Sync files

Author: asgerf

csharp/ql/lib/semmle/code/csharp/dataflow/internal/AccessPathSyntax.qll

@@ -4,6 +4,12 @@
  *
  * This file is used by the shared data flow library and by the JavaScript libraries
  * (which does not use the shared data flow libraries).
+ *
+ * An access path consists of a `.`-separated list of components, which each consist
+ * of an identifier optionally followed by a `[]`-enclosed argument.
+ *
+ * The argument can be be enclosed in single quotes. In this case, any character is allowed in-between
+ * the single quotes, and two consecutive single quotes will be interpreted as an individual single quote.
  */
 
 /**
@@ -116,7 +122,7 @@ private string getRawToken(AccessPath path, int n) {
   // Avoid splitting by '.' since tokens may contain dots, e.g. `Field[foo.Bar.x]`.
   // Instead use regexpFind to match valid tokens, and supplement with a final length
   // check (in `AccessPath.hasSyntaxError`) to ensure all characters were included in a token.
-  result = path.regexpFind("\\w+(?:\\[[^\\]]*\\])?(?=\\.|$)", n, _)
+  result = path.regexpFind("\\w+(?:\\[(?:[^'\\]]*|'(?:[^']|'')*')\\])?(?=\\.|$)", n, _)
 }
 
 /**
@@ -152,7 +158,7 @@ class AccessPathToken extends string {
   AccessPathToken() { this = getRawToken(_, _) }
 
   private string getPart(int part) {
-    result = this.regexpCapture("([^\\[]+)(?:\\[([^\\]]*)\\])?", part)
+    result = this.regexpCapture("([^\\[]+)(?:\\[(?:([^'\\]]*)|'((?:[^']|'')*)')\\])?", part)
   }
 
   /** Gets the name of the token, such as `Member` from `Member[x]` */
@@ -162,10 +168,20 @@ class AccessPathToken extends string {
    * Gets the argument list, such as `1,2` from `Member[1,2]`,
    * or has no result if there are no arguments.
    */
-  string getArgumentList() { result = this.getPart(2) }
+  string getArgumentList() {
+    result = this.getPart(2) or result = this.getPart(3).regexpReplaceAll("''", "'")
+  }
 
-  /** Gets the `n`th argument to this token, such as `x` or `y` from `Member[x,y]`. */
-  string getArgument(int n) { result = this.getArgumentList().splitAt(",", n).trim() }
+  /**
+   * Gets the `n`th argument to this token, such as `x` or `y` from `Member[x,y]`, or
+   * `foo,bar` from `Member['foo,bar']`.
+   */
+  pragma[nomagic]
+  string getArgument(int n) {
+    result = this.getPart(2).splitAt(",", n).trim()
+    or
+    result = this.getPart(3).replaceAll("''", "'") and n = 0
+  }
 
   /** Gets the `n`th argument to this `name` token, such as `x` or `y` from `Member[x,y]`. */
   pragma[nomagic]

go/ql/lib/semmle/go/dataflow/internal/AccessPathSyntax.qll

@@ -4,6 +4,12 @@
  *
  * This file is used by the shared data flow library and by the JavaScript libraries
  * (which does not use the shared data flow libraries).
+ *
+ * An access path consists of a `.`-separated list of components, which each consist
+ * of an identifier optionally followed by a `[]`-enclosed argument.
+ *
+ * The argument can be be enclosed in single quotes. In this case, any character is allowed in-between
+ * the single quotes, and two consecutive single quotes will be interpreted as an individual single quote.
  */
 
 /**
@@ -116,7 +122,7 @@ private string getRawToken(AccessPath path, int n) {
   // Avoid splitting by '.' since tokens may contain dots, e.g. `Field[foo.Bar.x]`.
   // Instead use regexpFind to match valid tokens, and supplement with a final length
   // check (in `AccessPath.hasSyntaxError`) to ensure all characters were included in a token.
-  result = path.regexpFind("\\w+(?:\\[[^\\]]*\\])?(?=\\.|$)", n, _)
+  result = path.regexpFind("\\w+(?:\\[(?:[^'\\]]*|'(?:[^']|'')*')\\])?(?=\\.|$)", n, _)
 }
 
 /**
@@ -152,7 +158,7 @@ class AccessPathToken extends string {
   AccessPathToken() { this = getRawToken(_, _) }
 
   private string getPart(int part) {
-    result = this.regexpCapture("([^\\[]+)(?:\\[([^\\]]*)\\])?", part)
+    result = this.regexpCapture("([^\\[]+)(?:\\[(?:([^'\\]]*)|'((?:[^']|'')*)')\\])?", part)
   }
 
   /** Gets the name of the token, such as `Member` from `Member[x]` */
@@ -162,10 +168,20 @@ class AccessPathToken extends string {
    * Gets the argument list, such as `1,2` from `Member[1,2]`,
    * or has no result if there are no arguments.
    */
-  string getArgumentList() { result = this.getPart(2) }
+  string getArgumentList() {
+    result = this.getPart(2) or result = this.getPart(3).regexpReplaceAll("''", "'")
+  }
 
-  /** Gets the `n`th argument to this token, such as `x` or `y` from `Member[x,y]`. */
-  string getArgument(int n) { result = this.getArgumentList().splitAt(",", n).trim() }
+  /**
+   * Gets the `n`th argument to this token, such as `x` or `y` from `Member[x,y]`, or
+   * `foo,bar` from `Member['foo,bar']`.
+   */
+  pragma[nomagic]
+  string getArgument(int n) {
+    result = this.getPart(2).splitAt(",", n).trim()
+    or
+    result = this.getPart(3).replaceAll("''", "'") and n = 0
+  }
 
   /** Gets the `n`th argument to this `name` token, such as `x` or `y` from `Member[x,y]`. */
   pragma[nomagic]

java/ql/lib/semmle/code/java/dataflow/internal/AccessPathSyntax.qll

@@ -4,6 +4,12 @@
  *
  * This file is used by the shared data flow library and by the JavaScript libraries
  * (which does not use the shared data flow libraries).
+ *
+ * An access path consists of a `.`-separated list of components, which each consist
+ * of an identifier optionally followed by a `[]`-enclosed argument.
+ *
+ * The argument can be be enclosed in single quotes. In this case, any character is allowed in-between
+ * the single quotes, and two consecutive single quotes will be interpreted as an individual single quote.
  */
 
 /**
@@ -116,7 +122,7 @@ private string getRawToken(AccessPath path, int n) {
   // Avoid splitting by '.' since tokens may contain dots, e.g. `Field[foo.Bar.x]`.
   // Instead use regexpFind to match valid tokens, and supplement with a final length
   // check (in `AccessPath.hasSyntaxError`) to ensure all characters were included in a token.
-  result = path.regexpFind("\\w+(?:\\[[^\\]]*\\])?(?=\\.|$)", n, _)
+  result = path.regexpFind("\\w+(?:\\[(?:[^'\\]]*|'(?:[^']|'')*')\\])?(?=\\.|$)", n, _)
 }
 
 /**
@@ -152,7 +158,7 @@ class AccessPathToken extends string {
   AccessPathToken() { this = getRawToken(_, _) }
 
   private string getPart(int part) {
-    result = this.regexpCapture("([^\\[]+)(?:\\[([^\\]]*)\\])?", part)
+    result = this.regexpCapture("([^\\[]+)(?:\\[(?:([^'\\]]*)|'((?:[^']|'')*)')\\])?", part)
   }
 
   /** Gets the name of the token, such as `Member` from `Member[x]` */
@@ -162,10 +168,20 @@ class AccessPathToken extends string {
    * Gets the argument list, such as `1,2` from `Member[1,2]`,
    * or has no result if there are no arguments.
    */
-  string getArgumentList() { result = this.getPart(2) }
+  string getArgumentList() {
+    result = this.getPart(2) or result = this.getPart(3).regexpReplaceAll("''", "'")
+  }
 
-  /** Gets the `n`th argument to this token, such as `x` or `y` from `Member[x,y]`. */
-  string getArgument(int n) { result = this.getArgumentList().splitAt(",", n).trim() }
+  /**
+   * Gets the `n`th argument to this token, such as `x` or `y` from `Member[x,y]`, or
+   * `foo,bar` from `Member['foo,bar']`.
+   */
+  pragma[nomagic]
+  string getArgument(int n) {
+    result = this.getPart(2).splitAt(",", n).trim()
+    or
+    result = this.getPart(3).replaceAll("''", "'") and n = 0
+  }
 
   /** Gets the `n`th argument to this `name` token, such as `x` or `y` from `Member[x,y]`. */
   pragma[nomagic]

javascript/ql/lib/semmle/javascript/frameworks/data/internal/AccessPathSyntax.qll

@@ -4,6 +4,12 @@
  *
  * This file is used by the shared data flow library and by the JavaScript libraries
  * (which does not use the shared data flow libraries).
+ *
+ * An access path consists of a `.`-separated list of components, which each consist
+ * of an identifier optionally followed by a `[]`-enclosed argument.
+ *
+ * The argument can be be enclosed in single quotes. In this case, any character is allowed in-between
+ * the single quotes, and two consecutive single quotes will be interpreted as an individual single quote.
  */
 
 /**
@@ -116,7 +122,7 @@ private string getRawToken(AccessPath path, int n) {
   // Avoid splitting by '.' since tokens may contain dots, e.g. `Field[foo.Bar.x]`.
   // Instead use regexpFind to match valid tokens, and supplement with a final length
   // check (in `AccessPath.hasSyntaxError`) to ensure all characters were included in a token.
-  result = path.regexpFind("\\w+(?:\\[[^\\]]*\\])?(?=\\.|$)", n, _)
+  result = path.regexpFind("\\w+(?:\\[(?:[^'\\]]*|'(?:[^']|'')*')\\])?(?=\\.|$)", n, _)
 }
 
 /**
@@ -152,7 +158,7 @@ class AccessPathToken extends string {
   AccessPathToken() { this = getRawToken(_, _) }
 
   private string getPart(int part) {
-    result = this.regexpCapture("([^\\[]+)(?:\\[([^\\]]*)\\])?", part)
+    result = this.regexpCapture("([^\\[]+)(?:\\[(?:([^'\\]]*)|'((?:[^']|'')*)')\\])?", part)
   }
 
   /** Gets the name of the token, such as `Member` from `Member[x]` */
@@ -162,10 +168,20 @@ class AccessPathToken extends string {
    * Gets the argument list, such as `1,2` from `Member[1,2]`,
    * or has no result if there are no arguments.
    */
-  string getArgumentList() { result = this.getPart(2) }
+  string getArgumentList() {
+    result = this.getPart(2) or result = this.getPart(3).regexpReplaceAll("''", "'")
+  }
 
-  /** Gets the `n`th argument to this token, such as `x` or `y` from `Member[x,y]`. */
-  string getArgument(int n) { result = this.getArgumentList().splitAt(",", n).trim() }
+  /**
+   * Gets the `n`th argument to this token, such as `x` or `y` from `Member[x,y]`, or
+   * `foo,bar` from `Member['foo,bar']`.
+   */
+  pragma[nomagic]
+  string getArgument(int n) {
+    result = this.getPart(2).splitAt(",", n).trim()
+    or
+    result = this.getPart(3).replaceAll("''", "'") and n = 0
+  }
 
   /** Gets the `n`th argument to this `name` token, such as `x` or `y` from `Member[x,y]`. */
   pragma[nomagic]

python/ql/lib/semmle/python/dataflow/new/internal/AccessPathSyntax.qll

@@ -4,6 +4,12 @@
  *
  * This file is used by the shared data flow library and by the JavaScript libraries
  * (which does not use the shared data flow libraries).
+ *
+ * An access path consists of a `.`-separated list of components, which each consist
+ * of an identifier optionally followed by a `[]`-enclosed argument.
+ *
+ * The argument can be be enclosed in single quotes. In this case, any character is allowed in-between
+ * the single quotes, and two consecutive single quotes will be interpreted as an individual single quote.
  */
 
 /**
@@ -116,7 +122,7 @@ private string getRawToken(AccessPath path, int n) {
   // Avoid splitting by '.' since tokens may contain dots, e.g. `Field[foo.Bar.x]`.
   // Instead use regexpFind to match valid tokens, and supplement with a final length
   // check (in `AccessPath.hasSyntaxError`) to ensure all characters were included in a token.
-  result = path.regexpFind("\\w+(?:\\[[^\\]]*\\])?(?=\\.|$)", n, _)
+  result = path.regexpFind("\\w+(?:\\[(?:[^'\\]]*|'(?:[^']|'')*')\\])?(?=\\.|$)", n, _)
 }
 
 /**
@@ -152,7 +158,7 @@ class AccessPathToken extends string {
   AccessPathToken() { this = getRawToken(_, _) }
 
   private string getPart(int part) {
-    result = this.regexpCapture("([^\\[]+)(?:\\[([^\\]]*)\\])?", part)
+    result = this.regexpCapture("([^\\[]+)(?:\\[(?:([^'\\]]*)|'((?:[^']|'')*)')\\])?", part)
   }
 
   /** Gets the name of the token, such as `Member` from `Member[x]` */
@@ -162,10 +168,20 @@ class AccessPathToken extends string {
    * Gets the argument list, such as `1,2` from `Member[1,2]`,
    * or has no result if there are no arguments.
    */
-  string getArgumentList() { result = this.getPart(2) }
+  string getArgumentList() {
+    result = this.getPart(2) or result = this.getPart(3).regexpReplaceAll("''", "'")
+  }
 
-  /** Gets the `n`th argument to this token, such as `x` or `y` from `Member[x,y]`. */
-  string getArgument(int n) { result = this.getArgumentList().splitAt(",", n).trim() }
+  /**
+   * Gets the `n`th argument to this token, such as `x` or `y` from `Member[x,y]`, or
+   * `foo,bar` from `Member['foo,bar']`.
+   */
+  pragma[nomagic]
+  string getArgument(int n) {
+    result = this.getPart(2).splitAt(",", n).trim()
+    or
+    result = this.getPart(3).replaceAll("''", "'") and n = 0
+  }
 
   /** Gets the `n`th argument to this `name` token, such as `x` or `y` from `Member[x,y]`. */
   pragma[nomagic]

swift/ql/lib/codeql/swift/dataflow/internal/AccessPathSyntax.qll

@@ -4,6 +4,12 @@
  *
  * This file is used by the shared data flow library and by the JavaScript libraries
  * (which does not use the shared data flow libraries).
+ *
+ * An access path consists of a `.`-separated list of components, which each consist
+ * of an identifier optionally followed by a `[]`-enclosed argument.
+ *
+ * The argument can be be enclosed in single quotes. In this case, any character is allowed in-between
+ * the single quotes, and two consecutive single quotes will be interpreted as an individual single quote.
  */
 
 /**
@@ -116,7 +122,7 @@ private string getRawToken(AccessPath path, int n) {
   // Avoid splitting by '.' since tokens may contain dots, e.g. `Field[foo.Bar.x]`.
   // Instead use regexpFind to match valid tokens, and supplement with a final length
   // check (in `AccessPath.hasSyntaxError`) to ensure all characters were included in a token.
-  result = path.regexpFind("\\w+(?:\\[[^\\]]*\\])?(?=\\.|$)", n, _)
+  result = path.regexpFind("\\w+(?:\\[(?:[^'\\]]*|'(?:[^']|'')*')\\])?(?=\\.|$)", n, _)
 }
 
 /**
@@ -152,7 +158,7 @@ class AccessPathToken extends string {
   AccessPathToken() { this = getRawToken(_, _) }
 
   private string getPart(int part) {
-    result = this.regexpCapture("([^\\[]+)(?:\\[([^\\]]*)\\])?", part)
+    result = this.regexpCapture("([^\\[]+)(?:\\[(?:([^'\\]]*)|'((?:[^']|'')*)')\\])?", part)
   }
 
   /** Gets the name of the token, such as `Member` from `Member[x]` */
@@ -162,10 +168,20 @@ class AccessPathToken extends string {
    * Gets the argument list, such as `1,2` from `Member[1,2]`,
    * or has no result if there are no arguments.
    */
-  string getArgumentList() { result = this.getPart(2) }
+  string getArgumentList() {
+    result = this.getPart(2) or result = this.getPart(3).regexpReplaceAll("''", "'")
+  }
 
-  /** Gets the `n`th argument to this token, such as `x` or `y` from `Member[x,y]`. */
-  string getArgument(int n) { result = this.getArgumentList().splitAt(",", n).trim() }
+  /**
+   * Gets the `n`th argument to this token, such as `x` or `y` from `Member[x,y]`, or
+   * `foo,bar` from `Member['foo,bar']`.
+   */
+  pragma[nomagic]
+  string getArgument(int n) {
+    result = this.getPart(2).splitAt(",", n).trim()
+    or
+    result = this.getPart(3).replaceAll("''", "'") and n = 0
+  }
 
   /** Gets the `n`th argument to this `name` token, such as `x` or `y` from `Member[x,y]`. */
   pragma[nomagic]