unified: Fix enclosing callable of capture declarations

Author: asgerf

unified/ql/lib/codeql/unified/internal/FacadeAst.qll

@@ -33,9 +33,23 @@ module Unified {
       )
     }
 
+    private AstNode overrideEnclosingCallableParent() {
+      exists(FunctionExpr func |
+        // Capture declarations are evaluated as part of the outer context, and
+        // considered to be captured by the function expression.
+        this = func.getACaptureDeclaration() and
+        result = func.getParent()
+      )
+    }
+
     /** Gets the nearest callable containing this AST node. */
     Callable getEnclosingCallable() {
-      exists(AstNode parent | parent = this.getParent() |
+      exists(AstNode parent |
+        parent = this.overrideEnclosingCallableParent()
+        or
+        not exists(this.overrideEnclosingCallableParent()) and
+        parent = this.getParent()
+      |
         result = parent
         or
         not parent instanceof Callable and

unified/ql/test/library-tests/local-name-binding/self_access.swift

@@ -10,14 +10,14 @@ class C {
     }
 
     func t3() { // implicit-self=t3.self
-        foo(123) { [self] in // name=closure.self
+        foo(123) { [self] in // $ captured=closure.self // name=closure.self
             print(self) // $ access=closure.self
             print(instanceField) // $ access=instanceField implicit-qualifier=closure.self
         }
     }
 
     func t4() { // implicit-self=t4.self
-        foo(123) { [weak self] in // name=weak.self
+        foo(123) { [weak self] in // $ captured=weak.self // name=weak.self
             // Here, 'self' is an Option<C> referring to .some(<outer self>) if it
             // has not been GC'ed yet. Swift does not allow unqualified self access here.
 

unified/ql/test/library-tests/local-name-binding/test.ql

@@ -4,7 +4,7 @@ import utils.test.CommentUtil
 import codeql.unified.internal.LocalNameBinding
 
 module VariableAccessTest implements TestSig {
-  string getARelevantTag() { result = ["access", "implicit-qualifier"] }
+  string getARelevantTag() { result = ["access", "implicit-qualifier", "captured"] }
 
   additional predicate declAt(LocalName v, string filepath, int line) {
     v.getLocation().hasLocationInfo(filepath, line, _, _, _)
@@ -51,6 +51,14 @@ module VariableAccessTest implements TestSig {
       access.isInstanceAccess() and // For now, don't annotate receiver access in static methods. It technically exists, it's just not important yet.
       tag = "implicit-qualifier"
     )
+    or
+    exists(LocalVariable v |
+      v.isCaptured() and
+      location = v.getLocation() and
+      element = v.toString() and
+      decl(v, value) and
+      tag = "captured"
+    )
   }
 }
 

unified/ql/test/library-tests/local-name-binding/test.swift

@@ -135,7 +135,7 @@ func t16() throws {
 
 // Closure captures
 func t17() {
-    let x = 1 // name=x1
+    let x = 1 // $ captured=x1 // name=x1
     let closure = { // name=closure1
         print(x) // $ access=x1
     }
@@ -181,7 +181,7 @@ func t21() {
 // Nested functions
 func t22() {
     let x = 1 // name=x1
-    func inner() { // name=inner1
+    func inner() { // $ captured=inner1 // name=inner1
         let x = 2 // name=x2
         print(x) // $ access=x2
     }