or
   // Array initializer