QL: prevent some cross-talk between modules

Author: erik-krogh

ql/ql/src/codeql_ql/ast/Ast.qll

@@ -25,6 +25,10 @@ class AstNode extends TAstNode {
   cached
   Location getLocation() { result = this.getFullLocation() } // overridden in some subclasses
 
+  /** Gets the file containing this AST node. */
+  cached
+  File getFile() { result = getFullLocation().getFile() }
+
   /** Gets the location that spans the entire AST node. */
   cached
   final Location getFullLocation() {

ql/ql/src/codeql_ql/ast/internal/Type.qll

@@ -289,10 +289,40 @@ predicate resolveTypeExpr(TypeExpr te, Type t) {
   else
     if primTypeName(te.getClassName())
     then t = TPrimitive(te.getClassName())
-    else
-      exists(FileOrModule m, boolean public, string clName | qualifier(te, m, public, clName) |
-        defines(m, clName, t, public)
+    else resolveTypeExpr2(te, t)
+}
+
+pragma[noopt]
+predicate resolveTypeExpr2(TypeExpr te, Type t) {
+  exists(FileOrModule m, boolean public, string clName |
+    qualifier(te, m, public, clName) and
+    defines(m, clName, t, public) and
+    // there can be some cross-talk between modules due to collapsing parameterized modules. This should remove the worst.
+    // require that the Type is contained in the same pack or a dependency.
+    (
+      exists(YAML::QLPack base, YAML::QLPack sup |
+        te.getFile() = base.getAFileInPack() and
+        exists(AstNode decl, File f |
+          decl = t.getDeclaration() and
+          f = decl.getFile() and
+          f = sup.getAFileInPack()
+        ) and
+        (
+          base.getADependency*() = sup
+          or
+          not exists(YAML::QLPack dep | dep = base.getADependency*() | exists(dep.getDBScheme()))
+          or
+          not exists(YAML::QLPack dep | dep = sup.getADependency*() | exists(dep.getDBScheme()))
+        )
       )
+      or
+      // for tests, and other cases where no qlpack exists.
+      not exists(YAML::QLPack base | te.getFile() = base.getAFileInPack())
+      or
+      // e.g. alias for primitives.
+      not exists(t.getDeclaration())
+    )
+  )
 }
 
 pragma[noinline]