Data flow: Track access path singleton info

Author: hvitved

shared/dataflow/codeql/dataflow/internal/DataFlowImpl.qll

@@ -2859,7 +2859,10 @@ module MakeImpl<LocationSig Location, InputSig<Location> Lang> {
       Typ getTyp(Type t) { any() }
 
       bindingset[c, tail]
-      Ap apCons(Content c, Ap tail) { result.getAHead() = c and exists(tail) }
+      Ap apCons(Content c, Ap tail) {
+        result.getAHead() = c and
+        if result.isSingleton() then tail instanceof ApNil else not tail instanceof ApNil
+      }
 
       class ApHeadContent = ContentApprox;
 
@@ -2961,7 +2964,10 @@ module MakeImpl<LocationSig Location, InputSig<Location> Lang> {
       Typ getTyp(Type t) { any() }
 
       bindingset[c, tail]
-      Ap apCons(Content c, Ap tail) { result.getHead() = c and exists(tail) }
+      Ap apCons(Content c, Ap tail) {
+        result.getHead() = c and
+        if result.isSingleton() then tail instanceof ApNil else not tail instanceof ApNil
+      }
 
       class ApHeadContent = Content;
 
@@ -3077,7 +3083,7 @@ module MakeImpl<LocationSig Location, InputSig<Location> Lang> {
         not expensiveLen2unfolding(c)
       } or
       TConsCons(Content c1, Content c2, int len) {
-        Stage4::consCand(c1, TFrontHead(c2)) and
+        Stage4::consCand(c1, TFrontHead(c2, _)) and
         len in [2 .. Config::accessPathLimit()] and
         not expensiveLen2unfolding(c1)
       } or
@@ -3131,7 +3137,7 @@ module MakeImpl<LocationSig Location, InputSig<Location> Lang> {
 
       override int len() { result = 1 }
 
-      override AccessPathFront getFront() { result = TFrontHead(c) }
+      override AccessPathFront getFront() { result = TFrontHead(c, true) }
 
       override predicate isCons(Content head, AccessPathApprox tail) { head = c and tail = TNil() }
     }
@@ -3153,7 +3159,7 @@ module MakeImpl<LocationSig Location, InputSig<Location> Lang> {
 
       override int len() { result = len }
 
-      override AccessPathFront getFront() { result = TFrontHead(c1) }
+      override AccessPathFront getFront() { result = TFrontHead(c1, false) }
 
       override predicate isCons(Content head, AccessPathApprox tail) {
         head = c1 and
@@ -3184,12 +3190,14 @@ module MakeImpl<LocationSig Location, InputSig<Location> Lang> {
 
       override int len() { result = len }
 
-      override AccessPathFront getFront() { result = TFrontHead(c) }
+      override AccessPathFront getFront() {
+        if len = 1 then result = TFrontHead(c, true) else result = TFrontHead(c, false)
+      }
 
       override predicate isCons(Content head, AccessPathApprox tail) {
         head = c and
         (
-          exists(Content c2 | Stage4::consCand(c, TFrontHead(c2)) |
+          exists(Content c2 | Stage4::consCand(c, TFrontHead(c2, _)) |
             tail = TConsCons(c2, _, len - 1)
             or
             len = 2 and
@@ -3531,7 +3539,11 @@ module MakeImpl<LocationSig Location, InputSig<Location> Lang> {
 
       override predicate isCons(Content head, AccessPath tail) { head = head_ and tail = tail_ }
 
-      override AccessPathFrontHead getFront() { result = TFrontHead(head_) }
+      override AccessPathFrontHead getFront() {
+        if tail_.length() = 0
+        then result = TFrontHead(head_, true)
+        else result = TFrontHead(head_, false)
+      }
 
       override AccessPathApproxCons getApprox() {
         result = TConsNil(head_) and tail_ = TAccessPathNil()
@@ -3586,7 +3598,7 @@ module MakeImpl<LocationSig Location, InputSig<Location> Lang> {
         tail.length() = len - 1
       }
 
-      override AccessPathFrontHead getFront() { result = TFrontHead(head1) }
+      override AccessPathFrontHead getFront() { result = TFrontHead(head1, false) }
 
       override AccessPathApproxCons getApprox() {
         result = TConsCons(head1, head2, len) or
@@ -3618,7 +3630,9 @@ module MakeImpl<LocationSig Location, InputSig<Location> Lang> {
         tail.length() = len - 1
       }
 
-      override AccessPathFrontHead getFront() { result = TFrontHead(head_) }
+      override AccessPathFrontHead getFront() {
+        if len = 1 then result = TFrontHead(head_, true) else result = TFrontHead(head_, false)
+      }
 
       override AccessPathApproxCons getApprox() { result = TCons1(head_, len) }
 

shared/dataflow/codeql/dataflow/internal/DataFlowImplCommon.qll

@@ -1797,12 +1797,12 @@ module MakeImplCommon<LocationSig Location, InputSig<Location> Lang> {
     cached
     newtype TAccessPathFront =
       TFrontNil() or
-      TFrontHead(Content c)
+      TFrontHead(Content c, Boolean singleton)
 
     cached
     newtype TApproxAccessPathFront =
       TApproxFrontNil() or
-      TApproxFrontHead(ContentApprox c)
+      TApproxFrontHead(ContentApprox c, Boolean singleton)
 
     cached
     newtype TAccessPathFrontOption =
@@ -2505,12 +2505,14 @@ module MakeImplCommon<LocationSig Location, InputSig<Location> Lang> {
 
     abstract boolean toBoolNonEmpty();
 
-    ContentApprox getHead() { this = TApproxFrontHead(result) }
+    ContentApprox getHead() { this = TApproxFrontHead(result, _) }
+
+    predicate isSingleton() { this = TApproxFrontHead(_, true) }
 
     pragma[nomagic]
     Content getAHead() {
       exists(ContentApprox cont |
-        this = TApproxFrontHead(cont) and
+        this = TApproxFrontHead(cont, _) and
         cont = getContentApproxCached(result)
       )
     }
@@ -2525,7 +2527,7 @@ module MakeImplCommon<LocationSig Location, InputSig<Location> Lang> {
   class ApproxAccessPathFrontHead extends ApproxAccessPathFront, TApproxFrontHead {
     private ContentApprox c;
 
-    ApproxAccessPathFrontHead() { this = TApproxFrontHead(c) }
+    ApproxAccessPathFrontHead() { this = TApproxFrontHead(c, _) }
 
     override string toString() { result = c.toString() }
 
@@ -2549,7 +2551,9 @@ module MakeImplCommon<LocationSig Location, InputSig<Location> Lang> {
 
     abstract ApproxAccessPathFront toApprox();
 
-    Content getHead() { this = TFrontHead(result) }
+    Content getHead() { this = TFrontHead(result, _) }
+
+    predicate isSingleton() { this = TFrontHead(_, true) }
   }
 
   class AccessPathFrontNil extends AccessPathFront, TFrontNil {
@@ -2560,12 +2564,15 @@ module MakeImplCommon<LocationSig Location, InputSig<Location> Lang> {
 
   class AccessPathFrontHead extends AccessPathFront, TFrontHead {
     private Content c;
+    private boolean singleton;
 
-    AccessPathFrontHead() { this = TFrontHead(c) }
+    AccessPathFrontHead() { this = TFrontHead(c, singleton) }
 
     override string toString() { result = c.toString() }
 
-    override ApproxAccessPathFront toApprox() { result.getAHead() = c }
+    override ApproxAccessPathFront toApprox() {
+      result.getAHead() = c and result = TApproxFrontHead(_, singleton)
+    }
   }
 
   /** An optional access path front. */