C#: Add dataflow support for collection expressions.

Author: michaelnebel

csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll

@@ -250,6 +250,10 @@ module LocalFlow {
         scope = e2 and
         isSuccessor = true
         or
+        e1 = e2.(CollectionExpression).getAnElement().(SpreadElementExpr).getExpr() and
+        scope = e2 and
+        isSuccessor = true
+        or
         exists(WithExpr we |
           scope = we and
           isSuccessor = true
@@ -738,6 +742,15 @@ private predicate fieldOrPropertyRead(Expr e1, Content c, FieldOrPropertyRead e2
   )
 }
 
+/**
+ * Holds if `ce` is a collection expression that adds `src` to the collection `ce`.
+ */
+private predicate collectionStore(Expr src, CollectionExpression ce) {
+  // Collection expression, `[1, src, 3]`
+  src = ce.getAnElement() and
+  not src instanceof SpreadElementExpr
+}
+
 /**
  * Holds if `e` is an expression that adds `src` to array `a`.
  *
@@ -1799,6 +1812,11 @@ private class StoreStepConfiguration extends ControlFlowReachabilityConfiguratio
     or
     exactScope = false and
     isSuccessor = true and
+    collectionStore(e1, e2) and
+    scope = e2
+    or
+    exactScope = false and
+    isSuccessor = true and
     isParamsArg(e2, e1, _) and
     scope = e2
   }
@@ -1823,6 +1841,10 @@ predicate storeStep(Node node1, ContentSet c, Node node2) {
     arrayStore(_, node1.asExpr(), node.getExpr(), postUpdate) and c instanceof ElementContent
   )
   or
+  exists(StoreStepConfiguration x | hasNodePath(x, node1, node2) |
+    collectionStore(node1.asExpr(), node2.asExpr()) and c instanceof ElementContent
+  )
+  or
   exists(StoreStepConfiguration x, Expr arg, ControlFlow::Node callCfn |
     x.hasExprPath(arg, node1.(ExprNode).getControlFlowNode(), _, callCfn) and
     node2 = TParamsArgumentNode(callCfn) and