Kotlin: handle default parameter values inherited from an overridden function

Author: smowton

java/kotlin-extractor/src/main/kotlin/KotlinFileExtractor.kt

@@ -6,6 +6,7 @@ import com.github.codeql.utils.versions.functionN
 import com.github.codeql.utils.versions.isUnderscoreParameter
 import com.semmle.extractor.java.OdasaOutput
 import org.jetbrains.kotlin.backend.common.extensions.IrPluginContext
+import org.jetbrains.kotlin.backend.common.ir.allOverridden
 import org.jetbrains.kotlin.backend.common.lower.parents
 import org.jetbrains.kotlin.backend.common.pop
 import org.jetbrains.kotlin.builtins.functions.BuiltInFunctionArity
@@ -1855,16 +1856,27 @@ open class KotlinFileExtractor(
             // Ensure the real target gets extracted, as we might not every directly touch it thanks to this call being redirected to a $default method.
             useFunction<DbCallable>(callTarget)
         }
-        val defaultMethodLabel = getDefaultsMethodLabel(callTarget)
+
+        // Default parameter values are inherited by overrides; in this case the call should dispatch against the $default method belonging to the class
+        // that specified the default values, which will in turn dynamically dispatch back to the relevant override.
+        val overriddenCallTarget = (callTarget as? IrSimpleFunction)?.allOverridden(true)?.firstOrNull {
+            it.overriddenSymbols.isEmpty() && it.valueParameters.any { p -> p.defaultValue != null }
+        } ?: callTarget
+        if (isExternalDeclaration(overriddenCallTarget)) {
+            // Likewise, ensure the overridden target gets extracted.
+            useFunction<DbCallable>(overriddenCallTarget)
+        }
+
+        val defaultMethodLabel = getDefaultsMethodLabel(overriddenCallTarget)
         val id = extractMethodAccessWithoutArgs(resultType, locId, enclosingCallable, callsiteParent, childIdx, enclosingStmt, defaultMethodLabel)
 
-        if (callTarget.isLocalFunction()) {
-            extractTypeAccess(getLocallyVisibleFunctionLabels(callTarget).type, locId, id, -1, enclosingCallable, enclosingStmt)
+        if (overriddenCallTarget.isLocalFunction()) {
+            extractTypeAccess(getLocallyVisibleFunctionLabels(overriddenCallTarget).type, locId, id, -1, enclosingCallable, enclosingStmt)
         } else {
-            extractStaticTypeAccessQualifierUnchecked(callTarget.parent, id, locId, enclosingCallable, enclosingStmt)
+            extractStaticTypeAccessQualifierUnchecked(overriddenCallTarget.parent, id, locId, enclosingCallable, enclosingStmt)
         }
 
-        extractDefaultsCallArguments(id, callTarget, enclosingCallable, enclosingStmt, valueArguments, dispatchReceiver, extensionReceiver)
+        extractDefaultsCallArguments(id, overriddenCallTarget, enclosingCallable, enclosingStmt, valueArguments, dispatchReceiver, extensionReceiver)
     }
 
     private fun extractDefaultsCallArguments(

java/ql/test/kotlin/library-tests/inherited-default-value/test.expected

@@ -0,0 +1,2 @@
+| test.kt:3:8:3:28 | f(...) | test.kt:3:8:3:28 | f | test.kt:1:1:5:1 | A |
+| test.kt:11:21:11:23 | f$default(...) | test.kt:3:8:3:28 | f$default | test.kt:1:1:5:1 | A |

java/ql/test/kotlin/library-tests/inherited-default-value/test.kt

@@ -0,0 +1,13 @@
+open class A {
+
+  open fun f(x: Int = 0) = x
+
+}
+
+class B : A() {
+
+  override fun f(x: Int) = x + 1
+
+  fun user() = this.f()
+
+}

java/ql/test/kotlin/library-tests/inherited-default-value/test.ql

@@ -0,0 +1,4 @@
+import java
+
+from MethodAccess ma
+select ma, ma.getCallee(), ma.getCallee().getDeclaringType()