C#: Don't generate models for any higher order callables.

Author: michaelnebel

csharp/ql/src/utils/model-generator/internal/CaptureModelsSpecific.qll

@@ -17,14 +17,24 @@ module TaintTracking = CS::TaintTracking;
 
 class Type = CS::Type;
 
+/**
+ * Holds if any of the parameters of `api` are `System.Func<>`.
+ */
+private predicate isHigherOrder(CS::Callable api) {
+  exists(Type t | t = api.getAParameter().getType().getUnboundDeclaration() |
+    t instanceof System::SystemFuncDelegateType
+  )
+}
+
 /**
  * Holds if it is relevant to generate models for `api`.
  */
 private predicate isRelevantForModels(CS::Callable api) {
   [api.(CS::Modifiable), api.(CS::Accessor).getDeclaration()].isEffectivelyPublic() and
   api.getDeclaringType().getNamespace().getQualifiedName() != "" and
   not api instanceof CS::ConversionOperator and
-  not api instanceof Util::MainMethod
+  not api instanceof Util::MainMethod and
+  not isHigherOrder(api)
 }
 
 /**

csharp/ql/test/utils/model-generator/NoSummaries.cs

@@ -85,4 +85,17 @@ public Int32 M4(Int32 i)
     {
         return i;
     }
+}
+
+public class HigherOrderParameters
+{
+    public string M1(string s, Func<string, string> map)
+    {
+        return s;
+    }
+
+    public object M2(Func<object, object> map, object o)
+    {
+        return map(o);
+    }
 }