unified: Add flow through string interpolation

Author: asgerf

unified/ql/lib/codeql/unified/internal/FacadeAst.qll

@@ -197,5 +197,8 @@ module Unified {
         result = arg.getValue()
       )
     }
+
+    /** Gets the number of arguments passed to this call, not counting implicit arguments like receiver. */
+    int getNumberOfArguments() { result = count(this.getAnArgument()) }
   }
 }

unified/ql/lib/codeql/unified/internal/dataflow/DataFlowGraph.qll

@@ -45,6 +45,23 @@ predicate step(Node node1, Step step, Node node2) {
     node2.isResultValue(expr)
   )
   or
+  exists(StringInterpolationExpr expr |
+    node1.isResultValue(expr.getAnElement()) and
+    step.taint() and
+    node2.isResultValue(expr)
+  )
+  or
+  exists(CallExpr call |
+    // String interpolations in Swift currently insert a call to a built-in called "interpolation".
+    // Add taint through plain 1-argument calls to this built-in.
+    call.getCallee().(BuiltinExpr).getValue() = "interpolation" and
+    call.getNumberOfArguments() = 1 and
+    not exists(call.getArgument(0).getName()) and
+    node1.isResultValue(call.getArgument(0).getValue()) and
+    step.value() and
+    node2.isResultValue(call)
+  )
+  or
   exists(TupleExpr expr, int i |
     node1.isResultValue(expr.getElement(i).getValue()) and
     step.storeName(i.toString()) and

unified/ql/test/library-tests/dataflow/test.swift

@@ -5,6 +5,11 @@ func t1() {
 func t2() {
     sink(source("t2.1") + "blah"); // $ hasTaintFlow=t2.1
     sink("blah" + source("t2.2")); // $ hasTaintFlow=t2.2
+
+    sink("\(source("t2.3")) blah"); // $ hasTaintFlow=t2.3
+    sink("blah \(source("t2.4"))"); // $ hasTaintFlow=t2.4
+    sink("blah \(source("t2.5")) blah"); // $ hasTaintFlow=t2.5
+    sink("blah \(escape: source("t2.6")) blah"); // no flow
 }
 
 func t3() {