Swift: Create ArgumentNodes and OutNodes for MaD.

Author: MathiasVP

swift/ql/lib/codeql/swift/dataflow/internal/DataFlowDispatch.qll

@@ -229,7 +229,9 @@ class SummaryCall extends DataFlowCall, TSummaryCall {
 cached
 private module Cached {
   cached
-  newtype TDataFlowCallable = TDataFlowFunc(CfgScope scope)
+  newtype TDataFlowCallable =
+    TDataFlowFunc(CfgScope scope) or
+    TSummarizedCallable(FlowSummary::SummarizedCallable c)
 
   /** Gets a viable run-time target for the call `call`. */
   cached
@@ -241,6 +243,8 @@ private module Cached {
     result = TDataFlowFunc(call.(PropertySetterCall).getAccessorDecl())
     or
     result = TDataFlowFunc(call.(PropertyObserverCall).getAccessorDecl())
+    or
+    result = TSummarizedCallable(call.asCall().getStaticTarget())
   }
 
   cached

swift/ql/lib/codeql/swift/dataflow/internal/DataFlowPrivate.qll

@@ -340,6 +340,14 @@ private module ArgumentNodes {
       )
     }
   }
+
+  class SummaryArgumentNode extends SummaryNode, ArgumentNode {
+    SummaryArgumentNode() { FlowSummaryImpl::Private::summaryArgumentNode(_, this, _) }
+
+    override predicate argumentOf(DataFlowCall call, ArgumentPosition pos) {
+      FlowSummaryImpl::Private::summaryArgumentNode(call, this, pos)
+    }
+  }
 }
 
 import ArgumentNodes
@@ -410,6 +418,12 @@ private module OutNodes {
     }
   }
 
+  class SummaryOutNode extends OutNode, SummaryNode {
+    override DataFlowCall getCall(ReturnKind kind) {
+      FlowSummaryImpl::Private::summaryOutNode(result, this, kind)
+    }
+  }
+
   class InOutUpdateArgNode extends OutNode, ExprPostUpdateNode {
     Argument arg;
 
@@ -596,6 +610,9 @@ predicate lambdaCreation(Node creation, LambdaCallKind kind, DataFlowCallable c)
 predicate lambdaCall(DataFlowCall call, LambdaCallKind kind, Node receiver) {
   kind = TLambdaCallKind() and
   receiver.asExpr() = call.asCall().getExpr().(ApplyExpr).getFunction()
+  or
+  kind = TLambdaCallKind() and
+  receiver = call.(SummaryCall).getReceiver()
 }
 
 /** Extra data-flow steps needed for lambda flow analysis. */