Swift: Add and use ApplyExpr.getArgumentByParamName.

Author: geoffw0

swift/ql/lib/codeql/swift/elements/expr/ApplyExpr.qll

@@ -19,6 +19,17 @@ class ApplyExpr extends Generated::ApplyExpr {
   /** Gets the method qualifier, if this is applying a method */
   Expr getQualifier() { none() }
 
+  /**
+   * Gets the argument that has corresponding parameter name `paramName` (if
+   * any). If this call does not have a static target, there will be no result.
+   */
+  final Argument getArgumentByParamName(string paramName) {
+    exists(int arg |
+      this.getStaticTarget().getParam(pragma[only_bind_into](arg)).getName() = paramName and
+      this.getArgument(pragma[only_bind_into](arg)) = result
+    )
+  }
+
   override string toString() {
     result = "call to " + this.getStaticTarget().toString()
     or

swift/ql/src/queries/Security/CWE-079/UnsafeWebViewFetch.ql

@@ -26,10 +26,7 @@ class Sink extends DataFlow::Node {
   Expr baseUrl;
 
   Sink() {
-    exists(
-      MethodDecl funcDecl, CallExpr call, string className, string funcName, string paramName,
-      int arg, int baseUrlArg
-    |
+    exists(MethodDecl funcDecl, CallExpr call, string className, string funcName, string paramName |
       // arguments to method calls...
       (
         // `loadHTMLString`
@@ -50,11 +47,9 @@ class Sink extends DataFlow::Node {
       call.getStaticTarget() = funcDecl and
       // match up `funcName`, `paramName`, `arg`, `node`.
       funcDecl.hasQualifiedName(className, funcName) and
-      funcDecl.getParam(pragma[only_bind_into](arg)).getName() = paramName and
-      call.getArgument(pragma[only_bind_into](arg)).getExpr() = this.asExpr() and
+      call.getArgumentByParamName(paramName).getExpr() = this.asExpr() and
       // match up `baseURLArg`
-      funcDecl.getParam(pragma[only_bind_into](baseUrlArg)).getName() = "baseURL" and
-      call.getArgument(pragma[only_bind_into](baseUrlArg)).getExpr() = baseUrl
+      call.getArgumentByParamName("baseURL").getExpr() = baseUrl
     )
   }
 

swift/ql/src/queries/Security/CWE-135/StringLengthConflation.ql

@@ -94,9 +94,7 @@ class StringLengthConflationConfiguration extends DataFlow::Configuration {
    * that sink. We actually want to report incorrect flow states.
    */
   predicate isSinkImpl(DataFlow::Node node, string flowstate) {
-    exists(
-      AbstractFunctionDecl funcDecl, CallExpr call, string funcName, string paramName, int arg
-    |
+    exists(AbstractFunctionDecl funcDecl, CallExpr call, string funcName, string paramName |
       (
         // arguments to method calls...
         exists(string className, ClassOrStructDecl c |
@@ -166,8 +164,7 @@ class StringLengthConflationConfiguration extends DataFlow::Configuration {
       ) and
       // match up `funcName`, `paramName`, `arg`, `node`.
       funcDecl.getName() = funcName and
-      funcDecl.getParam(pragma[only_bind_into](arg)).getName() = paramName and
-      call.getArgument(pragma[only_bind_into](arg)).getExpr() = node.asExpr()
+      call.getArgumentByParamName(paramName).getExpr() = node.asExpr()
     )
   }