…tors

Several improvements to Parse_dart_tree_sitter.ml independent of the
grammar bump:

- map_method_signature: pass the actual body to getter/setter mappings
  (was FBNothing) and label methods as Method instead of Function.
  Methods were silently losing their body in the AST, breaking taint
  analysis and any rule that matches inside a method.

- map_string_literal: skip the synthetic ConcatString wrapper for
  single-element string literals. Wrapping inserted a Call node that
  interfered with patterns matching plain string literals.

- map_template_substitution: emit Middle3 (the expression slot) for
  '${expr}' interpolations instead of Right3, and apply the same
  Pattern/Program env distinction used by map_sub_string_test for
  bare '$id' interpolations. This brings interpolation handling in
  line with the rest of the string parser.

- map_selector: use Dart's universal naming convention as a heuristic
  to disambiguate Call from New for '$X(...)'. Identifiers starting
  with an uppercase letter are types, so 'Foo()' becomes a New
  expression; lowercase stays a Call. Improves rule precision on
  taint sources/sinks that target constructors.

- File_type.ml/.mli: add Dart to pl_type and recognize '.dart' so
  non-parser code paths that switch on pl_type classify Dart files
  correctly.

- Unit_engine.ml: enable Dart tainting tests by registering the
  'tests/tainting_rules/dart' directory.

Tests:
- tests/patterns/dart/function_call.{dart,sgrep},
  function_def.{dart,sgrep}: new pattern tests covering Call/New
  disambiguation and method-body presence.
- tests/tainting_rules/dart/arrays_if.{dart,yaml},
  try_return.{dart,yaml}: tainting fixtures exercising arrays and
  try/return paths.
- 5 existing parsing snapshots refreshed (Method label, New for
  uppercase-starting calls, simplified single-element strings).

Validation: 199/199 .dart files from flutter/flutter@master parse
cleanly; 19 Dart tests pass (was 14).

The 'tree-sitter-dart is currently buggy and can generate some
segfaults' note (added 2023-11) referenced an input that no longer
crashes the bundled grammar. The original repro (': string (* filename
*)') now exits cleanly through both the standalone parse-dart and the
semgrep-core dump_pattern path.

- src/parsing/Parse_target.ml: remove the stale comment above the
  Lang.Dart arm.
- src/osemgrep/networking/Rule_fetching.ml: drop the
  'List_.exclude (... =*= Lang.Dart)' so '-e <pat>' (no '-l') tries
  Dart along with every other language.

Temporary: redirects the submodule URL from returntocorp/semgrep-dart
to AlexLaroche/semgrep-dart so a fresh clone of this branch resolves
the regenerated artifact at 452f0be (which only exists on the fork
until r2c runs './release dart' to publish a real release commit).

Drop this commit before opening the upstream PR — the public PR
should use the original returntocorp/semgrep-dart URL with whatever
SHA r2c produces from the regenerate.

…apes

Tracks the latest tree-sitter-dart parser-improvements commits:

- Adds a `\`Abst_choice_final_buil_opt_type_id_list` arm to
  map_declaration_, handling the three abstract instance field forms
  (`abstract <type> ids;`, `abstract final <type>? ids;`,
  `abstract covariant <type> ids;`) by emitting a VarDef with an
  unhandled `abstract` keyword attribute.
- Adds a `\`Opt_meta_exte_buil_choice_final_buil_opt_type_id_list_semi`
  arm to the top-level definition mapper, handling top-level external
  variable declarations (`external <type> id;`,
  `external final <type>? id;`, `external late <type>? id;`).

Also picks up small CST tag renames (`Show_id_list_`/`Hide_id_list_`,
`Cova_choice_late_buil_choice_final_buil_opt_type_id_list`,
`Late_buil_choice_final_buil_opt_type_id_list`,
`Final_buil_opt_type_id_list`) introduced when the new
`identifier_list` use-site changed the simplification output.

Bumps the semgrep-dart submodule to the corresponding generated CST.

After the latest tree-sitter-dart parser-improvements commit, the
`label` rule accepts `_get`/`_set`/`_function_builtin_identifier` as
identifier aliases, and `initialized_identifier` accepts `_operator`
as an identifier alias. The corresponding CST shape gained
`Func_buil_id` and `Op` tags.

- map_label now matches `\`Id` / `\`Get` / `\`Set` / `\`Func_buil_id`.
- map_initialized_identifier now matches `\`Id` / `\`Get` / `\`Set` /
  `\`Op`.

Bumps the semgrep-dart submodule to the corresponding generated CST.

Adds an `\`Empty_stmt` arm to `map_statement` that emits an empty
`Block` for `;` (Dart's null/empty statement), matching the new
`empty_statement` rule in the grammar.

Bumps the semgrep-dart submodule to the corresponding generated CST.

Adds an `\`Exte_choice_final_buil_opt_type_id_list` arm to
map_declaration_, handling `external final <type>? <ids>` and
`external covariant <var-or-type> <ids>` by emitting a VarDef with
the appropriate keyword attributes.

Bumps the semgrep-dart submodule to the corresponding generated CST.

Tracks the latest tree-sitter-dart parser-improvements commits:

- The for-loop update list now allows a trailing comma; CST gained
  a third tuple component carrying the optional comma. Renames the
  helper `map_anon_arg_rep_COMMA_arg_eb223b2` → `map_for_init_list`
  and adds `map_for_update_list` for the new shape, and updates the
  `Opt_choice_local_var_decl_opt_exp_semi_opt_exp_rep_COMMA_exp_opt_COMMA`
  variant tag.
- The field initializer's right-hand side is now a full
  `_expression` (not `_real_expression` + cascades). Updates the
  `\`Field_init` arm to take 4 components and call `map_expression`.

Bumps the semgrep-dart submodule to the corresponding generated CST.

The `pair` rule now accepts an optional `?` before the key as well as
before the value (Dart 3 null-aware elements), so the CST tuple has
five components instead of four. Updates the `\`Pair` arm of the
element mapper accordingly.

Bumps the semgrep-dart submodule to the corresponding generated CST.

… fields

Bumps semgrep-dart submodule to pick up two upstream tree-sitter-dart
grammar fixes:

- Cascade subsections now accept the postfix `!` null-assertion
  interleaved with argument parts, so code like
  `obj.._parent!.onChildrenChanged(this)` (common in flame, flutter
  widget code) parses cleanly.
- Static external fields can be named with built-in identifiers
  (`get`, `set`, `operator`), used by `dart:ffi` Struct field
  conventions like `external SomeType get;`.

Updates the OCaml mapper for the two new CST shapes:
- New `anon_choice_arg_part_7fd04ec` choice between argument parts and
  the `!` token in cascade contexts (factored into a helper).
- Existing `Exte_and_static_type_id` arm renamed to
  `Exte_and_static_type_choice_id` with a 4-arm choice for the field
  name.

…amed record

Bumps semgrep-dart submodule for three upstream tree-sitter-dart
grammar fixes:

- `library;` (unnamed library directive, Dart 2.19+) — common in files
  that exist solely to carry a doc comment for the library.
- Full symbol literal forms — `#a.b.c` (dotted) and operator symbols
  (`#+`, `#==`, `#[]`, `#[]=`, `#~`, etc.) per the Dart spec.
- Single-named-field record literal with trailing comma
  (`(name: value,)`), required by Dart 3 to disambiguate from a
  labeled parenthesized expression.

Updates the OCaml mapper for the new CST shapes:
- `map_library_name` makes the dotted_identifier_list optional.
- Symbol-literal arms now dispatch on the choice (dotted ids /
  equality / relational / shift / additive / multiplicative / single
  operator tokens) in both expression and pattern positions.
- New `Label_exp_COMMA` arm in record_literal_no_const for the
  single-named-field-with-trailing-comma form.

…word

Dart pattern parser tried the source-file parse first and only fell
back to the expression/statement parse when the file parse produced
errors. That breaks patterns starting with `if`, `for`, `while`,
`do`, `switch`, `try`, `return`, `throw`, `break`, `continue`,
`assert`, or `yield`: Dart's grammar doesn't allow statements at
top level, but `if (cond) { ... }` happens to parse silently as a
function definition (with `if` as the return type, `(cond)` as the
parameter list, `{ ... }` as the body) — no errors are raised, so
the fallback never fires.

Concretely, a pattern like

  pattern-not-inside: |
    if (kDebugMode) {
      ...
    }

was producing a function-definition AST and never matching the
target's actual `If(...)` node.

Detect statement-keyword starts up-front and route them through the
`__SEMGREP_EXPRESSION` fallback path directly, bypassing the
misleading file parse. `for`/`while`/`try`/etc. happened to land on
the fallback path before because their file-parse produced errors,
but `if` slipped through; this makes the behavior uniform across all
statement starters.

map_initialized_variable_definition_unwrapped dropped the variable
when there was no `= expr` initializer and no comma-separated
follow-on declarations: the `None` arm returned `[]` and the entity
list ended up empty.

Concretely, inside a function body
  void m() { String z; late String w; }
neither `z` nor `w` made it into the AST, so patterns like
`String $X;` or `late String $X;` could not match local
declarations. Top-level uninitialized declarations were unaffected
because they go through a different mapper path that uses
map_initialized_identifier_list (always non-empty).

Restructure the optional-init branch to produce a single
(id, init_opt) pair that's prepended to the list of follow-on
declarations, so the declared identifier is always emitted.

Pattern `await foo();` parsed at the file level as just `Call(foo, [])`
— the leading `await` was silently stripped — so the pattern matched
bare `foo()` calls (false positive) and never matched the `await foo()`
it was meant to find. Same root cause as the earlier `if (kDebugMode)`
case: the file parser silently produces the wrong shape, so the
errors-based fallback never fires.

Add `await` (and `rethrow` for symmetry) to the statement-keyword list
so these patterns route through the expression/statement parse path
directly. After this change, `await foo();` parses as
ExprStmt(Await(Call(...))) and matches only actual awaited calls.

Dart's `"hello $name"` interpolation collides with Semgrep's `$NAME`
metavariable convention, so the pattern parser previously kept all
interpolated `$id` fragments as raw text in pattern mode — meaning
`print("hello $X")` could not match `print("hello $name")`.

Special-case the uppercase/underscore form: when the interpolated
identifier matches `is_metavar_name`, emit it as a metavariable
expression (same shape as Program mode produces). Real Dart
interpolations like `$name` (lowercase) keep the raw-text behavior so
patterns like `"value=$count"` against `"value=$count"` still match
literally.

Verified: pattern `print("hello $X")` now matches `print("hello $name")`
and binds `$X` to `name`. Edge case of a Dart identifier whose name
happens to be all-uppercase (legal but very unusual) collides — same
trade-off every Semgrep language already accepts.

`map_function_signature` reinterpreted any pattern-mode signature with
empty parameters as a Call, justified by a forward-declaration
ambiguity (`foo();` looks both like a call and a forward decl). The
heuristic was too coarse: `void test() { ... }` was also rewritten as
`Call(test, [])`, losing the return type, body, and the function
context — so `pattern-inside: void test() { ... }` couldn't match any
function definition.

Tighten the condition: only reinterpret as Call when the construct is
truly ambiguous — no return type, no parameters, an empty body
(`FBDecl`/`FBNothing`/empty `FBStmt`), and no attributes. Anything
that looks like a real function definition (return type, parameters,
non-empty body, or attributes) is now mapped to a `DefStmt(FuncDef)`
as expected.

Verified: `void test() { ... }` matches function definitions in target
classes; the original `foo();` forward-decl pattern still matches Call
expressions (no regression).

…avar, function-def patterns

Adds four targeted regression tests for the recent Dart pattern-mode
fixes:

- `tests/rules/typed_metavar_dart.{yaml,dart}` — `print($X as String)`
  matches String-typed args and binds, but skips `int`/`dynamic`. Also
  covers locally-declared variables (`String name = ...`).
- `tests/rules/metavar_type_dart.{yaml,dart}` — `metavariable-type:
  String` filter restricts a `print($X)` pattern to String-typed
  expressions only.
- `tests/rules/string_interp_metavar_dart.{yaml,dart}` — pattern
  `print("hello $X")` binds the interpolation expression and matches
  multiple targets, while leaving non-matching prefix/literal strings
  untouched.
- `tests/patterns/dart/function_def_void.{dart,sgrep}` — pattern
  `void test() { ... }` matches both top-level and method-level
  function definitions named `test`, ignoring same-shape definitions
  with different names.

All four pass; broader Dart suite goes from 41/42 → 45/46 with the
same single pre-existing `biometric-weak-config` failure unchanged.

Adds tests for the parser-side fixes earlier in this branch and a
smoke parsing test covering the new Dart 3 grammar features pulled in
by the submodule bump:

- `tests/patterns/dart/uninit_local_var.{dart,sgrep}` — pattern
  `String $X;` matches uninitialized local declarations. Locks in the
  fix where `map_initialized_variable_definition_unwrapped` was
  returning [] when the optional `= expr` was absent, silently
  dropping `String z;` from the AST.
- `tests/rules/if_pattern_dart.{yaml,dart}` — pattern
  `if (kDebugMode) { ... }` matches real If statements. Locks in the
  statement-keyword pattern-routing fix that prevents `if`-prefixed
  patterns from silently misparsing as function definitions at the
  file level.
- `tests/rules/await_pattern_dart.{yaml,dart}` — pattern
  `await fetch($URL)` matches only awaited calls, not bare ones.
  Locks in the same routing fix for `await`/`rethrow`, where the
  `await` keyword was previously stripped at the file-parse level
  (the `Call(fetch, [...])` shape) and produced false positives.
- `tests/parsing/dart/dart3_grammar_features.dart` — exercises the
  grammar features brought in by the tree-sitter-dart bump: empty
  record `()`, single-named-field record `(name: v,)`, dot-shorthand
  `.foo`/`.new`, null-aware map element `?key: value`, null-assertion
  `!` inside a cascade chain, unnamed library directive `library;`,
  dotted/operator symbol literals (`#a.b.c`, `#==`), and `get`/`set`
  as identifiers.

All four pass; broader Dart suite goes from 45/46 → 49/50 with the
same single pre-existing `biometric-weak-config` failure unchanged.