[RESOLVED] What does "sink.asExpr() = ma.getArgument(0)" do here?

[CaledoniaProject]

I found this sink predicate online and it works fine:

  override predicate isSink(DataFlow::Node sink) {
    exists(MethodAccess ma |
      ma.getMethod().getName() = "lookup" and
      ma.getMethod().getDeclaringType() instanceof Context and
      sink.asExpr() = ma.getArgument(0)
    )
  }

I understand the first two filter statement, but not the last one

1. What does sink.asExpr() = ma.getArgument(0) do here? Is it trying to match the parameter to the sink function with the parameter to the source function?
2. What is the format of ma.getArgument(0)? Is it "String message" or "message"?

[smowton]

ma is a call to the method Context.lookup, not the method itself. So ma.getArgument(0) is whatever expression is passed at that callsite (e.g. someArg in the context (new Context()).lookup(someArg)).

sink.asExpr() gets the syntactic expression corresponding to the dataflow node sink (not all nodes have a corresponding expression -- they might represent something invisible in source code, like when two assignments to a variable flow together, but a lot of DataFlow::Nodes are in direct correspondence with syntactic Exprs.

Finally the equality constraint ties the whole thing together, so the line means "sink is a node corresponding to an expression which is passed to a call to Context.lookup". In the example above, the data-flow node for someArg is a sink.

Your question about String message vs. message only really makes sense if we're talking about formal parameters rather than arguments, but if we were (e.g. sink.asParameter() = any(Method m | m.getName() = "lookup").getParameter(0)), then the sink would correspond to message and sink.getType() would yield a RefType referring to java.lang.String, which pretty-prints as String.