Repository navigation
Conversation
- Add DynamicMaD.qll, an interpreter for sourceModel/sinkModel/summaryModel/typeModel rows identified by (type, path) pairs that does not require type information. - Rework FlowSummary.qll to key summarized callables on (type, path). - Add a type-model generator (GraphExport over name-binding nodes) for .swiftinterface files, with GenerateTypeModels.ql and generate-type-models.sh. - Treat .swiftinterface files as module scopes in name binding. - Preserve declaration modifiers on computed properties and attributes on functions/initializers in the extractor. - Convert the legacy Swift models and delete LegacyMaD.qll. - Move library stubs in tests into .swiftinterface files. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
- Only treat calls to a user subclass (or its init) as instances, not other static calls. - Evaluate the first access-path token per (type, token) instead of per model row. - Handle module-qualified type references in the type-model generator. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
asgerf
force-pushed
the
asgerf-dynamic-mad-for-unified
branch
from
October 29, 2026 14:10
2ca882a to
575c105
Compare
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| * `kind` is either `value`, `taint`, or `type`. A summary of kind `type` indicates that the value at | ||
| * `output` (relative to `(type, path)`) has the same type as the value at `input`. | ||
| */ | ||
| extensible predicate summaryModel( |
|
|
||
| /** Holds if there is an edge `pred -> succ` labeled with `path`. */ | ||
| predicate graphEdge(Node pred, string path, Node succ) { | ||
| exists(Member member, string name | |
|
|
||
| bindingset[host] | ||
| predicate hasTypeSummary(Node host, string path) { | ||
| exists(Member member, string name | |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The
unifiedanalysis should work without dependencies being present in the database. The MaD models inherited from the old Swift analysis assume type information is available, which requires dependencies. This PR switchesunifiedto the dynamic-style MaD format (as used for JavaScript/Python/Ruby), where models are(type, path)pairs andtypeModelrows describe how instances of a type can be obtained.Approach
internal/mad/DynamicMaD.qll, extensibles inDynamicMaDExtensions.qll): a standalone, unified-specific evaluator ofsourceModel/sinkModel/summaryModel/typeModelrows. Type strings are module-qualified:Foundation(module),Foundation.FileManager(instances),Foundation.FileManager.Type(metatype).initcalls,typeModelrows, and user subclasses/conformers (includingParameter[..]on overriding methods and implicitselfmember accesses).Member[name](base name only; initializers areMember[init]on the metatype),WithNamedArgument[l]/WithoutNamedArgument[l]to disambiguate overloads by argument labels,Argument[..],Parameter[..],ReturnValue. Optionals are transparent. Only local flow is followed between steps.Models::isSource/isSinkkeep their existing signatures.FlowSummary.qll): summarized callables are keyed on(type, path);type-kind summaries are applied as type steps.internal/mad/TypeModelGenerator.qll,ql/src/utils/modelgenerator/GenerateTypeModels.ql,scripts/generate-type-models.sh): instantiatescodeql.mad.dynamic.GraphExportover name-binding nodes from.swiftinterfacefiles (plus nodes for callables, function types and undeclared types). Only types used by existing source/sink/summary models are exported.SwiftInterfaceModuleinNameBindingPluginSwift.qllmakes each interface file a module scope. Output from 10 local SDK modules is committed inext/generated/swift-type-models.model.yml.ext/swift-<module>.model.yml, with minimal label filters to separate overloads.LegacyMaD.qllandlegacy-swift.model.ymlare deleted.public,static), and functions/initializers keep their attributes (@_spi,@available), which the generator needs. Two corpus cases added.dynamic-mad(interpreter) andtype-model-generatortests; library stubs in existing tests moved into per-module.swiftinterfacefiles; a test checks the shipped models have no invalid access paths.Things worth reviewing
FileManager,NSString, UIKit classes) do not appear in SDK.swiftinterfacefiles, so their type models cannot be generated. A few key ones are hand-written inext/swift-modules.model.yml, along with module re-exports.Swiftand declared re-exports).Argument[label:], property types reached through another value's member are not resolved, and generic arguments are not tracked.Results
Security query tests lose no expected alerts, and about 15 previously
MISSINGresults are now found (e.g.Process.executableURL,Realm.Configuration.fileURL,textField.text). On Alamofire, sources are unchanged (42) and sinks go 131 -> 135. On Vapor, sinks go 83 -> 77, mostly dropping name-only false matches such as SQLite/GRDBinsert.