PS: CFG and AST helpers.

Author: MathiasVP

powershell/ql/lib/semmle/code/powershell/ArrayExpression.qll

@@ -5,5 +5,22 @@ class ArrayExpr extends @array_expression, Expr {
 
   StmtBlock getStmtBlock() { array_expression(this, result) }
 
+  /**
+   * Gets the i'th element of this `ArrayExpr`, if this can be determined statically.
+   *
+   * See `getStmtBlock` when the array elements are not known statically.
+   */
+  Expr getElement(int i) {
+    result =
+      unique( | | this.getStmtBlock().getAStmt()).(CmdExpr).getExpr().(ArrayLiteral).getElement(i)
+  }
+
+  /**
+   * Gets an element of this `ArrayExpr`, if this can be determined statically.
+   *
+   * See `getStmtBlock` when the array elements are not known statically.
+   */
+  Expr getAnElement() { result = this.getElement(_) }
+
   override string toString() { result = "@(...)" }
 }

powershell/ql/lib/semmle/code/powershell/controlflow/CfgNodes.qll

@@ -201,6 +201,25 @@ class ProcessBlockCfgNode extends NamedBlockCfgNode {
   PipelineParameter getPipelineParameter() { result = block.getEnclosingFunction().getAParameter() }
 }
 
+private class StmtBlockChildMapping extends NonExprChildMapping, StmtBlock {
+  override predicate relevantChild(Ast n) { n = this.getAStmt() or n = this.getAnElement() }
+}
+
+class StmtBlockCfgNode extends AstCfgNode {
+  StmtBlockChildMapping block;
+
+  StmtBlockCfgNode() { this.getAstNode() = block }
+
+  StmtBlock getBlock() { result = block }
+
+  StmtCfgNode getStmt(int i) { block.hasCfgChild(block.getStmt(i), this, result) }
+
+  StmtCfgNode getAStmt() { block.hasCfgChild(block.getAStmt(), this, result) }
+
+  /** Gets an AST element that may be returned from this `StmtBlockCfgNode`. */
+  AstCfgNode getAnElement() { block.hasCfgChild(block.getAnElement(), this, result) }
+}
+
 /** Provides classes for control-flow nodes that wrap AST expressions. */
 module ExprNodes {
   private class VarAccessChildMapping extends ExprChildMapping, VarAccess {
@@ -418,6 +437,22 @@ module ExprNodes {
   class IndexCfgReadNode extends IndexCfgNode {
     IndexCfgReadNode() { this.getExpr() instanceof IndexExprRead }
   }
+
+  class ArrayExprChildMapping extends ExprChildMapping, ArrayExpr {
+    override predicate relevantChild(Ast n) { n = this.getStmtBlock() or n = this.getAnElement() }
+  }
+
+  class ArrayExprCfgNode extends ExprCfgNode {
+    override string getAPrimaryQlClass() { result = "ArrayExprCfgNode" }
+
+    override ArrayExprChildMapping e;
+
+    ExprCfgNode getElement(int i) { e.hasCfgChild(e.getElement(i), this, result) }
+
+    ExprCfgNode getAnElement() { result = this.getElement(_) }
+
+    StmtBlockCfgNode getStmtBlock() { e.hasCfgChild(e.getStmtBlock(), this, result) }
+  }
 }
 
 module StmtNodes {