unified: Also use exprStep for type casts

Author: asgerf

unified/ql/lib/codeql/unified/internal/dataflow/DataFlowPluginSwift.qll

@@ -21,6 +21,19 @@ private class SwiftDataFlowPlugin extends DataFlowPlugin {
       expr1 = expr.getOperand() and
       expr2 = expr
     )
+    or
+    mustFlow = true and
+    exists(TypeCastExpr expr |
+      // Type-cast operators:
+      // - "as": Safe upcast conversion
+      // - "as?": Wrap in Optional<T> if cast succeeds
+      // - "as!": Throw if cast fails
+      //
+      // Since we bypass Optional<T> content, we model all of these as must-flow steps.
+      expr.getOperator().getValue() = ["as", "as?", "as!"] and
+      expr1 = expr.getExpr() and
+      expr2 = expr
+    )
   }
 
   override predicate step(BuilderNode node1, Step step, BuilderNode node2) {
@@ -49,19 +62,6 @@ private class SwiftDataFlowPlugin extends DataFlowPlugin {
       node2.isResultValue(expr)
     )
     or
-    exists(TypeCastExpr expr |
-      // Type-cast operators:
-      // - "as": Safe upcast conversion
-      // - "as?": Wrap in Optional<T> if cast succeeds
-      // - "as!": Throw if cast fails
-      //
-      // Since we bypass Optional<T> content, we model all of these as value steps.
-      expr.getOperator().getValue() = ["as", "as?", "as!"] and
-      node1.isResultValue(expr.getExpr()) and
-      step.value() and
-      node2.isResultValue(expr)
-    )
-    or
     exists(NullCoalescingExpr expr |
       // We bypass Optional<T> content so we add value-flow out of both operands of "??"
       node1.isResultValue(expr.getAnOperand()) and

unified/ql/test/library-tests/dataflow/test.expected

@@ -448,6 +448,10 @@ edges
 | test.swift:253:30:253:44 | source(...) | test.swift:253:16:253:45 | ... .some(...) | provenance |  |
 | test.swift:255:10:255:22 | getOptional(...) | test.swift:255:10:255:35 | ... ?? ... | provenance |  |
 | test.swift:256:20:256:32 | getOptional(...) | test.swift:256:10:256:32 | ... ?? ... | provenance |  |
+| test.swift:264:5:264:23 | ... .field | test.swift:264:6:264:16 | [post] TypeCastExpr [field] | provenance |  |
+| test.swift:264:6:264:16 | [post] TypeCastExpr [field] | test.swift:265:10:265:12 | box [field] | provenance |  |
+| test.swift:264:27:264:41 | source(...) | test.swift:264:5:264:23 | ... .field | provenance |  |
+| test.swift:265:10:265:12 | box [field] | test.swift:265:10:265:18 | ... .field | provenance |  |
 nodes
 | calls.swift:7:19:7:19 | x | semmle.label | x |
 | calls.swift:8:14:8:14 | x | semmle.label | x |
@@ -991,6 +995,11 @@ nodes
 | test.swift:255:10:255:35 | ... ?? ... | semmle.label | ... ?? ... |
 | test.swift:256:10:256:32 | ... ?? ... | semmle.label | ... ?? ... |
 | test.swift:256:20:256:32 | getOptional(...) | semmle.label | getOptional(...) |
+| test.swift:264:5:264:23 | ... .field | semmle.label | ... .field |
+| test.swift:264:6:264:16 | [post] TypeCastExpr [field] | semmle.label | [post] TypeCastExpr [field] |
+| test.swift:264:27:264:41 | source(...) | semmle.label | source(...) |
+| test.swift:265:10:265:12 | box [field] | semmle.label | box [field] |
+| test.swift:265:10:265:18 | ... .field | semmle.label | ... .field |
 subpaths
 | calls.swift:31:17:31:30 | source(...) | calls.swift:28:19:28:19 | x | calls.swift:29:16:29:24 | ... + ... | calls.swift:31:10:31:31 | target(...) |
 | calls.swift:32:17:32:30 | source(...) | calls.swift:28:19:28:19 | x | calls.swift:29:16:29:24 | ... + ... | calls.swift:32:10:32:31 | target(...) |
@@ -1142,3 +1151,4 @@ testFailures
 | test.swift:247:14:247:14 | x | test.swift:242:30:242:44 | source(...) | test.swift:247:14:247:14 | x | $@ | test.swift:242:30:242:44 | source(...) | source(...) |
 | test.swift:255:10:255:35 | ... ?? ... | test.swift:253:30:253:44 | source(...) | test.swift:255:10:255:35 | ... ?? ... | $@ | test.swift:253:30:253:44 | source(...) | source(...) |
 | test.swift:256:10:256:32 | ... ?? ... | test.swift:253:30:253:44 | source(...) | test.swift:256:10:256:32 | ... ?? ... | $@ | test.swift:253:30:253:44 | source(...) | source(...) |
+| test.swift:265:10:265:18 | ... .field | test.swift:264:27:264:41 | source(...) | test.swift:265:10:265:18 | ... .field | $@ | test.swift:264:27:264:41 | source(...) | source(...) |

unified/ql/test/library-tests/dataflow/test.swift

@@ -262,5 +262,5 @@ func t29() {
     }
     let box = Box()
     (box as! Box).field = source("t29.1")
-    sink(box.field)  // $ MISSING: hasValueFlow=t29.1
+    sink(box.field)  // $ hasValueFlow=t29.1
 }