Unified: Support property models with base-type match

unified/ql/lib/codeql/unified/internal/AnalysisQuality.qll

@@ -129,7 +129,7 @@ module TaintReach {
   }
 
   module TaintReachConfig implements DataFlow::ConfigSig {
-    predicate isSource(DataFlow::Node node) { Models::isSource(node, _) }
+    predicate isSource(DataFlow::Node node) { Models::isSource(node, ["local", "remote"]) }
 
     predicate isSink(DataFlow::Node node) { node instanceof Candidate }
   }

unified/ql/lib/codeql/unified/internal/ExprPositions.qll

@@ -43,7 +43,7 @@ predicate isInSyntacticTypeContext(Expr expr) {
 }
 
 private predicate isInTypeContext0(Expr expr) {
-  exists(NameBinding::getTypeFromRef(expr))
+  NameBinding::isTypeRef(expr)
   or
   isInTypeContext0(expr.getEnclosingExpr())
 }

unified/ql/lib/codeql/unified/internal/StaticNameBinding.qll

@@ -7,6 +7,7 @@ module;
 private import unified
 private import codeql.unified.internal.LocalNameBinding
 private import codeql.unified.internal.NameBindingPlugin
+private import codeql.unified.internal.mad.LegacyMaD as MaD
 
 cached
 private newtype TNameBindingNode =
@@ -21,7 +22,8 @@ private newtype TNameBindingNode =
   } or
   TModuleScope(ModuleScopeRepr repr) or
   TFolderScope(Folder folder) or
-  TModuleRoot()
+  TModuleRoot() or
+  TTypeSelector(MaD::TypeSelector type)
 
 /**
  * A node in a graph, in which name-binding rules are represented as edges between nodes.
@@ -61,6 +63,8 @@ class NameBindingNode extends TNameBindingNode {
   /** Holds if this represents the root namespace in which all named modules are members. */
   predicate isModuleRoot() { this = TModuleRoot() }
 
+  predicate isTypeSelector(MaD::TypeSelector type) { this = TTypeSelector(type) }
+
   /**
    * Gets an AST node wrapped by this name-binding node, if such a node exists.
    *
@@ -104,6 +108,10 @@ class NameBindingNode extends TNameBindingNode {
     exists(Folder folder | this.isFolderScope(folder) and result = "FolderScope(" + folder + ")")
     or
     this.isModuleRoot() and result = "ModuleRoot"
+    or
+    exists(MaD::TypeSelector type |
+      this.isTypeSelector(type) and result = "TypeSelector(" + type + ")"
+    )
   }
 
   Location getLocation() {
@@ -224,6 +232,11 @@ predicate storeStep(NameBindingNode node1, string name, NameBindingNode node2) {
   )
   or
   FolderHeuristic::storeStep(node1, name, node2)
+  or
+  exists(MaD::TypeSelector type |
+    node1.isTypeSelector(type.append(name)) and
+    node2.isTypeSelector(type)
+  )
 }
 
 predicate valueStep(NameBindingNode node1, NameBindingNode node2) {
@@ -290,6 +303,11 @@ predicate valueStep(NameBindingNode node1, NameBindingNode node2) {
     node2.isLocalName(self) and
     self.hasNameAndScope(any(NameBindingPlugin p).getStaticSelfName(cls), cls)
   )
+  or
+  exists(TopLevel top |
+    node1.isTypeSelector("") and
+    node2.isLocalNamespace(top.getBody())
+  )
 }
 
 private predicate isImportPrefix(Expr e) {
@@ -529,6 +547,8 @@ private module TrackNameBindingInput implements TrackInputSig {
       node.isIdentifier(decl) and
       not isTrivialNameAlias(decl)
     )
+    or
+    node.isTypeSelector(_)
   }
 }
 
@@ -542,6 +562,14 @@ private NameBindingNode trackNameBinding(NameBinding decl) {
   )
 }
 
+/** Gets a name-binding node that may refer to the given type from a model. */
+NameBindingNode trackTypeSelector(MaD::TypeSelector type) {
+  exists(NameBindingNode start |
+    start.isTypeSelector(type) and
+    result = TrackNameBinding::track(start)
+  )
+}
+
 /** Holds if `node` should be included in the debug view. */
 private signature predicate relevantNodeSig(AstNode node);
 
@@ -842,6 +870,14 @@ Identifier getTypeFromRef(AstNode access) {
   )
 }
 
+/** Holds if `access` is a reference to a type. */
+predicate isTypeRef(AstNode access) {
+  exists(getTypeFromRef(access))
+  or
+  not exists(getStaticBindingTargetFromRef(access)) and
+  trackTypeSelector(_) = getNodeFromRef(access)
+}
+
 /**
  * Gets the name of the implicit receiver parameter in scope at `callable` (possibly declared by an outer callable).
  *