[michaelnebel]

In this PR we added data flow support for property patterns. An example of a pattern pattern can be seen in the conditional of the if-statement below.

var i = 1;
var r = new C() { Prop = i };
if (r is C { Prop: int p })
{
    Sink(p); // $ has value flow 1
}

DCA looks good.

[Copilot]

Copilot review overview

🟡 Changes recommended

Pattern reads omit fields and can conflate hidden members with identical names.

Review effort: Balanced
Findings: 1

Open (1)

• Support field-backed property patterns · New

What changed in this PR

Adds C# data-flow support for values extracted through property patterns.

Changes:

• Adds property-pattern read steps.
• Adds tests for nested, extended, generic, and tuple patterns.
• Adds a change note.

File	Description
Patterns.cs	Adds property-pattern flow cases.
PatternFlow.expected	Updates generated test expectations.
DataFlowPrivate.qll	Implements pattern-member reads.
2026-10-06-property-pattern-flow.md	Documents the analysis improvement.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[hvitved]

One question.

[hvitved]

Doesn't this mean that we get read steps for any field/property with a matching name? It seems we should be able to only generate reads for the relevant fields/properties based on type information.

[michaelnebel]

Uh yes, that is a good point.
We do extract some type information for the patterns, but NOT for directly nested property patterns (e.g. MyProp.MyNestedProp) as Roslyn doesn't really provide any good type information for it. Perhaps, we should accept that we don't handle that particular case in data flow and then only generate read steps when we have type information that connects to the field/property name.
I have added a commit with the suggested changes.

[hvitved]

One way we could also handle nested record properties is to use TDynamicPropertyContent and TDynamicPropertyContentSet (which really ought to be named TDynamicMemberContent(set)).