unified: Fix mistranslated Argument tokens

Some argument indices were not translated correctly.

In some cases it seems the original index was out of bounds and we set
it to the intended argument.

Author: asgerf

unified/ql/lib/codeql/unified/internal/mad/LegacyMaD.qll

@@ -187,6 +187,8 @@ private class Selector extends TSelector {
       this = MkSelector(type, true, name, argLabels, _)
     )
   }
+
+  int getPositionalArity() { result = count(int n | this.getArgLabels().splitAt(":", n) = "_") }
 }
 
 private predicate isAccessPath(string path) {
@@ -333,3 +335,18 @@ module Public {
     predicate isSink(DataFlow::Node node, string kind) { node = getASink(kind, _) }
   }
 }
+
+private module Debug {
+  query predicate invalidAccessPath(Selector selector, AccessPathToken ap) {
+    (
+      normalizedSourceModel(selector, ap, _, _)
+      or
+      normalizedSinkModel(selector, ap, _, _)
+    ) and
+    exists(int n |
+      ap.getName() = ["Argument", "Parameter"] and
+      parseInt(ap.getAnArgument()) = n and
+      not n in [0 .. selector.getPositionalArity() - 1]
+    )
+  }
+}

unified/ql/lib/ext/legacy-swift.model.yml

@@ -95,9 +95,9 @@ extensions:
       - ["", "", false, "NSLog(_:_:)", "", "", "Argument[0,1]", "log-injection", "manual"]
       - ["", "", false, "NSLogv(_:_:)", "", "", "Argument[0,1]", "log-injection", "manual"]
       - ["", "", false, "os_log(_:)", "", "", "Argument[0]", "log-injection", "manual"]
-      - ["", "", false, "os_log(_:_:_:dso:log:)", "", "", "Argument[0,4]", "log-injection", "manual"]
-      - ["", "", false, "os_log(_:_:dso:log:type:)", "", "", "Argument[0,4]", "log-injection", "manual"]
-      - ["", "", false, "os_log(_:_:log:)", "", "", "Argument[2]", "log-injection", "manual"]
+      - ["", "", false, "os_log(_:_:_:dso:log:)", "", "", "Argument[0,log:]", "log-injection", "manual"]
+      - ["", "", false, "os_log(_:_:dso:log:type:)", "", "", "Argument[0,log:]", "log-injection", "manual"]
+      - ["", "", false, "os_log(_:_:log:)", "", "", "Argument[log:]", "log-injection", "manual"]
       - ["", "", false, "print(_:separator:terminator:toStream:)", "", "", "Argument[0,separator:,terminator:]", "log-injection", "manual"]
       - ["", "", false, "vfprintf(_:_:_:)", "", "", "Argument[1,2]", "log-injection", "manual"]
       - ["", "", false, "sqlite3_bind_blob(_:_:_:_:_:)", "", "", "Argument[2]", "database-store", "manual"]
@@ -272,16 +272,16 @@ extensions:
       - ["", "SHA1", true, "calculate(for:)", "", "", "Argument[for:]", "weak-hash-input-SHA1", "manual"]
       - ["", "SHA1", true, "process(block:currentHash:)", "", "", "Argument[block:]", "weak-hash-input-SHA1", "manual"]
       - ["", "SHA1", true, "update(isLast:withBytes:)", "", "", "Argument[withBytes:]", "weak-hash-input-SHA1", "manual"]
-      - ["", "Logger", true, "warning(_:)", "", "", "Argument[1]", "log-injection", "manual"]
-      - ["", "Logger", true, "error(_:)", "", "", "Argument[1]", "log-injection", "manual"]
-      - ["", "Logger", true, "critical(_:)", "", "", "Argument[1]", "log-injection", "manual"]
-      - ["", "Logger", true, "debug(_:)", "", "", "Argument[1]", "log-injection", "manual"]
-      - ["", "Logger", true, "fault(_:)", "", "", "Argument[1]", "log-injection", "manual"]
-      - ["", "Logger", true, "info(_:)", "", "", "Argument[1]", "log-injection", "manual"]
+      - ["", "Logger", true, "warning(_:)", "", "", "Argument[0]", "log-injection", "manual"]
+      - ["", "Logger", true, "error(_:)", "", "", "Argument[0]", "log-injection", "manual"]
+      - ["", "Logger", true, "critical(_:)", "", "", "Argument[0]", "log-injection", "manual"]
+      - ["", "Logger", true, "debug(_:)", "", "", "Argument[0]", "log-injection", "manual"]
+      - ["", "Logger", true, "fault(_:)", "", "", "Argument[0]", "log-injection", "manual"]
+      - ["", "Logger", true, "info(_:)", "", "", "Argument[0]", "log-injection", "manual"]
       - ["", "Logger", true, "log(_:)", "", "", "Argument[0]", "log-injection", "manual"]
-      - ["", "Logger", true, "log(_:level:)", "", "", "Argument[1]", "log-injection", "manual"]
-      - ["", "Logger", true, "notice(_:)", "", "", "Argument[1]", "log-injection", "manual"]
-      - ["", "Logger", true, "trace(_:)", "", "", "Argument[1]", "log-injection", "manual"]
+      - ["", "Logger", true, "log(_:level:)", "", "", "Argument[0]", "log-injection", "manual"]
+      - ["", "Logger", true, "notice(_:)", "", "", "Argument[0]", "log-injection", "manual"]
+      - ["", "Logger", true, "trace(_:)", "", "", "Argument[0]", "log-injection", "manual"]
       - ["", "NSException", true, "init(name:reason:userInfo:)", "", "", "Argument[reason:]", "log-injection", "manual"]
       - ["", "NSException", true, "raise(_:arguments:format:)", "", "", "Argument[format:,arguments:]", "log-injection", "manual"]
       - ["", "SHA256", true, "hash(bufferPointer:)", "", "", "Argument[bufferPointer:]", "weak-password-hash-input-SHA256", "manual"]
@@ -321,11 +321,11 @@ extensions:
       - ["", "QueryType", true, "insert(_:)", "", "", "Argument[0]", "database-store", "manual"]
       - ["", "QueryType", true, "update(_:)", "", "", "Argument[0]", "database-store", "manual"]
       - ["", "QueryType", true, "insert(_:_:)", "", "", "Argument[0,1]", "database-store", "manual"]
-      - ["", "QueryType", true, "insert(_:or:)", "", "", "Argument[1]", "database-store", "manual"]
+      - ["", "QueryType", true, "insert(_:or:)", "", "", "Argument[0]", "database-store", "manual"]
       - ["", "QueryType", true, "insertMany(_:)", "", "", "Argument[0]", "database-store", "manual"]
-      - ["", "QueryType", true, "insertMany(_:or:)", "", "", "Argument[1]", "database-store", "manual"]
+      - ["", "QueryType", true, "insertMany(_:or:)", "", "", "Argument[0]", "database-store", "manual"]
       - ["", "QueryType", true, "update(_:_:)", "", "", "Argument[0,1]", "database-store", "manual"]
-      - ["", "QueryType", true, "update(_:or:)", "", "", "Argument[1]", "database-store", "manual"]
+      - ["", "QueryType", true, "update(_:or:)", "", "", "Argument[0]", "database-store", "manual"]
       - ["", "QueryType", true, "upsert(_:onConflictOf:)", "", "", "Argument[0]", "database-store", "manual"]
       - ["", "QueryType", true, "upsert(_:onConflictOf:setValues:)", "", "", "Argument[0]", "database-store", "manual"]
       - ["", "QueryType", true, "upsert(_:onConflictOf:setValues:)", "", "", "Argument[setValues:]", "database-store", "manual"]