Further refine potential call targets for interface calls.

The call target must belong to the method set of a type that implements the interface type of the method call receiver, if any.

For example, assume `h` has type `hash.Hash`, then `h.Write(...)` should only be resolved to implementations of `Write` in types implementing `hash.Hash`, not arbitrary other `Writer`s.

Author: Max Schaefer

ql/src/semmle/go/dataflow/internal/DataFlowDispatch.qll

@@ -63,14 +63,36 @@ private FuncDecl getConcreteTarget(DataFlow::CallNode call) {
   )
 }
 
+/**
+ * Holds if `call` is a method call whose receiver has an interface type.
+ */
+private predicate isInterfaceMethodCall(DataFlow::CallNode call) {
+  isInterfaceCallReceiver(call, _, _, _)
+}
+
+/**
+ * Gets a method that might be called by `call`, where we restrict the result to
+ * implement the interface type of the receiver of `call`.
+ */
+private MethodDecl getRestrictedInterfaceTarget(DataFlow::CallNode call) {
+  exists(InterfaceType tp, Type recvtp, string m |
+    isInterfaceCallReceiver(call, _, tp, m) and
+    result = recvtp.getMethod(m).(DeclaredFunction).getFuncDecl() and
+    recvtp.implements(tp)
+  )
+}
+
 /**
  * Gets a function that might be called by `call`.
  */
 DataFlowCallable viableCallable(CallExpr ma) {
   exists(DataFlow::CallNode call | call.asExpr() = ma |
     if isConcreteInterfaceCall(call, _, _)
     then result = getConcreteTarget(call)
-    else result = call.getACallee()
+    else
+      if isInterfaceMethodCall(call)
+      then result = getRestrictedInterfaceTarget(call)
+      else result = call.getACallee()
   )
 }
 

ql/test/library-tests/semmle/go/dataflow/CallGraph/getACallee.expected

@@ -3,3 +3,4 @@ spuriousCallee
 | main.go:44:3:44:7 | call to m | main.go:17:1:17:17 | function declaration |
 | main.go:44:3:44:7 | call to m | main.go:21:1:21:20 | function declaration |
 | main.go:56:2:56:6 | call to m | main.go:21:1:21:20 | function declaration |
+| test.go:42:2:42:13 | call to Write | test.go:36:1:39:1 | function declaration |

ql/test/library-tests/semmle/go/dataflow/CallGraph/test.go

@@ -0,0 +1,49 @@
+package main
+
+import (
+	"fmt"
+	"hash"
+	"io"
+)
+
+type Resetter struct{}
+
+func (_ Resetter) Reset() {} // name: Resetter.Reset
+
+type MockHash struct {
+	Resetter
+}
+
+func (_ MockHash) Write(p []byte) (n int, err error) { // name: MockHash.Write
+	fmt.Println("MockHash.Write")
+	return 0, nil
+}
+
+func (_ MockHash) Sum(b []byte) []byte {
+	return nil
+}
+
+func (_ MockHash) Size() int {
+	return 0
+}
+
+func (_ MockHash) BlockSize() int {
+	return 0
+}
+
+type MockWriter struct{}
+
+func (_ MockWriter) Write(p []byte) (n int, err error) { // name: MockWriter.Write
+	fmt.Println("MockWriter.Write")
+	return 0, nil
+}
+
+func test5(h hash.Hash, w io.Writer) { // name: test5
+	h.Write(nil) // callee: MockHash.Write
+	w.Write(nil) // callee: MockWriter.Write callee: MockHash.Write
+	h.Reset()    // callee: Resetter.Reset
+}
+
+func test6(h MockHash, w MockWriter) {
+	test5(h, w) // callee: test5
+}