unified: Add basic flow through arrays

Only array literals and for-in statements are handled
asgerf · Oct 9, 2026 · Oct 5, 2026 · Oct 5, 2026 · Oct 5, 2026 · Oct 5, 2026
commit 488f1319216cef0513c9f70969dd426a0d2d1a5b
@@ -2,6 +2,7 @@ private import unified
 private import AllDataFlow
 
 private newtype TContent =
+  TArrayElement() or
   TNamedMember(string name) {
     name = any(Identifier id).getValue()
     or
@@ -15,7 +16,13 @@ private newtype TContent =
 class Content extends TContent {
   string asNamedMember() { this = TNamedMember(result) }
 
-  string toString() { result = this.asNamedMember() }
+  predicate isArrayElement() { this = TArrayElement() }
+
+  string toString() {
+    result = this.asNamedMember()
+    or
+    this.isArrayElement() and result = "ArrayElement"
+  }
 
   Location getLocation() { none() }
 }
@@ -36,4 +43,6 @@ class ContentSet extends TContentSet {
 
 module ContentSet {
   ContentSet namedMember(string name) { result.asSingleton().asNamedMember() = name }
+
+  ContentSet arrayElement() { result.asSingleton().isArrayElement() }
 }
@@ -134,6 +134,18 @@ predicate step(Node node1, Step step, Node node2) {
     node2.isIncomingValue(expr.getExpr())
   )
   or
+  exists(ArrayLiteral expr |
+    node1.isResultValue(expr.getAnElement()) and
+    step.store(ContentSet::arrayElement()) and
+    node2.isResultValue(expr)
+  )
+  or
+  exists(ForEachStmt stmt |
+    node1.isResultValue(stmt.getIterable()) and
+    step.readArrayElement() and
+    node2.isIncomingValue(stmt.getPattern())
+  )
+  or
   none() // Temporarily disable compilation errors from unsatisfiable types
 }
 

@@ -28,13 +28,21 @@ class Step extends TStep {
   pragma[nomagic]
   predicate readName(string name) { this.read(ContentSet::namedMember(name)) }
 
+  /** Holds if this represents a step reading an element from an array. */
+  pragma[nomagic]
+  predicate readArrayElement() { this.read(ContentSet::arrayElement()) }
+
   /** Holds if this represents a step storing into `contents`. */
   predicate store(ContentSet contents) { this = TStoreStep(contents) }
 
   /** Holds if this represents a step storing into the named member `name`. */
   pragma[nomagic]
   predicate storeName(string name) { this.store(ContentSet::namedMember(name)) }
 
+  /** Holds if this represents a step storing a value into an array. */
+  pragma[nomagic]
+  predicate storeArrayElement() { this.store(ContentSet::arrayElement()) }
+
   string toString() {
     this.value() and result = "value"
     or

@@ -282,6 +282,12 @@ edges
 | test.swift:221:12:221:12 | y | test.swift:222:14:222:14 | y | provenance |  |
 | test.swift:221:16:221:16 | x | test.swift:221:16:221:27 | TypeCastExpr [some.0] | provenance |  |
 | test.swift:221:16:221:27 | TypeCastExpr [some.0] | test.swift:221:8:221:12 | ... .some(...) [some.0] | provenance |  |
+| test.swift:227:9:227:9 | x [ArrayElement] | test.swift:228:20:228:20 | x [ArrayElement] | provenance |  |
+| test.swift:227:13:227:46 | ArrayLiteral [ArrayElement] | test.swift:227:9:227:9 | x [ArrayElement] | provenance |  |
+| test.swift:227:14:227:28 | source(...) | test.swift:227:13:227:46 | ArrayLiteral [ArrayElement] | provenance |  |
+| test.swift:227:31:227:45 | source(...) | test.swift:227:13:227:46 | ArrayLiteral [ArrayElement] | provenance |  |
+| test.swift:228:9:228:15 | element | test.swift:229:14:229:20 | element | provenance |  |
+| test.swift:228:20:228:20 | x [ArrayElement] | test.swift:228:9:228:15 | element | provenance |  |
 nodes
 | calls.swift:7:19:7:19 | x | semmle.label | x |
 | calls.swift:8:14:8:14 | x | semmle.label | x |
@@ -627,6 +633,13 @@ nodes
 | test.swift:221:16:221:16 | x | semmle.label | x |
 | test.swift:221:16:221:27 | TypeCastExpr [some.0] | semmle.label | TypeCastExpr [some.0] |
 | test.swift:222:14:222:14 | y | semmle.label | y |
+| test.swift:227:9:227:9 | x [ArrayElement] | semmle.label | x [ArrayElement] |
+| test.swift:227:13:227:46 | ArrayLiteral [ArrayElement] | semmle.label | ArrayLiteral [ArrayElement] |
+| test.swift:227:14:227:28 | source(...) | semmle.label | source(...) |
+| test.swift:227:31:227:45 | source(...) | semmle.label | source(...) |
+| test.swift:228:9:228:15 | element | semmle.label | element |
+| test.swift:228:20:228:20 | x [ArrayElement] | semmle.label | x [ArrayElement] |
+| test.swift:229:14:229:20 | element | semmle.label | element |
 subpaths
 | calls.swift:31:17:31:30 | source(...) | calls.swift:28:19:28:19 | x | calls.swift:29:16:29:24 | ... + ... | calls.swift:31:10:31:31 | target(...) |
 | calls.swift:32:17:32:30 | source(...) | calls.swift:28:19:28:19 | x | calls.swift:29:16:29:24 | ... + ... | calls.swift:32:10:32:31 | target(...) |
@@ -723,3 +736,5 @@ testFailures
 | test.swift:219:10:219:20 | TypeCastExpr | test.swift:218:13:218:27 | source(...) | test.swift:219:10:219:20 | TypeCastExpr | $@ | test.swift:218:13:218:27 | source(...) | source(...) |
 | test.swift:220:10:220:21 | TypeCastExpr | test.swift:218:13:218:27 | source(...) | test.swift:220:10:220:21 | TypeCastExpr | $@ | test.swift:218:13:218:27 | source(...) | source(...) |
 | test.swift:222:14:222:14 | y | test.swift:218:13:218:27 | source(...) | test.swift:222:14:222:14 | y | $@ | test.swift:218:13:218:27 | source(...) | source(...) |
+| test.swift:229:14:229:20 | element | test.swift:227:14:227:28 | source(...) | test.swift:229:14:229:20 | element | $@ | test.swift:227:14:227:28 | source(...) | source(...) |
+| test.swift:229:14:229:20 | element | test.swift:227:31:227:45 | source(...) | test.swift:229:14:229:20 | element | $@ | test.swift:227:31:227:45 | source(...) | source(...) |
@@ -222,3 +222,11 @@ func t24() {
         sink(y)  // $ hasValueFlow=t24.1
     }
 }
+
+func t25() {
+    let x = [source("t25.1"), source("t25.2")]
+    for element in x {
+        sink(element)  // $ hasValueFlow=t25.1 hasValueFlow=t25.2
+    }
+
+}