Java: Add BoundedType.getTypeBound(int)

Author: Marcono1234

java/ql/src/semmle/code/java/Generics.qll

@@ -91,11 +91,16 @@ abstract class BoundedType extends RefType, @boundedtype {
   /** Holds if this type is bounded. */
   predicate hasTypeBound() { exists(TypeBound tb | tb = this.getATypeBound()) }
 
+  /** Gets the type bound for this type at the 0-based position, if any. */
+  TypeBound getTypeBound(int position) {
+    result = getATypeBound() and result.getPosition() = position
+  }
+
   /** Gets a type bound for this type, if any. */
   TypeBound getATypeBound() { result.getBoundedType() = this }
 
   /** Gets the first type bound for this type, if any. */
-  TypeBound getFirstTypeBound() { result = getATypeBound() and result.getPosition() = 0 }
+  TypeBound getFirstTypeBound() { result = getTypeBound(0) }
 
   /**
    * Gets an upper type bound of this type, or `Object`

java/ql/test/library-tests/generics/TypeVarsUpperBound.expected

@@ -1,6 +0,0 @@
-| file://:0:0:0:0 | ? | Object |
-| file://:0:0:0:0 | ? extends Float | Float |
-| file://:0:0:0:0 | ? extends Object | Object |
-| file://:0:0:0:0 | ? super Double | Object |
-| generics/A.java:6:16:6:16 | T | Object |
-| generics/A.java:16:9:16:24 | V | Number |

java/ql/test/library-tests/generics/TypeVarsUpperBound.ql

@@ -1,7 +1,33 @@
 import default
+import TestUtilities.InlineExpectationsTest
 
-from BoundedType bt
-where
-  bt.fromSource() or
-  exists(TypeAccess ta | ta.getType().(ParameterizedType).getATypeArgument() = bt)
-select bt, bt.getUpperBoundType().toString()
+private string getOrderedBounds(BoundedType bt) {
+  result =
+    concat(TypeBound bound, int position |
+      bound = bt.getTypeBound(position)
+    |
+      bound.getType().toString(), "," order by position
+    )
+}
+
+class TypeVariableBoundTest extends InlineExpectationsTest {
+  TypeVariableBoundTest() { this = "TypeVariableBoundTest" }
+
+  override string getARelevantTag() { result = ["bounded", "boundedAccess"] }
+
+  override predicate hasActualResult(Location location, string element, string tag, string value) {
+    exists(BoundedType bt | value = getOrderedBounds(bt) |
+      bt.fromSource() and
+      location = bt.getLocation() and
+      element = bt.toString() and
+      tag = "bounded"
+      or
+      exists(TypeAccess ta |
+        ta.getType().(ParameterizedType).getATypeArgument() = bt and
+        location = ta.getLocation() and
+        element = ta.toString() and
+        tag = "boundedAccess"
+      )
+    )
+  }
+}

java/ql/test/library-tests/generics/generics/A.java

@@ -3,8 +3,11 @@
 import java.util.HashMap;
 import java.util.Map;
 
-public class A<T> {
+public class A<T> { // $bounded=
 	class B { }
+
+	public <R> void noBound() { } // $bounded=
+	public <R extends String> void upperBound() { } // $bounded=String
 }
 
 class C { 
@@ -13,10 +16,24 @@ class C {
 	Map<String, Object> m = new HashMap<String, Object>();
 }
 
-class D<V extends Number> {
-	D<?> d1;
-	D<? extends Object> d2;
-	D<? extends Float> d3;
-	D<? super Double> d4;
+class D<V extends Number> { // $bounded=Number
+	// Currently erroneously reports implicit Object as bound, see https://github.com/github/codeql/issues/5405
+	D<?> d1; // $SPURIOUS: boundedAccess=Object MISSING: boundedAccess=
+	D<? extends Object> d2; // $boundedAccess=Object
+	D<? extends Float> d3; // $boundedAccess=Float
+	D<? super Double> d4; // $boundedAccess=Double
 	{ java.util.Arrays.asList(); }
-}
+}
+
+interface I1 { }
+interface I2 { }
+
+class E1<T extends C & I1 & I2> { } // $bounded=C,I1,I2
+class E2<T extends I2 & I1> { } // $bounded=I2,I1
+class E3<T extends Object & I2 & I1> { } // $bounded=Object,I2,I1
+
+class F {
+	public <T extends C & I1 & I2> void test1() { } // $bounded=C,I1,I2
+	public <T extends I2 & I1> void test2() { } // $bounded=I2,I1
+	public <T extends Object & I2 & I1> void test3() { } // $bounded=Object,I2,I1
+}