diff --git a/MODULE.bazel b/MODULE.bazel
index 474e6df0aba8..3b2532b08afd 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -230,6 +230,7 @@ use_repo(
"kotlin-compiler-2.1.0-Beta1",
"kotlin-compiler-2.1.20-Beta1",
"kotlin-compiler-2.2.0-Beta1",
+ "kotlin-compiler-2.2.20-Beta2",
"kotlin-compiler-embeddable-1.6.0",
"kotlin-compiler-embeddable-1.6.20",
"kotlin-compiler-embeddable-1.7.0",
@@ -242,6 +243,7 @@ use_repo(
"kotlin-compiler-embeddable-2.1.0-Beta1",
"kotlin-compiler-embeddable-2.1.20-Beta1",
"kotlin-compiler-embeddable-2.2.0-Beta1",
+ "kotlin-compiler-embeddable-2.2.20-Beta2",
"kotlin-stdlib-1.6.0",
"kotlin-stdlib-1.6.20",
"kotlin-stdlib-1.7.0",
@@ -254,6 +256,7 @@ use_repo(
"kotlin-stdlib-2.1.0-Beta1",
"kotlin-stdlib-2.1.20-Beta1",
"kotlin-stdlib-2.2.0-Beta1",
+ "kotlin-stdlib-2.2.20-Beta2",
)
go_sdk = use_extension("@rules_go//go:extensions.bzl", "go_sdk")
diff --git a/actions/ql/lib/CHANGELOG.md b/actions/ql/lib/CHANGELOG.md
index 241e94c0065e..dffad0539b0e 100644
--- a/actions/ql/lib/CHANGELOG.md
+++ b/actions/ql/lib/CHANGELOG.md
@@ -1,7 +1,13 @@
-## 0.4.13
+## 0.4.14
No user-facing changes.
+## 0.4.13
+
+### Bug Fixes
+
+* The `actions/artifact-poisoning/critical` and `actions/artifact-poisoning/medium` queries now exclude artifacts downloaded to `$[{ runner.temp }}` in addition to `/tmp`.
+
## 0.4.12
### Minor Analysis Improvements
diff --git a/actions/ql/lib/change-notes/2025-07-11-artifact-poisoning.md b/actions/ql/lib/change-notes/2025-07-11-artifact-poisoning.md
deleted file mode 100644
index 893a695a22c6..000000000000
--- a/actions/ql/lib/change-notes/2025-07-11-artifact-poisoning.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: fix
----
-* The `actions/artifact-poisoning/critical` and `actions/artifact-poisoning/medium` queries now exclude artifacts downloaded to `$[{ runner.temp }}` in addition to `/tmp`.
diff --git a/actions/ql/lib/change-notes/released/0.4.13.md b/actions/ql/lib/change-notes/released/0.4.13.md
index b061eef7d3b4..1c7fa59a3568 100644
--- a/actions/ql/lib/change-notes/released/0.4.13.md
+++ b/actions/ql/lib/change-notes/released/0.4.13.md
@@ -1,3 +1,5 @@
## 0.4.13
-No user-facing changes.
+### Bug Fixes
+
+* The `actions/artifact-poisoning/critical` and `actions/artifact-poisoning/medium` queries now exclude artifacts downloaded to `$[{ runner.temp }}` in addition to `/tmp`.
diff --git a/csharp/ql/lib/change-notes/released/5.1.10.md b/actions/ql/lib/change-notes/released/0.4.14.md
similarity index 71%
rename from csharp/ql/lib/change-notes/released/5.1.10.md
rename to actions/ql/lib/change-notes/released/0.4.14.md
index f22ccf3e6e9d..09e581963738 100644
--- a/csharp/ql/lib/change-notes/released/5.1.10.md
+++ b/actions/ql/lib/change-notes/released/0.4.14.md
@@ -1,3 +1,3 @@
-## 5.1.10
+## 0.4.14
No user-facing changes.
diff --git a/actions/ql/lib/codeql-pack.release.yml b/actions/ql/lib/codeql-pack.release.yml
index 88ad5ab8f224..3841668fe04e 100644
--- a/actions/ql/lib/codeql-pack.release.yml
+++ b/actions/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.4.13
+lastReleaseVersion: 0.4.14
diff --git a/actions/ql/lib/qlpack.yml b/actions/ql/lib/qlpack.yml
index 81cda8662de5..dd2723b03157 100644
--- a/actions/ql/lib/qlpack.yml
+++ b/actions/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/actions-all
-version: 0.4.14-dev
+version: 0.4.15-dev
library: true
warnOnImplicitThis: true
dependencies:
diff --git a/actions/ql/src/CHANGELOG.md b/actions/ql/src/CHANGELOG.md
index d0db2aff304d..09fb20778fcf 100644
--- a/actions/ql/src/CHANGELOG.md
+++ b/actions/ql/src/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.6.6
+
+No user-facing changes.
+
## 0.6.5
No user-facing changes.
diff --git a/java/ql/lib/change-notes/released/7.3.3.md b/actions/ql/src/change-notes/released/0.6.6.md
similarity index 73%
rename from java/ql/lib/change-notes/released/7.3.3.md
rename to actions/ql/src/change-notes/released/0.6.6.md
index 3546e57ff574..ab10d897be1d 100644
--- a/java/ql/lib/change-notes/released/7.3.3.md
+++ b/actions/ql/src/change-notes/released/0.6.6.md
@@ -1,3 +1,3 @@
-## 7.3.3
+## 0.6.6
No user-facing changes.
diff --git a/actions/ql/src/codeql-pack.release.yml b/actions/ql/src/codeql-pack.release.yml
index 86780fb61480..f4cae0a77ada 100644
--- a/actions/ql/src/codeql-pack.release.yml
+++ b/actions/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.6.5
+lastReleaseVersion: 0.6.6
diff --git a/actions/ql/src/qlpack.yml b/actions/ql/src/qlpack.yml
index f422500da370..911d1e191682 100644
--- a/actions/ql/src/qlpack.yml
+++ b/actions/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/actions-queries
-version: 0.6.6-dev
+version: 0.6.7-dev
library: false
warnOnImplicitThis: true
groups: [actions, queries]
diff --git a/config/identical-files.json b/config/identical-files.json
index 56aac5604734..89beb48acd40 100644
--- a/config/identical-files.json
+++ b/config/identical-files.json
@@ -231,35 +231,10 @@
"java/ql/src/experimental/Security/CWE/CWE-400/LocalThreadResourceAbuse.qhelp",
"java/ql/src/experimental/Security/CWE/CWE-400/ThreadResourceAbuse.qhelp"
],
- "CryptoAlgorithms Python/JS/Ruby": [
- "javascript/ql/lib/semmle/javascript/security/CryptoAlgorithms.qll",
- "python/ql/lib/semmle/python/concepts/CryptoAlgorithms.qll",
- "ruby/ql/lib/codeql/ruby/security/CryptoAlgorithms.qll",
- "rust/ql/lib/codeql/rust/security/CryptoAlgorithms.qll"
- ],
- "CryptoAlgorithmNames Python/JS/Ruby": [
- "javascript/ql/lib/semmle/javascript/security/internal/CryptoAlgorithmNames.qll",
- "python/ql/lib/semmle/python/concepts/internal/CryptoAlgorithmNames.qll",
- "ruby/ql/lib/codeql/ruby/security/internal/CryptoAlgorithmNames.qll",
- "rust/ql/lib/codeql/rust/security/internal/CryptoAlgorithmNames.qll"
- ],
- "SensitiveDataHeuristics Python/JS": [
- "javascript/ql/lib/semmle/javascript/security/internal/SensitiveDataHeuristics.qll",
- "python/ql/lib/semmle/python/security/internal/SensitiveDataHeuristics.qll",
- "ruby/ql/lib/codeql/ruby/security/internal/SensitiveDataHeuristics.qll",
- "swift/ql/lib/codeql/swift/security/internal/SensitiveDataHeuristics.qll",
- "rust/ql/lib/codeql/rust/security/internal/SensitiveDataHeuristics.qll"
- ],
"IncompleteUrlSubstringSanitization": [
"javascript/ql/src/Security/CWE-020/IncompleteUrlSubstringSanitization.qll",
"ruby/ql/src/queries/security/cwe-020/IncompleteUrlSubstringSanitization.qll"
],
- "Concepts Python/Ruby/JS": [
- "python/ql/lib/semmle/python/internal/ConceptsShared.qll",
- "ruby/ql/lib/codeql/ruby/internal/ConceptsShared.qll",
- "javascript/ql/lib/semmle/javascript/internal/ConceptsShared.qll",
- "rust/ql/lib/codeql/rust/internal/ConceptsShared.qll"
- ],
"ApiGraphModels": [
"javascript/ql/lib/semmle/javascript/frameworks/data/internal/ApiGraphModels.qll",
"ruby/ql/lib/codeql/ruby/frameworks/data/internal/ApiGraphModels.qll",
diff --git a/cpp/ql/lib/CHANGELOG.md b/cpp/ql/lib/CHANGELOG.md
index 6b056a683e43..def048bdd3c3 100644
--- a/cpp/ql/lib/CHANGELOG.md
+++ b/cpp/ql/lib/CHANGELOG.md
@@ -1,11 +1,26 @@
+## 5.4.0
+
+### New Features
+
+* Exposed various SSA-related classes (`Definition`, `PhiNode`, `ExplicitDefinition`, `DirectExplicitDefinition`, and `IndirectExplicitDefinition`) which were previously only usable inside the internal dataflow directory.
+
+### Minor Analysis Improvements
+
+* The `cpp/overrun-write` query now recognizes more bound checks and thus produces fewer false positives.
+
## 5.3.0
### Deprecated APIs
* The `UnknownDefaultLocation`, `UnknownExprLocation`, and `UnknownStmtLocation` classes have been deprecated. Use `UnknownLocation` instead.
+### New Features
+
+* Added a `isFinalValueOfParameter` predicate to `DataFlow::Node` which holds when a dataflow node represents the final value of an output parameter of a function.
+
### Minor Analysis Improvements
+* The `FunctionWithWrappers` library (`semmle.code.cpp.security.FunctionWithWrappers`) no longer considers calls through function pointers as wrapper functions.
* The analysis of C/C++ code targeting 64-bit Arm platforms has been improved. This includes support for the Arm-specific builtin functions, support for the `arm_neon.h` header and Neon vector types, and support for the `fp8` scalar type. The `arm_sve.h` header and scalable vectors are only partially supported at this point.
* Added support for `__fp16 _Complex` and `__bf16 _Complex` types
* Added `sql-injection` sink models for the Oracle Call Interface (OCI) database library functions `OCIStmtPrepare` and `OCIStmtPrepare2`.
diff --git a/cpp/ql/lib/change-notes/2025-07-10-final.md b/cpp/ql/lib/change-notes/2025-07-10-final.md
deleted file mode 100644
index 8e6b3dba2662..000000000000
--- a/cpp/ql/lib/change-notes/2025-07-10-final.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: feature
----
-* Added a `isFinalValueOfParameter` predicate to DataFlow::Node which holds when a dataflow node represents the final value of an output parameter of a function.
diff --git a/cpp/ql/lib/change-notes/released/5.3.0.md b/cpp/ql/lib/change-notes/released/5.3.0.md
index 439486f3fca1..a7ea151fcf33 100644
--- a/cpp/ql/lib/change-notes/released/5.3.0.md
+++ b/cpp/ql/lib/change-notes/released/5.3.0.md
@@ -4,8 +4,13 @@
* The `UnknownDefaultLocation`, `UnknownExprLocation`, and `UnknownStmtLocation` classes have been deprecated. Use `UnknownLocation` instead.
+### New Features
+
+* Added a `isFinalValueOfParameter` predicate to `DataFlow::Node` which holds when a dataflow node represents the final value of an output parameter of a function.
+
### Minor Analysis Improvements
+* The `FunctionWithWrappers` library (`semmle.code.cpp.security.FunctionWithWrappers`) no longer considers calls through function pointers as wrapper functions.
* The analysis of C/C++ code targeting 64-bit Arm platforms has been improved. This includes support for the Arm-specific builtin functions, support for the `arm_neon.h` header and Neon vector types, and support for the `fp8` scalar type. The `arm_sve.h` header and scalable vectors are only partially supported at this point.
* Added support for `__fp16 _Complex` and `__bf16 _Complex` types
* Added `sql-injection` sink models for the Oracle Call Interface (OCI) database library functions `OCIStmtPrepare` and `OCIStmtPrepare2`.
diff --git a/cpp/ql/lib/change-notes/released/5.4.0.md b/cpp/ql/lib/change-notes/released/5.4.0.md
new file mode 100644
index 000000000000..8c8cea5440c6
--- /dev/null
+++ b/cpp/ql/lib/change-notes/released/5.4.0.md
@@ -0,0 +1,9 @@
+## 5.4.0
+
+### New Features
+
+* Exposed various SSA-related classes (`Definition`, `PhiNode`, `ExplicitDefinition`, `DirectExplicitDefinition`, and `IndirectExplicitDefinition`) which were previously only usable inside the internal dataflow directory.
+
+### Minor Analysis Improvements
+
+* The `cpp/overrun-write` query now recognizes more bound checks and thus produces fewer false positives.
diff --git a/cpp/ql/lib/codeql-pack.release.yml b/cpp/ql/lib/codeql-pack.release.yml
index b0a1c83e5bc9..afb2156eaa2b 100644
--- a/cpp/ql/lib/codeql-pack.release.yml
+++ b/cpp/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 5.3.0
+lastReleaseVersion: 5.4.0
diff --git a/cpp/ql/lib/ext/Windows.model.yml b/cpp/ql/lib/ext/Windows.model.yml
index 9df7c16850f8..ccebfc9f3401 100644
--- a/cpp/ql/lib/ext/Windows.model.yml
+++ b/cpp/ql/lib/ext/Windows.model.yml
@@ -36,4 +36,14 @@ extensions:
# processthreadsapi.h
- ["", "", False, "CreateThread", "", "", "Argument[@3]", "Argument[2].Parameter[@0]", "value", "manual"]
- ["", "", False, "CreateRemoteThread", "", "", "Argument[@4]", "Argument[3].Parameter[@0]", "value", "manual"]
- - ["", "", False, "CreateRemoteThreadEx", "", "", "Argument[@4]", "Argument[3].Parameter[@0]", "value", "manual"]
\ No newline at end of file
+ - ["", "", False, "CreateRemoteThreadEx", "", "", "Argument[@4]", "Argument[3].Parameter[@0]", "value", "manual"]
+ # wdm.h
+ - ["", "", False, "RtlCopyVolatileMemory", "", "", "Argument[*@1]", "Argument[*@0]", "value", "manual"]
+ - ["", "", False, "RtlCopyDeviceMemory", "", "", "Argument[*@1]", "Argument[*@0]", "value", "manual"]
+ - ["", "", False, "RtlCopyMemory", "", "", "Argument[*@1]", "Argument[*@0]", "value", "manual"]
+ - ["", "", False, "RtlCopyMemoryNonTemporal", "", "", "Argument[*@1]", "Argument[*@0]", "value", "manual"]
+ - ["", "", False, "RtlCopyUnicodeString", "", "", "Argument[*1].Field[*Buffer]", "Argument[*0].Field[*Buffer]", "value", "manual"]
+ - ["", "", False, "RtlMoveMemory", "", "", "Argument[*@1]", "Argument[*@0]", "value", "manual"]
+ - ["", "", False, "RtlMoveVolatileMemory", "", "", "Argument[*@1]", "Argument[*@0]", "value", "manual"]
+ # winternl.h
+ - ["", "", False, "RtlInitUnicodeString", "", "", "Argument[*1]", "Argument[*0].Field[*Buffer]", "value", "manual"]
\ No newline at end of file
diff --git a/cpp/ql/lib/qlpack.yml b/cpp/ql/lib/qlpack.yml
index c34c35f239aa..7c1fb8aad1cc 100644
--- a/cpp/ql/lib/qlpack.yml
+++ b/cpp/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/cpp-all
-version: 5.3.1-dev
+version: 5.4.1-dev
groups: cpp
dbscheme: semmlecode.cpp.dbscheme
extractor: cpp
diff --git a/cpp/ql/lib/semmle/code/cpp/controlflow/SSA.qll b/cpp/ql/lib/semmle/code/cpp/controlflow/SSA.qll
index 1e0b39be1ac7..9c6069d4a0c5 100644
--- a/cpp/ql/lib/semmle/code/cpp/controlflow/SSA.qll
+++ b/cpp/ql/lib/semmle/code/cpp/controlflow/SSA.qll
@@ -15,6 +15,13 @@ class StandardSsa extends SsaHelper {
}
/**
+ * NOTE: If possible, prefer the SSA classes exposed by the new dataflow
+ * library:
+ * ```
+ * import semmle.code.cpp.dataflow.new.DataFlow
+ * // use `DataFlow::Ssa::Definition`
+ * ```
+ *
* A definition of one or more SSA variables, including phi node definitions.
* An _SSA variable_, as defined in the literature, is effectively the pair of
* an `SsaDefinition d` and a `StackVariable v`, written `(d, v)` in this
diff --git a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowDispatch.qll b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowDispatch.qll
index 1a4c777af35b..b5e899bf0aac 100644
--- a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowDispatch.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowDispatch.qll
@@ -1,6 +1,5 @@
private import cpp
private import semmle.code.cpp.ir.IR
-private import semmle.code.cpp.ir.dataflow.DataFlow
private import DataFlowPrivate
private import DataFlowUtil
private import DataFlowImplCommon as DataFlowImplCommon
@@ -60,7 +59,7 @@ private module VirtualDispatch {
* `resolve` predicate to stitch that information together and resolve the
* call.
*/
- abstract DataFlow::Node getDispatchValue();
+ abstract Node getDispatchValue();
/** Gets a candidate target for this call. */
abstract Function resolve();
@@ -72,17 +71,13 @@ private module VirtualDispatch {
* parameter is true when the search is allowed to continue backwards into
* a parameter; non-recursive callers should pass `_` for `allowFromArg`.
*/
- predicate flowsFrom(DataFlow::Node src, boolean allowFromArg) {
+ predicate flowsFrom(Node src, boolean allowFromArg) {
src = this.getDispatchValue() and allowFromArg = true
or
- exists(DataFlow::Node other, boolean allowOtherFromArg |
- this.flowsFrom(other, allowOtherFromArg)
- |
+ exists(Node other, boolean allowOtherFromArg | this.flowsFrom(other, allowOtherFromArg) |
// Call argument
exists(DataFlowCall call, Position i |
- other
- .(DataFlow::ParameterNode)
- .isParameterOf(pragma[only_bind_into](call).getStaticCallTarget(), i) and
+ other.(ParameterNode).isParameterOf(pragma[only_bind_into](call).getStaticCallTarget(), i) and
src.(ArgumentNode).argumentOf(call, pragma[only_bind_into](pragma[only_bind_out](i)))
) and
allowOtherFromArg = true and
@@ -96,7 +91,7 @@ private module VirtualDispatch {
allowFromArg = false
or
// Local flow
- DataFlow::localFlowStep(src, other) and
+ localFlowStep(src, other) and
allowFromArg = allowOtherFromArg
or
// Flow from global variable to load.
@@ -159,11 +154,11 @@ private module VirtualDispatch {
private class DataSensitiveExprCall extends DataSensitiveCall {
DataSensitiveExprCall() { not exists(this.getStaticCallTarget()) }
- override DataFlow::Node getDispatchValue() { result.asOperand() = this.getCallTargetOperand() }
+ override Node getDispatchValue() { result.asOperand() = this.getCallTargetOperand() }
override Function resolve() {
exists(FunctionInstruction fi |
- this.flowsFrom(DataFlow::instructionNode(fi), _) and
+ this.flowsFrom(instructionNode(fi), _) and
result = fi.getFunctionSymbol()
) and
(
@@ -186,7 +181,7 @@ private module VirtualDispatch {
)
}
- override DataFlow::Node getDispatchValue() { result.asInstruction() = this.getArgument(-1) }
+ override Node getDispatchValue() { result.asInstruction() = this.getArgument(-1) }
override MemberFunction resolve() {
exists(Class overridingClass |
@@ -213,7 +208,7 @@ private module VirtualDispatch {
pragma[noinline]
private predicate hasFlowFromCastFrom(Class derivedClass) {
exists(ConvertToBaseInstruction toBase |
- this.flowsFrom(DataFlow::instructionNode(toBase), _) and
+ this.flowsFrom(instructionNode(toBase), _) and
derivedClass = toBase.getDerivedClass()
)
}
@@ -270,7 +265,7 @@ private predicate mayBenefitFromCallContext(
exists(InitializeParameterInstruction init |
not exists(call.getStaticCallTarget()) and
init.getEnclosingFunction() = f.getUnderlyingCallable() and
- call.flowsFrom(DataFlow::instructionNode(init), _) and
+ call.flowsFrom(instructionNode(init), _) and
init.getParameter().getIndex() = arg
)
}
diff --git a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll
index d7f26dd00513..f308ee190e7a 100644
--- a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll
@@ -4,7 +4,7 @@ private import semmle.code.cpp.ir.IR
private import DataFlowDispatch
private import semmle.code.cpp.ir.internal.IRCppLanguage
private import semmle.code.cpp.dataflow.internal.FlowSummaryImpl as FlowSummaryImpl
-private import SsaInternals as Ssa
+private import SsaImpl as Ssa
private import DataFlowImplCommon as DataFlowImplCommon
private import codeql.util.Unit
private import Node0ToString
@@ -1982,19 +1982,23 @@ module IteratorFlow {
predicate allowFlowIntoUncertainDef(IteratorSsa::UncertainWriteDefinition def) { any() }
+ class GuardValue = Void;
+
class Guard extends Void {
- predicate hasBranchEdge(SsaInput::BasicBlock bb1, SsaInput::BasicBlock bb2, boolean branch) {
+ predicate hasValueBranchEdge(
+ SsaInput::BasicBlock bb1, SsaInput::BasicBlock bb2, GuardValue val
+ ) {
none()
}
- predicate controlsBranchEdge(
- SsaInput::BasicBlock bb1, SsaInput::BasicBlock bb2, boolean branch
+ predicate valueControlsBranchEdge(
+ SsaInput::BasicBlock bb1, SsaInput::BasicBlock bb2, GuardValue val
) {
none()
}
}
- predicate guardDirectlyControlsBlock(Guard guard, SsaInput::BasicBlock bb, boolean branch) {
+ predicate guardDirectlyControlsBlock(Guard guard, SsaInput::BasicBlock bb, GuardValue val) {
none()
}
diff --git a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
index 38a4d827a4da..bc3dda5fd345 100644
--- a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
@@ -13,7 +13,7 @@ private import semmle.code.cpp.models.interfaces.DataFlow
private import semmle.code.cpp.dataflow.internal.FlowSummaryImpl as FlowSummaryImpl
private import DataFlowPrivate
private import ModelUtil
-private import SsaInternals as Ssa
+private import SsaImpl as SsaImpl
private import DataFlowImplCommon as DataFlowImplCommon
private import codeql.util.Unit
private import Node0ToString
@@ -39,38 +39,39 @@ private newtype TIRDataFlowNode =
TNode0(Node0Impl node) { DataFlowImplCommon::forceCachingInSameStage() } or
TGlobalLikeVariableNode(GlobalLikeVariable var, int indirectionIndex) {
indirectionIndex =
- [getMinIndirectionsForType(var.getUnspecifiedType()) .. Ssa::getMaxIndirectionsForType(var.getUnspecifiedType())]
+ [getMinIndirectionsForType(var.getUnspecifiedType()) .. SsaImpl::getMaxIndirectionsForType(var.getUnspecifiedType())]
} or
TPostUpdateNodeImpl(Operand operand, int indirectionIndex) {
operand = any(FieldAddress fa).getObjectAddressOperand() and
- indirectionIndex = [0 .. Ssa::countIndirectionsForCppType(Ssa::getLanguageType(operand))]
+ indirectionIndex =
+ [0 .. SsaImpl::countIndirectionsForCppType(SsaImpl::getLanguageType(operand))]
or
- Ssa::isModifiableByCall(operand, indirectionIndex)
+ SsaImpl::isModifiableByCall(operand, indirectionIndex)
} or
- TSsaSynthNode(Ssa::SynthNode n) or
+ TSsaSynthNode(SsaImpl::SynthNode n) or
TSsaIteratorNode(IteratorFlow::IteratorFlowNode n) or
TRawIndirectOperand0(Node0Impl node, int indirectionIndex) {
- Ssa::hasRawIndirectOperand(node.asOperand(), indirectionIndex)
+ SsaImpl::hasRawIndirectOperand(node.asOperand(), indirectionIndex)
} or
TRawIndirectInstruction0(Node0Impl node, int indirectionIndex) {
not exists(node.asOperand()) and
- Ssa::hasRawIndirectInstruction(node.asInstruction(), indirectionIndex)
+ SsaImpl::hasRawIndirectInstruction(node.asInstruction(), indirectionIndex)
} or
TFinalParameterNode(Parameter p, int indirectionIndex) {
- exists(Ssa::FinalParameterUse use |
+ exists(SsaImpl::FinalParameterUse use |
use.getParameter() = p and
use.getIndirectionIndex() = indirectionIndex
)
} or
- TFinalGlobalValue(Ssa::GlobalUse globalUse) or
- TInitialGlobalValue(Ssa::GlobalDef globalUse) or
+ TFinalGlobalValue(SsaImpl::GlobalUse globalUse) or
+ TInitialGlobalValue(SsaImpl::GlobalDef globalUse) or
TBodyLessParameterNodeImpl(Parameter p, int indirectionIndex) {
// Rule out parameters of catch blocks.
not exists(p.getCatchBlock()) and
// We subtract one because `getMaxIndirectionsForType` returns the maximum
// indirection for a glvalue of a given type, and this doesn't apply to
// parameters.
- indirectionIndex = [0 .. Ssa::getMaxIndirectionsForType(p.getUnspecifiedType()) - 1] and
+ indirectionIndex = [0 .. SsaImpl::getMaxIndirectionsForType(p.getUnspecifiedType()) - 1] and
not any(InitializeParameterInstruction init).getParameter() = p
} or
TFlowSummaryNode(FlowSummaryImpl::Private::SummaryNode sn)
@@ -81,7 +82,7 @@ private newtype TIRDataFlowNode =
class FieldAddress extends Operand {
FieldAddressInstruction fai;
- FieldAddress() { fai = this.getDef() and not Ssa::ignoreOperand(this) }
+ FieldAddress() { fai = this.getDef() and not SsaImpl::ignoreOperand(this) }
/** Gets the field associated with this instruction. */
Field getField() { result = fai.getField() }
@@ -126,7 +127,7 @@ predicate conversionFlow(
)
or
additional = true and
- Ssa::isAdditionalConversionFlow(opFrom, instrTo)
+ SsaImpl::isAdditionalConversionFlow(opFrom, instrTo)
)
or
isPointerArith = true and
@@ -183,7 +184,7 @@ class Node extends TIRDataFlowNode {
or
this.asOperand().getUse() = block.getInstruction(i)
or
- exists(Ssa::SynthNode ssaNode |
+ exists(SsaImpl::SynthNode ssaNode |
this.(SsaSynthNode).getSynthNode() = ssaNode and
ssaNode.getBasicBlock() = block and
ssaNode.getIndex() = i
@@ -364,10 +365,10 @@ class Node extends TIRDataFlowNode {
* pointed to by `p`.
*/
Expr asDefinition(boolean uncertain) {
- exists(StoreInstruction store, Ssa::Definition def |
+ exists(StoreInstruction store, SsaImpl::Definition def |
store = this.asInstruction() and
result = asDefinitionImpl(store) and
- Ssa::defToNode(this, def, _) and
+ SsaImpl::defToNode(this, def, _) and
if def.isCertain() then uncertain = false else uncertain = true
)
}
@@ -627,7 +628,7 @@ class OperandNode extends Node, Node0 {
* For example, `stripPointers(int*&)` is `int*` and `stripPointers(int*)` is `int`.
*/
Type stripPointer(Type t) {
- result = any(Ssa::Indirection ind | ind.getType() = t).getBaseType()
+ result = any(SsaImpl::Indirection ind | ind.getType() = t).getBaseType()
or
result = t.(PointerToMemberType).getBaseType()
or
@@ -694,12 +695,12 @@ class PostFieldUpdateNode extends PostUpdateNodeImpl {
* in a data flow graph.
*/
class SsaSynthNode extends Node, TSsaSynthNode {
- Ssa::SynthNode node;
+ SsaImpl::SynthNode node;
SsaSynthNode() { this = TSsaSynthNode(node) }
/** Gets the synthesized SSA node associated with this node. */
- Ssa::SynthNode getSynthNode() { result = node }
+ SsaImpl::SynthNode getSynthNode() { result = node }
override DataFlowCallable getEnclosingCallable() {
result.asSourceCallable() = this.getFunction()
@@ -782,12 +783,12 @@ class SideEffectOperandNode extends Node instanceof IndirectOperand {
* from a function body.
*/
class FinalGlobalValue extends Node, TFinalGlobalValue {
- Ssa::GlobalUse globalUse;
+ SsaImpl::GlobalUse globalUse;
FinalGlobalValue() { this = TFinalGlobalValue(globalUse) }
/** Gets the underlying SSA use. */
- Ssa::GlobalUse getGlobalUse() { result = globalUse }
+ SsaImpl::GlobalUse getGlobalUse() { result = globalUse }
override DataFlowCallable getEnclosingCallable() {
result.asSourceCallable() = this.getFunction()
@@ -814,12 +815,12 @@ class FinalGlobalValue extends Node, TFinalGlobalValue {
* a function body.
*/
class InitialGlobalValue extends Node, TInitialGlobalValue {
- Ssa::GlobalDef globalDef;
+ SsaImpl::GlobalDef globalDef;
InitialGlobalValue() { this = TInitialGlobalValue(globalDef) }
/** Gets the underlying SSA definition. */
- Ssa::GlobalDef getGlobalDef() { result = globalDef }
+ SsaImpl::GlobalDef getGlobalDef() { result = globalDef }
override DataFlowCallable getEnclosingCallable() {
result.asSourceCallable() = this.getFunction()
@@ -1288,11 +1289,11 @@ class UninitializedNode extends Node {
LocalVariable v;
UninitializedNode() {
- exists(Ssa::Definition def, Ssa::SourceVariable sv |
+ exists(SsaImpl::Definition def, SsaImpl::SourceVariable sv |
def.getIndirectionIndex() = 0 and
def.getValue().asInstruction() instanceof UninitializedInstruction and
- Ssa::defToNode(this, def, sv) and
- v = sv.getBaseVariable().(Ssa::BaseIRVariable).getIRVariable().getAst()
+ SsaImpl::defToNode(this, def, sv) and
+ v = sv.getBaseVariable().(SsaImpl::BaseIRVariable).getIRVariable().getAst()
)
}
@@ -1722,7 +1723,7 @@ private module Cached {
cached
predicate flowsToBackEdge(Node n) {
exists(Node succ, IRBlock bb1, IRBlock bb2 |
- Ssa::ssaFlow(n, succ) and
+ SsaImpl::ssaFlow(n, succ) and
bb1 = n.getBasicBlock() and
bb2 = succ.getBasicBlock() and
bb1 != bb2 and
@@ -1820,7 +1821,7 @@ private module Cached {
predicate simpleLocalFlowStep(Node nodeFrom, Node nodeTo, string model) {
(
// Def-use/Use-use flow
- Ssa::ssaFlow(nodeFrom, nodeTo)
+ SsaImpl::ssaFlow(nodeFrom, nodeTo)
or
IteratorFlow::localFlowStep(nodeFrom, nodeTo)
or
@@ -1833,7 +1834,7 @@ private module Cached {
|
simpleOperandLocalFlowStep(iFrom, opTo) and
// Omit when the instruction node also represents the operand.
- not iFrom = Ssa::getIRRepresentationOfOperand(opTo)
+ not iFrom = SsaImpl::getIRRepresentationOfOperand(opTo)
)
or
// Indirect operand -> (indirect) instruction flow
@@ -1906,7 +1907,7 @@ private module Cached {
// We also want a write coming out of an `OutNode` to flow `nodeTo`.
// This is different from `reverseFlowInstruction` since `nodeFrom` can never
// be an `OutNode` when it's defined by an instruction.
- Ssa::outNodeHasAddressAndIndex(nodeFrom, address, indirectionIndex)
+ SsaImpl::outNodeHasAddressAndIndex(nodeFrom, address, indirectionIndex)
)
}
@@ -2099,7 +2100,7 @@ private newtype TContent =
TFieldContent(Field f, int indirectionIndex) {
// the indirection index for field content starts at 1 (because `TFieldContent` is thought of as
// the address of the field, `FieldAddress` in the IR).
- indirectionIndex = [1 .. Ssa::getMaxIndirectionsForType(f.getUnspecifiedType())] and
+ indirectionIndex = [1 .. SsaImpl::getMaxIndirectionsForType(f.getUnspecifiedType())] and
// Reads and writes of union fields are tracked using `UnionContent`.
not f.getDeclaringType() instanceof Union
} or
@@ -2111,7 +2112,9 @@ private newtype TContent =
// field can be read by any read of the union's fields. Again, the indirection index
// is 1-based (because 0 is considered the address).
indirectionIndex =
- [1 .. max(Ssa::getMaxIndirectionsForType(getAFieldWithSize(u, bytes).getUnspecifiedType()))]
+ [1 .. max(SsaImpl::getMaxIndirectionsForType(getAFieldWithSize(u, bytes)
+ .getUnspecifiedType())
+ )]
)
} or
TElementContent(int indirectionIndex) {
@@ -2354,7 +2357,7 @@ module BarrierGuard {
controls(g, result, edge)
)
or
- result = Ssa::BarrierGuard::getABarrierNode()
+ result = SsaImpl::BarrierGuard::getABarrierNode()
}
/**
@@ -2453,7 +2456,7 @@ module BarrierGuard {
)
or
result =
- Ssa::BarrierGuardWithIntParam::getABarrierNode(indirectionIndex)
+ SsaImpl::BarrierGuardWithIntParam::getABarrierNode(indirectionIndex)
}
}
@@ -2490,7 +2493,7 @@ module InstructionBarrierGuard::getABarrierNode()
+ result = SsaImpl::BarrierGuard::getABarrierNode()
}
bindingset[value, n]
@@ -2520,7 +2523,7 @@ module InstructionBarrierGuard::getABarrierNode(indirectionIndex)
+ SsaImpl::BarrierGuardWithIntParam::getABarrierNode(indirectionIndex)
}
}
@@ -2576,3 +2579,16 @@ Function getARuntimeTarget(Call call) {
result = DataFlowImplCommon::viableCallableLambda(dfCall, _).asSourceCallable()
)
}
+
+/** A module that provides static single assignment (SSA) information. */
+module Ssa {
+ class Definition = SsaImpl::Definition;
+
+ class ExplicitDefinition = SsaImpl::ExplicitDefinition;
+
+ class DirectExplicitDefinition = SsaImpl::DirectExplicitDefinition;
+
+ class IndirectExplicitDefinition = SsaImpl::IndirectExplicitDefinition;
+
+ class PhiNode = SsaImpl::PhiNode;
+}
diff --git a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/ModelUtil.qll b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/ModelUtil.qll
index 055f48c80ec8..f880bee1c1c4 100644
--- a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/ModelUtil.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/ModelUtil.qll
@@ -4,15 +4,15 @@
*/
private import semmle.code.cpp.ir.IR
-private import semmle.code.cpp.ir.dataflow.DataFlow
+private import semmle.code.cpp.models.interfaces.FunctionInputsAndOutputs
private import DataFlowUtil
private import DataFlowPrivate
-private import SsaInternals as Ssa
+private import SsaImpl as Ssa
/**
* Gets the instruction that goes into `input` for `call`.
*/
-DataFlow::Node callInput(CallInstruction call, FunctionInput input) {
+Node callInput(CallInstruction call, FunctionInput input) {
// An argument or qualifier
exists(int index |
result.asOperand() = call.getArgumentOperand(index) and
@@ -62,8 +62,8 @@ Node callOutput(CallInstruction call, FunctionOutput output) {
result = callOutputWithIndirectionIndex(call, output, _)
}
-DataFlow::Node callInput(CallInstruction call, FunctionInput input, int d) {
- exists(DataFlow::Node n | n = callInput(call, input) and d > 0 |
+Node callInput(CallInstruction call, FunctionInput input, int d) {
+ exists(Node n | n = callInput(call, input) and d > 0 |
// An argument or qualifier
hasOperandAndIndex(result, n.asOperand(), d)
or
@@ -85,7 +85,7 @@ private IndirectReturnOutNode getIndirectReturnOutNode(CallInstruction call, int
*/
bindingset[d]
Node callOutput(CallInstruction call, FunctionOutput output, int d) {
- exists(DataFlow::Node n, int indirectionIndex |
+ exists(Node n, int indirectionIndex |
n = callOutputWithIndirectionIndex(call, output, indirectionIndex) and d > 0
|
// The return value
diff --git a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/PrintDataFlowRelevantIR.qll b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/PrintDataFlowRelevantIR.qll
index 2a654828ee54..22550e187ace 100644
--- a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/PrintDataFlowRelevantIR.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/PrintDataFlowRelevantIR.qll
@@ -1,6 +1,6 @@
private import cpp
private import semmle.code.cpp.ir.IR
-private import SsaInternals as Ssa
+private import SsaImpl as Ssa
/**
* A property provider that hides all instructions and operands that are not relevant for IR dataflow.
diff --git a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/PrintIRLocalFlow.qll b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/PrintIRLocalFlow.qll
index cf612ce73687..e310db319319 100644
--- a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/PrintIRLocalFlow.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/PrintIRLocalFlow.qll
@@ -2,7 +2,7 @@ private import cpp
private import semmle.code.cpp.ir.IR
private import semmle.code.cpp.ir.dataflow.internal.DataFlowUtil
private import semmle.code.cpp.ir.dataflow.internal.DataFlowPrivate
-private import SsaInternals as Ssa
+private import SsaImpl as Ssa
private import PrintIRUtilities
/**
diff --git a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaInternals.qll b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaImpl.qll
similarity index 90%
rename from cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaInternals.qll
rename to cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaImpl.qll
index fd9ba967a13d..3af2ea38a641 100644
--- a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaInternals.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaImpl.qll
@@ -1,4 +1,4 @@
-private import codeql.ssa.Ssa as SsaImplCommon
+private import codeql.ssa.Ssa as Ssa
private import semmle.code.cpp.ir.IR
private import DataFlowUtil
private import DataFlowImplCommon as DataFlowImplCommon
@@ -12,7 +12,7 @@ private import semmle.code.cpp.ir.internal.IRCppLanguage
private import semmle.code.cpp.ir.dataflow.internal.ModelUtil
private import semmle.code.cpp.ir.implementation.raw.internal.TranslatedInitialization
private import DataFlowPrivate
-import SsaInternalsCommon
+import SsaImplCommon
private module SourceVariables {
cached
@@ -884,7 +884,7 @@ private predicate baseSourceVariableIsGlobal(
)
}
-private module SsaInput implements SsaImplCommon::InputSig {
+private module SsaInput implements Ssa::InputSig {
import InputSigCommon
import SourceVariables
@@ -958,9 +958,11 @@ class GlobalDef extends Definition {
GlobalLikeVariable getVariable() { result = impl.getVariable() }
}
-private module SsaImpl = SsaImplCommon::Make;
+private module SsaImpl = Ssa::Make;
private module DataFlowIntegrationInput implements SsaImpl::DataFlowIntegrationInputSig {
+ private import codeql.util.Boolean
+
class Expr extends Instruction {
Expr() {
exists(IRBlock bb, int i |
@@ -992,10 +994,14 @@ private module DataFlowIntegrationInput implements SsaImpl::DataFlowIntegrationI
result instanceof FalseEdge
}
+ class GuardValue = Boolean;
+
class Guard instanceof IRGuards::IRGuardCondition {
string toString() { result = super.toString() }
- predicate hasBranchEdge(SsaInput::BasicBlock bb1, SsaInput::BasicBlock bb2, boolean branch) {
+ predicate hasValueBranchEdge(
+ SsaInput::BasicBlock bb1, SsaInput::BasicBlock bb2, GuardValue branch
+ ) {
exists(EdgeKind kind |
super.getBlock() = bb1 and
kind = getConditionalEdge(branch) and
@@ -1003,12 +1009,14 @@ private module DataFlowIntegrationInput implements SsaImpl::DataFlowIntegrationI
)
}
- predicate controlsBranchEdge(SsaInput::BasicBlock bb1, SsaInput::BasicBlock bb2, boolean branch) {
- this.hasBranchEdge(bb1, bb2, branch)
+ predicate valueControlsBranchEdge(
+ SsaInput::BasicBlock bb1, SsaInput::BasicBlock bb2, GuardValue branch
+ ) {
+ this.hasValueBranchEdge(bb1, bb2, branch)
}
}
- predicate guardDirectlyControlsBlock(Guard guard, SsaInput::BasicBlock bb, boolean branch) {
+ predicate guardDirectlyControlsBlock(Guard guard, SsaInput::BasicBlock bb, GuardValue branch) {
guard.(IRGuards::IRGuardCondition).controls(bb, branch)
}
@@ -1037,7 +1045,8 @@ module BarrierGuardWithIntParam {
}
private predicate guardChecks(
- DataFlowIntegrationInput::Guard g, SsaImpl::Definition def, boolean branch, int indirectionIndex
+ DataFlowIntegrationInput::Guard g, SsaImpl::Definition def,
+ DataFlowIntegrationInput::GuardValue branch, int indirectionIndex
) {
exists(UseImpl use |
guardChecksNode(g, use.getNode(), branch, indirectionIndex) and
@@ -1116,9 +1125,11 @@ class PhiNode extends Definition instanceof SsaImpl::PhiNode {
/** An static single assignment (SSA) definition. */
class Definition extends SsaImpl::Definition {
- // TODO: Include prior definitions of uncertain writes or rename predicate
- // i.e. the disjunct `SsaImpl::uncertainWriteDefinitionInput(this, result)`
- private Definition getAPhiInputOrPriorDefinition() { result = this.(PhiNode).getAnInput() }
+ private Definition getAPhiInputOrPriorDefinition() {
+ result = this.(PhiNode).getAnInput()
+ or
+ SsaImpl::uncertainWriteDefinitionInput(this, result)
+ }
/**
* Gets a definition that ultimately defines this SSA definition and is
@@ -1129,6 +1140,36 @@ class Definition extends SsaImpl::Definition {
not result instanceof PhiNode
}
+ /** Gets an `Operand` that represents a use of this definition. */
+ Operand getAUse() {
+ exists(SourceVariable sv, IRBlock bb, int i, UseImpl use |
+ ssaDefReachesRead(sv, this, bb, i) and
+ use.hasIndexInBlock(bb, i, sv) and
+ result = use.getNode().asOperand()
+ )
+ }
+
+ /**
+ * Gets an `Operand` that represents an indirect use of this definition.
+ *
+ * The use is indirect because the operand represents a pointer that points
+ * to the value written by this definition. For example in:
+ * ```cpp
+ * 1. int x = 42;
+ * 2. int* p = &x;
+ * ```
+ * There is an `ExplicitDefinition` corresponding to `x = 42` on line 1 and
+ * the definition has an indirect use on line 2 because `&x` points to the
+ * value that was defined by the definition.
+ */
+ Operand getAnIndirectUse(int indirectionIndex) {
+ exists(SourceVariable sv, IRBlock bb, int i, UseImpl use |
+ ssaDefReachesRead(sv, this, bb, i) and
+ use.hasIndexInBlock(bb, i, sv) and
+ result = use.getNode().asIndirectOperand(indirectionIndex)
+ )
+ }
+
/**
* INTERNAL: Do not use.
*/
@@ -1161,4 +1202,63 @@ class Definition extends SsaImpl::Definition {
Type getUnspecifiedType() { result = this.getUnderlyingType().getUnspecifiedType() }
}
+/**
+ * An SSA definition that corresponds to an explicit definition.
+ */
+class ExplicitDefinition extends Definition, SsaImpl::WriteDefinition {
+ DefImpl def;
+
+ ExplicitDefinition() {
+ exists(IRBlock bb, int i, SourceVariable sv |
+ this.definesAt(sv, bb, i) and
+ def.hasIndexInBlock(sv, bb, i)
+ )
+ }
+
+ /**
+ * Gets the `Instruction` computing the value that is written to the
+ * associated SSA variable by this SSA definition.
+ *
+ * If `this.getIndirectionIndex() = 0` (i.e., if `this` is an instance of
+ * `DirectExplicitDefinition`) then the SSA variable is present in the source
+ * code.
+ * However, if `this.getIndirectionIndex() > 0` (i.e., if `this` is an
+ * instance of `IndirectExplicitDefinition`) then the SSA variable associated
+ * with this definition represents the memory pointed to by a variable in the
+ * source code.
+ */
+ Instruction getAssignedInstruction() { result = def.getValue().asInstruction() }
+}
+
+/**
+ * An explicit SSA definition that writes an indirect value to a pointer.
+ *
+ * For example in:
+ * ```cpp
+ * int x = 42; // (1)
+ * int* p = &x; // (2)
+ * ```
+ * There are three `ExplicitDefinition`:
+ * 1. A `DirectExplicitDefinition` at (1) which writes `42` to the SSA variable
+ * corresponding to `x`.
+ * 2. A `DirectExplicitDefinition` at (2) which writes `&x` to the SSA variable
+ * corresponding to `p`.
+ * 3. A `IndirectExplicitDefinition` at (2) which writes `*&x` (i.e., `x`) to
+ * the SSA variable corresponding to `*p`.
+ */
+class IndirectExplicitDefinition extends ExplicitDefinition {
+ IndirectExplicitDefinition() { this.getIndirectionIndex() > 0 }
+}
+
+/**
+ * An SSA definition that corresponds to an explicit definition.
+ *
+ * Unlike `ExplicitDefinition` this class does not include indirect
+ * explicit definition. See `IndirectExplicitDefinition` if you want to include
+ * those.
+ */
+class DirectExplicitDefinition extends ExplicitDefinition {
+ DirectExplicitDefinition() { this.getIndirectionIndex() = 0 }
+}
+
import SsaCached
diff --git a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaInternalsCommon.qll b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaImplCommon.qll
similarity index 100%
rename from cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaInternalsCommon.qll
rename to cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaImplCommon.qll
diff --git a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/TaintTrackingUtil.qll b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/TaintTrackingUtil.qll
index 83fac3ebb49a..f190569330f5 100644
--- a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/TaintTrackingUtil.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/TaintTrackingUtil.qll
@@ -5,7 +5,7 @@ private import semmle.code.cpp.models.interfaces.DataFlow
private import semmle.code.cpp.models.interfaces.SideEffect
private import DataFlowUtil
private import DataFlowPrivate
-private import SsaInternals as Ssa
+private import SsaImpl as Ssa
private import semmle.code.cpp.dataflow.internal.FlowSummaryImpl as FlowSummaryImpl
private import semmle.code.cpp.ir.dataflow.FlowSteps
diff --git a/cpp/ql/lib/semmle/code/cpp/ir/implementation/Opcode.qll b/cpp/ql/lib/semmle/code/cpp/ir/implementation/Opcode.qll
index bd1ffcd5ce15..d8c1c6115c80 100644
--- a/cpp/ql/lib/semmle/code/cpp/ir/implementation/Opcode.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/implementation/Opcode.qll
@@ -42,6 +42,7 @@ private newtype TOpcode =
TCompareGT() or
TCompareLE() or
TCompareGE() or
+ TSpaceship() or
TPointerAdd() or
TPointerSub() or
TPointerDiff() or
@@ -92,7 +93,9 @@ private newtype TOpcode =
TUninitializedGroup() or
TInlineAsm() or
TUnreached() or
- TNewObj()
+ TNewObj() or
+ TTypeidExpr() or
+ TTypeidType()
/**
* An opcode that specifies the operation performed by an `Instruction`.
@@ -763,6 +766,15 @@ module Opcode {
final override string toString() { result = "CompareGE" }
}
+ /**
+ * The `Opcode` for a `SpaceshipInstruction`.
+ *
+ * See the `SpaceshipInstruction` documentation for more details.
+ */
+ class Spaceship extends BinaryOpcode, TSpaceship {
+ final override string toString() { result = "Spaceship" }
+ }
+
/**
* The `Opcode` for a `PointerAddInstruction`.
*
@@ -1281,4 +1293,29 @@ module Opcode {
class NewObj extends Opcode, TNewObj {
final override string toString() { result = "NewObj" }
}
+
+ /**
+ * The `Opcode` for a `TypeidInstruction`.
+ *
+ * See the `TypeidInstruction` documentation for more details.
+ */
+ abstract class Typeid extends Opcode { }
+
+ /**
+ * The `Opcode` for a `TypeidExprInstruction`.
+ *
+ * See the `TypeidExprInstruction` documentation for more details.
+ */
+ class TypeidExpr extends Typeid, UnaryOpcode, TTypeidExpr {
+ final override string toString() { result = "TypeidExpr" }
+ }
+
+ /**
+ * The `Opcode` for a `TypeidTypeInstruction`.
+ *
+ * See the `TypeidTypeInstruction` documentation for more details.
+ */
+ class TypeidType extends Typeid, TTypeidType {
+ final override string toString() { result = "TypeidType" }
+ }
}
diff --git a/cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/Instruction.qll b/cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/Instruction.qll
index 96c18a04ff7b..a564508e16b4 100644
--- a/cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/Instruction.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/Instruction.qll
@@ -1604,6 +1604,13 @@ class CompareGEInstruction extends RelationalInstruction {
override predicate isStrict() { none() }
}
+/**
+ * An instruction that represents a three-way comparison operator.
+ */
+class SpaceshipInstruction extends BinaryInstruction {
+ SpaceshipInstruction() { this.getOpcode() instanceof Opcode::Spaceship }
+}
+
/**
* An instruction that branches to one of multiple successor instructions based on the value of an
* integer operand.
@@ -2293,3 +2300,26 @@ class NextVarArgInstruction extends UnaryInstruction {
class NewObjInstruction extends Instruction {
NewObjInstruction() { this.getOpcode() instanceof Opcode::NewObj }
}
+
+/**
+ * An instruction that returns the type info for its operand.
+ */
+class TypeidInstruction extends Instruction {
+ TypeidInstruction() { this.getOpcode() instanceof Opcode::Typeid }
+}
+
+/**
+ * An instruction that returns the type info for its operand, where the
+ * operand occurs as an expression in the AST.
+ */
+class TypeidExprInstruction extends TypeidInstruction, UnaryInstruction {
+ TypeidExprInstruction() { this.getOpcode() instanceof Opcode::TypeidExpr }
+}
+
+/**
+ * An instruction that returns the type info for its operand, where the
+ * operand occurs as a type in the AST.
+ */
+class TypeidTypeInstruction extends TypeidInstruction {
+ TypeidTypeInstruction() { this.getOpcode() instanceof Opcode::TypeidType }
+}
diff --git a/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/Instruction.qll b/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/Instruction.qll
index 96c18a04ff7b..a564508e16b4 100644
--- a/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/Instruction.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/Instruction.qll
@@ -1604,6 +1604,13 @@ class CompareGEInstruction extends RelationalInstruction {
override predicate isStrict() { none() }
}
+/**
+ * An instruction that represents a three-way comparison operator.
+ */
+class SpaceshipInstruction extends BinaryInstruction {
+ SpaceshipInstruction() { this.getOpcode() instanceof Opcode::Spaceship }
+}
+
/**
* An instruction that branches to one of multiple successor instructions based on the value of an
* integer operand.
@@ -2293,3 +2300,26 @@ class NextVarArgInstruction extends UnaryInstruction {
class NewObjInstruction extends Instruction {
NewObjInstruction() { this.getOpcode() instanceof Opcode::NewObj }
}
+
+/**
+ * An instruction that returns the type info for its operand.
+ */
+class TypeidInstruction extends Instruction {
+ TypeidInstruction() { this.getOpcode() instanceof Opcode::Typeid }
+}
+
+/**
+ * An instruction that returns the type info for its operand, where the
+ * operand occurs as an expression in the AST.
+ */
+class TypeidExprInstruction extends TypeidInstruction, UnaryInstruction {
+ TypeidExprInstruction() { this.getOpcode() instanceof Opcode::TypeidExpr }
+}
+
+/**
+ * An instruction that returns the type info for its operand, where the
+ * operand occurs as a type in the AST.
+ */
+class TypeidTypeInstruction extends TypeidInstruction {
+ TypeidTypeInstruction() { this.getOpcode() instanceof Opcode::TypeidType }
+}
diff --git a/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedExpr.qll b/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedExpr.qll
index dea86499e7ca..a7e85fe9b1a5 100644
--- a/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedExpr.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedExpr.qll
@@ -1808,6 +1808,11 @@ private Opcode comparisonOpcode(ComparisonOperation expr) {
expr instanceof GEExpr and result instanceof Opcode::CompareGE
}
+private Opcode spaceShipOpcode(SpaceshipExpr expr) {
+ exists(expr) and
+ result instanceof Opcode::Spaceship
+}
+
/**
* IR translation of a simple binary operation.
*/
@@ -1867,7 +1872,8 @@ class TranslatedBinaryOperation extends TranslatedSingleInstructionExpr {
override Opcode getOpcode() {
result = binaryArithmeticOpcode(expr) or
result = binaryBitwiseOpcode(expr) or
- result = comparisonOpcode(expr)
+ result = comparisonOpcode(expr) or
+ result = spaceShipOpcode(expr)
}
override Type getExprType() {
@@ -4185,3 +4191,52 @@ class TranslatedAssumeExpr extends TranslatedSingleInstructionExpr {
none()
}
}
+
+class TranslatedTypeidExpr extends TranslatedSingleInstructionExpr {
+ override TypeidOperator expr;
+
+ final override Opcode getOpcode() {
+ exists(this.getOperand()) and
+ result instanceof Opcode::TypeidExpr
+ or
+ not exists(this.getOperand()) and
+ result instanceof Opcode::TypeidType
+ }
+
+ final override Instruction getFirstInstruction(EdgeKind kind) {
+ result = this.getOperand().getFirstInstruction(kind)
+ or
+ not exists(this.getOperand()) and
+ result = this.getInstruction(OnlyInstructionTag()) and
+ kind instanceof GotoEdge
+ }
+
+ override Instruction getALastInstructionInternal() {
+ result = this.getInstruction(OnlyInstructionTag())
+ }
+
+ final override TranslatedElement getChildInternal(int id) {
+ id = 0 and result = this.getOperand()
+ }
+
+ final override Instruction getInstructionSuccessorInternal(InstructionTag tag, EdgeKind kind) {
+ tag = OnlyInstructionTag() and
+ result = this.getParent().getChildSuccessor(this, kind)
+ }
+
+ final override Instruction getChildSuccessorInternal(TranslatedElement child, EdgeKind kind) {
+ child = this.getOperand() and
+ result = this.getInstruction(OnlyInstructionTag()) and
+ kind instanceof GotoEdge
+ }
+
+ final override Instruction getInstructionRegisterOperand(InstructionTag tag, OperandTag operandTag) {
+ tag = OnlyInstructionTag() and
+ result = this.getOperand().getResult() and
+ operandTag instanceof UnaryOperandTag
+ }
+
+ private TranslatedExpr getOperand() {
+ result = getTranslatedExpr(expr.getExpr().getFullyConverted())
+ }
+}
diff --git a/cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/Instruction.qll b/cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/Instruction.qll
index 96c18a04ff7b..a564508e16b4 100644
--- a/cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/Instruction.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/Instruction.qll
@@ -1604,6 +1604,13 @@ class CompareGEInstruction extends RelationalInstruction {
override predicate isStrict() { none() }
}
+/**
+ * An instruction that represents a three-way comparison operator.
+ */
+class SpaceshipInstruction extends BinaryInstruction {
+ SpaceshipInstruction() { this.getOpcode() instanceof Opcode::Spaceship }
+}
+
/**
* An instruction that branches to one of multiple successor instructions based on the value of an
* integer operand.
@@ -2293,3 +2300,26 @@ class NextVarArgInstruction extends UnaryInstruction {
class NewObjInstruction extends Instruction {
NewObjInstruction() { this.getOpcode() instanceof Opcode::NewObj }
}
+
+/**
+ * An instruction that returns the type info for its operand.
+ */
+class TypeidInstruction extends Instruction {
+ TypeidInstruction() { this.getOpcode() instanceof Opcode::Typeid }
+}
+
+/**
+ * An instruction that returns the type info for its operand, where the
+ * operand occurs as an expression in the AST.
+ */
+class TypeidExprInstruction extends TypeidInstruction, UnaryInstruction {
+ TypeidExprInstruction() { this.getOpcode() instanceof Opcode::TypeidExpr }
+}
+
+/**
+ * An instruction that returns the type info for its operand, where the
+ * operand occurs as a type in the AST.
+ */
+class TypeidTypeInstruction extends TypeidInstruction {
+ TypeidTypeInstruction() { this.getOpcode() instanceof Opcode::TypeidType }
+}
diff --git a/cpp/ql/lib/semmle/code/cpp/security/FunctionWithWrappers.qll b/cpp/ql/lib/semmle/code/cpp/security/FunctionWithWrappers.qll
index b7a7a95a4271..b66731678475 100644
--- a/cpp/ql/lib/semmle/code/cpp/security/FunctionWithWrappers.qll
+++ b/cpp/ql/lib/semmle/code/cpp/security/FunctionWithWrappers.qll
@@ -17,7 +17,6 @@
import cpp
import PrintfLike
-private import semmle.code.cpp.ir.dataflow.ResolveCall
bindingset[index]
private string toCause(Function func, int index) {
@@ -37,9 +36,9 @@ private predicate wrapperFunctionStep(
not target.isVirtual() and
not source.isVirtual() and
source.hasDefinition() and
- exists(Call call, Expr arg, Parameter sourceParam |
+ exists(FunctionCall call, Expr arg, Parameter sourceParam |
// there is a 'call' to 'target' with argument 'arg' at index 'targetParamIndex'
- target = resolveCall(call) and
+ target = call.getTarget() and
arg = call.getArgument(targetParamIndex) and
// 'call' is enclosed in 'source'
source = call.getEnclosingFunction() and
@@ -154,8 +153,8 @@ abstract class FunctionWithWrappers extends Function {
* Whether 'arg' is an argument in a call to an outermost wrapper function of 'this' function.
*/
predicate outermostWrapperFunctionCall(Expr arg, string callChain) {
- exists(Function targetFunc, Call call, int argIndex |
- targetFunc = resolveCall(call) and
+ exists(Function targetFunc, FunctionCall call, int argIndex |
+ targetFunc = call.getTarget() and
this.wrapperFunction(targetFunc, argIndex, callChain) and
(
exists(Function sourceFunc | sourceFunc = call.getEnclosingFunction() |
diff --git a/cpp/ql/lib/semmle/code/cpp/security/InvalidPointerDereference/AllocationToInvalidPointer.qll b/cpp/ql/lib/semmle/code/cpp/security/InvalidPointerDereference/AllocationToInvalidPointer.qll
index 223d0abf1d4e..2fea5327720a 100644
--- a/cpp/ql/lib/semmle/code/cpp/security/InvalidPointerDereference/AllocationToInvalidPointer.qll
+++ b/cpp/ql/lib/semmle/code/cpp/security/InvalidPointerDereference/AllocationToInvalidPointer.qll
@@ -53,44 +53,12 @@
private import cpp
private import semmle.code.cpp.ir.dataflow.internal.ProductFlow
+private import semmle.code.cpp.security.ProductFlowUtils.ProductFlowUtils
private import semmle.code.cpp.ir.ValueNumbering
private import semmle.code.cpp.controlflow.IRGuards
private import codeql.util.Unit
private import semmle.code.cpp.rangeanalysis.new.RangeAnalysisUtil
-private VariableAccess getAVariableAccess(Expr e) { e.getAChild*() = result }
-
-/**
- * Gets a (sub)expression that may be the result of evaluating `size`.
- *
- * For example, `getASizeCandidate(a ? b : c)` gives `a ? b : c`, `b` and `c`.
- */
-bindingset[size]
-pragma[inline_late]
-private Expr getASizeCandidate(Expr size) {
- result = size
- or
- result = [size.(ConditionalExpr).getThen(), size.(ConditionalExpr).getElse()]
-}
-
-/**
- * Holds if the `(n, state)` pair represents the source of flow for the size
- * expression associated with `alloc`.
- */
-predicate hasSize(HeuristicAllocationExpr alloc, DataFlow::Node n, int state) {
- exists(VariableAccess va, Expr size, int delta, Expr s |
- size = alloc.getSizeExpr() and
- s = getASizeCandidate(size) and
- // Get the unique variable in a size expression like `x` in `malloc(x + 1)`.
- va = unique( | | getAVariableAccess(s)) and
- // Compute `delta` as the constant difference between `x` and `x + 1`.
- bounded1(any(Instruction instr | instr.getUnconvertedResultExpression() = s),
- any(LoadInstruction load | load.getUnconvertedResultExpression() = va), delta) and
- n.asExpr() = va and
- state = delta
- )
-}
-
/**
* Gets the virtual dispatch branching limit when calculating field flow while searching
* for flow from an allocation to the construction of an out-of-bounds pointer.
@@ -100,125 +68,6 @@ predicate hasSize(HeuristicAllocationExpr alloc, DataFlow::Node n, int state) {
*/
int allocationToInvalidPointerFieldFlowBranchLimit() { result = 0 }
-/**
- * A module that encapsulates a barrier guard to remove false positives from flow like:
- * ```cpp
- * char *p = new char[size];
- * // ...
- * unsigned n = size;
- * // ...
- * if(n < size) {
- * use(*p[n]);
- * }
- * ```
- * In this case, the sink pair identified by the product flow library (without any additional barriers)
- * would be `(p, n)` (where `n` is the `n` in `p[n]`), because there exists a pointer-arithmetic
- * instruction `pai = a + b` such that:
- * 1. the allocation flows to `a`, and
- * 2. `b <= n` where `n` is the `n` in `p[n]`
- * but because there's a strict comparison that compares `n` against the size of the allocation this
- * snippet is fine.
- */
-private module SizeBarrier {
- private module SizeBarrierConfig implements DataFlow::ConfigSig {
- predicate isSource(DataFlow::Node source) {
- // The sources is the same as in the sources for the second
- // projection in the `AllocToInvalidPointerConfig` module.
- hasSize(_, source, _) and
- InterestingPointerAddInstruction::isInterestingSize(source)
- }
-
- int fieldFlowBranchLimit() { result = allocationToInvalidPointerFieldFlowBranchLimit() }
-
- /**
- * Holds if `small <= large + k` holds if `g` evaluates to `testIsTrue`.
- */
- additional predicate isSink(
- DataFlow::Node small, DataFlow::Node large, IRGuardCondition g, int k, boolean testIsTrue
- ) {
- // The sink is any "large" side of a relational comparison. i.e., the `large` expression
- // in a guard such as `small <= large + k`.
- g.comparesLt(small.asOperand(), large.asOperand(), k + 1, true, testIsTrue)
- }
-
- predicate isSink(DataFlow::Node sink) { isSink(_, sink, _, _, _) }
- }
-
- module SizeBarrierFlow = DataFlow::Global;
-
- private int getASizeAddend(DataFlow::Node node) {
- exists(DataFlow::Node source |
- SizeBarrierFlow::flow(source, node) and
- hasSize(_, source, result)
- )
- }
-
- /**
- * Holds if `small <= large + k` holds if `g` evaluates to `edge`.
- */
- private predicate operandGuardChecks(
- IRGuardCondition g, Operand small, DataFlow::Node large, int k, boolean edge
- ) {
- SizeBarrierFlow::flowTo(large) and
- SizeBarrierConfig::isSink(DataFlow::operandNode(small), large, g, k, edge)
- }
-
- /**
- * Gets an instruction `instr` that is guarded by a check such as `instr <= small + delta` where
- * `small <= _ + k` and `small` is the "small side" of of a relational comparison that checks
- * whether `small <= size` where `size` is the size of an allocation.
- */
- Instruction getABarrierInstruction0(int delta, int k) {
- exists(
- IRGuardCondition g, ValueNumber value, Operand small, boolean edge, DataFlow::Node large
- |
- // We know:
- // 1. result <= value + delta (by `bounded`)
- // 2. value <= large + k (by `operandGuardChecks`).
- // So:
- // result <= value + delta (by 1.)
- // <= large + k + delta (by 2.)
- small = value.getAUse() and
- operandGuardChecks(pragma[only_bind_into](g), pragma[only_bind_into](small), large,
- pragma[only_bind_into](k), pragma[only_bind_into](edge)) and
- bounded(result, value.getAnInstruction(), delta) and
- g.controls(result.getBlock(), edge) and
- k < getASizeAddend(large)
- )
- }
-
- /**
- * Gets an instruction that is guarded by a guard condition which ensures that
- * the value of the instruction is upper-bounded by size of some allocation.
- */
- bindingset[state]
- pragma[inline_late]
- Instruction getABarrierInstruction(int state) {
- exists(int delta, int k |
- state > k + delta and
- // result <= "size of allocation" + delta + k
- // < "size of allocation" + state
- result = getABarrierInstruction0(delta, k)
- )
- }
-
- /**
- * Gets a `DataFlow::Node` that is guarded by a guard condition which ensures that
- * the value of the node is upper-bounded by size of some allocation.
- */
- DataFlow::Node getABarrierNode(int state) {
- exists(DataFlow::Node source, int delta, int k |
- SizeBarrierFlow::flow(source, result) and
- hasSize(_, source, state) and
- result.asInstruction() = SizeBarrier::getABarrierInstruction0(delta, k) and
- state > k + delta
- // so now we have:
- // result <= "size of allocation" + delta + k
- // < "size of allocation" + state
- )
- }
-}
-
private module InterestingPointerAddInstruction {
private module PointerAddInstructionConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) {
@@ -227,7 +76,7 @@ private module InterestingPointerAddInstruction {
hasSize(source.asExpr(), _, _)
}
- int fieldFlowBranchLimit() { result = allocationToInvalidPointerFieldFlowBranchLimit() }
+ predicate fieldFlowBranchLimit = allocationToInvalidPointerFieldFlowBranchLimit/0;
predicate isSink(DataFlow::Node sink) {
sink.asInstruction() = any(PointerAddInstruction pai).getLeft()
@@ -263,6 +112,17 @@ private module InterestingPointerAddInstruction {
}
}
+private module SizeBarrierInput implements SizeBarrierInputSig {
+ predicate fieldFlowBranchLimit = allocationToInvalidPointerFieldFlowBranchLimit/0;
+
+ predicate isSource(DataFlow::Node source) {
+ // The sources is the same as in the sources for the second
+ // projection in the `AllocToInvalidPointerConfig` module.
+ hasSize(_, source, _) and
+ InterestingPointerAddInstruction::isInterestingSize(source)
+ }
+}
+
/**
* A product-flow configuration for flow from an `(allocation, size)` pair to a
* pointer-arithmetic operation `pai` such that `pai <= allocation + size`.
@@ -301,7 +161,7 @@ private module Config implements ProductFlow::StateConfigSig {
private import semmle.code.cpp.ir.dataflow.internal.DataFlowPrivate
predicate isBarrier2(DataFlow::Node node, FlowState2 state) {
- node = SizeBarrier::getABarrierNode(state)
+ node = SizeBarrier::getABarrierNode(state)
}
predicate isBarrier2(DataFlow::Node node) {
@@ -357,8 +217,8 @@ private predicate pointerAddInstructionHasBounds0(
sizeInstr = sizeSink.asInstruction() and
// pai.getRight() <= sizeSink + delta
bounded1(right, sizeInstr, delta) and
- not right = SizeBarrier::getABarrierInstruction(delta) and
- not sizeInstr = SizeBarrier::getABarrierInstruction(delta)
+ not right = SizeBarrier::getABarrierInstruction(delta) and
+ not sizeInstr = SizeBarrier::getABarrierInstruction(delta)
)
}
diff --git a/cpp/ql/lib/semmle/code/cpp/security/ProductFlowUtils/ProductFlowUtils.qll b/cpp/ql/lib/semmle/code/cpp/security/ProductFlowUtils/ProductFlowUtils.qll
new file mode 100644
index 000000000000..151c5d1ae22a
--- /dev/null
+++ b/cpp/ql/lib/semmle/code/cpp/security/ProductFlowUtils/ProductFlowUtils.qll
@@ -0,0 +1,167 @@
+/**
+ * This file provides the `SizeBarrier` module which provides barriers for
+ * both the `cpp/invalid-pointer-deref` query and the `cpp/overrun-write`
+ * query.
+ */
+
+private import cpp
+private import semmle.code.cpp.dataflow.new.DataFlow
+private import semmle.code.cpp.ir.ValueNumbering
+private import semmle.code.cpp.controlflow.IRGuards
+private import semmle.code.cpp.rangeanalysis.new.RangeAnalysisUtil
+
+private VariableAccess getAVariableAccess(Expr e) { e.getAChild*() = result }
+
+/**
+ * Gets a (sub)expression that may be the result of evaluating `size`.
+ *
+ * For example, `getASizeCandidate(a ? b : c)` gives `a ? b : c`, `b` and `c`.
+ */
+bindingset[size]
+pragma[inline_late]
+private Expr getASizeCandidate(Expr size) {
+ result = size
+ or
+ result = [size.(ConditionalExpr).getThen(), size.(ConditionalExpr).getElse()]
+}
+
+/**
+ * Holds if the `(n, state)` pair represents the source of flow for the size
+ * expression associated with `alloc`.
+ */
+predicate hasSize(HeuristicAllocationExpr alloc, DataFlow::Node n, int state) {
+ exists(VariableAccess va, Expr size, int delta, Expr s |
+ size = alloc.getSizeExpr() and
+ s = getASizeCandidate(size) and
+ // Get the unique variable in a size expression like `x` in `malloc(x + 1)`.
+ va = unique( | | getAVariableAccess(s)) and
+ // Compute `delta` as the constant difference between `x` and `x + 1`.
+ bounded1(any(Instruction instr | instr.getUnconvertedResultExpression() = s),
+ any(LoadInstruction load | load.getUnconvertedResultExpression() = va), delta) and
+ n.asExpr() = va and
+ state = delta
+ )
+}
+
+/** Provides the input specification of the `SizeBarrier` module. */
+signature module SizeBarrierInputSig {
+ /** Gets the virtual dispatch branching limit when calculating field flow. */
+ int fieldFlowBranchLimit();
+
+ /** Holds if `source` is a relevant data flow source. */
+ predicate isSource(DataFlow::Node source);
+}
+
+/**
+ * A module that encapsulates a barrier guard to remove false positives from flow like:
+ * ```cpp
+ * char *p = new char[size];
+ * // ...
+ * unsigned n = size;
+ * // ...
+ * if(n < size) {
+ * use(*p[n]);
+ * }
+ * ```
+ * In this case, the sink pair identified by the product flow library (without any additional barriers)
+ * would be `(p, n)` (where `n` is the `n` in `p[n]`), because there exists a pointer-arithmetic
+ * instruction `pai = a + b` such that:
+ * 1. the allocation flows to `a`, and
+ * 2. `b <= n` where `n` is the `n` in `p[n]`
+ * but because there's a strict comparison that compares `n` against the size of the allocation this
+ * snippet is fine.
+ */
+module SizeBarrier {
+ private module SizeBarrierConfig implements DataFlow::ConfigSig {
+ predicate isSource = Input::isSource/1;
+
+ predicate fieldFlowBranchLimit = Input::fieldFlowBranchLimit/0;
+
+ /**
+ * Holds if `small <= large + k` holds if `g` evaluates to `testIsTrue`.
+ */
+ additional predicate isSink(
+ DataFlow::Node small, DataFlow::Node large, IRGuardCondition g, int k, boolean testIsTrue
+ ) {
+ // The sink is any "large" side of a relational comparison. i.e., the `large` expression
+ // in a guard such as `small <= large + k`.
+ g.comparesLt(small.asOperand(), large.asOperand(), k + 1, true, testIsTrue)
+ }
+
+ predicate isSink(DataFlow::Node sink) { isSink(_, sink, _, _, _) }
+ }
+
+ private module SizeBarrierFlow = DataFlow::Global;
+
+ private int getASizeAddend(DataFlow::Node node) {
+ exists(DataFlow::Node source |
+ SizeBarrierFlow::flow(source, node) and
+ hasSize(_, source, result)
+ )
+ }
+
+ /**
+ * Holds if `small <= large + k` holds if `g` evaluates to `edge`.
+ */
+ private predicate operandGuardChecks(
+ IRGuardCondition g, Operand small, DataFlow::Node large, int k, boolean edge
+ ) {
+ SizeBarrierFlow::flowTo(large) and
+ SizeBarrierConfig::isSink(DataFlow::operandNode(small), large, g, k, edge)
+ }
+
+ /**
+ * Gets an instruction `instr` that is guarded by a check such as `instr <= small + delta` where
+ * `small <= _ + k` and `small` is the "small side" of a relational comparison that checks
+ * whether `small <= size` where `size` is the size of an allocation.
+ */
+ private Instruction getABarrierInstruction0(int delta, int k) {
+ exists(
+ IRGuardCondition g, ValueNumber value, Operand small, boolean edge, DataFlow::Node large
+ |
+ // We know:
+ // 1. result <= value + delta (by `bounded`)
+ // 2. value <= large + k (by `operandGuardChecks`).
+ // So:
+ // result <= value + delta (by 1.)
+ // <= large + k + delta (by 2.)
+ small = value.getAUse() and
+ operandGuardChecks(pragma[only_bind_into](g), pragma[only_bind_into](small), large,
+ pragma[only_bind_into](k), pragma[only_bind_into](edge)) and
+ bounded(result, value.getAnInstruction(), delta) and
+ g.controls(result.getBlock(), edge) and
+ k < getASizeAddend(large)
+ )
+ }
+
+ /**
+ * Gets an instruction that is guarded by a guard condition which ensures that
+ * the value of the instruction is upper-bounded by size of some allocation.
+ */
+ bindingset[state]
+ pragma[inline_late]
+ Instruction getABarrierInstruction(int state) {
+ exists(int delta, int k |
+ state > k + delta and
+ // result <= "size of allocation" + delta + k
+ // < "size of allocation" + state
+ result = getABarrierInstruction0(delta, k)
+ )
+ }
+
+ /**
+ * Gets a `DataFlow::Node` that is guarded by a guard condition which ensures that
+ * the value of the node is upper-bounded by size of some allocation.
+ */
+ DataFlow::Node getABarrierNode(int state) {
+ exists(DataFlow::Node source, int delta, int k |
+ SizeBarrierFlow::flow(source, result) and
+ hasSize(_, source, state) and
+ result.asInstruction() = getABarrierInstruction0(delta, k) and
+ state > k + delta
+ // so now we have:
+ // result <= "size of allocation" + delta + k
+ // < "size of allocation" + state
+ )
+ }
+}
diff --git a/cpp/ql/src/CHANGELOG.md b/cpp/ql/src/CHANGELOG.md
index 8fd203bea4f2..589dfb68e1ef 100644
--- a/cpp/ql/src/CHANGELOG.md
+++ b/cpp/ql/src/CHANGELOG.md
@@ -1,8 +1,18 @@
+## 1.4.5
+
+### Minor Analysis Improvements
+
+* The "Initialization code not run" query (`cpp/initialization-not-run`) no longer reports an alert on static global variables that have no dereference.
+
## 1.4.4
### Minor Analysis Improvements
+* Due to changes in the `FunctionWithWrappers` library (`semmle.code.cpp.security.FunctionWithWrappers`) the primary alert location generated by the queries `cpp/path-injection`, `cpp/sql-injection`, `cpp/tainted-format-string`, and `cpp/command-line-injection` may have changed.
* Added flow models for the Win32 API functions `CreateThread`, `CreateRemoteThread`, and `CreateRemoteThreadEx`.
+* Improved support for dataflow through function objects and lambda expressions.
+* Added flow models for `pthread_create` and `std::thread`.
+* The `cpp/incorrect-string-type-conversion` query no longer alerts on incorrect type conversions that occur in unreachable code.
* Added flow models for the GNU C Library.
* Fixed a number of false positives and false negatives in `cpp/global-use-before-init`. Note that this query is not part of any of the default query suites.
* The query `cpp/sql-injection` now can be extended using the `sql-injection` Models as Data (MaD) sink kind.
diff --git a/cpp/ql/src/Critical/InitialisationNotRun.ql b/cpp/ql/src/Critical/InitialisationNotRun.ql
index ba575c55921b..0b97b30fbd69 100644
--- a/cpp/ql/src/Critical/InitialisationNotRun.ql
+++ b/cpp/ql/src/Critical/InitialisationNotRun.ql
@@ -32,9 +32,18 @@ predicate called(Function f) {
exists(FunctionAccess fa | fa.getTarget() = f)
}
+predicate staticWithoutDereference(GlobalVariable v) {
+ v.isStatic() and
+ not exists(VariableAccess va |
+ va = v.getAnAccess() and
+ dereferenced(va)
+ )
+}
+
from GlobalVariable v
where
global(v) and
+ not staticWithoutDereference(v) and
not exists(VariableAccess lval |
v.getAnAccess() = lval and
lval.isUsedAsLValue() and
diff --git a/cpp/ql/src/Metrics/Classes/CNumberOfFunctions.qhelp b/cpp/ql/src/Metrics/Classes/CNumberOfFunctions.qhelp
index cc62cb50f498..8ef045c70923 100644
--- a/cpp/ql/src/Metrics/Classes/CNumberOfFunctions.qhelp
+++ b/cpp/ql/src/Metrics/Classes/CNumberOfFunctions.qhelp
@@ -49,21 +49,16 @@ need to be part of the class. (A classic example of this is the
observes, there are at least two key problems with this approach:
-
--
-It may be possible to generalize some of the utility functions beyond the
+1. It may be possible to generalize some of the utility functions beyond the
narrow context of the class in question -- by bundling them with the class,
the class author reduces the scope for functionality reuse.
-
--
-It's usually impossible for the class author to know every possible
+2. It's usually impossible for the class author to know every possible
operation that the user might want to perform on the class, so the public
interface will inherently be incomplete. New utility functions will end up
having a different syntax to the privileged public functions in the class,
negatively impacting on code consistency.
-
-
+
To refactor a class like this, simply move its utility functions elsewhere,
paring its public interface down to the bare minimum.
diff --git a/cpp/ql/src/Metrics/Classes/CSizeOfAPI.qhelp b/cpp/ql/src/Metrics/Classes/CSizeOfAPI.qhelp
index 0d560f920aa6..70c4c862fb61 100644
--- a/cpp/ql/src/Metrics/Classes/CSizeOfAPI.qhelp
+++ b/cpp/ql/src/Metrics/Classes/CSizeOfAPI.qhelp
@@ -46,21 +46,17 @@ need to be part of the class. (A classic example of this is the
std::string
class in the C++ Standard Library.) As [Sutter]
observes, there are at least two key problems with this approach:
-
--
-It may be possible to generalize some of the utility functions beyond the
+
+1. It may be possible to generalize some of the utility functions beyond the
narrow context of the class in question -- by bundling them with the class,
the class author reduces the scope for functionality reuse.
-
--
-It's usually impossible for the class author to know every possible
+2. It's usually impossible for the class author to know every possible
operation that the user might want to perform on the class, so the public
interface will inherently be incomplete. New utility functions will end up
having a different syntax to the privileged public functions in the class,
negatively impacting on code consistency.
-
-
+
To refactor a class like this, simply move its utility functions elsewhere,
paring its public interface down to the bare minimum.
diff --git a/cpp/ql/src/Security/CWE/CWE-114/UncontrolledProcessOperation.ql b/cpp/ql/src/Security/CWE/CWE-114/UncontrolledProcessOperation.ql
index aedb21da5167..7d2513d25e33 100644
--- a/cpp/ql/src/Security/CWE/CWE-114/UncontrolledProcessOperation.ql
+++ b/cpp/ql/src/Security/CWE/CWE-114/UncontrolledProcessOperation.ql
@@ -23,7 +23,7 @@ predicate isProcessOperationExplanation(DataFlow::Node arg, string processOperat
exists(int processOperationArg, FunctionCall call |
isProcessOperationArgument(processOperation, processOperationArg) and
call.getTarget().getName() = processOperation and
- call.getArgument(processOperationArg) = [arg.asExpr(), arg.asIndirectExpr()]
+ call.getArgument(processOperationArg) = arg.asIndirectExpr()
)
}
diff --git a/cpp/ql/src/Security/CWE/CWE-119/OverrunWriteProductFlow.ql b/cpp/ql/src/Security/CWE/CWE-119/OverrunWriteProductFlow.ql
index b193b846b5a8..c2ebb4879a99 100644
--- a/cpp/ql/src/Security/CWE/CWE-119/OverrunWriteProductFlow.ql
+++ b/cpp/ql/src/Security/CWE/CWE-119/OverrunWriteProductFlow.ql
@@ -20,6 +20,7 @@ import semmle.code.cpp.models.interfaces.Allocation
import semmle.code.cpp.models.interfaces.ArrayFunction
import semmle.code.cpp.rangeanalysis.new.internal.semantic.analysis.RangeAnalysis
import semmle.code.cpp.rangeanalysis.new.internal.semantic.SemanticExprSpecific
+import semmle.code.cpp.security.ProductFlowUtils.ProductFlowUtils
import semmle.code.cpp.rangeanalysis.new.RangeAnalysisUtil
import StringSizeFlow::PathGraph1
import codeql.util.Unit
@@ -43,20 +44,28 @@ predicate hasSize(HeuristicAllocationExpr alloc, DataFlow::Node n, int state) {
)
}
-predicate isSinkPairImpl(
- CallInstruction c, DataFlow::Node bufSink, DataFlow::Node sizeSink, int delta, Expr eBuf
+/**
+ * Holds if `c` a call to an `ArrayFunction` with buffer argument `bufSink`,
+ * and a size argument `sizeInstr` which satisfies `sizeInstr <= sizeBound + delta`.
+ *
+ * Furthermore, the `sizeSink` node is the dataflow node corresponding to
+ * `sizeBound`, and the expression `eBuf` is the expression corresponding
+ * to `bufInstr`.
+ */
+predicate isSinkPairImpl0(
+ CallInstruction c, DataFlow::Node bufSink, DataFlow::Node sizeSink, int delta, Expr eBuf,
+ Instruction sizeBound, Instruction sizeInstr
) {
- exists(
- int bufIndex, int sizeIndex, Instruction sizeInstr, Instruction bufInstr, ArrayFunction func
- |
+ exists(int bufIndex, int sizeIndex, Instruction bufInstr, ArrayFunction func |
bufInstr = bufSink.asInstruction() and
c.getArgument(bufIndex) = bufInstr and
- sizeInstr = sizeSink.asInstruction() and
+ sizeBound = sizeSink.asInstruction() and
+ c.getArgument(sizeIndex) = sizeInstr and
c.getStaticCallTarget() = func and
pragma[only_bind_into](func)
.hasArrayWithVariableSize(pragma[only_bind_into](bufIndex),
pragma[only_bind_into](sizeIndex)) and
- bounded(c.getArgument(sizeIndex), sizeInstr, delta) and
+ bounded(sizeInstr, sizeBound, delta) and
eBuf = bufInstr.getUnconvertedResultExpression()
)
}
@@ -86,99 +95,39 @@ module ValidState {
private module ValidStateConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { hasSize(_, source, _) }
- predicate isSink(DataFlow::Node sink) { isSinkPairImpl(_, _, sink, _, _) }
-
- predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
- isAdditionalFlowStep2(node1, node2, _)
- }
+ predicate isSink(DataFlow::Node sink) { isSinkPairImpl0(_, _, sink, _, _, _, _) }
- predicate includeHiddenNodes() { any() }
+ predicate isBarrierOut(DataFlow::Node node) { DataFlow::flowsToBackEdge(node) }
}
private import DataFlow::Global
- private predicate inLoop(PathNode n) { n.getASuccessor+() = n }
-
- /**
- * Holds if `value` is a possible offset for `n`.
- *
- * To ensure termination, we limit `value` to be in the
- * range `[-2, 2]` if the node is part of a loop. Without
- * this restriction we wouldn't terminate on an example like:
- * ```cpp
- * while(unknown()) { size++; }
- * ```
- */
- private predicate validStateImpl(PathNode n, int value) {
- // If the dataflow node depends recursively on itself we restrict the range.
- (inLoop(n) implies value = [-2 .. 2]) and
- (
- // For the dataflow source we have an allocation such as `malloc(size + k)`,
- // and the value of the flow-state is then `k`.
- hasSize(_, n.getNode(), value)
- or
- // For a dataflow sink any `value` that is strictly smaller than the delta
- // needs to be a valid flow-state. That is, for a snippet like:
- // ```
- // p = b ? new char[size] : new char[size + 1];
- // memset(p, 0, size + 2);
- // ```
- // the valid flow-states at the `memset` must include the set `{0, 1}` since the
- // flow-state at `new char[size]` is `0`, and the flow-state at `new char[size + 1]`
- // is `1`.
- //
- // So we find a valid flow-state at the sink's predecessor, and use the definition
- // of our sink predicate to compute the valid flow-states at the sink.
- exists(int delta, PathNode n0 |
- n0.getASuccessor() = n and
- validStateImpl(n0, value) and
- isSinkPairImpl(_, _, n.getNode(), delta, _) and
- delta > value
- )
- or
- // For a non-source and non-sink node there is two cases to consider.
- // 1. A node where we have to update the flow-state, or
- // 2. A node that doesn't update the flow-state.
- //
- // For case 1, we compute the new flow-state by adding the constant operand of the
- // `AddInstruction` to the flow-state of any predecessor node.
- // For case 2 we simply propagate the valid flow-states from the predecessor node to
- // the next one.
- exists(PathNode n0, DataFlow::Node node0, DataFlow::Node node, int value0 |
- n0.getASuccessor() = n and
- validStateImpl(n0, value0) and
- node = n.getNode() and
- node0 = n0.getNode()
- |
- exists(int delta |
- isAdditionalFlowStep2(node0, node, delta) and
- value0 = value + delta
- )
- or
- not isAdditionalFlowStep2(node0, node, _) and
- value = value0
- )
- )
- }
-
- predicate validState(DataFlow::Node n, int value) {
- validStateImpl(any(PathNode pn | pn.getNode() = n), value)
+ predicate validState(DataFlow::Node source, DataFlow::Node sink, int value) {
+ hasSize(_, source, value) and
+ flow(source, sink)
}
}
import ValidState
-/**
- * Holds if `node2` is a dataflow node that represents an addition of two operands `op1`
- * and `op2` such that:
- * 1. `node1` is the dataflow node that represents `op1`, and
- * 2. the value of `op2` can be upper bounded by `delta.`
- */
-predicate isAdditionalFlowStep2(DataFlow::Node node1, DataFlow::Node node2, int delta) {
- exists(AddInstruction add, Operand op |
- add.hasOperands(node1.asOperand(), op) and
- semBounded(getSemanticExpr(op.getDef()), any(SemZeroBound zero), delta, true, _) and
- node2.asInstruction() = add
+module SizeBarrierInput implements SizeBarrierInputSig {
+ int fieldFlowBranchLimit() { result = 2 }
+
+ predicate isSource(DataFlow::Node source) {
+ exists(int state |
+ hasSize(_, source, state) and
+ validState(source, _, state)
+ )
+ }
+}
+
+predicate isSinkPairImpl(
+ CallInstruction c, DataFlow::Node bufSink, DataFlow::Node sizeSink, int delta, Expr eBuf
+) {
+ exists(Instruction sizeBound, Instruction sizeInstr |
+ isSinkPairImpl0(c, bufSink, sizeSink, delta, eBuf, sizeBound, sizeInstr) and
+ not sizeBound = SizeBarrier::getABarrierInstruction(delta) and
+ not sizeInstr = SizeBarrier::getABarrierInstruction(delta)
)
}
@@ -198,14 +147,14 @@ module StringSizeConfig implements ProductFlow::StateConfigSig {
// to the size of the allocation. This state is then checked in `isSinkPair`.
exists(state1) and
hasSize(bufSource.asExpr(), sizeSource, state2) and
- validState(sizeSource, state2)
+ validState(sizeSource, _, state2)
}
predicate isSinkPair(
DataFlow::Node bufSink, FlowState1 state1, DataFlow::Node sizeSink, FlowState2 state2
) {
exists(state1) and
- validState(sizeSink, state2) and
+ validState(_, sizeSink, state2) and
exists(int delta |
isSinkPairImpl(_, bufSink, sizeSink, delta, _) and
delta > state2
@@ -214,14 +163,8 @@ module StringSizeConfig implements ProductFlow::StateConfigSig {
predicate isBarrierOut2(DataFlow::Node node) { DataFlow::flowsToBackEdge(node) }
- predicate isAdditionalFlowStep2(
- DataFlow::Node node1, FlowState2 state1, DataFlow::Node node2, FlowState2 state2
- ) {
- validState(node2, state2) and
- exists(int delta |
- isAdditionalFlowStep2(node1, node2, delta) and
- state1 = state2 + delta
- )
+ predicate isBarrier2(DataFlow::Node node, FlowState2 state) {
+ node = SizeBarrier::getABarrierNode(state)
}
}
diff --git a/cpp/ql/src/change-notes/2025-07-10-pthread-and-std-thread.md b/cpp/ql/src/change-notes/2025-07-10-pthread-and-std-thread.md
deleted file mode 100644
index 8e8d0659fa62..000000000000
--- a/cpp/ql/src/change-notes/2025-07-10-pthread-and-std-thread.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Added flow models for `pthread_create` and `std::thread`.
\ No newline at end of file
diff --git a/cpp/ql/src/change-notes/2025-07-10-wchar-fp.md b/cpp/ql/src/change-notes/2025-07-10-wchar-fp.md
deleted file mode 100644
index db940f182861..000000000000
--- a/cpp/ql/src/change-notes/2025-07-10-wchar-fp.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* The `cpp/incorrect-string-type-conversion` query no longer alerts on incorrect type conversions that occur in unreachable code.
diff --git a/cpp/ql/src/change-notes/2025-07-11-function-objects.md b/cpp/ql/src/change-notes/2025-07-11-function-objects.md
deleted file mode 100644
index 48bc71f27ca8..000000000000
--- a/cpp/ql/src/change-notes/2025-07-11-function-objects.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Improved support for dataflow through function objects and lambda expressions.
\ No newline at end of file
diff --git a/cpp/ql/src/change-notes/released/1.4.4.md b/cpp/ql/src/change-notes/released/1.4.4.md
index 819e8dcd7284..87e1b909fbb9 100644
--- a/cpp/ql/src/change-notes/released/1.4.4.md
+++ b/cpp/ql/src/change-notes/released/1.4.4.md
@@ -2,7 +2,11 @@
### Minor Analysis Improvements
+* Due to changes in the `FunctionWithWrappers` library (`semmle.code.cpp.security.FunctionWithWrappers`) the primary alert location generated by the queries `cpp/path-injection`, `cpp/sql-injection`, `cpp/tainted-format-string`, and `cpp/command-line-injection` may have changed.
* Added flow models for the Win32 API functions `CreateThread`, `CreateRemoteThread`, and `CreateRemoteThreadEx`.
+* Improved support for dataflow through function objects and lambda expressions.
+* Added flow models for `pthread_create` and `std::thread`.
+* The `cpp/incorrect-string-type-conversion` query no longer alerts on incorrect type conversions that occur in unreachable code.
* Added flow models for the GNU C Library.
* Fixed a number of false positives and false negatives in `cpp/global-use-before-init`. Note that this query is not part of any of the default query suites.
* The query `cpp/sql-injection` now can be extended using the `sql-injection` Models as Data (MaD) sink kind.
diff --git a/cpp/ql/src/change-notes/released/1.4.5.md b/cpp/ql/src/change-notes/released/1.4.5.md
new file mode 100644
index 000000000000..2b606677eba6
--- /dev/null
+++ b/cpp/ql/src/change-notes/released/1.4.5.md
@@ -0,0 +1,5 @@
+## 1.4.5
+
+### Minor Analysis Improvements
+
+* The "Initialization code not run" query (`cpp/initialization-not-run`) no longer reports an alert on static global variables that have no dereference.
diff --git a/cpp/ql/src/codeql-pack.release.yml b/cpp/ql/src/codeql-pack.release.yml
index 1dfca6daa3b1..a74b6b08d860 100644
--- a/cpp/ql/src/codeql-pack.release.yml
+++ b/cpp/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 1.4.4
+lastReleaseVersion: 1.4.5
diff --git a/cpp/ql/src/qlpack.yml b/cpp/ql/src/qlpack.yml
index 9fe6ea9f5489..ad3dc6c91f9e 100644
--- a/cpp/ql/src/qlpack.yml
+++ b/cpp/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/cpp-queries
-version: 1.4.5-dev
+version: 1.4.6-dev
groups:
- cpp
- queries
diff --git a/cpp/ql/test/library-tests/dataflow/external-models/flow.expected b/cpp/ql/test/library-tests/dataflow/external-models/flow.expected
index bf9a4ed28d01..b1f984680ad6 100644
--- a/cpp/ql/test/library-tests/dataflow/external-models/flow.expected
+++ b/cpp/ql/test/library-tests/dataflow/external-models/flow.expected
@@ -21,14 +21,22 @@ models
| 20 | Summary: ; ; false; CreateRemoteThreadEx; ; ; Argument[@4]; Argument[3].Parameter[@0]; value; manual |
| 21 | Summary: ; ; false; CreateThread; ; ; Argument[@3]; Argument[2].Parameter[@0]; value; manual |
| 22 | Summary: ; ; false; ReadFileEx; ; ; Argument[*3].Field[@hEvent]; Argument[4].Parameter[*2].Field[@hEvent]; value; manual |
-| 23 | Summary: ; ; false; callWithArgument; ; ; Argument[1]; Argument[0].Parameter[0]; value; manual |
-| 24 | Summary: ; ; false; pthread_create; ; ; Argument[@3]; Argument[2].Parameter[@0]; value; manual |
-| 25 | Summary: ; ; false; ymlStepGenerated; ; ; Argument[0]; ReturnValue; taint; df-generated |
-| 26 | Summary: ; ; false; ymlStepManual; ; ; Argument[0]; ReturnValue; taint; manual |
-| 27 | Summary: ; ; false; ymlStepManual_with_body; ; ; Argument[0]; ReturnValue; taint; manual |
-| 28 | Summary: boost::asio; ; false; buffer; ; ; Argument[*0]; ReturnValue; taint; manual |
+| 23 | Summary: ; ; false; RtlCopyDeviceMemory; ; ; Argument[*@1]; Argument[*@0]; value; manual |
+| 24 | Summary: ; ; false; RtlCopyMemory; ; ; Argument[*@1]; Argument[*@0]; value; manual |
+| 25 | Summary: ; ; false; RtlCopyMemoryNonTemporal; ; ; Argument[*@1]; Argument[*@0]; value; manual |
+| 26 | Summary: ; ; false; RtlCopyUnicodeString; ; ; Argument[*1].Field[*Buffer]; Argument[*0].Field[*Buffer]; value; manual |
+| 27 | Summary: ; ; false; RtlCopyVolatileMemory; ; ; Argument[*@1]; Argument[*@0]; value; manual |
+| 28 | Summary: ; ; false; RtlInitUnicodeString; ; ; Argument[*1]; Argument[*0].Field[*Buffer]; value; manual |
+| 29 | Summary: ; ; false; RtlMoveMemory; ; ; Argument[*@1]; Argument[*@0]; value; manual |
+| 30 | Summary: ; ; false; RtlMoveVolatileMemory; ; ; Argument[*@1]; Argument[*@0]; value; manual |
+| 31 | Summary: ; ; false; callWithArgument; ; ; Argument[1]; Argument[0].Parameter[0]; value; manual |
+| 32 | Summary: ; ; false; pthread_create; ; ; Argument[@3]; Argument[2].Parameter[@0]; value; manual |
+| 33 | Summary: ; ; false; ymlStepGenerated; ; ; Argument[0]; ReturnValue; taint; df-generated |
+| 34 | Summary: ; ; false; ymlStepManual; ; ; Argument[0]; ReturnValue; taint; manual |
+| 35 | Summary: ; ; false; ymlStepManual_with_body; ; ; Argument[0]; ReturnValue; taint; manual |
+| 36 | Summary: boost::asio; ; false; buffer; ; ; Argument[*0]; ReturnValue; taint; manual |
edges
-| asio_streams.cpp:56:18:56:23 | [summary param] *0 in buffer | asio_streams.cpp:56:18:56:23 | [summary] to write: ReturnValue in buffer | provenance | MaD:28 |
+| asio_streams.cpp:56:18:56:23 | [summary param] *0 in buffer | asio_streams.cpp:56:18:56:23 | [summary] to write: ReturnValue in buffer | provenance | MaD:36 |
| asio_streams.cpp:87:34:87:44 | read_until output argument | asio_streams.cpp:91:7:91:17 | recv_buffer | provenance | Src:MaD:17 |
| asio_streams.cpp:87:34:87:44 | read_until output argument | asio_streams.cpp:93:29:93:39 | *recv_buffer | provenance | Src:MaD:17 Sink:MaD:2 |
| asio_streams.cpp:97:37:97:44 | call to source | asio_streams.cpp:98:7:98:14 | send_str | provenance | TaintFunction |
@@ -37,10 +45,10 @@ edges
| asio_streams.cpp:100:44:100:62 | call to buffer | asio_streams.cpp:101:7:101:17 | send_buffer | provenance | |
| asio_streams.cpp:100:44:100:62 | call to buffer | asio_streams.cpp:103:29:103:39 | *send_buffer | provenance | Sink:MaD:2 |
| asio_streams.cpp:100:64:100:71 | *send_str | asio_streams.cpp:56:18:56:23 | [summary param] *0 in buffer | provenance | |
-| asio_streams.cpp:100:64:100:71 | *send_str | asio_streams.cpp:100:44:100:62 | call to buffer | provenance | MaD:28 |
-| test.cpp:4:5:4:17 | [summary param] 0 in ymlStepManual | test.cpp:4:5:4:17 | [summary] to write: ReturnValue in ymlStepManual | provenance | MaD:26 |
-| test.cpp:5:5:5:20 | [summary param] 0 in ymlStepGenerated | test.cpp:5:5:5:20 | [summary] to write: ReturnValue in ymlStepGenerated | provenance | MaD:25 |
-| test.cpp:6:5:6:27 | [summary param] 0 in ymlStepManual_with_body | test.cpp:6:5:6:27 | [summary] to write: ReturnValue in ymlStepManual_with_body | provenance | MaD:27 |
+| asio_streams.cpp:100:64:100:71 | *send_str | asio_streams.cpp:100:44:100:62 | call to buffer | provenance | MaD:36 |
+| test.cpp:4:5:4:17 | [summary param] 0 in ymlStepManual | test.cpp:4:5:4:17 | [summary] to write: ReturnValue in ymlStepManual | provenance | MaD:34 |
+| test.cpp:5:5:5:20 | [summary param] 0 in ymlStepGenerated | test.cpp:5:5:5:20 | [summary] to write: ReturnValue in ymlStepGenerated | provenance | MaD:33 |
+| test.cpp:6:5:6:27 | [summary param] 0 in ymlStepManual_with_body | test.cpp:6:5:6:27 | [summary] to write: ReturnValue in ymlStepManual_with_body | provenance | MaD:35 |
| test.cpp:7:47:7:52 | value2 | test.cpp:7:64:7:69 | value2 | provenance | |
| test.cpp:7:64:7:69 | value2 | test.cpp:7:5:7:30 | *ymlStepGenerated_with_body | provenance | |
| test.cpp:10:10:10:18 | call to ymlSource | test.cpp:10:10:10:18 | call to ymlSource | provenance | Src:MaD:16 |
@@ -52,15 +60,15 @@ edges
| test.cpp:17:10:17:22 | call to ymlStepManual | test.cpp:17:10:17:22 | call to ymlStepManual | provenance | |
| test.cpp:17:10:17:22 | call to ymlStepManual | test.cpp:18:10:18:10 | y | provenance | Sink:MaD:1 |
| test.cpp:17:24:17:24 | x | test.cpp:4:5:4:17 | [summary param] 0 in ymlStepManual | provenance | |
-| test.cpp:17:24:17:24 | x | test.cpp:17:10:17:22 | call to ymlStepManual | provenance | MaD:26 |
+| test.cpp:17:24:17:24 | x | test.cpp:17:10:17:22 | call to ymlStepManual | provenance | MaD:34 |
| test.cpp:21:10:21:25 | call to ymlStepGenerated | test.cpp:21:10:21:25 | call to ymlStepGenerated | provenance | |
| test.cpp:21:10:21:25 | call to ymlStepGenerated | test.cpp:22:10:22:10 | z | provenance | Sink:MaD:1 |
| test.cpp:21:27:21:27 | x | test.cpp:5:5:5:20 | [summary param] 0 in ymlStepGenerated | provenance | |
-| test.cpp:21:27:21:27 | x | test.cpp:21:10:21:25 | call to ymlStepGenerated | provenance | MaD:25 |
+| test.cpp:21:27:21:27 | x | test.cpp:21:10:21:25 | call to ymlStepGenerated | provenance | MaD:33 |
| test.cpp:25:11:25:33 | call to ymlStepManual_with_body | test.cpp:25:11:25:33 | call to ymlStepManual_with_body | provenance | |
| test.cpp:25:11:25:33 | call to ymlStepManual_with_body | test.cpp:26:10:26:11 | y2 | provenance | Sink:MaD:1 |
| test.cpp:25:35:25:35 | x | test.cpp:6:5:6:27 | [summary param] 0 in ymlStepManual_with_body | provenance | |
-| test.cpp:25:35:25:35 | x | test.cpp:25:11:25:33 | call to ymlStepManual_with_body | provenance | MaD:27 |
+| test.cpp:25:35:25:35 | x | test.cpp:25:11:25:33 | call to ymlStepManual_with_body | provenance | MaD:35 |
| test.cpp:32:11:32:36 | call to ymlStepGenerated_with_body | test.cpp:32:11:32:36 | call to ymlStepGenerated_with_body | provenance | |
| test.cpp:32:11:32:36 | call to ymlStepGenerated_with_body | test.cpp:33:10:33:11 | z2 | provenance | Sink:MaD:1 |
| test.cpp:32:41:32:41 | x | test.cpp:7:47:7:52 | value2 | provenance | |
@@ -68,16 +76,16 @@ edges
| test.cpp:46:30:46:32 | *arg [x] | test.cpp:47:12:47:19 | *arg [x] | provenance | |
| test.cpp:47:12:47:19 | *arg [x] | test.cpp:48:13:48:13 | *s [x] | provenance | |
| test.cpp:48:13:48:13 | *s [x] | test.cpp:48:16:48:16 | x | provenance | Sink:MaD:1 |
-| test.cpp:52:5:52:18 | [summary param] *3 in pthread_create [x] | test.cpp:52:5:52:18 | [summary] to write: Argument[2].Parameter[*0] in pthread_create [x] | provenance | MaD:24 |
+| test.cpp:52:5:52:18 | [summary param] *3 in pthread_create [x] | test.cpp:52:5:52:18 | [summary] to write: Argument[2].Parameter[*0] in pthread_create [x] | provenance | MaD:32 |
| test.cpp:52:5:52:18 | [summary] to write: Argument[2].Parameter[*0] in pthread_create [x] | test.cpp:46:30:46:32 | *arg [x] | provenance | |
| test.cpp:56:2:56:2 | *s [post update] [x] | test.cpp:59:55:59:64 | *& ... [x] | provenance | |
| test.cpp:56:2:56:18 | ... = ... | test.cpp:56:2:56:2 | *s [post update] [x] | provenance | |
| test.cpp:56:8:56:16 | call to ymlSource | test.cpp:56:2:56:18 | ... = ... | provenance | Src:MaD:16 |
| test.cpp:59:55:59:64 | *& ... [x] | test.cpp:52:5:52:18 | [summary param] *3 in pthread_create [x] | provenance | |
-| test.cpp:63:6:63:21 | [summary param] 1 in callWithArgument | test.cpp:63:6:63:21 | [summary] to write: Argument[0].Parameter[0] in callWithArgument | provenance | MaD:23 |
-| test.cpp:63:6:63:21 | [summary param] 1 in callWithArgument | test.cpp:63:6:63:21 | [summary] to write: Argument[0].Parameter[0] in callWithArgument | provenance | MaD:23 |
-| test.cpp:63:6:63:21 | [summary param] 1 in callWithArgument | test.cpp:63:6:63:21 | [summary] to write: Argument[0].Parameter[0] in callWithArgument | provenance | MaD:23 |
-| test.cpp:63:6:63:21 | [summary param] 1 in callWithArgument | test.cpp:63:6:63:21 | [summary] to write: Argument[0].Parameter[0] in callWithArgument | provenance | MaD:23 |
+| test.cpp:63:6:63:21 | [summary param] 1 in callWithArgument | test.cpp:63:6:63:21 | [summary] to write: Argument[0].Parameter[0] in callWithArgument | provenance | MaD:31 |
+| test.cpp:63:6:63:21 | [summary param] 1 in callWithArgument | test.cpp:63:6:63:21 | [summary] to write: Argument[0].Parameter[0] in callWithArgument | provenance | MaD:31 |
+| test.cpp:63:6:63:21 | [summary param] 1 in callWithArgument | test.cpp:63:6:63:21 | [summary] to write: Argument[0].Parameter[0] in callWithArgument | provenance | MaD:31 |
+| test.cpp:63:6:63:21 | [summary param] 1 in callWithArgument | test.cpp:63:6:63:21 | [summary] to write: Argument[0].Parameter[0] in callWithArgument | provenance | MaD:31 |
| test.cpp:63:6:63:21 | [summary] to write: Argument[0].Parameter[0] in callWithArgument | test.cpp:68:22:68:22 | y | provenance | |
| test.cpp:63:6:63:21 | [summary] to write: Argument[0].Parameter[0] in callWithArgument | test.cpp:74:22:74:22 | y | provenance | |
| test.cpp:63:6:63:21 | [summary] to write: Argument[0].Parameter[0] in callWithArgument | test.cpp:82:22:82:22 | y | provenance | |
@@ -180,6 +188,59 @@ edges
| windows.cpp:439:7:439:8 | *& ... [x] | windows.cpp:349:8:349:19 | [summary param] *3 in CreateThread [x] | provenance | |
| windows.cpp:451:7:451:8 | *& ... [x] | windows.cpp:357:8:357:25 | [summary param] *4 in CreateRemoteThread [x] | provenance | |
| windows.cpp:464:7:464:8 | *& ... [x] | windows.cpp:387:8:387:27 | [summary param] *4 in CreateRemoteThreadEx [x] | provenance | |
+| windows.cpp:473:17:473:37 | [summary param] *1 in RtlCopyVolatileMemory | windows.cpp:473:17:473:37 | [summary param] *0 in RtlCopyVolatileMemory [Return] | provenance | MaD:27 |
+| windows.cpp:479:17:479:35 | [summary param] *1 in RtlCopyDeviceMemory | windows.cpp:479:17:479:35 | [summary param] *0 in RtlCopyDeviceMemory [Return] | provenance | MaD:23 |
+| windows.cpp:485:6:485:18 | [summary param] *1 in RtlCopyMemory | windows.cpp:485:6:485:18 | [summary param] *0 in RtlCopyMemory [Return] | provenance | MaD:24 |
+| windows.cpp:493:6:493:29 | [summary param] *1 in RtlCopyMemoryNonTemporal | windows.cpp:493:6:493:29 | [summary param] *0 in RtlCopyMemoryNonTemporal [Return] | provenance | MaD:25 |
+| windows.cpp:510:6:510:25 | [summary param] *1 in RtlCopyUnicodeString [*Buffer] | windows.cpp:510:6:510:25 | [summary] read: Argument[*1].Field[*Buffer] in RtlCopyUnicodeString | provenance | |
+| windows.cpp:510:6:510:25 | [summary] read: Argument[*1].Field[*Buffer] in RtlCopyUnicodeString | windows.cpp:510:6:510:25 | [summary] to write: Argument[*0].Field[*Buffer] in RtlCopyUnicodeString | provenance | MaD:26 |
+| windows.cpp:510:6:510:25 | [summary] to write: Argument[*0] in RtlCopyUnicodeString [*Buffer] | windows.cpp:510:6:510:25 | [summary param] *0 in RtlCopyUnicodeString [Return] [*Buffer] | provenance | |
+| windows.cpp:510:6:510:25 | [summary] to write: Argument[*0].Field[*Buffer] in RtlCopyUnicodeString | windows.cpp:510:6:510:25 | [summary] to write: Argument[*0] in RtlCopyUnicodeString [*Buffer] | provenance | |
+| windows.cpp:515:6:515:18 | [summary param] *1 in RtlMoveMemory | windows.cpp:515:6:515:18 | [summary param] *0 in RtlMoveMemory [Return] | provenance | MaD:29 |
+| windows.cpp:521:17:521:37 | [summary param] *1 in RtlMoveVolatileMemory | windows.cpp:521:17:521:37 | [summary param] *0 in RtlMoveVolatileMemory [Return] | provenance | MaD:30 |
+| windows.cpp:527:6:527:25 | [summary param] *1 in RtlInitUnicodeString | windows.cpp:527:6:527:25 | [summary] to write: Argument[*0].Field[*Buffer] in RtlInitUnicodeString | provenance | MaD:28 |
+| windows.cpp:527:6:527:25 | [summary] to write: Argument[*0] in RtlInitUnicodeString [*Buffer] | windows.cpp:527:6:527:25 | [summary param] *0 in RtlInitUnicodeString [Return] [*Buffer] | provenance | |
+| windows.cpp:527:6:527:25 | [summary] to write: Argument[*0].Field[*Buffer] in RtlInitUnicodeString | windows.cpp:527:6:527:25 | [summary] to write: Argument[*0] in RtlInitUnicodeString [*Buffer] | provenance | |
+| windows.cpp:533:11:533:16 | call to source | windows.cpp:533:11:533:16 | call to source | provenance | |
+| windows.cpp:533:11:533:16 | call to source | windows.cpp:537:40:537:41 | *& ... | provenance | |
+| windows.cpp:533:11:533:16 | call to source | windows.cpp:542:38:542:39 | *& ... | provenance | |
+| windows.cpp:533:11:533:16 | call to source | windows.cpp:547:32:547:33 | *& ... | provenance | |
+| windows.cpp:533:11:533:16 | call to source | windows.cpp:552:43:552:44 | *& ... | provenance | |
+| windows.cpp:533:11:533:16 | call to source | windows.cpp:568:32:568:33 | *& ... | provenance | |
+| windows.cpp:533:11:533:16 | call to source | windows.cpp:573:40:573:41 | *& ... | provenance | |
+| windows.cpp:537:27:537:37 | RtlCopyVolatileMemory output argument | windows.cpp:538:10:538:23 | access to array | provenance | |
+| windows.cpp:537:40:537:41 | *& ... | windows.cpp:473:17:473:37 | [summary param] *1 in RtlCopyVolatileMemory | provenance | |
+| windows.cpp:537:40:537:41 | *& ... | windows.cpp:537:27:537:37 | RtlCopyVolatileMemory output argument | provenance | MaD:27 |
+| windows.cpp:542:25:542:35 | RtlCopyDeviceMemory output argument | windows.cpp:543:10:543:23 | access to array | provenance | |
+| windows.cpp:542:38:542:39 | *& ... | windows.cpp:479:17:479:35 | [summary param] *1 in RtlCopyDeviceMemory | provenance | |
+| windows.cpp:542:38:542:39 | *& ... | windows.cpp:542:25:542:35 | RtlCopyDeviceMemory output argument | provenance | MaD:23 |
+| windows.cpp:547:19:547:29 | RtlCopyMemory output argument | windows.cpp:548:10:548:23 | access to array | provenance | |
+| windows.cpp:547:32:547:33 | *& ... | windows.cpp:485:6:485:18 | [summary param] *1 in RtlCopyMemory | provenance | |
+| windows.cpp:547:32:547:33 | *& ... | windows.cpp:547:19:547:29 | RtlCopyMemory output argument | provenance | MaD:24 |
+| windows.cpp:552:30:552:40 | RtlCopyMemoryNonTemporal output argument | windows.cpp:553:10:553:23 | access to array | provenance | |
+| windows.cpp:552:43:552:44 | *& ... | windows.cpp:493:6:493:29 | [summary param] *1 in RtlCopyMemoryNonTemporal | provenance | |
+| windows.cpp:552:43:552:44 | *& ... | windows.cpp:552:30:552:40 | RtlCopyMemoryNonTemporal output argument | provenance | MaD:25 |
+| windows.cpp:559:5:559:24 | ... = ... | windows.cpp:561:39:561:44 | *buffer | provenance | |
+| windows.cpp:559:17:559:24 | call to source | windows.cpp:559:5:559:24 | ... = ... | provenance | |
+| windows.cpp:561:26:561:36 | RtlInitUnicodeString output argument [*Buffer] | windows.cpp:562:10:562:19 | *src_string [*Buffer] | provenance | |
+| windows.cpp:561:26:561:36 | RtlInitUnicodeString output argument [*Buffer] | windows.cpp:563:40:563:50 | *& ... [*Buffer] | provenance | |
+| windows.cpp:561:39:561:44 | *buffer | windows.cpp:527:6:527:25 | [summary param] *1 in RtlInitUnicodeString | provenance | |
+| windows.cpp:561:39:561:44 | *buffer | windows.cpp:561:26:561:36 | RtlInitUnicodeString output argument [*Buffer] | provenance | MaD:28 |
+| windows.cpp:562:10:562:19 | *src_string [*Buffer] | windows.cpp:562:10:562:29 | access to array | provenance | |
+| windows.cpp:562:10:562:19 | *src_string [*Buffer] | windows.cpp:562:21:562:26 | *Buffer | provenance | |
+| windows.cpp:562:21:562:26 | *Buffer | windows.cpp:562:10:562:29 | access to array | provenance | |
+| windows.cpp:563:26:563:37 | RtlCopyUnicodeString output argument [*Buffer] | windows.cpp:564:10:564:20 | *dest_string [*Buffer] | provenance | |
+| windows.cpp:563:40:563:50 | *& ... [*Buffer] | windows.cpp:510:6:510:25 | [summary param] *1 in RtlCopyUnicodeString [*Buffer] | provenance | |
+| windows.cpp:563:40:563:50 | *& ... [*Buffer] | windows.cpp:563:26:563:37 | RtlCopyUnicodeString output argument [*Buffer] | provenance | MaD:26 |
+| windows.cpp:564:10:564:20 | *dest_string [*Buffer] | windows.cpp:564:10:564:30 | access to array | provenance | |
+| windows.cpp:564:10:564:20 | *dest_string [*Buffer] | windows.cpp:564:22:564:27 | *Buffer | provenance | |
+| windows.cpp:564:22:564:27 | *Buffer | windows.cpp:564:10:564:30 | access to array | provenance | |
+| windows.cpp:568:19:568:29 | RtlMoveMemory output argument | windows.cpp:569:10:569:23 | access to array | provenance | |
+| windows.cpp:568:32:568:33 | *& ... | windows.cpp:515:6:515:18 | [summary param] *1 in RtlMoveMemory | provenance | |
+| windows.cpp:568:32:568:33 | *& ... | windows.cpp:568:19:568:29 | RtlMoveMemory output argument | provenance | MaD:29 |
+| windows.cpp:573:27:573:37 | RtlMoveVolatileMemory output argument | windows.cpp:574:10:574:23 | access to array | provenance | |
+| windows.cpp:573:40:573:41 | *& ... | windows.cpp:521:17:521:37 | [summary param] *1 in RtlMoveVolatileMemory | provenance | |
+| windows.cpp:573:40:573:41 | *& ... | windows.cpp:573:27:573:37 | RtlMoveVolatileMemory output argument | provenance | MaD:30 |
nodes
| asio_streams.cpp:56:18:56:23 | [summary param] *0 in buffer | semmle.label | [summary param] *0 in buffer |
| asio_streams.cpp:56:18:56:23 | [summary] to write: ReturnValue in buffer | semmle.label | [summary] to write: ReturnValue in buffer |
@@ -352,6 +413,59 @@ nodes
| windows.cpp:439:7:439:8 | *& ... [x] | semmle.label | *& ... [x] |
| windows.cpp:451:7:451:8 | *& ... [x] | semmle.label | *& ... [x] |
| windows.cpp:464:7:464:8 | *& ... [x] | semmle.label | *& ... [x] |
+| windows.cpp:473:17:473:37 | [summary param] *0 in RtlCopyVolatileMemory [Return] | semmle.label | [summary param] *0 in RtlCopyVolatileMemory [Return] |
+| windows.cpp:473:17:473:37 | [summary param] *1 in RtlCopyVolatileMemory | semmle.label | [summary param] *1 in RtlCopyVolatileMemory |
+| windows.cpp:479:17:479:35 | [summary param] *0 in RtlCopyDeviceMemory [Return] | semmle.label | [summary param] *0 in RtlCopyDeviceMemory [Return] |
+| windows.cpp:479:17:479:35 | [summary param] *1 in RtlCopyDeviceMemory | semmle.label | [summary param] *1 in RtlCopyDeviceMemory |
+| windows.cpp:485:6:485:18 | [summary param] *0 in RtlCopyMemory [Return] | semmle.label | [summary param] *0 in RtlCopyMemory [Return] |
+| windows.cpp:485:6:485:18 | [summary param] *1 in RtlCopyMemory | semmle.label | [summary param] *1 in RtlCopyMemory |
+| windows.cpp:493:6:493:29 | [summary param] *0 in RtlCopyMemoryNonTemporal [Return] | semmle.label | [summary param] *0 in RtlCopyMemoryNonTemporal [Return] |
+| windows.cpp:493:6:493:29 | [summary param] *1 in RtlCopyMemoryNonTemporal | semmle.label | [summary param] *1 in RtlCopyMemoryNonTemporal |
+| windows.cpp:510:6:510:25 | [summary param] *0 in RtlCopyUnicodeString [Return] [*Buffer] | semmle.label | [summary param] *0 in RtlCopyUnicodeString [Return] [*Buffer] |
+| windows.cpp:510:6:510:25 | [summary param] *1 in RtlCopyUnicodeString [*Buffer] | semmle.label | [summary param] *1 in RtlCopyUnicodeString [*Buffer] |
+| windows.cpp:510:6:510:25 | [summary] read: Argument[*1].Field[*Buffer] in RtlCopyUnicodeString | semmle.label | [summary] read: Argument[*1].Field[*Buffer] in RtlCopyUnicodeString |
+| windows.cpp:510:6:510:25 | [summary] to write: Argument[*0] in RtlCopyUnicodeString [*Buffer] | semmle.label | [summary] to write: Argument[*0] in RtlCopyUnicodeString [*Buffer] |
+| windows.cpp:510:6:510:25 | [summary] to write: Argument[*0].Field[*Buffer] in RtlCopyUnicodeString | semmle.label | [summary] to write: Argument[*0].Field[*Buffer] in RtlCopyUnicodeString |
+| windows.cpp:515:6:515:18 | [summary param] *0 in RtlMoveMemory [Return] | semmle.label | [summary param] *0 in RtlMoveMemory [Return] |
+| windows.cpp:515:6:515:18 | [summary param] *1 in RtlMoveMemory | semmle.label | [summary param] *1 in RtlMoveMemory |
+| windows.cpp:521:17:521:37 | [summary param] *0 in RtlMoveVolatileMemory [Return] | semmle.label | [summary param] *0 in RtlMoveVolatileMemory [Return] |
+| windows.cpp:521:17:521:37 | [summary param] *1 in RtlMoveVolatileMemory | semmle.label | [summary param] *1 in RtlMoveVolatileMemory |
+| windows.cpp:527:6:527:25 | [summary param] *0 in RtlInitUnicodeString [Return] [*Buffer] | semmle.label | [summary param] *0 in RtlInitUnicodeString [Return] [*Buffer] |
+| windows.cpp:527:6:527:25 | [summary param] *1 in RtlInitUnicodeString | semmle.label | [summary param] *1 in RtlInitUnicodeString |
+| windows.cpp:527:6:527:25 | [summary] to write: Argument[*0] in RtlInitUnicodeString [*Buffer] | semmle.label | [summary] to write: Argument[*0] in RtlInitUnicodeString [*Buffer] |
+| windows.cpp:527:6:527:25 | [summary] to write: Argument[*0].Field[*Buffer] in RtlInitUnicodeString | semmle.label | [summary] to write: Argument[*0].Field[*Buffer] in RtlInitUnicodeString |
+| windows.cpp:533:11:533:16 | call to source | semmle.label | call to source |
+| windows.cpp:533:11:533:16 | call to source | semmle.label | call to source |
+| windows.cpp:537:27:537:37 | RtlCopyVolatileMemory output argument | semmle.label | RtlCopyVolatileMemory output argument |
+| windows.cpp:537:40:537:41 | *& ... | semmle.label | *& ... |
+| windows.cpp:538:10:538:23 | access to array | semmle.label | access to array |
+| windows.cpp:542:25:542:35 | RtlCopyDeviceMemory output argument | semmle.label | RtlCopyDeviceMemory output argument |
+| windows.cpp:542:38:542:39 | *& ... | semmle.label | *& ... |
+| windows.cpp:543:10:543:23 | access to array | semmle.label | access to array |
+| windows.cpp:547:19:547:29 | RtlCopyMemory output argument | semmle.label | RtlCopyMemory output argument |
+| windows.cpp:547:32:547:33 | *& ... | semmle.label | *& ... |
+| windows.cpp:548:10:548:23 | access to array | semmle.label | access to array |
+| windows.cpp:552:30:552:40 | RtlCopyMemoryNonTemporal output argument | semmle.label | RtlCopyMemoryNonTemporal output argument |
+| windows.cpp:552:43:552:44 | *& ... | semmle.label | *& ... |
+| windows.cpp:553:10:553:23 | access to array | semmle.label | access to array |
+| windows.cpp:559:5:559:24 | ... = ... | semmle.label | ... = ... |
+| windows.cpp:559:17:559:24 | call to source | semmle.label | call to source |
+| windows.cpp:561:26:561:36 | RtlInitUnicodeString output argument [*Buffer] | semmle.label | RtlInitUnicodeString output argument [*Buffer] |
+| windows.cpp:561:39:561:44 | *buffer | semmle.label | *buffer |
+| windows.cpp:562:10:562:19 | *src_string [*Buffer] | semmle.label | *src_string [*Buffer] |
+| windows.cpp:562:10:562:29 | access to array | semmle.label | access to array |
+| windows.cpp:562:21:562:26 | *Buffer | semmle.label | *Buffer |
+| windows.cpp:563:26:563:37 | RtlCopyUnicodeString output argument [*Buffer] | semmle.label | RtlCopyUnicodeString output argument [*Buffer] |
+| windows.cpp:563:40:563:50 | *& ... [*Buffer] | semmle.label | *& ... [*Buffer] |
+| windows.cpp:564:10:564:20 | *dest_string [*Buffer] | semmle.label | *dest_string [*Buffer] |
+| windows.cpp:564:10:564:30 | access to array | semmle.label | access to array |
+| windows.cpp:564:22:564:27 | *Buffer | semmle.label | *Buffer |
+| windows.cpp:568:19:568:29 | RtlMoveMemory output argument | semmle.label | RtlMoveMemory output argument |
+| windows.cpp:568:32:568:33 | *& ... | semmle.label | *& ... |
+| windows.cpp:569:10:569:23 | access to array | semmle.label | access to array |
+| windows.cpp:573:27:573:37 | RtlMoveVolatileMemory output argument | semmle.label | RtlMoveVolatileMemory output argument |
+| windows.cpp:573:40:573:41 | *& ... | semmle.label | *& ... |
+| windows.cpp:574:10:574:23 | access to array | semmle.label | access to array |
subpaths
| asio_streams.cpp:100:64:100:71 | *send_str | asio_streams.cpp:56:18:56:23 | [summary param] *0 in buffer | asio_streams.cpp:56:18:56:23 | [summary] to write: ReturnValue in buffer | asio_streams.cpp:100:44:100:62 | call to buffer |
| test.cpp:17:24:17:24 | x | test.cpp:4:5:4:17 | [summary param] 0 in ymlStepManual | test.cpp:4:5:4:17 | [summary] to write: ReturnValue in ymlStepManual | test.cpp:17:10:17:22 | call to ymlStepManual |
@@ -359,4 +473,12 @@ subpaths
| test.cpp:25:35:25:35 | x | test.cpp:6:5:6:27 | [summary param] 0 in ymlStepManual_with_body | test.cpp:6:5:6:27 | [summary] to write: ReturnValue in ymlStepManual_with_body | test.cpp:25:11:25:33 | call to ymlStepManual_with_body |
| test.cpp:32:41:32:41 | x | test.cpp:7:47:7:52 | value2 | test.cpp:7:5:7:30 | *ymlStepGenerated_with_body | test.cpp:32:11:32:36 | call to ymlStepGenerated_with_body |
| windows.cpp:27:36:27:38 | *cmd | windows.cpp:17:8:17:25 | [summary param] *0 in CommandLineToArgvA | windows.cpp:17:8:17:25 | [summary] to write: ReturnValue[**] in CommandLineToArgvA | windows.cpp:27:17:27:34 | **call to CommandLineToArgvA |
+| windows.cpp:537:40:537:41 | *& ... | windows.cpp:473:17:473:37 | [summary param] *1 in RtlCopyVolatileMemory | windows.cpp:473:17:473:37 | [summary param] *0 in RtlCopyVolatileMemory [Return] | windows.cpp:537:27:537:37 | RtlCopyVolatileMemory output argument |
+| windows.cpp:542:38:542:39 | *& ... | windows.cpp:479:17:479:35 | [summary param] *1 in RtlCopyDeviceMemory | windows.cpp:479:17:479:35 | [summary param] *0 in RtlCopyDeviceMemory [Return] | windows.cpp:542:25:542:35 | RtlCopyDeviceMemory output argument |
+| windows.cpp:547:32:547:33 | *& ... | windows.cpp:485:6:485:18 | [summary param] *1 in RtlCopyMemory | windows.cpp:485:6:485:18 | [summary param] *0 in RtlCopyMemory [Return] | windows.cpp:547:19:547:29 | RtlCopyMemory output argument |
+| windows.cpp:552:43:552:44 | *& ... | windows.cpp:493:6:493:29 | [summary param] *1 in RtlCopyMemoryNonTemporal | windows.cpp:493:6:493:29 | [summary param] *0 in RtlCopyMemoryNonTemporal [Return] | windows.cpp:552:30:552:40 | RtlCopyMemoryNonTemporal output argument |
+| windows.cpp:561:39:561:44 | *buffer | windows.cpp:527:6:527:25 | [summary param] *1 in RtlInitUnicodeString | windows.cpp:527:6:527:25 | [summary param] *0 in RtlInitUnicodeString [Return] [*Buffer] | windows.cpp:561:26:561:36 | RtlInitUnicodeString output argument [*Buffer] |
+| windows.cpp:563:40:563:50 | *& ... [*Buffer] | windows.cpp:510:6:510:25 | [summary param] *1 in RtlCopyUnicodeString [*Buffer] | windows.cpp:510:6:510:25 | [summary param] *0 in RtlCopyUnicodeString [Return] [*Buffer] | windows.cpp:563:26:563:37 | RtlCopyUnicodeString output argument [*Buffer] |
+| windows.cpp:568:32:568:33 | *& ... | windows.cpp:515:6:515:18 | [summary param] *1 in RtlMoveMemory | windows.cpp:515:6:515:18 | [summary param] *0 in RtlMoveMemory [Return] | windows.cpp:568:19:568:29 | RtlMoveMemory output argument |
+| windows.cpp:573:40:573:41 | *& ... | windows.cpp:521:17:521:37 | [summary param] *1 in RtlMoveVolatileMemory | windows.cpp:521:17:521:37 | [summary param] *0 in RtlMoveVolatileMemory [Return] | windows.cpp:573:27:573:37 | RtlMoveVolatileMemory output argument |
testFailures
diff --git a/cpp/ql/test/library-tests/dataflow/external-models/validatemodels.expected b/cpp/ql/test/library-tests/dataflow/external-models/validatemodels.expected
index 6fdbe067e171..aeb2362ef339 100644
--- a/cpp/ql/test/library-tests/dataflow/external-models/validatemodels.expected
+++ b/cpp/ql/test/library-tests/dataflow/external-models/validatemodels.expected
@@ -5556,12 +5556,24 @@
| Dubious signature "(z_streamp,int *)" in summary model. |
| Dubious signature "(z_streamp,unsigned int *,int *)" in summary model. |
| Dubious signature "(z_streamp,unsigned int)" in summary model. |
+| Unrecognized input specification "Argument[***0]" in summary model. |
+| Unrecognized input specification "Argument[***1]" in summary model. |
| Unrecognized input specification "Argument[***3]" in summary model. |
| Unrecognized input specification "Argument[***4]" in summary model. |
+| Unrecognized input specification "Argument[****0]" in summary model. |
+| Unrecognized input specification "Argument[****1]" in summary model. |
| Unrecognized input specification "Argument[****3]" in summary model. |
| Unrecognized input specification "Argument[****4]" in summary model. |
+| Unrecognized input specification "Argument[*****0]" in summary model. |
+| Unrecognized input specification "Argument[*****1]" in summary model. |
| Unrecognized input specification "Field[****hEvent]" in summary model. |
| Unrecognized input specification "Field[***hEvent]" in summary model. |
+| Unrecognized output specification "Argument[***0]" in summary model. |
+| Unrecognized output specification "Argument[***1]" in summary model. |
+| Unrecognized output specification "Argument[****0]" in summary model. |
+| Unrecognized output specification "Argument[****1]" in summary model. |
+| Unrecognized output specification "Argument[*****0]" in summary model. |
+| Unrecognized output specification "Argument[*****1]" in summary model. |
| Unrecognized output specification "Field[****hEvent]" in summary model. |
| Unrecognized output specification "Field[***hEvent]" in summary model. |
| Unrecognized output specification "Parameter[***0]" in summary model. |
diff --git a/cpp/ql/test/library-tests/dataflow/external-models/windows.cpp b/cpp/ql/test/library-tests/dataflow/external-models/windows.cpp
index 2554dc9fd46c..3e03c1a69a5b 100644
--- a/cpp/ql/test/library-tests/dataflow/external-models/windows.cpp
+++ b/cpp/ql/test/library-tests/dataflow/external-models/windows.cpp
@@ -466,4 +466,111 @@ void test_create_thread()
&attrList,
&threadId);
}
+}
+
+using size_t = decltype(sizeof(0));
+
+volatile void * RtlCopyVolatileMemory(
+ volatile void *Destination,
+ volatile const void *Source,
+ size_t Length
+);
+
+volatile void * RtlCopyDeviceMemory(
+ volatile void *Destination,
+ volatile const void *Source,
+ size_t Length
+);
+
+void RtlCopyMemory(
+ void* Destination,
+ const void* Source,
+ size_t Length
+);
+
+using VOID = void;
+
+VOID RtlCopyMemoryNonTemporal(
+ VOID *Destination,
+ const VOID *Source,
+ SIZE_T Length
+);
+
+using USHORT = unsigned short;
+using PWSTR = wchar_t*;
+using PCWSTR = const wchar_t*;
+using PCUNICODE_STRING = const struct _UNICODE_STRING*;
+
+typedef struct _UNICODE_STRING {
+ USHORT Length;
+ USHORT MaximumLength;
+ PWSTR Buffer;
+} UNICODE_STRING, *PUNICODE_STRING;
+
+VOID RtlCopyUnicodeString(
+ PUNICODE_STRING DestinationString,
+ PCUNICODE_STRING SourceString
+);
+
+void RtlMoveMemory(
+ void* Destination,
+ const void* Source,
+ size_t Length
+);
+
+volatile void * RtlMoveVolatileMemory(
+ volatile void *Destination,
+ volatile const void *Source,
+ size_t Length
+);
+
+void RtlInitUnicodeString(
+ PUNICODE_STRING DestinationString,
+ PCWSTR SourceString
+);
+
+void test_copy_and_move_memory() {
+ int x = source();
+
+ {
+ char dest_buffer[1024];
+ RtlCopyVolatileMemory(dest_buffer, &x, sizeof(x));
+ sink(dest_buffer[0]); // $ ir
+ }
+ {
+ char dest_buffer[1024];
+ RtlCopyDeviceMemory(dest_buffer, &x, sizeof(x));
+ sink(dest_buffer[0]); // $ ir
+ }
+ {
+ char dest_buffer[1024];
+ RtlCopyMemory(dest_buffer, &x, sizeof(x));
+ sink(dest_buffer[0]); // $ ir
+ }
+ {
+ char dest_buffer[1024];
+ RtlCopyMemoryNonTemporal(dest_buffer, &x, sizeof(x));
+ sink(dest_buffer[0]); // $ ir
+ }
+ {
+ UNICODE_STRING dest_string;
+ UNICODE_STRING src_string;
+ wchar_t buffer[1024];
+ buffer[0] = source();
+
+ RtlInitUnicodeString(&src_string, buffer);
+ sink(src_string.Buffer[0]); // $ ir
+ RtlCopyUnicodeString(&dest_string, &src_string);
+ sink(dest_string.Buffer[0]); // $ ir
+ }
+ {
+ char dest_buffer[1024];
+ RtlMoveMemory(dest_buffer, &x, sizeof(x));
+ sink(dest_buffer[0]); // $ ir
+ }
+ {
+ volatile char dest_buffer[1024];
+ RtlMoveVolatileMemory(dest_buffer, &x, sizeof(x));
+ sink(dest_buffer[0]); // $ ir
+ }
}
\ No newline at end of file
diff --git a/cpp/ql/test/library-tests/ir/ir/PrintAST.expected b/cpp/ql/test/library-tests/ir/ir/PrintAST.expected
index 346ace60e2fe..a3ee6b46bd53 100644
--- a/cpp/ql/test/library-tests/ir/ir/PrintAST.expected
+++ b/cpp/ql/test/library-tests/ir/ir/PrintAST.expected
@@ -24436,6 +24436,107 @@ ir.cpp:
# 2742| Type = [IntType] int
# 2742| ValueCategory = prvalue
# 2743| getStmt(14): [ReturnStmt] return ...
+# 2747| [CopyAssignmentOperator] std::strong_ordering& std::strong_ordering::operator=(std::strong_ordering const&)
+# 2747| :
+#-----| getParameter(0): [Parameter] (unnamed parameter 0)
+#-----| Type = [LValueReferenceType] const strong_ordering &
+# 2747| [MoveAssignmentOperator] std::strong_ordering& std::strong_ordering::operator=(std::strong_ordering&&)
+# 2747| :
+#-----| getParameter(0): [Parameter] (unnamed parameter 0)
+#-----| Type = [RValueReferenceType] strong_ordering &&
+# 2747| [CopyConstructor] void std::strong_ordering::strong_ordering(std::strong_ordering const&)
+# 2747| :
+#-----| getParameter(0): [Parameter] (unnamed parameter 0)
+#-----| Type = [LValueReferenceType] const strong_ordering &
+# 2747| [MoveConstructor] void std::strong_ordering::strong_ordering(std::strong_ordering&&)
+# 2747| :
+#-----| getParameter(0): [Parameter] (unnamed parameter 0)
+#-----| Type = [RValueReferenceType] strong_ordering &&
+# 2747| :
+# 2747| getEntryPoint(): [BlockStmt] { ... }
+# 2747| getStmt(0): [ReturnStmt] return ...
+# 2748| [Constructor] void std::strong_ordering::strong_ordering(std::_Order)
+# 2748| :
+# 2748| getParameter(0): [Parameter] v
+# 2748| Type = [ScopedEnum] _Order
+# 2748| :
+# 2748| getEntryPoint(): [BlockStmt] { ... }
+# 2748| getStmt(0): [ReturnStmt] return ...
+# 2763| [CopyAssignmentOperator] ThreeWay& ThreeWay::operator=(ThreeWay const&)
+# 2763| :
+#-----| getParameter(0): [Parameter] (unnamed parameter 0)
+#-----| Type = [LValueReferenceType] const ThreeWay &
+# 2763| [MoveAssignmentOperator] ThreeWay& ThreeWay::operator=(ThreeWay&&)
+# 2763| :
+#-----| getParameter(0): [Parameter] (unnamed parameter 0)
+#-----| Type = [RValueReferenceType] ThreeWay &&
+# 2763| [Constructor] void ThreeWay::ThreeWay()
+# 2763| :
+# 2766| [MemberFunction] std::strong_ordering ThreeWay::operator<=>(ThreeWay&)
+# 2766| :
+# 2766| getParameter(0): [Parameter] y
+# 2766| Type = [LValueReferenceType] ThreeWay &
+# 2766| getEntryPoint(): [BlockStmt] { ... }
+# 2766| getStmt(0): [ReturnStmt] return ...
+# 2766| getExpr(): [SpaceshipExpr] ... <=> ...
+# 2766| Type = [Class] strong_ordering
+# 2766| ValueCategory = prvalue
+# 2766| getChild(0): [PointerFieldAccess] x
+# 2766| Type = [IntType] int
+# 2766| ValueCategory = prvalue(load)
+# 2766| getQualifier(): [ThisExpr] this
+# 2766| Type = [PointerType] ThreeWay *
+# 2766| ValueCategory = prvalue(load)
+# 2766| getChild(1): [ReferenceFieldAccess] x
+# 2766| Type = [IntType] int
+# 2766| ValueCategory = prvalue(load)
+# 2766| getQualifier(): [VariableAccess] y
+# 2766| Type = [LValueReferenceType] ThreeWay &
+# 2766| ValueCategory = prvalue(load)
+# 2766| getQualifier().getFullyConverted(): [ReferenceDereferenceExpr] (reference dereference)
+# 2766| Type = [Class] ThreeWay
+# 2766| ValueCategory = lvalue
+# 2769| [TopLevelFunction] void test_three_way(int, int, ThreeWay, ThreeWay)
+# 2769| :
+# 2769| getParameter(0): [Parameter] a
+# 2769| Type = [IntType] int
+# 2769| getParameter(1): [Parameter] b
+# 2769| Type = [IntType] int
+# 2769| getParameter(2): [Parameter] c
+# 2769| Type = [Class] ThreeWay
+# 2769| getParameter(3): [Parameter] d
+# 2769| Type = [Class] ThreeWay
+# 2769| getEntryPoint(): [BlockStmt] { ... }
+# 2770| getStmt(0): [DeclStmt] declaration
+# 2770| getDeclarationEntry(0): [VariableDeclarationEntry] definition of x
+# 2770| Type = [Class] strong_ordering
+# 2770| getVariable().getInitializer(): [Initializer] initializer for x
+# 2770| getExpr(): [SpaceshipExpr] ... <=> ...
+# 2770| Type = [Class] strong_ordering
+# 2770| ValueCategory = prvalue
+# 2770| getChild(0): [VariableAccess] a
+# 2770| Type = [IntType] int
+# 2770| ValueCategory = prvalue(load)
+# 2770| getChild(1): [VariableAccess] b
+# 2770| Type = [IntType] int
+# 2770| ValueCategory = prvalue(load)
+# 2771| getStmt(1): [DeclStmt] declaration
+# 2771| getDeclarationEntry(0): [VariableDeclarationEntry] definition of y
+# 2771| Type = [Class] strong_ordering
+# 2771| getVariable().getInitializer(): [Initializer] initializer for y
+# 2771| getExpr(): [FunctionCall] call to operator<=>
+# 2771| Type = [Class] strong_ordering
+# 2771| ValueCategory = prvalue
+# 2771| getQualifier(): [VariableAccess] c
+# 2771| Type = [Class] ThreeWay
+# 2771| ValueCategory = lvalue
+# 2771| getArgument(0): [VariableAccess] d
+# 2771| Type = [Class] ThreeWay
+# 2771| ValueCategory = lvalue
+# 2771| getArgument(0).getFullyConverted(): [ReferenceToExpr] (reference to)
+# 2771| Type = [LValueReferenceType] ThreeWay &
+# 2771| ValueCategory = prvalue
+# 2772| getStmt(2): [ReturnStmt] return ...
ir23.cpp:
# 1| [TopLevelFunction] bool consteval_1()
# 1| :
diff --git a/cpp/ql/test/library-tests/ir/ir/aliased_ir.expected b/cpp/ql/test/library-tests/ir/ir/aliased_ir.expected
index 38f0a0a4f4f7..6d58656b55ff 100644
--- a/cpp/ql/test/library-tests/ir/ir/aliased_ir.expected
+++ b/cpp/ql/test/library-tests/ir/ir/aliased_ir.expected
@@ -20273,6 +20273,119 @@ ir.cpp:
# 2728| v2728_14(void) = AliasedUse : ~m2728_9
# 2728| v2728_15(void) = ExitFunction :
+# 2747| void std::strong_ordering::strong_ordering(std::strong_ordering&&)
+# 2747| Block 0
+# 2747| v2747_1(void) = EnterFunction :
+# 2747| m2747_2(unknown) = AliasedDefinition :
+# 2747| m2747_3(unknown) = InitializeNonLocal :
+# 2747| m2747_4(unknown) = Chi : total:m2747_2, partial:m2747_3
+# 2747| r2747_5(glval) = VariableAddress[#this] :
+# 2747| m2747_6(glval) = InitializeParameter[#this] : &:r2747_5
+# 2747| r2747_7(glval) = Load[#this] : &:r2747_5, m2747_6
+# 2747| m2747_8(strong_ordering) = InitializeIndirection[#this] : &:r2747_7
+#-----| r0_1(glval) = VariableAddress[(unnamed parameter 0)] :
+#-----| m0_2(strong_ordering &&) = InitializeParameter[(unnamed parameter 0)] : &:r0_1
+#-----| r0_3(strong_ordering &&) = Load[(unnamed parameter 0)] : &:r0_1, m0_2
+#-----| m0_4(unknown) = InitializeIndirection[(unnamed parameter 0)] : &:r0_3
+# 2747| v2747_9(void) = NoOp :
+# 2747| v2747_10(void) = ReturnIndirection[#this] : &:r2747_7, m2747_8
+#-----| v0_5(void) = ReturnIndirection[(unnamed parameter 0)] : &:r0_3, m0_4
+# 2747| v2747_11(void) = ReturnVoid :
+# 2747| v2747_12(void) = AliasedUse : m2747_3
+# 2747| v2747_13(void) = ExitFunction :
+
+# 2748| void std::strong_ordering::strong_ordering(std::_Order)
+# 2748| Block 0
+# 2748| v2748_1(void) = EnterFunction :
+# 2748| m2748_2(unknown) = AliasedDefinition :
+# 2748| m2748_3(unknown) = InitializeNonLocal :
+# 2748| m2748_4(unknown) = Chi : total:m2748_2, partial:m2748_3
+# 2748| r2748_5(glval) = VariableAddress[#this] :
+# 2748| m2748_6(glval) = InitializeParameter[#this] : &:r2748_5
+# 2748| r2748_7(glval) = Load[#this] : &:r2748_5, m2748_6
+# 2748| m2748_8(strong_ordering) = InitializeIndirection[#this] : &:r2748_7
+# 2748| r2748_9(glval<_Order>) = VariableAddress[v] :
+# 2748| m2748_10(_Order) = InitializeParameter[v] : &:r2748_9
+# 2748| v2748_11(void) = NoOp :
+# 2748| v2748_12(void) = ReturnIndirection[#this] : &:r2748_7, m2748_8
+# 2748| v2748_13(void) = ReturnVoid :
+# 2748| v2748_14(void) = AliasedUse : m2748_3
+# 2748| v2748_15(void) = ExitFunction :
+
+# 2766| std::strong_ordering ThreeWay::operator<=>(ThreeWay&)
+# 2766| Block 0
+# 2766| v2766_1(void) = EnterFunction :
+# 2766| m2766_2(unknown) = AliasedDefinition :
+# 2766| m2766_3(unknown) = InitializeNonLocal :
+# 2766| m2766_4(unknown) = Chi : total:m2766_2, partial:m2766_3
+# 2766| r2766_5(glval) = VariableAddress[#this] :
+# 2766| m2766_6(glval) = InitializeParameter[#this] : &:r2766_5
+# 2766| r2766_7(glval) = Load[#this] : &:r2766_5, m2766_6
+# 2766| m2766_8(ThreeWay) = InitializeIndirection[#this] : &:r2766_7
+# 2766| r2766_9(glval) = VariableAddress[y] :
+# 2766| m2766_10(ThreeWay &) = InitializeParameter[y] : &:r2766_9
+# 2766| r2766_11(ThreeWay &) = Load[y] : &:r2766_9, m2766_10
+# 2766| m2766_12(unknown) = InitializeIndirection[y] : &:r2766_11
+# 2766| r2766_13(glval) = VariableAddress[#return] :
+# 2766| r2766_14(glval) = VariableAddress[#this] :
+# 2766| r2766_15(ThreeWay *) = Load[#this] : &:r2766_14, m2766_6
+# 2766| r2766_16(glval) = FieldAddress[x] : r2766_15
+# 2766| r2766_17(int) = Load[?] : &:r2766_16, ~m2766_8
+# 2766| r2766_18(glval) = VariableAddress[y] :
+# 2766| r2766_19(ThreeWay &) = Load[y] : &:r2766_18, m2766_10
+# 2766| r2766_20(glval) = CopyValue : r2766_19
+# 2766| r2766_21(glval) = FieldAddress[x] : r2766_20
+# 2766| r2766_22(int) = Load[?] : &:r2766_21, ~m2766_12
+# 2766| r2766_23(strong_ordering) = Spaceship : r2766_17, r2766_22
+# 2766| m2766_24(strong_ordering) = Store[#return] : &:r2766_13, r2766_23
+# 2766| v2766_25(void) = ReturnIndirection[#this] : &:r2766_7, m2766_8
+# 2766| v2766_26(void) = ReturnIndirection[y] : &:r2766_11, m2766_12
+# 2766| r2766_27(glval) = VariableAddress[#return] :
+# 2766| v2766_28(void) = ReturnValue : &:r2766_27, m2766_24
+# 2766| v2766_29(void) = AliasedUse : m2766_3
+# 2766| v2766_30(void) = ExitFunction :
+
+# 2769| void test_three_way(int, int, ThreeWay, ThreeWay)
+# 2769| Block 0
+# 2769| v2769_1(void) = EnterFunction :
+# 2769| m2769_2(unknown) = AliasedDefinition :
+# 2769| m2769_3(unknown) = InitializeNonLocal :
+# 2769| m2769_4(unknown) = Chi : total:m2769_2, partial:m2769_3
+# 2769| r2769_5(glval) = VariableAddress[a] :
+# 2769| m2769_6(int) = InitializeParameter[a] : &:r2769_5
+# 2769| r2769_7(glval) = VariableAddress[b] :
+# 2769| m2769_8(int) = InitializeParameter[b] : &:r2769_7
+# 2769| r2769_9(glval) = VariableAddress[c] :
+# 2769| m2769_10(ThreeWay) = InitializeParameter[c] : &:r2769_9
+# 2769| r2769_11(glval) = VariableAddress[d] :
+# 2769| m2769_12(ThreeWay) = InitializeParameter[d] : &:r2769_11
+# 2770| r2770_1(glval) = VariableAddress[x] :
+# 2770| r2770_2(glval) = VariableAddress[a] :
+# 2770| r2770_3(int) = Load[a] : &:r2770_2, m2769_6
+# 2770| r2770_4(glval) = VariableAddress[b] :
+# 2770| r2770_5(int) = Load[b] : &:r2770_4, m2769_8
+# 2770| r2770_6(strong_ordering) = Spaceship : r2770_3, r2770_5
+# 2770| m2770_7(strong_ordering) = Store[x] : &:r2770_1, r2770_6
+# 2771| r2771_1(glval) = VariableAddress[y] :
+# 2771| r2771_2(glval) = VariableAddress[c] :
+# 2771| r2771_3(glval) = FunctionAddress[operator<=>] :
+# 2771| r2771_4(glval) = VariableAddress[d] :
+# 2771| r2771_5(ThreeWay &) = CopyValue : r2771_4
+# 2771| r2771_6(strong_ordering) = Call[operator<=>] : func:r2771_3, this:r2771_2, 0:r2771_5
+# 2771| m2771_7(unknown) = ^CallSideEffect : ~m2769_4
+# 2771| m2771_8(unknown) = Chi : total:m2769_4, partial:m2771_7
+# 2771| v2771_9(void) = ^IndirectReadSideEffect[-1] : &:r2771_2, m2769_10
+# 2771| v2771_10(void) = ^BufferReadSideEffect[0] : &:r2771_5, ~m2769_12
+# 2771| m2771_11(ThreeWay) = ^IndirectMayWriteSideEffect[-1] : &:r2771_2
+# 2771| m2771_12(ThreeWay) = Chi : total:m2769_10, partial:m2771_11
+# 2771| m2771_13(unknown) = ^BufferMayWriteSideEffect[0] : &:r2771_5
+# 2771| m2771_14(ThreeWay) = Chi : total:m2769_12, partial:m2771_13
+# 2771| m2771_15(strong_ordering) = Store[y] : &:r2771_1, r2771_6
+# 2772| v2772_1(void) = NoOp :
+# 2769| v2769_13(void) = ReturnVoid :
+# 2769| v2769_14(void) = AliasedUse : ~m2771_8
+# 2769| v2769_15(void) = ExitFunction :
+
ir23.cpp:
# 1| bool consteval_1()
# 1| Block 0
@@ -39983,4 +40096,17 @@ type_info_test.cpp:
# 3| m3_4(unknown) = Chi : total:m3_2, partial:m3_3
# 3| r3_5(glval) = VariableAddress[x] :
# 3| m3_6(int) = InitializeParameter[x] : &:r3_5
+# 3| m3_7(unknown) = Chi : total:m3_4, partial:m3_6
# 4| r4_1(glval) = VariableAddress[t1] :
+# 4| r4_2(glval) = VariableAddress[x] :
+# 4| r4_3(glval) = TypeidExpr : r4_2
+# 4| r4_4(type_info &) = CopyValue : r4_3
+# 4| m4_5(type_info &) = Store[t1] : &:r4_1, r4_4
+# 5| r5_1(glval) = VariableAddress[t2] :
+# 5| r5_2(glval) = TypeidType :
+# 5| r5_3(type_info &) = CopyValue : r5_2
+# 5| m5_4(type_info &) = Store[t2] : &:r5_1, r5_3
+# 6| v6_1(void) = NoOp :
+# 3| v3_8(void) = ReturnVoid :
+# 3| v3_9(void) = AliasedUse : m3_3
+# 3| v3_10(void) = ExitFunction :
diff --git a/cpp/ql/test/library-tests/ir/ir/aliased_ssa_consistency.expected b/cpp/ql/test/library-tests/ir/ir/aliased_ssa_consistency.expected
index 137b2aee2665..b83d9ea47e38 100644
--- a/cpp/ql/test/library-tests/ir/ir/aliased_ssa_consistency.expected
+++ b/cpp/ql/test/library-tests/ir/ir/aliased_ssa_consistency.expected
@@ -6,7 +6,6 @@ missingOperandType
duplicateChiOperand
sideEffectWithoutPrimary
instructionWithoutSuccessor
-| type_info_test.cpp:4:25:4:26 | VariableAddress: definition of t1 | Instruction 'VariableAddress: definition of t1' has no successors in function '$@'. | type_info_test.cpp:3:6:3:19 | void type_info_test(int) | void type_info_test(int) |
ambiguousSuccessors
unexplainedLoop
unnecessaryPhiInstruction
diff --git a/cpp/ql/test/library-tests/ir/ir/aliased_ssa_consistency_unsound.expected b/cpp/ql/test/library-tests/ir/ir/aliased_ssa_consistency_unsound.expected
index 137b2aee2665..b83d9ea47e38 100644
--- a/cpp/ql/test/library-tests/ir/ir/aliased_ssa_consistency_unsound.expected
+++ b/cpp/ql/test/library-tests/ir/ir/aliased_ssa_consistency_unsound.expected
@@ -6,7 +6,6 @@ missingOperandType
duplicateChiOperand
sideEffectWithoutPrimary
instructionWithoutSuccessor
-| type_info_test.cpp:4:25:4:26 | VariableAddress: definition of t1 | Instruction 'VariableAddress: definition of t1' has no successors in function '$@'. | type_info_test.cpp:3:6:3:19 | void type_info_test(int) | void type_info_test(int) |
ambiguousSuccessors
unexplainedLoop
unnecessaryPhiInstruction
diff --git a/cpp/ql/test/library-tests/ir/ir/ir.cpp b/cpp/ql/test/library-tests/ir/ir/ir.cpp
index 92566968e6ea..74c41c7e916b 100644
--- a/cpp/ql/test/library-tests/ir/ir/ir.cpp
+++ b/cpp/ql/test/library-tests/ir/ir/ir.cpp
@@ -2742,4 +2742,33 @@ void test_postfix_crement(int *p, int q) {
int q2 = (int)(q++);
}
+namespace std {
+ enum class _Order : signed char { __less = -1, __equiv = 0, __greater = 1 };
+ class strong_ordering {
+ explicit constexpr strong_ordering(_Order v) {}
+
+ public:
+ static const strong_ordering less;
+ static const strong_ordering equal;
+ static const strong_ordering equivalent;
+ static const strong_ordering greater;
+ };
+
+ inline constexpr strong_ordering strong_ordering::less(_Order::__less);
+ inline constexpr strong_ordering strong_ordering::equal(_Order::__equiv);
+ inline constexpr strong_ordering strong_ordering::equivalent(_Order::__equiv);
+ inline constexpr strong_ordering strong_ordering::greater(_Order::__greater);
+}
+
+class ThreeWay {
+ int x;
+public:
+ std::strong_ordering operator<=>(ThreeWay &y) { return this->x <=> y.x; }
+};
+
+void test_three_way(int a, int b, ThreeWay c, ThreeWay d) {
+ auto x = a <=> b;
+ auto y = c <=> d;
+}
+
// semmle-extractor-options: -std=c++20 --clang
diff --git a/cpp/ql/test/library-tests/ir/ir/raw_consistency.expected b/cpp/ql/test/library-tests/ir/ir/raw_consistency.expected
index 9cdfdd2dcd5e..e30106d35204 100644
--- a/cpp/ql/test/library-tests/ir/ir/raw_consistency.expected
+++ b/cpp/ql/test/library-tests/ir/ir/raw_consistency.expected
@@ -1,6 +1,4 @@
missingOperand
-| type_info_test.cpp:4:30:4:38 | CopyValue: (reference to) | Instruction 'CopyValue' is missing an expected operand with tag 'Unary' in function '$@'. | type_info_test.cpp:3:6:3:19 | void type_info_test(int) | void type_info_test(int) |
-| type_info_test.cpp:5:30:5:40 | CopyValue: (reference to) | Instruction 'CopyValue' is missing an expected operand with tag 'Unary' in function '$@'. | type_info_test.cpp:3:6:3:19 | void type_info_test(int) | void type_info_test(int) |
unexpectedOperand
duplicateOperand
missingPhiOperand
@@ -8,9 +6,6 @@ missingOperandType
duplicateChiOperand
sideEffectWithoutPrimary
instructionWithoutSuccessor
-| type_info_test.cpp:4:25:4:26 | VariableAddress: definition of t1 | Instruction 'VariableAddress: definition of t1' has no successors in function '$@'. | type_info_test.cpp:3:6:3:19 | void type_info_test(int) | void type_info_test(int) |
-| type_info_test.cpp:4:37:4:37 | VariableAddress: x | Instruction 'VariableAddress: x' has no successors in function '$@'. | type_info_test.cpp:3:6:3:19 | void type_info_test(int) | void type_info_test(int) |
-| type_info_test.cpp:5:25:5:26 | VariableAddress: definition of t2 | Instruction 'VariableAddress: definition of t2' has no successors in function '$@'. | type_info_test.cpp:3:6:3:19 | void type_info_test(int) | void type_info_test(int) |
ambiguousSuccessors
unexplainedLoop
unnecessaryPhiInstruction
@@ -26,8 +21,6 @@ lostReachability
backEdgeCountMismatch
useNotDominatedByDefinition
| ir.cpp:1535:8:1535:8 | Unary | Operand 'Unary' is not dominated by its definition in function '$@'. | ir.cpp:1535:8:1535:8 | void StructuredBindingDataMemberStruct::StructuredBindingDataMemberStruct() | void StructuredBindingDataMemberStruct::StructuredBindingDataMemberStruct() |
-| type_info_test.cpp:4:25:4:26 | Address | Operand 'Address' is not dominated by its definition in function '$@'. | type_info_test.cpp:3:6:3:19 | void type_info_test(int) | void type_info_test(int) |
-| type_info_test.cpp:5:25:5:26 | Address | Operand 'Address' is not dominated by its definition in function '$@'. | type_info_test.cpp:3:6:3:19 | void type_info_test(int) | void type_info_test(int) |
switchInstructionWithoutDefaultEdge
notMarkedAsConflated
wronglyMarkedAsConflated
diff --git a/cpp/ql/test/library-tests/ir/ir/raw_ir.expected b/cpp/ql/test/library-tests/ir/ir/raw_ir.expected
index c9158233914d..8cdb5e8c351f 100644
--- a/cpp/ql/test/library-tests/ir/ir/raw_ir.expected
+++ b/cpp/ql/test/library-tests/ir/ir/raw_ir.expected
@@ -18432,6 +18432,112 @@ ir.cpp:
# 2728| v2728_12(void) = AliasedUse : ~m?
# 2728| v2728_13(void) = ExitFunction :
+# 2747| void std::strong_ordering::strong_ordering(std::strong_ordering&&)
+# 2747| Block 0
+# 2747| v2747_1(void) = EnterFunction :
+# 2747| mu2747_2(unknown) = AliasedDefinition :
+# 2747| mu2747_3(unknown) = InitializeNonLocal :
+# 2747| r2747_4(glval) = VariableAddress[#this] :
+# 2747| mu2747_5(glval) = InitializeParameter[#this] : &:r2747_4
+# 2747| r2747_6(glval) = Load[#this] : &:r2747_4, ~m?
+# 2747| mu2747_7(strong_ordering) = InitializeIndirection[#this] : &:r2747_6
+#-----| r0_1(glval) = VariableAddress[(unnamed parameter 0)] :
+#-----| mu0_2(strong_ordering &&) = InitializeParameter[(unnamed parameter 0)] : &:r0_1
+#-----| r0_3(strong_ordering &&) = Load[(unnamed parameter 0)] : &:r0_1, ~m?
+#-----| mu0_4(unknown) = InitializeIndirection[(unnamed parameter 0)] : &:r0_3
+# 2747| v2747_8(void) = NoOp :
+# 2747| v2747_9(void) = ReturnIndirection[#this] : &:r2747_6, ~m?
+#-----| v0_5(void) = ReturnIndirection[(unnamed parameter 0)] : &:r0_3, ~m?
+# 2747| v2747_10(void) = ReturnVoid :
+# 2747| v2747_11(void) = AliasedUse : ~m?
+# 2747| v2747_12(void) = ExitFunction :
+
+# 2748| void std::strong_ordering::strong_ordering(std::_Order)
+# 2748| Block 0
+# 2748| v2748_1(void) = EnterFunction :
+# 2748| mu2748_2(unknown) = AliasedDefinition :
+# 2748| mu2748_3(unknown) = InitializeNonLocal :
+# 2748| r2748_4(glval) = VariableAddress[#this] :
+# 2748| mu2748_5(glval) = InitializeParameter[#this] : &:r2748_4
+# 2748| r2748_6(glval) = Load[#this] : &:r2748_4, ~m?
+# 2748| mu2748_7(strong_ordering) = InitializeIndirection[#this] : &:r2748_6
+# 2748| r2748_8(glval<_Order>) = VariableAddress[v] :
+# 2748| mu2748_9(_Order) = InitializeParameter[v] : &:r2748_8
+# 2748| v2748_10(void) = NoOp :
+# 2748| v2748_11(void) = ReturnIndirection[#this] : &:r2748_6, ~m?
+# 2748| v2748_12(void) = ReturnVoid :
+# 2748| v2748_13(void) = AliasedUse : ~m?
+# 2748| v2748_14(void) = ExitFunction :
+
+# 2766| std::strong_ordering ThreeWay::operator<=>(ThreeWay&)
+# 2766| Block 0
+# 2766| v2766_1(void) = EnterFunction :
+# 2766| mu2766_2(unknown) = AliasedDefinition :
+# 2766| mu2766_3(unknown) = InitializeNonLocal :
+# 2766| r2766_4(glval) = VariableAddress[#this] :
+# 2766| mu2766_5(glval) = InitializeParameter[#this] : &:r2766_4
+# 2766| r2766_6(glval) = Load[#this] : &:r2766_4, ~m?
+# 2766| mu2766_7(ThreeWay) = InitializeIndirection[#this] : &:r2766_6
+# 2766| r2766_8(glval) = VariableAddress[y] :
+# 2766| mu2766_9(ThreeWay &) = InitializeParameter[y] : &:r2766_8
+# 2766| r2766_10(ThreeWay &) = Load[y] : &:r2766_8, ~m?
+# 2766| mu2766_11(unknown) = InitializeIndirection[y] : &:r2766_10
+# 2766| r2766_12(glval) = VariableAddress[#return] :
+# 2766| r2766_13(glval) = VariableAddress[#this] :
+# 2766| r2766_14(ThreeWay *) = Load[#this] : &:r2766_13, ~m?
+# 2766| r2766_15(glval) = FieldAddress[x] : r2766_14
+# 2766| r2766_16(int) = Load[?] : &:r2766_15, ~m?
+# 2766| r2766_17(glval) = VariableAddress[y] :
+# 2766| r2766_18(ThreeWay &) = Load[y] : &:r2766_17, ~m?
+# 2766| r2766_19(glval) = CopyValue : r2766_18
+# 2766| r2766_20(glval) = FieldAddress[x] : r2766_19
+# 2766| r2766_21(int) = Load[?] : &:r2766_20, ~m?
+# 2766| r2766_22(strong_ordering) = Spaceship : r2766_16, r2766_21
+# 2766| mu2766_23(strong_ordering) = Store[#return] : &:r2766_12, r2766_22
+# 2766| v2766_24(void) = ReturnIndirection[#this] : &:r2766_6, ~m?
+# 2766| v2766_25(void) = ReturnIndirection[y] : &:r2766_10, ~m?
+# 2766| r2766_26(glval) = VariableAddress[#return] :
+# 2766| v2766_27(void) = ReturnValue : &:r2766_26, ~m?
+# 2766| v2766_28(void) = AliasedUse : ~m?
+# 2766| v2766_29(void) = ExitFunction :
+
+# 2769| void test_three_way(int, int, ThreeWay, ThreeWay)
+# 2769| Block 0
+# 2769| v2769_1(void) = EnterFunction :
+# 2769| mu2769_2(unknown) = AliasedDefinition :
+# 2769| mu2769_3(unknown) = InitializeNonLocal :
+# 2769| r2769_4(glval) = VariableAddress[a] :
+# 2769| mu2769_5(int) = InitializeParameter[a] : &:r2769_4
+# 2769| r2769_6(glval) = VariableAddress[b] :
+# 2769| mu2769_7(int) = InitializeParameter[b] : &:r2769_6
+# 2769| r2769_8(glval) = VariableAddress[c] :
+# 2769| mu2769_9(ThreeWay) = InitializeParameter[c] : &:r2769_8
+# 2769| r2769_10(glval) = VariableAddress[d] :
+# 2769| mu2769_11(ThreeWay) = InitializeParameter[d] : &:r2769_10
+# 2770| r2770_1(glval) = VariableAddress[x] :
+# 2770| r2770_2(glval) = VariableAddress[a] :
+# 2770| r2770_3(int) = Load[a] : &:r2770_2, ~m?
+# 2770| r2770_4(glval) = VariableAddress[b] :
+# 2770| r2770_5(int) = Load[b] : &:r2770_4, ~m?
+# 2770| r2770_6(strong_ordering) = Spaceship : r2770_3, r2770_5
+# 2770| mu2770_7(strong_ordering) = Store[x] : &:r2770_1, r2770_6
+# 2771| r2771_1(glval) = VariableAddress[y] :
+# 2771| r2771_2(glval) = VariableAddress[c] :
+# 2771| r2771_3(glval) = FunctionAddress[operator<=>] :
+# 2771| r2771_4(glval) = VariableAddress[d] :
+# 2771| r2771_5(ThreeWay &) = CopyValue : r2771_4
+# 2771| r2771_6(strong_ordering) = Call[operator<=>] : func:r2771_3, this:r2771_2, 0:r2771_5
+# 2771| mu2771_7(unknown) = ^CallSideEffect : ~m?
+# 2771| v2771_8(void) = ^IndirectReadSideEffect[-1] : &:r2771_2, ~m?
+# 2771| v2771_9(void) = ^BufferReadSideEffect[0] : &:r2771_5, ~m?
+# 2771| mu2771_10(ThreeWay) = ^IndirectMayWriteSideEffect[-1] : &:r2771_2
+# 2771| mu2771_11(unknown) = ^BufferMayWriteSideEffect[0] : &:r2771_5
+# 2771| mu2771_12(strong_ordering) = Store[y] : &:r2771_1, r2771_6
+# 2772| v2772_1(void) = NoOp :
+# 2769| v2769_12(void) = ReturnVoid :
+# 2769| v2769_13(void) = AliasedUse : ~m?
+# 2769| v2769_14(void) = ExitFunction :
+
ir23.cpp:
# 1| bool consteval_1()
# 1| Block 0
@@ -38112,19 +38218,15 @@ type_info_test.cpp:
# 3| r3_4(glval) = VariableAddress[x] :
# 3| mu3_5(int) = InitializeParameter[x] : &:r3_4
# 4| r4_1(glval) = VariableAddress[t1] :
-
-# 4| Block 1
-# 4| r4_2(glval) = VariableAddress[x] :
-
-# 4| Block 2
-# 4| r4_3(type_info &) = CopyValue :
-# 4| mu4_4(type_info &) = Store[t1] : &:r4_1, r4_3
-# 5| r5_1(glval) = VariableAddress[t2] :
-
-# 5| Block 3
-# 5| r5_2(type_info &) = CopyValue :
-# 5| mu5_3(type_info &) = Store[t2] : &:r5_1, r5_2
-# 6| v6_1(void) = NoOp :
-# 3| v3_6(void) = ReturnVoid :
-# 3| v3_7(void) = AliasedUse : ~m?
-# 3| v3_8(void) = ExitFunction :
+# 4| r4_2(glval) = VariableAddress[x] :
+# 4| r4_3(glval) = TypeidExpr : r4_2
+# 4| r4_4(type_info &) = CopyValue : r4_3
+# 4| mu4_5(type_info &) = Store[t1] : &:r4_1, r4_4
+# 5| r5_1(glval) = VariableAddress[t2] :
+# 5| r5_2(glval) = TypeidType :
+# 5| r5_3(type_info &) = CopyValue : r5_2
+# 5| mu5_4(type_info &) = Store[t2] : &:r5_1, r5_3
+# 6| v6_1(void) = NoOp :
+# 3| v3_6(void) = ReturnVoid :
+# 3| v3_7(void) = AliasedUse : ~m?
+# 3| v3_8(void) = ExitFunction :
diff --git a/cpp/ql/test/library-tests/ir/ir/unaliased_ssa_consistency.expected b/cpp/ql/test/library-tests/ir/ir/unaliased_ssa_consistency.expected
index 137b2aee2665..b83d9ea47e38 100644
--- a/cpp/ql/test/library-tests/ir/ir/unaliased_ssa_consistency.expected
+++ b/cpp/ql/test/library-tests/ir/ir/unaliased_ssa_consistency.expected
@@ -6,7 +6,6 @@ missingOperandType
duplicateChiOperand
sideEffectWithoutPrimary
instructionWithoutSuccessor
-| type_info_test.cpp:4:25:4:26 | VariableAddress: definition of t1 | Instruction 'VariableAddress: definition of t1' has no successors in function '$@'. | type_info_test.cpp:3:6:3:19 | void type_info_test(int) | void type_info_test(int) |
ambiguousSuccessors
unexplainedLoop
unnecessaryPhiInstruction
diff --git a/cpp/ql/test/library-tests/ir/ir/unaliased_ssa_consistency_unsound.expected b/cpp/ql/test/library-tests/ir/ir/unaliased_ssa_consistency_unsound.expected
index 137b2aee2665..b83d9ea47e38 100644
--- a/cpp/ql/test/library-tests/ir/ir/unaliased_ssa_consistency_unsound.expected
+++ b/cpp/ql/test/library-tests/ir/ir/unaliased_ssa_consistency_unsound.expected
@@ -6,7 +6,6 @@ missingOperandType
duplicateChiOperand
sideEffectWithoutPrimary
instructionWithoutSuccessor
-| type_info_test.cpp:4:25:4:26 | VariableAddress: definition of t1 | Instruction 'VariableAddress: definition of t1' has no successors in function '$@'. | type_info_test.cpp:3:6:3:19 | void type_info_test(int) | void type_info_test(int) |
ambiguousSuccessors
unexplainedLoop
unnecessaryPhiInstruction
diff --git a/cpp/ql/test/query-tests/Critical/InitialisationNotRun/InitialisationNotRun.expected b/cpp/ql/test/query-tests/Critical/InitialisationNotRun/InitialisationNotRun.expected
new file mode 100644
index 000000000000..fdb53a2a4689
--- /dev/null
+++ b/cpp/ql/test/query-tests/Critical/InitialisationNotRun/InitialisationNotRun.expected
@@ -0,0 +1,2 @@
+| test.cpp:12:16:12:17 | g1 | Initialization code for 'g1' is never run. |
+| test.cpp:14:23:14:24 | g3 | Initialization code for 'g3' is never run. |
diff --git a/cpp/ql/test/query-tests/Critical/InitialisationNotRun/InitialisationNotRun.qlref b/cpp/ql/test/query-tests/Critical/InitialisationNotRun/InitialisationNotRun.qlref
new file mode 100644
index 000000000000..7012169e8945
--- /dev/null
+++ b/cpp/ql/test/query-tests/Critical/InitialisationNotRun/InitialisationNotRun.qlref
@@ -0,0 +1 @@
+Critical/InitialisationNotRun.ql
diff --git a/cpp/ql/test/query-tests/Critical/InitialisationNotRun/test.cpp b/cpp/ql/test/query-tests/Critical/InitialisationNotRun/test.cpp
new file mode 100644
index 000000000000..ee0d070df088
--- /dev/null
+++ b/cpp/ql/test/query-tests/Critical/InitialisationNotRun/test.cpp
@@ -0,0 +1,36 @@
+// --- stubs ---
+
+char *strcpy(char *dest, const char *src);
+
+// --- tests ---
+
+class GlobalStorage {
+public:
+ char name[1000];
+};
+
+GlobalStorage *g1; // BAD
+static GlobalStorage g2; // GOOD
+static GlobalStorage *g3; // BAD
+// static variables are initialized by compilers
+static int a; // GOOD
+static int b = 0; // GOOD
+
+void init() { //initializes g_storage, but is never run from main
+ g1 = new GlobalStorage();
+ g3 = new GlobalStorage();
+}
+
+void init2(int b) {
+ for (int i = 0; i < b; ++i)
+ a *= -1;
+}
+
+int main(int argc, char *argv[]) {
+ //init not called
+ strcpy(g1->name, argv[1]); // g1 is used before init() is called
+ strcpy(g2.name, argv[1]); // g2 is initialised by compiler
+ strcpy(g3->name, argv[1]);
+ b++;
+ return 0;
+}
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/OverrunWriteProductFlow.expected b/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/OverrunWriteProductFlow.expected
index 2f24a9a27cb5..3a2b7372831d 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/OverrunWriteProductFlow.expected
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/OverrunWriteProductFlow.expected
@@ -12,19 +12,6 @@ edges
| test.cpp:42:13:42:15 | *str [string] | test.cpp:42:18:42:23 | string | provenance | |
| test.cpp:72:17:72:19 | *str [string] | test.cpp:72:22:72:27 | string | provenance | |
| test.cpp:80:17:80:19 | *str [string] | test.cpp:80:22:80:27 | string | provenance | |
-| test.cpp:88:11:88:30 | **mk_string_t_plus_one [string] | test.cpp:96:21:96:40 | *call to mk_string_t_plus_one [string] | provenance | |
-| test.cpp:90:5:90:7 | *str [post update] [string] | test.cpp:91:5:91:7 | *str [string] | provenance | |
-| test.cpp:90:5:90:34 | ... = ... | test.cpp:90:5:90:7 | *str [post update] [string] | provenance | |
-| test.cpp:90:19:90:24 | call to malloc | test.cpp:90:5:90:34 | ... = ... | provenance | |
-| test.cpp:91:5:91:7 | *str [string] | test.cpp:92:12:92:14 | *str [string] | provenance | |
-| test.cpp:92:12:92:14 | *str [string] | test.cpp:88:11:88:30 | **mk_string_t_plus_one [string] | provenance | |
-| test.cpp:96:21:96:40 | *call to mk_string_t_plus_one [string] | test.cpp:96:21:96:40 | *call to mk_string_t_plus_one [string] | provenance | |
-| test.cpp:96:21:96:40 | *call to mk_string_t_plus_one [string] | test.cpp:99:13:99:15 | *str [string] | provenance | |
-| test.cpp:96:21:96:40 | *call to mk_string_t_plus_one [string] | test.cpp:129:17:129:19 | *str [string] | provenance | |
-| test.cpp:96:21:96:40 | *call to mk_string_t_plus_one [string] | test.cpp:137:17:137:19 | *str [string] | provenance | |
-| test.cpp:99:13:99:15 | *str [string] | test.cpp:99:18:99:23 | string | provenance | |
-| test.cpp:129:17:129:19 | *str [string] | test.cpp:129:22:129:27 | string | provenance | |
-| test.cpp:137:17:137:19 | *str [string] | test.cpp:137:22:137:27 | string | provenance | |
| test.cpp:147:5:147:7 | *str [post update] [string] | test.cpp:148:5:148:7 | *str [string] | provenance | |
| test.cpp:147:5:147:34 | ... = ... | test.cpp:147:5:147:7 | *str [post update] [string] | provenance | |
| test.cpp:147:19:147:24 | call to malloc | test.cpp:147:5:147:34 | ... = ... | provenance | |
@@ -46,12 +33,6 @@ edges
| test.cpp:199:17:199:19 | *str [string] | test.cpp:199:22:199:27 | string | provenance | |
| test.cpp:203:17:203:19 | *str [string] | test.cpp:203:22:203:27 | string | provenance | |
| test.cpp:207:17:207:19 | *str [string] | test.cpp:207:22:207:27 | string | provenance | |
-| test.cpp:214:24:214:24 | p | test.cpp:216:10:216:10 | p | provenance | |
-| test.cpp:220:27:220:54 | call to malloc | test.cpp:220:27:220:54 | call to malloc | provenance | |
-| test.cpp:220:27:220:54 | call to malloc | test.cpp:222:15:222:20 | buffer | provenance | |
-| test.cpp:222:15:222:20 | buffer | test.cpp:214:24:214:24 | p | provenance | |
-| test.cpp:228:27:228:54 | call to malloc | test.cpp:228:27:228:54 | call to malloc | provenance | |
-| test.cpp:228:27:228:54 | call to malloc | test.cpp:232:10:232:15 | buffer | provenance | |
| test.cpp:235:40:235:45 | buffer | test.cpp:236:5:236:26 | ... = ... | provenance | |
| test.cpp:236:5:236:9 | *p_str [post update] [string] | test.cpp:235:27:235:31 | *p_str [Return] [string] | provenance | |
| test.cpp:236:5:236:9 | *p_str [post update] [string] | test.cpp:235:27:235:31 | *p_str [string] | provenance | |
@@ -64,8 +45,6 @@ edges
| test.cpp:243:12:243:14 | *str [string] | test.cpp:243:12:243:21 | string | provenance | |
| test.cpp:249:14:249:33 | call to my_alloc | test.cpp:249:14:249:33 | call to my_alloc | provenance | |
| test.cpp:249:14:249:33 | call to my_alloc | test.cpp:250:12:250:12 | p | provenance | |
-| test.cpp:256:5:256:25 | ... = ... | test.cpp:257:12:257:12 | p | provenance | |
-| test.cpp:256:9:256:25 | call to malloc | test.cpp:256:5:256:25 | ... = ... | provenance | |
| test.cpp:262:15:262:30 | call to malloc | test.cpp:262:15:262:30 | call to malloc | provenance | |
| test.cpp:262:15:262:30 | call to malloc | test.cpp:266:12:266:12 | p | provenance | |
| test.cpp:264:9:264:30 | ... = ... | test.cpp:266:12:266:12 | p | provenance | |
@@ -85,20 +64,6 @@ nodes
| test.cpp:72:22:72:27 | string | semmle.label | string |
| test.cpp:80:17:80:19 | *str [string] | semmle.label | *str [string] |
| test.cpp:80:22:80:27 | string | semmle.label | string |
-| test.cpp:88:11:88:30 | **mk_string_t_plus_one [string] | semmle.label | **mk_string_t_plus_one [string] |
-| test.cpp:90:5:90:7 | *str [post update] [string] | semmle.label | *str [post update] [string] |
-| test.cpp:90:5:90:34 | ... = ... | semmle.label | ... = ... |
-| test.cpp:90:19:90:24 | call to malloc | semmle.label | call to malloc |
-| test.cpp:91:5:91:7 | *str [string] | semmle.label | *str [string] |
-| test.cpp:92:12:92:14 | *str [string] | semmle.label | *str [string] |
-| test.cpp:96:21:96:40 | *call to mk_string_t_plus_one [string] | semmle.label | *call to mk_string_t_plus_one [string] |
-| test.cpp:96:21:96:40 | *call to mk_string_t_plus_one [string] | semmle.label | *call to mk_string_t_plus_one [string] |
-| test.cpp:99:13:99:15 | *str [string] | semmle.label | *str [string] |
-| test.cpp:99:18:99:23 | string | semmle.label | string |
-| test.cpp:129:17:129:19 | *str [string] | semmle.label | *str [string] |
-| test.cpp:129:22:129:27 | string | semmle.label | string |
-| test.cpp:137:17:137:19 | *str [string] | semmle.label | *str [string] |
-| test.cpp:137:22:137:27 | string | semmle.label | string |
| test.cpp:147:5:147:7 | *str [post update] [string] | semmle.label | *str [post update] [string] |
| test.cpp:147:5:147:34 | ... = ... | semmle.label | ... = ... |
| test.cpp:147:19:147:24 | call to malloc | semmle.label | call to malloc |
@@ -121,14 +86,6 @@ nodes
| test.cpp:203:22:203:27 | string | semmle.label | string |
| test.cpp:207:17:207:19 | *str [string] | semmle.label | *str [string] |
| test.cpp:207:22:207:27 | string | semmle.label | string |
-| test.cpp:214:24:214:24 | p | semmle.label | p |
-| test.cpp:216:10:216:10 | p | semmle.label | p |
-| test.cpp:220:27:220:54 | call to malloc | semmle.label | call to malloc |
-| test.cpp:220:27:220:54 | call to malloc | semmle.label | call to malloc |
-| test.cpp:222:15:222:20 | buffer | semmle.label | buffer |
-| test.cpp:228:27:228:54 | call to malloc | semmle.label | call to malloc |
-| test.cpp:228:27:228:54 | call to malloc | semmle.label | call to malloc |
-| test.cpp:232:10:232:15 | buffer | semmle.label | buffer |
| test.cpp:235:27:235:31 | *p_str [Return] [string] | semmle.label | *p_str [Return] [string] |
| test.cpp:235:27:235:31 | *p_str [string] | semmle.label | *p_str [string] |
| test.cpp:235:40:235:45 | buffer | semmle.label | buffer |
@@ -143,9 +100,6 @@ nodes
| test.cpp:249:14:249:33 | call to my_alloc | semmle.label | call to my_alloc |
| test.cpp:249:14:249:33 | call to my_alloc | semmle.label | call to my_alloc |
| test.cpp:250:12:250:12 | p | semmle.label | p |
-| test.cpp:256:5:256:25 | ... = ... | semmle.label | ... = ... |
-| test.cpp:256:9:256:25 | call to malloc | semmle.label | call to malloc |
-| test.cpp:257:12:257:12 | p | semmle.label | p |
| test.cpp:262:15:262:30 | call to malloc | semmle.label | call to malloc |
| test.cpp:262:15:262:30 | call to malloc | semmle.label | call to malloc |
| test.cpp:264:9:264:30 | ... = ... | semmle.label | ... = ... |
@@ -158,9 +112,6 @@ subpaths
| test.cpp:42:5:42:11 | call to strncpy | test.cpp:18:19:18:24 | call to malloc | test.cpp:42:18:42:23 | string | This write may overflow $@ by 1 element. | test.cpp:42:18:42:23 | string | string |
| test.cpp:72:9:72:15 | call to strncpy | test.cpp:18:19:18:24 | call to malloc | test.cpp:72:22:72:27 | string | This write may overflow $@ by 1 element. | test.cpp:72:22:72:27 | string | string |
| test.cpp:80:9:80:15 | call to strncpy | test.cpp:18:19:18:24 | call to malloc | test.cpp:80:22:80:27 | string | This write may overflow $@ by 2 elements. | test.cpp:80:22:80:27 | string | string |
-| test.cpp:99:5:99:11 | call to strncpy | test.cpp:90:19:90:24 | call to malloc | test.cpp:99:18:99:23 | string | This write may overflow $@ by 1 element. | test.cpp:99:18:99:23 | string | string |
-| test.cpp:129:9:129:15 | call to strncpy | test.cpp:90:19:90:24 | call to malloc | test.cpp:129:22:129:27 | string | This write may overflow $@ by 1 element. | test.cpp:129:22:129:27 | string | string |
-| test.cpp:137:9:137:15 | call to strncpy | test.cpp:90:19:90:24 | call to malloc | test.cpp:137:22:137:27 | string | This write may overflow $@ by 2 elements. | test.cpp:137:22:137:27 | string | string |
| test.cpp:152:5:152:11 | call to strncpy | test.cpp:147:19:147:24 | call to malloc | test.cpp:152:18:152:23 | string | This write may overflow $@ by 1 element. | test.cpp:152:18:152:23 | string | string |
| test.cpp:154:5:154:11 | call to strncpy | test.cpp:147:19:147:24 | call to malloc | test.cpp:154:18:154:23 | string | This write may overflow $@ by 1 element. | test.cpp:154:18:154:23 | string | string |
| test.cpp:156:5:156:11 | call to strncpy | test.cpp:147:19:147:24 | call to malloc | test.cpp:156:18:156:23 | string | This write may overflow $@ by 2 elements. | test.cpp:156:18:156:23 | string | string |
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/test.cpp
index 253ac4fe2925..ca6ca9a5c5a8 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/test.cpp
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/test.cpp
@@ -264,4 +264,15 @@ void test7(unsigned n) {
p = (char*)malloc(++n);
}
memset(p, 0, n); // GOOD [FALSE POSITIVE]
+}
+
+void test8(unsigned size, unsigned src_pos)
+{
+ char *xs = new char[size];
+ if (src_pos > size) {
+ src_pos = size;
+ }
+ if (src_pos < size - 1) {
+ memset(xs, 0, src_pos + 1); // GOOD
+ }
}
\ No newline at end of file
diff --git a/csharp/documentation/library-coverage/coverage.csv b/csharp/documentation/library-coverage/coverage.csv
index ea5961f0c4ee..72c46c89934a 100644
--- a/csharp/documentation/library-coverage/coverage.csv
+++ b/csharp/documentation/library-coverage/coverage.csv
@@ -43,5 +43,5 @@ MySql.Data.MySqlClient,48,,,,,,,,,,,,48,,,,,,,,,,
Newtonsoft.Json,,,91,,,,,,,,,,,,,,,,,,,73,18
ServiceStack,194,,7,27,,,,,75,,,,92,,,,,,,,,7,
SourceGenerators,,,5,,,,,,,,,,,,,,,,,,,,5
-System,54,47,12139,,6,5,5,,,4,1,,33,2,,6,15,17,4,3,,5903,6236
+System,54,47,12165,,6,5,5,,,4,1,,33,2,,6,15,17,4,3,,5929,6236
Windows.Security.Cryptography.Core,1,,,,,,,1,,,,,,,,,,,,,,,
diff --git a/csharp/documentation/library-coverage/coverage.rst b/csharp/documentation/library-coverage/coverage.rst
index 6ab5a55b3e68..c1c3f927fd7d 100644
--- a/csharp/documentation/library-coverage/coverage.rst
+++ b/csharp/documentation/library-coverage/coverage.rst
@@ -8,7 +8,7 @@ C# framework & library support
Framework / library,Package,Flow sources,Taint & value steps,Sinks (total),`CWE-079` :sub:`Cross-site scripting`
`ServiceStack `_,"``ServiceStack.*``, ``ServiceStack``",,7,194,
- System,"``System.*``, ``System``",47,12139,54,5
+ System,"``System.*``, ``System``",47,12165,54,5
Others,"``Amazon.Lambda.APIGatewayEvents``, ``Amazon.Lambda.Core``, ``Dapper``, ``ILCompiler``, ``ILLink.RoslynAnalyzer``, ``ILLink.Shared``, ``ILLink.Tasks``, ``Internal.IL``, ``Internal.Pgo``, ``Internal.TypeSystem``, ``Microsoft.ApplicationBlocks.Data``, ``Microsoft.AspNetCore.Components``, ``Microsoft.AspNetCore.Http``, ``Microsoft.AspNetCore.Mvc``, ``Microsoft.AspNetCore.WebUtilities``, ``Microsoft.CSharp``, ``Microsoft.Data.SqlClient``, ``Microsoft.Diagnostics.Tools.Pgo``, ``Microsoft.DotNet.Build.Tasks``, ``Microsoft.DotNet.PlatformAbstractions``, ``Microsoft.EntityFrameworkCore``, ``Microsoft.Extensions.Caching.Distributed``, ``Microsoft.Extensions.Caching.Memory``, ``Microsoft.Extensions.Configuration``, ``Microsoft.Extensions.DependencyInjection``, ``Microsoft.Extensions.DependencyModel``, ``Microsoft.Extensions.Diagnostics.Metrics``, ``Microsoft.Extensions.FileProviders``, ``Microsoft.Extensions.FileSystemGlobbing``, ``Microsoft.Extensions.Hosting``, ``Microsoft.Extensions.Http``, ``Microsoft.Extensions.Logging``, ``Microsoft.Extensions.Options``, ``Microsoft.Extensions.Primitives``, ``Microsoft.Interop``, ``Microsoft.JSInterop``, ``Microsoft.NET.Build.Tasks``, ``Microsoft.VisualBasic``, ``Microsoft.Win32``, ``Mono.Linker``, ``MySql.Data.MySqlClient``, ``Newtonsoft.Json``, ``SourceGenerators``, ``Windows.Security.Cryptography.Core``",60,2257,159,4
- Totals,,107,14403,407,9
+ Totals,,107,14429,407,9
diff --git a/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md b/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md
index f46a19790d63..1b3c69fd4d05 100644
--- a/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md
+++ b/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 1.7.45
+
+No user-facing changes.
+
## 1.7.44
No user-facing changes.
diff --git a/ruby/ql/lib/change-notes/released/4.1.10.md b/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.45.md
similarity index 71%
rename from ruby/ql/lib/change-notes/released/4.1.10.md
rename to csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.45.md
index abac078d4e2a..3e891d822fb9 100644
--- a/ruby/ql/lib/change-notes/released/4.1.10.md
+++ b/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.45.md
@@ -1,3 +1,3 @@
-## 4.1.10
+## 1.7.45
No user-facing changes.
diff --git a/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml b/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml
index a392bdc2592e..5a84df101839 100644
--- a/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml
+++ b/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 1.7.44
+lastReleaseVersion: 1.7.45
diff --git a/csharp/ql/campaigns/Solorigate/lib/qlpack.yml b/csharp/ql/campaigns/Solorigate/lib/qlpack.yml
index 9f064506c032..c6e17a64adcd 100644
--- a/csharp/ql/campaigns/Solorigate/lib/qlpack.yml
+++ b/csharp/ql/campaigns/Solorigate/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-solorigate-all
-version: 1.7.45-dev
+version: 1.7.46-dev
groups:
- csharp
- solorigate
diff --git a/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md b/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md
index f46a19790d63..1b3c69fd4d05 100644
--- a/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md
+++ b/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 1.7.45
+
+No user-facing changes.
+
## 1.7.44
No user-facing changes.
diff --git a/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.45.md b/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.45.md
new file mode 100644
index 000000000000..3e891d822fb9
--- /dev/null
+++ b/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.45.md
@@ -0,0 +1,3 @@
+## 1.7.45
+
+No user-facing changes.
diff --git a/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml b/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml
index a392bdc2592e..5a84df101839 100644
--- a/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml
+++ b/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 1.7.44
+lastReleaseVersion: 1.7.45
diff --git a/csharp/ql/campaigns/Solorigate/src/qlpack.yml b/csharp/ql/campaigns/Solorigate/src/qlpack.yml
index 29f22535c2ef..529cd400b6c3 100644
--- a/csharp/ql/campaigns/Solorigate/src/qlpack.yml
+++ b/csharp/ql/campaigns/Solorigate/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-solorigate-queries
-version: 1.7.45-dev
+version: 1.7.46-dev
groups:
- csharp
- solorigate
diff --git a/csharp/ql/lib/CHANGELOG.md b/csharp/ql/lib/CHANGELOG.md
index 108a37248ce3..1bce7a7f8031 100644
--- a/csharp/ql/lib/CHANGELOG.md
+++ b/csharp/ql/lib/CHANGELOG.md
@@ -1,7 +1,13 @@
-## 5.1.10
+## 5.2.1
No user-facing changes.
+## 5.2.0
+
+### New Features
+
+* Added a new predicate, `getASuperType()`, to get a direct supertype of this type.
+
## 5.1.9
No user-facing changes.
diff --git a/csharp/ql/lib/change-notes/released/5.2.0.md b/csharp/ql/lib/change-notes/released/5.2.0.md
new file mode 100644
index 000000000000..5408c0d44bde
--- /dev/null
+++ b/csharp/ql/lib/change-notes/released/5.2.0.md
@@ -0,0 +1,5 @@
+## 5.2.0
+
+### New Features
+
+* Added a new predicate, `getASuperType()`, to get a direct supertype of this type.
diff --git a/csharp/ql/lib/change-notes/released/5.2.1.md b/csharp/ql/lib/change-notes/released/5.2.1.md
new file mode 100644
index 000000000000..8d65db4e16d0
--- /dev/null
+++ b/csharp/ql/lib/change-notes/released/5.2.1.md
@@ -0,0 +1,3 @@
+## 5.2.1
+
+No user-facing changes.
diff --git a/csharp/ql/lib/codeql-pack.release.yml b/csharp/ql/lib/codeql-pack.release.yml
index 9198af0dd6c7..1684d0e72a28 100644
--- a/csharp/ql/lib/codeql-pack.release.yml
+++ b/csharp/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 5.1.10
+lastReleaseVersion: 5.2.1
diff --git a/csharp/ql/lib/ext/System.IO.model.yml b/csharp/ql/lib/ext/System.IO.model.yml
index dcc9c70551b0..0b8b52d9e8a5 100644
--- a/csharp/ql/lib/ext/System.IO.model.yml
+++ b/csharp/ql/lib/ext/System.IO.model.yml
@@ -47,7 +47,7 @@ extensions:
- ["System.IO", "FileStream", False, "FileStream", "(System.String,System.IO.FileMode,System.IO.FileAccess,System.IO.FileShare,System.Int32)", "", "Argument[0]", "Argument[this]", "taint", "manual"]
- ["System.IO", "FileStream", False, "FileStream", "(System.String,System.IO.FileMode,System.IO.FileAccess,System.IO.FileShare,System.Int32,System.Boolean)", "", "Argument[0]", "Argument[this]", "taint", "manual"]
- ["System.IO", "FileStream", False, "FileStream", "(System.String,System.IO.FileMode,System.IO.FileAccess,System.IO.FileShare,System.Int32,System.IO.FileOptions)", "", "Argument[0]", "Argument[this]", "taint", "manual"]
- - ["System.IO", "MemoryStream", False, "MemoryStream", "(System.Byte[])", "", "Argument[0]", "Argument[this]", "taint", "manual"]
+ - ["System.IO", "MemoryStream", False, "MemoryStream", "(System.Byte[])", "", "Argument[0].Element", "Argument[this]", "taint", "manual"]
- ["System.IO", "MemoryStream", False, "MemoryStream", "(System.Byte[],System.Boolean)", "", "Argument[0].Element", "Argument[this]", "taint", "manual"]
- ["System.IO", "MemoryStream", False, "MemoryStream", "(System.Byte[],System.Int32,System.Int32)", "", "Argument[0].Element", "Argument[this]", "taint", "manual"]
- ["System.IO", "MemoryStream", False, "MemoryStream", "(System.Byte[],System.Int32,System.Int32,System.Boolean)", "", "Argument[0].Element", "Argument[this]", "taint", "manual"]
diff --git a/csharp/ql/lib/ext/System.Runtime.Serialization.model.yml b/csharp/ql/lib/ext/System.Runtime.Serialization.model.yml
new file mode 100644
index 000000000000..628d06b33b8d
--- /dev/null
+++ b/csharp/ql/lib/ext/System.Runtime.Serialization.model.yml
@@ -0,0 +1,13 @@
+extensions:
+ - addsTo:
+ pack: codeql/csharp-all
+ extensible: summaryModel
+ data:
+ - ["System.Runtime.Serialization", "SerializationInfo", False, "AddValue", "(System.String,System.Object)", "", "Argument[1]", "Argument[this]", "taint", "manual"]
+ - ["System.Runtime.Serialization", "SerializationInfo", False, "AddValue", "(System.String,System.Object,System.Type)", "", "Argument[1]", "Argument[this]", "taint", "manual"]
+ - ["System.Runtime.Serialization", "SerializationInfo", False, "GetEnumerator", "()", "", "Argument[this]", "ReturnValue", "taint", "manual"]
+ - ["System.Runtime.Serialization", "SerializationInfo", False, "GetString", "(System.String)", "", "Argument[this]", "ReturnValue", "taint", "manual"]
+ - ["System.Runtime.Serialization", "SerializationInfo", False, "GetValue", "(System.String,System.Type)", "", "Argument[this]", "ReturnValue", "taint", "manual"]
+ # Note that SerializationEntry hasn't been modeled yet, so the model below for get_Current will not in itself provide more flow.
+ - ["System.Runtime.Serialization", "SerializationInfoEnumerator", False, "get_Current", "()", "", "Argument[this]", "ReturnValue", "taint", "manual"]
+ - ["System.Runtime.Serialization", "SerializationInfoEnumerator", False, "get_Value", "()", "", "Argument[this]", "ReturnValue", "taint", "manual"]
diff --git a/csharp/ql/lib/ext/System.Text.model.yml b/csharp/ql/lib/ext/System.Text.model.yml
index 4a94b61109f9..0067b8b000cf 100644
--- a/csharp/ql/lib/ext/System.Text.model.yml
+++ b/csharp/ql/lib/ext/System.Text.model.yml
@@ -3,18 +3,18 @@ extensions:
pack: codeql/csharp-all
extensible: summaryModel
data:
- - ["System.Text", "Encoding", True, "GetBytes", "(System.Char*,System.Int32,System.Byte*,System.Int32)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
+ - ["System.Text", "Encoding", True, "GetBytes", "(System.Char*,System.Int32,System.Byte*,System.Int32)", "", "Argument[0].Element", "Argument[2]", "taint", "manual"]
- ["System.Text", "Encoding", True, "GetBytes", "(System.Char[])", "", "Argument[0].Element", "ReturnValue", "taint", "manual"]
- ["System.Text", "Encoding", True, "GetBytes", "(System.Char[],System.Int32,System.Int32)", "", "Argument[0].Element", "ReturnValue", "taint", "manual"]
- - ["System.Text", "Encoding", True, "GetBytes", "(System.Char[],System.Int32,System.Int32,System.Byte[],System.Int32)", "", "Argument[0].Element", "ReturnValue", "taint", "manual"]
- - ["System.Text", "Encoding", True, "GetBytes", "(System.ReadOnlySpan,System.Span)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
+ - ["System.Text", "Encoding", True, "GetBytes", "(System.Char[],System.Int32,System.Int32,System.Byte[],System.Int32)", "", "Argument[0].Element", "Argument[3]", "taint", "manual"]
+ - ["System.Text", "Encoding", True, "GetBytes", "(System.ReadOnlySpan,System.Span)", "", "Argument[0].Element", "Argument[1]", "taint", "manual"]
- ["System.Text", "Encoding", True, "GetBytes", "(System.String)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
- - ["System.Text", "Encoding", False, "GetBytes", "(System.String,System.Int32,System.Int32)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
- - ["System.Text", "Encoding", True, "GetBytes", "(System.String,System.Int32,System.Int32,System.Byte[],System.Int32)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
- - ["System.Text", "Encoding", True, "GetChars", "(System.Byte*,System.Int32,System.Char*,System.Int32)", "", "Argument[0].Element", "ReturnValue", "taint", "manual"]
+ - ["System.Text", "Encoding", True, "GetBytes", "(System.String,System.Int32,System.Int32)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
+ - ["System.Text", "Encoding", True, "GetBytes", "(System.String,System.Int32,System.Int32,System.Byte[],System.Int32)", "", "Argument[0]", "Argument[3]", "taint", "manual"]
+ - ["System.Text", "Encoding", True, "GetChars", "(System.Byte*,System.Int32,System.Char*,System.Int32)", "", "Argument[0].Element", "Argument[2]", "taint", "manual"]
- ["System.Text", "Encoding", True, "GetChars", "(System.Byte[])", "", "Argument[0].Element", "ReturnValue", "taint", "manual"]
- ["System.Text", "Encoding", True, "GetChars", "(System.Byte[],System.Int32,System.Int32)", "", "Argument[0].Element", "ReturnValue", "taint", "manual"]
- - ["System.Text", "Encoding", True, "GetChars", "(System.Byte[],System.Int32,System.Int32,System.Char[],System.Int32)", "", "Argument[0].Element", "ReturnValue", "taint", "manual"]
+ - ["System.Text", "Encoding", True, "GetChars", "(System.Byte[],System.Int32,System.Int32,System.Char[],System.Int32)", "", "Argument[0].Element", "Argument[3]", "taint", "manual"]
- ["System.Text", "Encoding", True, "GetChars", "(System.ReadOnlySpan,System.Span)", "", "Argument[0].Element", "ReturnValue", "taint", "manual"]
- ["System.Text", "Encoding", False, "GetString", "(System.Byte*,System.Int32)", "", "Argument[0].Element", "ReturnValue", "taint", "manual"]
- ["System.Text", "Encoding", True, "GetString", "(System.Byte[])", "", "Argument[0].Element", "ReturnValue", "taint", "manual"]
diff --git a/csharp/ql/lib/ext/System.Xml.model.yml b/csharp/ql/lib/ext/System.Xml.model.yml
index 55825304a145..efea34b40dbe 100644
--- a/csharp/ql/lib/ext/System.Xml.model.yml
+++ b/csharp/ql/lib/ext/System.Xml.model.yml
@@ -4,6 +4,25 @@ extensions:
extensible: summaryModel
data:
- ["System.Xml", "XmlAttributeCollection", False, "CopyTo", "(System.Xml.XmlAttribute[],System.Int32)", "", "Argument[this].Element", "Argument[0].Element", "value", "manual"]
+ - ["System.Xml", "XmlDictionaryReader", False, "CreateBinaryReader", "(System.Byte[],System.Int32,System.Int32,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas)", "", "Argument[0].Element", "ReturnValue", "taint", "df-manual"]
+ - ["System.Xml", "XmlDictionaryReader", False, "CreateBinaryReader", "(System.Byte[],System.Int32,System.Int32,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas)", "", "Argument[3]", "ReturnValue", "taint", "df-manual"]
+ - ["System.Xml", "XmlDictionaryReader", False, "CreateBinaryReader", "(System.Byte[],System.Int32,System.Int32,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas,System.Xml.XmlBinaryReaderSession)", "", "Argument[0].Element", "ReturnValue", "taint", "df-manual"]
+ - ["System.Xml", "XmlDictionaryReader", False, "CreateBinaryReader", "(System.Byte[],System.Int32,System.Int32,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas,System.Xml.XmlBinaryReaderSession)", "", "Argument[3]", "ReturnValue", "taint", "df-manual"]
+ - ["System.Xml", "XmlDictionaryReader", False, "CreateBinaryReader", "(System.Byte[],System.Int32,System.Int32,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas,System.Xml.XmlBinaryReaderSession)", "", "Argument[5]", "ReturnValue", "taint", "df-manual"]
+ - ["System.Xml", "XmlDictionaryReader", False, "CreateBinaryReader", "(System.Byte[],System.Int32,System.Int32,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas,System.Xml.XmlBinaryReaderSession,System.Xml.OnXmlDictionaryReaderClose)", "", "Argument[0].Element", "ReturnValue", "taint", "manual"]
+ - ["System.Xml", "XmlDictionaryReader", False, "CreateBinaryReader", "(System.Byte[],System.Int32,System.Int32,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas,System.Xml.XmlBinaryReaderSession,System.Xml.OnXmlDictionaryReaderClose)", "", "Argument[3]", "ReturnValue", "taint", "manual"]
+ - ["System.Xml", "XmlDictionaryReader", False, "CreateBinaryReader", "(System.Byte[],System.Int32,System.Int32,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas,System.Xml.XmlBinaryReaderSession,System.Xml.OnXmlDictionaryReaderClose)", "", "Argument[5]", "ReturnValue", "taint", "manual"]
+ - ["System.Xml", "XmlDictionaryReader", False, "CreateBinaryReader", "(System.Byte[],System.Int32,System.Int32,System.Xml.XmlDictionaryReaderQuotas)", "", "Argument[0].Element", "ReturnValue", "taint", "df-manual"]
+ - ["System.Xml", "XmlDictionaryReader", False, "CreateBinaryReader", "(System.Byte[],System.Xml.XmlDictionaryReaderQuotas)", "", "Argument[0].Element", "ReturnValue", "taint", "df-manual"]
+ - ["System.Xml", "XmlDictionaryReader", False, "CreateBinaryReader", "(System.IO.Stream,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas)", "", "Argument[0]", "ReturnValue", "taint", "df-manual"]
+ - ["System.Xml", "XmlDictionaryReader", False, "CreateBinaryReader", "(System.IO.Stream,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas)", "", "Argument[1]", "ReturnValue", "taint", "df-manual"]
+ - ["System.Xml", "XmlDictionaryReader", False, "CreateBinaryReader", "(System.IO.Stream,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas,System.Xml.XmlBinaryReaderSession)", "", "Argument[0]", "ReturnValue", "taint", "df-manual"]
+ - ["System.Xml", "XmlDictionaryReader", False, "CreateBinaryReader", "(System.IO.Stream,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas,System.Xml.XmlBinaryReaderSession)", "", "Argument[1]", "ReturnValue", "taint", "df-manual"]
+ - ["System.Xml", "XmlDictionaryReader", False, "CreateBinaryReader", "(System.IO.Stream,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas,System.Xml.XmlBinaryReaderSession)", "", "Argument[3]", "ReturnValue", "taint", "df-manual"]
+ - ["System.Xml", "XmlDictionaryReader", False, "CreateBinaryReader", "(System.IO.Stream,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas,System.Xml.XmlBinaryReaderSession,System.Xml.OnXmlDictionaryReaderClose)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
+ - ["System.Xml", "XmlDictionaryReader", False, "CreateBinaryReader", "(System.IO.Stream,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas,System.Xml.XmlBinaryReaderSession,System.Xml.OnXmlDictionaryReaderClose)", "", "Argument[1]", "ReturnValue", "taint", "manual"]
+ - ["System.Xml", "XmlDictionaryReader", False, "CreateBinaryReader", "(System.IO.Stream,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas,System.Xml.XmlBinaryReaderSession,System.Xml.OnXmlDictionaryReaderClose)", "", "Argument[3]", "ReturnValue", "taint", "manual"]
+ - ["System.Xml", "XmlDictionaryReader", False, "CreateBinaryReader", "(System.IO.Stream,System.Xml.XmlDictionaryReaderQuotas)", "", "Argument[0]", "ReturnValue", "taint", "df-manual"]
- ["System.Xml", "XmlDocument", False, "Load", "(System.IO.Stream)", "", "Argument[0]", "Argument[this]", "taint", "manual"]
- ["System.Xml", "XmlDocument", False, "Load", "(System.IO.TextReader)", "", "Argument[0]", "Argument[this]", "taint", "manual"]
- ["System.Xml", "XmlDocument", False, "Load", "(System.String)", "", "Argument[0]", "Argument[this]", "taint", "manual"]
diff --git a/csharp/ql/lib/qlpack.yml b/csharp/ql/lib/qlpack.yml
index cc94ae1c2a59..b99e5b5be642 100644
--- a/csharp/ql/lib/qlpack.yml
+++ b/csharp/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-all
-version: 5.1.11-dev
+version: 5.2.2-dev
groups: csharp
dbscheme: semmlecode.csharp.dbscheme
extractor: csharp
diff --git a/csharp/ql/lib/semmle/code/asp/WebConfig.qll b/csharp/ql/lib/semmle/code/asp/WebConfig.qll
index f9106bcd1afd..384c3a013c3b 100644
--- a/csharp/ql/lib/semmle/code/asp/WebConfig.qll
+++ b/csharp/ql/lib/semmle/code/asp/WebConfig.qll
@@ -8,14 +8,14 @@ import csharp
* A `Web.config` file.
*/
class WebConfigXml extends XmlFile {
- WebConfigXml() { this.getName().matches("%Web.config") }
+ WebConfigXml() { this.getName().toLowerCase().matches("%web.config") }
}
/**
* A `Web.config` transformation file.
*/
class WebConfigReleaseTransformXml extends XmlFile {
- WebConfigReleaseTransformXml() { this.getName().matches("%Web.Release.config") }
+ WebConfigReleaseTransformXml() { this.getName().toLowerCase().matches("%web.release.config") }
}
/** A `` tag in an ASP.NET configuration file. */
diff --git a/csharp/ql/lib/semmle/code/csharp/Type.qll b/csharp/ql/lib/semmle/code/csharp/Type.qll
index 9283bb3002a1..e417f393b94a 100644
--- a/csharp/ql/lib/semmle/code/csharp/Type.qll
+++ b/csharp/ql/lib/semmle/code/csharp/Type.qll
@@ -138,6 +138,9 @@ class ValueOrRefType extends Type, Attributable, @value_or_ref_type {
/** Gets an immediate subtype of this type, if any. */
ValueOrRefType getASubType() { result.getABaseType() = this }
+ /** Gets an immediate supertype of this type, if any. */
+ ValueOrRefType getASuperType() { this.getABaseType() = result }
+
/** Gets a member of this type, if any. */
Member getAMember() { result.getDeclaringType() = this }
@@ -198,7 +201,7 @@ class ValueOrRefType extends Type, Attributable, @value_or_ref_type {
*/
pragma[inline]
predicate hasCallable(Callable c) {
- this.hasMethod(c)
+ this.hasMember(c)
or
this.hasMember(c.(Accessor).getDeclaration())
}
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/SsaImpl.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/SsaImpl.qll
index 6d59c0579860..d1490c849163 100644
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/SsaImpl.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/SsaImpl.qll
@@ -975,7 +975,8 @@ private module Cached {
cached // nothing is actually cached
module BarrierGuard {
private predicate guardChecksAdjTypes(
- DataFlowIntegrationInput::Guard g, DataFlowIntegrationInput::Expr e, boolean branch
+ DataFlowIntegrationInput::Guard g, DataFlowIntegrationInput::Expr e,
+ DataFlowIntegrationInput::GuardValue branch
) {
exists(Guards::AbstractValues::BooleanValue v |
guardChecks(g, e.getAstNode(), v) and
@@ -1016,6 +1017,7 @@ string getToStringPrefix(Definition def) {
private module DataFlowIntegrationInput implements Impl::DataFlowIntegrationInputSig {
private import csharp as Cs
private import semmle.code.csharp.controlflow.BasicBlocks
+ private import codeql.util.Boolean
class Expr extends ControlFlow::Node {
predicate hasCfgNode(ControlFlow::BasicBlock bb, int i) { this = bb.getNode(i) }
@@ -1042,12 +1044,14 @@ private module DataFlowIntegrationInput implements Impl::DataFlowIntegrationInpu
)
}
+ class GuardValue = Boolean;
+
class Guard extends Guards::Guard {
/**
* Holds if the evaluation of this guard to `branch` corresponds to the edge
* from `bb1` to `bb2`.
*/
- predicate hasBranchEdge(BasicBlock bb1, BasicBlock bb2, boolean branch) {
+ predicate hasValueBranchEdge(BasicBlock bb1, BasicBlock bb2, GuardValue branch) {
exists(ControlFlow::SuccessorTypes::ConditionalSuccessor s |
this.getAControlFlowNode() = bb1.getLastNode() and
bb2 = bb1.getASuccessorByType(s) and
@@ -1060,13 +1064,13 @@ private module DataFlowIntegrationInput implements Impl::DataFlowIntegrationInpu
* branch edge from `bb1` to `bb2`. That is, following the edge from
* `bb1` to `bb2` implies that this guard evaluated to `branch`.
*/
- predicate controlsBranchEdge(BasicBlock bb1, BasicBlock bb2, boolean branch) {
- this.hasBranchEdge(bb1, bb2, branch)
+ predicate valueControlsBranchEdge(BasicBlock bb1, BasicBlock bb2, GuardValue branch) {
+ this.hasValueBranchEdge(bb1, bb2, branch)
}
}
/** Holds if the guard `guard` controls block `bb` upon evaluating to `branch`. */
- predicate guardDirectlyControlsBlock(Guard guard, ControlFlow::BasicBlock bb, boolean branch) {
+ predicate guardDirectlyControlsBlock(Guard guard, ControlFlow::BasicBlock bb, GuardValue branch) {
exists(ConditionBlock conditionBlock, ControlFlow::SuccessorTypes::ConditionalSuccessor s |
guard.getAControlFlowNode() = conditionBlock.getLastNode() and
s.getValue() = branch and
diff --git a/csharp/ql/src/CHANGELOG.md b/csharp/ql/src/CHANGELOG.md
index 67a3deb278bf..7209d4cfb81e 100644
--- a/csharp/ql/src/CHANGELOG.md
+++ b/csharp/ql/src/CHANGELOG.md
@@ -1,9 +1,18 @@
+## 1.3.2
+
+No user-facing changes.
+
## 1.3.1
### Minor Analysis Improvements
+* Explicitly added summary models for all overloads of `System.Xml.XmlDictionaryReader.CreateBinaryReader`. Added models for some of the methods and properties in `System.Runtime.Serialization.SerializationInfo` and `System.Runtime.Serialization.SerializationInfoEnumerator`. Updated models for `System.Text.Encoding.GetBytes`, `System.Text.Encoding.GetChars` and the constructor for `System.IO.MemoryStream`. This generally improves the library modelling and thus reduces the number of false negatives.
* Added explicit SQL injection Models as Data models for `Microsoft.Data.SqlClient.SqlCommand` and `Microsoft.Data.SqlClient.SqlDataAdapter`. This reduces false negatives for the query `cs/sql-injection`.
+### Bug Fixes
+
+* `web.config` and `web.release.config` files are now recognized regardless of case. This means queries `cs/web/debug-binary` and `cs/web/missing-x-frame-options` may produce more results than before.
+
## 1.3.0
### Query Metadata Changes
diff --git a/csharp/ql/src/change-notes/released/1.3.1.md b/csharp/ql/src/change-notes/released/1.3.1.md
index 389a7a4d6a67..4576c8116873 100644
--- a/csharp/ql/src/change-notes/released/1.3.1.md
+++ b/csharp/ql/src/change-notes/released/1.3.1.md
@@ -2,4 +2,9 @@
### Minor Analysis Improvements
+* Explicitly added summary models for all overloads of `System.Xml.XmlDictionaryReader.CreateBinaryReader`. Added models for some of the methods and properties in `System.Runtime.Serialization.SerializationInfo` and `System.Runtime.Serialization.SerializationInfoEnumerator`. Updated models for `System.Text.Encoding.GetBytes`, `System.Text.Encoding.GetChars` and the constructor for `System.IO.MemoryStream`. This generally improves the library modelling and thus reduces the number of false negatives.
* Added explicit SQL injection Models as Data models for `Microsoft.Data.SqlClient.SqlCommand` and `Microsoft.Data.SqlClient.SqlDataAdapter`. This reduces false negatives for the query `cs/sql-injection`.
+
+### Bug Fixes
+
+* `web.config` and `web.release.config` files are now recognized regardless of case. This means queries `cs/web/debug-binary` and `cs/web/missing-x-frame-options` may produce more results than before.
diff --git a/csharp/ql/src/change-notes/released/1.3.2.md b/csharp/ql/src/change-notes/released/1.3.2.md
new file mode 100644
index 000000000000..14f14807ef51
--- /dev/null
+++ b/csharp/ql/src/change-notes/released/1.3.2.md
@@ -0,0 +1,3 @@
+## 1.3.2
+
+No user-facing changes.
diff --git a/csharp/ql/src/codeql-pack.release.yml b/csharp/ql/src/codeql-pack.release.yml
index e71b6d081f15..86a9cb32d86b 100644
--- a/csharp/ql/src/codeql-pack.release.yml
+++ b/csharp/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 1.3.1
+lastReleaseVersion: 1.3.2
diff --git a/csharp/ql/src/qlpack.yml b/csharp/ql/src/qlpack.yml
index 62db73042efe..ec0fab1f1114 100644
--- a/csharp/ql/src/qlpack.yml
+++ b/csharp/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-queries
-version: 1.3.2-dev
+version: 1.3.3-dev
groups:
- csharp
- queries
diff --git a/csharp/ql/test/library-tests/dataflow/library/FlowSummaries.expected b/csharp/ql/test/library-tests/dataflow/library/FlowSummaries.expected
index c3eb0402922c..ff615d531152 100644
--- a/csharp/ql/test/library-tests/dataflow/library/FlowSummaries.expected
+++ b/csharp/ql/test/library-tests/dataflow/library/FlowSummaries.expected
@@ -12371,7 +12371,7 @@ summary
| System.IO;MemoryStream;CopyToAsync;(System.IO.Stream,System.Int32,System.Threading.CancellationToken);Argument[this];Argument[0];taint;manual |
| System.IO;MemoryStream;FlushAsync;(System.Threading.CancellationToken);Argument[this];ReturnValue.SyntheticField[System.Threading.Tasks.Task.m_stateObject];value;dfc-generated |
| System.IO;MemoryStream;GetBuffer;();Argument[this];ReturnValue;taint;df-generated |
-| System.IO;MemoryStream;MemoryStream;(System.Byte[]);Argument[0];Argument[this];taint;manual |
+| System.IO;MemoryStream;MemoryStream;(System.Byte[]);Argument[0].Element;Argument[this];taint;manual |
| System.IO;MemoryStream;MemoryStream;(System.Byte[],System.Boolean);Argument[0].Element;Argument[this];taint;manual |
| System.IO;MemoryStream;MemoryStream;(System.Byte[],System.Int32,System.Int32);Argument[0].Element;Argument[this];taint;manual |
| System.IO;MemoryStream;MemoryStream;(System.Byte[],System.Int32,System.Int32,System.Boolean);Argument[0].Element;Argument[this];taint;manual |
@@ -17277,30 +17277,20 @@ summary
| System.Runtime.Serialization;SerializationInfo;AddValue;(System.String,System.Int16);Argument[0];Argument[this].SyntheticField[System.Runtime.Serialization.SerializationInfo._names].Element;value;dfc-generated |
| System.Runtime.Serialization;SerializationInfo;AddValue;(System.String,System.Int32);Argument[0];Argument[this].SyntheticField[System.Runtime.Serialization.SerializationInfo._names].Element;value;dfc-generated |
| System.Runtime.Serialization;SerializationInfo;AddValue;(System.String,System.Int64);Argument[0];Argument[this].SyntheticField[System.Runtime.Serialization.SerializationInfo._names].Element;value;dfc-generated |
-| System.Runtime.Serialization;SerializationInfo;AddValue;(System.String,System.Object);Argument[0];Argument[this].SyntheticField[System.Runtime.Serialization.SerializationInfo._names].Element;value;dfc-generated |
-| System.Runtime.Serialization;SerializationInfo;AddValue;(System.String,System.Object);Argument[1];Argument[this].SyntheticField[System.Runtime.Serialization.SerializationInfo._values].Element;value;dfc-generated |
-| System.Runtime.Serialization;SerializationInfo;AddValue;(System.String,System.Object,System.Type);Argument[0];Argument[this].SyntheticField[System.Runtime.Serialization.SerializationInfo._names].Element;value;dfc-generated |
-| System.Runtime.Serialization;SerializationInfo;AddValue;(System.String,System.Object,System.Type);Argument[1];Argument[this].SyntheticField[System.Runtime.Serialization.SerializationInfo._values].Element;value;dfc-generated |
+| System.Runtime.Serialization;SerializationInfo;AddValue;(System.String,System.Object);Argument[1];Argument[this];taint;manual |
+| System.Runtime.Serialization;SerializationInfo;AddValue;(System.String,System.Object,System.Type);Argument[1];Argument[this];taint;manual |
| System.Runtime.Serialization;SerializationInfo;AddValue;(System.String,System.SByte);Argument[0];Argument[this].SyntheticField[System.Runtime.Serialization.SerializationInfo._names].Element;value;dfc-generated |
| System.Runtime.Serialization;SerializationInfo;AddValue;(System.String,System.Single);Argument[0];Argument[this].SyntheticField[System.Runtime.Serialization.SerializationInfo._names].Element;value;dfc-generated |
| System.Runtime.Serialization;SerializationInfo;AddValue;(System.String,System.UInt16);Argument[0];Argument[this].SyntheticField[System.Runtime.Serialization.SerializationInfo._names].Element;value;dfc-generated |
| System.Runtime.Serialization;SerializationInfo;AddValue;(System.String,System.UInt32);Argument[0];Argument[this].SyntheticField[System.Runtime.Serialization.SerializationInfo._names].Element;value;dfc-generated |
| System.Runtime.Serialization;SerializationInfo;AddValue;(System.String,System.UInt64);Argument[0];Argument[this].SyntheticField[System.Runtime.Serialization.SerializationInfo._names].Element;value;dfc-generated |
-| System.Runtime.Serialization;SerializationInfo;GetEnumerator;();Argument[this].SyntheticField[System.Runtime.Serialization.SerializationInfo._names];ReturnValue.SyntheticField[System.Runtime.Serialization.SerializationInfoEnumerator._members];value;dfc-generated |
-| System.Runtime.Serialization;SerializationInfo;GetEnumerator;();Argument[this].SyntheticField[System.Runtime.Serialization.SerializationInfo._values];ReturnValue.SyntheticField[System.Runtime.Serialization.SerializationInfoEnumerator._data];value;dfc-generated |
-| System.Runtime.Serialization;SerializationInfo;GetString;(System.String);Argument[this].SyntheticField[System.Runtime.Serialization.SerializationInfo._values].Element;ReturnValue;value;dfc-generated |
-| System.Runtime.Serialization;SerializationInfo;GetValue;(System.String,System.Type);Argument[this].SyntheticField[System.Runtime.Serialization.SerializationInfo._values].Element;ReturnValue;value;dfc-generated |
+| System.Runtime.Serialization;SerializationInfo;GetEnumerator;();Argument[this];ReturnValue;taint;manual |
+| System.Runtime.Serialization;SerializationInfo;GetString;(System.String);Argument[this];ReturnValue;taint;manual |
+| System.Runtime.Serialization;SerializationInfo;GetValue;(System.String,System.Type);Argument[this];ReturnValue;taint;manual |
| System.Runtime.Serialization;SerializationInfo;SerializationInfo;(System.Type,System.Runtime.Serialization.IFormatterConverter);Argument[1];Argument[this];taint;df-generated |
-| System.Runtime.Serialization;SerializationInfoEnumerator;get_Current;();Argument[this].Property[System.Runtime.Serialization.SerializationInfoEnumerator.Current];ReturnValue;value;df-generated |
-| System.Runtime.Serialization;SerializationInfoEnumerator;get_Current;();Argument[this].Property[System.Runtime.Serialization.SerializationInfoEnumerator.Current];ReturnValue;value;dfc-generated |
-| System.Runtime.Serialization;SerializationInfoEnumerator;get_Current;();Argument[this].SyntheticField[System.Runtime.Serialization.SerializationInfoEnumerator._data].Element;ReturnValue.SyntheticField[System.Runtime.Serialization.SerializationEntry._value];value;df-generated |
-| System.Runtime.Serialization;SerializationInfoEnumerator;get_Current;();Argument[this].SyntheticField[System.Runtime.Serialization.SerializationInfoEnumerator._data].Element;ReturnValue.SyntheticField[System.Runtime.Serialization.SerializationEntry._value];value;dfc-generated |
-| System.Runtime.Serialization;SerializationInfoEnumerator;get_Current;();Argument[this].SyntheticField[System.Runtime.Serialization.SerializationInfoEnumerator._members].Element;ReturnValue.SyntheticField[System.Runtime.Serialization.SerializationEntry._name];value;df-generated |
-| System.Runtime.Serialization;SerializationInfoEnumerator;get_Current;();Argument[this].SyntheticField[System.Runtime.Serialization.SerializationInfoEnumerator._members].Element;ReturnValue.SyntheticField[System.Runtime.Serialization.SerializationEntry._name];value;dfc-generated |
-| System.Runtime.Serialization;SerializationInfoEnumerator;get_Current;();Argument[this];ReturnValue;taint;df-generated |
-| System.Runtime.Serialization;SerializationInfoEnumerator;get_Current;();Argument[this];ReturnValue;taint;dfc-generated |
+| System.Runtime.Serialization;SerializationInfoEnumerator;get_Current;();Argument[this];ReturnValue;taint;manual |
| System.Runtime.Serialization;SerializationInfoEnumerator;get_Name;();Argument[this].SyntheticField[System.Runtime.Serialization.SerializationInfoEnumerator._members].Element;ReturnValue;value;dfc-generated |
-| System.Runtime.Serialization;SerializationInfoEnumerator;get_Value;();Argument[this].SyntheticField[System.Runtime.Serialization.SerializationInfoEnumerator._data].Element;ReturnValue;value;dfc-generated |
+| System.Runtime.Serialization;SerializationInfoEnumerator;get_Value;();Argument[this];ReturnValue;taint;manual |
| System.Runtime.Serialization;SerializationObjectManager;SerializationObjectManager;(System.Runtime.Serialization.StreamingContext);Argument[0];Argument[this];taint;df-generated |
| System.Runtime.Serialization;StreamingContext;StreamingContext;(System.Runtime.Serialization.StreamingContextStates,System.Object);Argument[1];Argument[this].SyntheticField[System.Runtime.Serialization.StreamingContext._additionalContext];value;dfc-generated |
| System.Runtime.Serialization;StreamingContext;get_Context;();Argument[this].SyntheticField[System.Runtime.Serialization.StreamingContext._additionalContext];ReturnValue;value;dfc-generated |
@@ -18467,12 +18457,12 @@ summary
| System.Text.Unicode;Utf8+TryWriteInterpolatedStringHandler;TryWriteInterpolatedStringHandler;(System.Int32,System.Int32,System.Span,System.Boolean);Argument[2];Argument[this];taint;df-generated |
| System.Text.Unicode;Utf8+TryWriteInterpolatedStringHandler;TryWriteInterpolatedStringHandler;(System.Int32,System.Int32,System.Span,System.IFormatProvider,System.Boolean);Argument[2];Argument[this];taint;df-generated |
| System.Text.Unicode;Utf8+TryWriteInterpolatedStringHandler;TryWriteInterpolatedStringHandler;(System.Int32,System.Int32,System.Span,System.IFormatProvider,System.Boolean);Argument[3];Argument[this];taint;df-generated |
-| System.Text;ASCIIEncoding;GetBytes;(System.Char*,System.Int32,System.Byte*,System.Int32);Argument[0];ReturnValue;taint;manual |
-| System.Text;ASCIIEncoding;GetBytes;(System.Char[],System.Int32,System.Int32,System.Byte[],System.Int32);Argument[0].Element;ReturnValue;taint;manual |
-| System.Text;ASCIIEncoding;GetBytes;(System.ReadOnlySpan,System.Span);Argument[0];ReturnValue;taint;manual |
-| System.Text;ASCIIEncoding;GetBytes;(System.String,System.Int32,System.Int32,System.Byte[],System.Int32);Argument[0];ReturnValue;taint;manual |
-| System.Text;ASCIIEncoding;GetChars;(System.Byte*,System.Int32,System.Char*,System.Int32);Argument[0].Element;ReturnValue;taint;manual |
-| System.Text;ASCIIEncoding;GetChars;(System.Byte[],System.Int32,System.Int32,System.Char[],System.Int32);Argument[0].Element;ReturnValue;taint;manual |
+| System.Text;ASCIIEncoding;GetBytes;(System.Char*,System.Int32,System.Byte*,System.Int32);Argument[0].Element;Argument[2];taint;manual |
+| System.Text;ASCIIEncoding;GetBytes;(System.Char[],System.Int32,System.Int32,System.Byte[],System.Int32);Argument[0].Element;Argument[3];taint;manual |
+| System.Text;ASCIIEncoding;GetBytes;(System.ReadOnlySpan,System.Span);Argument[0].Element;Argument[1];taint;manual |
+| System.Text;ASCIIEncoding;GetBytes;(System.String,System.Int32,System.Int32,System.Byte[],System.Int32);Argument[0];Argument[3];taint;manual |
+| System.Text;ASCIIEncoding;GetChars;(System.Byte*,System.Int32,System.Char*,System.Int32);Argument[0].Element;Argument[2];taint;manual |
+| System.Text;ASCIIEncoding;GetChars;(System.Byte[],System.Int32,System.Int32,System.Char[],System.Int32);Argument[0].Element;Argument[3];taint;manual |
| System.Text;ASCIIEncoding;GetChars;(System.ReadOnlySpan,System.Span);Argument[0].Element;ReturnValue;taint;manual |
| System.Text;ASCIIEncoding;GetDecoder;();Argument[this];ReturnValue;taint;df-generated |
| System.Text;ASCIIEncoding;GetEncoder;();Argument[this];ReturnValue;taint;df-generated |
@@ -18501,18 +18491,18 @@ summary
| System.Text;Encoding;CreateTranscodingStream;(System.IO.Stream,System.Text.Encoding,System.Text.Encoding,System.Boolean);Argument[2];ReturnValue;taint;df-generated |
| System.Text;Encoding;Encoding;(System.Int32,System.Text.EncoderFallback,System.Text.DecoderFallback);Argument[1];Argument[this];taint;df-generated |
| System.Text;Encoding;Encoding;(System.Int32,System.Text.EncoderFallback,System.Text.DecoderFallback);Argument[2];Argument[this];taint;df-generated |
-| System.Text;Encoding;GetBytes;(System.Char*,System.Int32,System.Byte*,System.Int32);Argument[0];ReturnValue;taint;manual |
+| System.Text;Encoding;GetBytes;(System.Char*,System.Int32,System.Byte*,System.Int32);Argument[0].Element;Argument[2];taint;manual |
| System.Text;Encoding;GetBytes;(System.Char[]);Argument[0].Element;ReturnValue;taint;manual |
| System.Text;Encoding;GetBytes;(System.Char[],System.Int32,System.Int32);Argument[0].Element;ReturnValue;taint;manual |
-| System.Text;Encoding;GetBytes;(System.Char[],System.Int32,System.Int32,System.Byte[],System.Int32);Argument[0].Element;ReturnValue;taint;manual |
-| System.Text;Encoding;GetBytes;(System.ReadOnlySpan,System.Span);Argument[0];ReturnValue;taint;manual |
+| System.Text;Encoding;GetBytes;(System.Char[],System.Int32,System.Int32,System.Byte[],System.Int32);Argument[0].Element;Argument[3];taint;manual |
+| System.Text;Encoding;GetBytes;(System.ReadOnlySpan,System.Span);Argument[0].Element;Argument[1];taint;manual |
| System.Text;Encoding;GetBytes;(System.String);Argument[0];ReturnValue;taint;manual |
| System.Text;Encoding;GetBytes;(System.String,System.Int32,System.Int32);Argument[0];ReturnValue;taint;manual |
-| System.Text;Encoding;GetBytes;(System.String,System.Int32,System.Int32,System.Byte[],System.Int32);Argument[0];ReturnValue;taint;manual |
-| System.Text;Encoding;GetChars;(System.Byte*,System.Int32,System.Char*,System.Int32);Argument[0].Element;ReturnValue;taint;manual |
+| System.Text;Encoding;GetBytes;(System.String,System.Int32,System.Int32,System.Byte[],System.Int32);Argument[0];Argument[3];taint;manual |
+| System.Text;Encoding;GetChars;(System.Byte*,System.Int32,System.Char*,System.Int32);Argument[0].Element;Argument[2];taint;manual |
| System.Text;Encoding;GetChars;(System.Byte[]);Argument[0].Element;ReturnValue;taint;manual |
| System.Text;Encoding;GetChars;(System.Byte[],System.Int32,System.Int32);Argument[0].Element;ReturnValue;taint;manual |
-| System.Text;Encoding;GetChars;(System.Byte[],System.Int32,System.Int32,System.Char[],System.Int32);Argument[0].Element;ReturnValue;taint;manual |
+| System.Text;Encoding;GetChars;(System.Byte[],System.Int32,System.Int32,System.Char[],System.Int32);Argument[0].Element;Argument[3];taint;manual |
| System.Text;Encoding;GetChars;(System.ReadOnlySpan,System.Span);Argument[0].Element;ReturnValue;taint;manual |
| System.Text;Encoding;GetDecoder;();Argument[this];ReturnValue;taint;df-generated |
| System.Text;Encoding;GetEncoder;();Argument[this];ReturnValue;taint;df-generated |
@@ -18703,37 +18693,37 @@ summary
| System.Text;StringRuneEnumerator;GetEnumerator;();Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
| System.Text;StringRuneEnumerator;GetEnumerator;();Argument[this];ReturnValue;value;dfc-generated |
| System.Text;StringRuneEnumerator;get_Current;();Argument[this];ReturnValue;taint;df-generated |
-| System.Text;UTF7Encoding;GetBytes;(System.Char*,System.Int32,System.Byte*,System.Int32);Argument[0];ReturnValue;taint;manual |
-| System.Text;UTF7Encoding;GetBytes;(System.Char[],System.Int32,System.Int32,System.Byte[],System.Int32);Argument[0].Element;ReturnValue;taint;manual |
-| System.Text;UTF7Encoding;GetBytes;(System.String,System.Int32,System.Int32,System.Byte[],System.Int32);Argument[0];ReturnValue;taint;manual |
-| System.Text;UTF7Encoding;GetChars;(System.Byte*,System.Int32,System.Char*,System.Int32);Argument[0].Element;ReturnValue;taint;manual |
-| System.Text;UTF7Encoding;GetChars;(System.Byte[],System.Int32,System.Int32,System.Char[],System.Int32);Argument[0].Element;ReturnValue;taint;manual |
+| System.Text;UTF7Encoding;GetBytes;(System.Char*,System.Int32,System.Byte*,System.Int32);Argument[0].Element;Argument[2];taint;manual |
+| System.Text;UTF7Encoding;GetBytes;(System.Char[],System.Int32,System.Int32,System.Byte[],System.Int32);Argument[0].Element;Argument[3];taint;manual |
+| System.Text;UTF7Encoding;GetBytes;(System.String,System.Int32,System.Int32,System.Byte[],System.Int32);Argument[0];Argument[3];taint;manual |
+| System.Text;UTF7Encoding;GetChars;(System.Byte*,System.Int32,System.Char*,System.Int32);Argument[0].Element;Argument[2];taint;manual |
+| System.Text;UTF7Encoding;GetChars;(System.Byte[],System.Int32,System.Int32,System.Char[],System.Int32);Argument[0].Element;Argument[3];taint;manual |
| System.Text;UTF7Encoding;GetDecoder;();Argument[this];ReturnValue;taint;df-generated |
| System.Text;UTF7Encoding;GetEncoder;();Argument[this];ReturnValue;taint;df-generated |
| System.Text;UTF7Encoding;GetString;(System.Byte[],System.Int32,System.Int32);Argument[0].Element;ReturnValue;taint;manual |
-| System.Text;UTF8Encoding;GetBytes;(System.Char*,System.Int32,System.Byte*,System.Int32);Argument[0];ReturnValue;taint;manual |
-| System.Text;UTF8Encoding;GetBytes;(System.Char[],System.Int32,System.Int32,System.Byte[],System.Int32);Argument[0].Element;ReturnValue;taint;manual |
-| System.Text;UTF8Encoding;GetBytes;(System.ReadOnlySpan,System.Span);Argument[0];ReturnValue;taint;manual |
-| System.Text;UTF8Encoding;GetBytes;(System.String,System.Int32,System.Int32,System.Byte[],System.Int32);Argument[0];ReturnValue;taint;manual |
-| System.Text;UTF8Encoding;GetChars;(System.Byte*,System.Int32,System.Char*,System.Int32);Argument[0].Element;ReturnValue;taint;manual |
-| System.Text;UTF8Encoding;GetChars;(System.Byte[],System.Int32,System.Int32,System.Char[],System.Int32);Argument[0].Element;ReturnValue;taint;manual |
+| System.Text;UTF8Encoding;GetBytes;(System.Char*,System.Int32,System.Byte*,System.Int32);Argument[0].Element;Argument[2];taint;manual |
+| System.Text;UTF8Encoding;GetBytes;(System.Char[],System.Int32,System.Int32,System.Byte[],System.Int32);Argument[0].Element;Argument[3];taint;manual |
+| System.Text;UTF8Encoding;GetBytes;(System.ReadOnlySpan,System.Span);Argument[0].Element;Argument[1];taint;manual |
+| System.Text;UTF8Encoding;GetBytes;(System.String,System.Int32,System.Int32,System.Byte[],System.Int32);Argument[0];Argument[3];taint;manual |
+| System.Text;UTF8Encoding;GetChars;(System.Byte*,System.Int32,System.Char*,System.Int32);Argument[0].Element;Argument[2];taint;manual |
+| System.Text;UTF8Encoding;GetChars;(System.Byte[],System.Int32,System.Int32,System.Char[],System.Int32);Argument[0].Element;Argument[3];taint;manual |
| System.Text;UTF8Encoding;GetChars;(System.ReadOnlySpan,System.Span);Argument[0].Element;ReturnValue;taint;manual |
| System.Text;UTF8Encoding;GetDecoder;();Argument[this];ReturnValue;taint;df-generated |
| System.Text;UTF8Encoding;GetEncoder;();Argument[this];ReturnValue;taint;df-generated |
| System.Text;UTF8Encoding;GetString;(System.Byte[],System.Int32,System.Int32);Argument[0].Element;ReturnValue;taint;manual |
-| System.Text;UTF32Encoding;GetBytes;(System.Char*,System.Int32,System.Byte*,System.Int32);Argument[0];ReturnValue;taint;manual |
-| System.Text;UTF32Encoding;GetBytes;(System.Char[],System.Int32,System.Int32,System.Byte[],System.Int32);Argument[0].Element;ReturnValue;taint;manual |
-| System.Text;UTF32Encoding;GetBytes;(System.String,System.Int32,System.Int32,System.Byte[],System.Int32);Argument[0];ReturnValue;taint;manual |
-| System.Text;UTF32Encoding;GetChars;(System.Byte*,System.Int32,System.Char*,System.Int32);Argument[0].Element;ReturnValue;taint;manual |
-| System.Text;UTF32Encoding;GetChars;(System.Byte[],System.Int32,System.Int32,System.Char[],System.Int32);Argument[0].Element;ReturnValue;taint;manual |
+| System.Text;UTF32Encoding;GetBytes;(System.Char*,System.Int32,System.Byte*,System.Int32);Argument[0].Element;Argument[2];taint;manual |
+| System.Text;UTF32Encoding;GetBytes;(System.Char[],System.Int32,System.Int32,System.Byte[],System.Int32);Argument[0].Element;Argument[3];taint;manual |
+| System.Text;UTF32Encoding;GetBytes;(System.String,System.Int32,System.Int32,System.Byte[],System.Int32);Argument[0];Argument[3];taint;manual |
+| System.Text;UTF32Encoding;GetChars;(System.Byte*,System.Int32,System.Char*,System.Int32);Argument[0].Element;Argument[2];taint;manual |
+| System.Text;UTF32Encoding;GetChars;(System.Byte[],System.Int32,System.Int32,System.Char[],System.Int32);Argument[0].Element;Argument[3];taint;manual |
| System.Text;UTF32Encoding;GetDecoder;();Argument[this];ReturnValue;taint;df-generated |
| System.Text;UTF32Encoding;GetEncoder;();Argument[this];ReturnValue;taint;df-generated |
| System.Text;UTF32Encoding;GetString;(System.Byte[],System.Int32,System.Int32);Argument[0].Element;ReturnValue;taint;manual |
-| System.Text;UnicodeEncoding;GetBytes;(System.Char*,System.Int32,System.Byte*,System.Int32);Argument[0];ReturnValue;taint;manual |
-| System.Text;UnicodeEncoding;GetBytes;(System.Char[],System.Int32,System.Int32,System.Byte[],System.Int32);Argument[0].Element;ReturnValue;taint;manual |
-| System.Text;UnicodeEncoding;GetBytes;(System.String,System.Int32,System.Int32,System.Byte[],System.Int32);Argument[0];ReturnValue;taint;manual |
-| System.Text;UnicodeEncoding;GetChars;(System.Byte*,System.Int32,System.Char*,System.Int32);Argument[0].Element;ReturnValue;taint;manual |
-| System.Text;UnicodeEncoding;GetChars;(System.Byte[],System.Int32,System.Int32,System.Char[],System.Int32);Argument[0].Element;ReturnValue;taint;manual |
+| System.Text;UnicodeEncoding;GetBytes;(System.Char*,System.Int32,System.Byte*,System.Int32);Argument[0].Element;Argument[2];taint;manual |
+| System.Text;UnicodeEncoding;GetBytes;(System.Char[],System.Int32,System.Int32,System.Byte[],System.Int32);Argument[0].Element;Argument[3];taint;manual |
+| System.Text;UnicodeEncoding;GetBytes;(System.String,System.Int32,System.Int32,System.Byte[],System.Int32);Argument[0];Argument[3];taint;manual |
+| System.Text;UnicodeEncoding;GetChars;(System.Byte*,System.Int32,System.Char*,System.Int32);Argument[0].Element;Argument[2];taint;manual |
+| System.Text;UnicodeEncoding;GetChars;(System.Byte[],System.Int32,System.Int32,System.Char[],System.Int32);Argument[0].Element;Argument[3];taint;manual |
| System.Text;UnicodeEncoding;GetDecoder;();Argument[this];ReturnValue;taint;df-generated |
| System.Text;UnicodeEncoding;GetEncoder;();Argument[this];ReturnValue;taint;df-generated |
| System.Text;UnicodeEncoding;GetString;(System.Byte[],System.Int32,System.Int32);Argument[0].Element;ReturnValue;taint;manual |
@@ -20868,21 +20858,27 @@ summary
| System.Xml;XmlDictionary;TryLookup;(System.Int32,System.Xml.XmlDictionaryString);Argument[this];Argument[1];taint;df-generated |
| System.Xml;XmlDictionary;TryLookup;(System.String,System.Xml.XmlDictionaryString);Argument[this];Argument[1];taint;df-generated |
| System.Xml;XmlDictionary;TryLookup;(System.Xml.XmlDictionaryString,System.Xml.XmlDictionaryString);Argument[0];Argument[1];value;dfc-generated |
-| System.Xml;XmlDictionaryReader;CreateBinaryReader;(System.Byte[],System.Int32,System.Int32,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas);Argument[0].Element;ReturnValue;taint;df-generated |
-| System.Xml;XmlDictionaryReader;CreateBinaryReader;(System.Byte[],System.Int32,System.Int32,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas);Argument[3];ReturnValue;taint;df-generated |
-| System.Xml;XmlDictionaryReader;CreateBinaryReader;(System.Byte[],System.Int32,System.Int32,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas,System.Xml.XmlBinaryReaderSession);Argument[0].Element;ReturnValue;taint;df-generated |
-| System.Xml;XmlDictionaryReader;CreateBinaryReader;(System.Byte[],System.Int32,System.Int32,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas,System.Xml.XmlBinaryReaderSession);Argument[3];ReturnValue;taint;df-generated |
-| System.Xml;XmlDictionaryReader;CreateBinaryReader;(System.Byte[],System.Int32,System.Int32,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas,System.Xml.XmlBinaryReaderSession);Argument[5];ReturnValue;taint;df-generated |
-| System.Xml;XmlDictionaryReader;CreateBinaryReader;(System.Byte[],System.Int32,System.Int32,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas,System.Xml.XmlBinaryReaderSession,System.Xml.OnXmlDictionaryReaderClose);Argument[6];Argument[6].Parameter[delegate-self];value;hq-generated |
-| System.Xml;XmlDictionaryReader;CreateBinaryReader;(System.Byte[],System.Int32,System.Int32,System.Xml.XmlDictionaryReaderQuotas);Argument[0].Element;ReturnValue;taint;df-generated |
-| System.Xml;XmlDictionaryReader;CreateBinaryReader;(System.Byte[],System.Xml.XmlDictionaryReaderQuotas);Argument[0].Element;ReturnValue;taint;df-generated |
-| System.Xml;XmlDictionaryReader;CreateBinaryReader;(System.IO.Stream,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas);Argument[0];ReturnValue;taint;df-generated |
-| System.Xml;XmlDictionaryReader;CreateBinaryReader;(System.IO.Stream,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas);Argument[1];ReturnValue;taint;df-generated |
-| System.Xml;XmlDictionaryReader;CreateBinaryReader;(System.IO.Stream,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas,System.Xml.XmlBinaryReaderSession);Argument[0];ReturnValue;taint;df-generated |
-| System.Xml;XmlDictionaryReader;CreateBinaryReader;(System.IO.Stream,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas,System.Xml.XmlBinaryReaderSession);Argument[1];ReturnValue;taint;df-generated |
-| System.Xml;XmlDictionaryReader;CreateBinaryReader;(System.IO.Stream,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas,System.Xml.XmlBinaryReaderSession);Argument[3];ReturnValue;taint;df-generated |
-| System.Xml;XmlDictionaryReader;CreateBinaryReader;(System.IO.Stream,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas,System.Xml.XmlBinaryReaderSession,System.Xml.OnXmlDictionaryReaderClose);Argument[4];Argument[4].Parameter[delegate-self];value;hq-generated |
-| System.Xml;XmlDictionaryReader;CreateBinaryReader;(System.IO.Stream,System.Xml.XmlDictionaryReaderQuotas);Argument[0];ReturnValue;taint;df-generated |
+| System.Xml;XmlDictionaryReader;CreateBinaryReader;(System.Byte[],System.Int32,System.Int32,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas);Argument[0].Element;ReturnValue;taint;df-manual |
+| System.Xml;XmlDictionaryReader;CreateBinaryReader;(System.Byte[],System.Int32,System.Int32,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas);Argument[3];ReturnValue;taint;df-manual |
+| System.Xml;XmlDictionaryReader;CreateBinaryReader;(System.Byte[],System.Int32,System.Int32,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas,System.Xml.XmlBinaryReaderSession);Argument[0].Element;ReturnValue;taint;df-manual |
+| System.Xml;XmlDictionaryReader;CreateBinaryReader;(System.Byte[],System.Int32,System.Int32,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas,System.Xml.XmlBinaryReaderSession);Argument[3];ReturnValue;taint;df-manual |
+| System.Xml;XmlDictionaryReader;CreateBinaryReader;(System.Byte[],System.Int32,System.Int32,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas,System.Xml.XmlBinaryReaderSession);Argument[5];ReturnValue;taint;df-manual |
+| System.Xml;XmlDictionaryReader;CreateBinaryReader;(System.Byte[],System.Int32,System.Int32,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas,System.Xml.XmlBinaryReaderSession,System.Xml.OnXmlDictionaryReaderClose);Argument[0].Element;ReturnValue;taint;manual |
+| System.Xml;XmlDictionaryReader;CreateBinaryReader;(System.Byte[],System.Int32,System.Int32,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas,System.Xml.XmlBinaryReaderSession,System.Xml.OnXmlDictionaryReaderClose);Argument[3];ReturnValue;taint;manual |
+| System.Xml;XmlDictionaryReader;CreateBinaryReader;(System.Byte[],System.Int32,System.Int32,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas,System.Xml.XmlBinaryReaderSession,System.Xml.OnXmlDictionaryReaderClose);Argument[5];ReturnValue;taint;manual |
+| System.Xml;XmlDictionaryReader;CreateBinaryReader;(System.Byte[],System.Int32,System.Int32,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas,System.Xml.XmlBinaryReaderSession,System.Xml.OnXmlDictionaryReaderClose);Argument[6];Argument[6].Parameter[delegate-self];value;manual |
+| System.Xml;XmlDictionaryReader;CreateBinaryReader;(System.Byte[],System.Int32,System.Int32,System.Xml.XmlDictionaryReaderQuotas);Argument[0].Element;ReturnValue;taint;df-manual |
+| System.Xml;XmlDictionaryReader;CreateBinaryReader;(System.Byte[],System.Xml.XmlDictionaryReaderQuotas);Argument[0].Element;ReturnValue;taint;df-manual |
+| System.Xml;XmlDictionaryReader;CreateBinaryReader;(System.IO.Stream,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas);Argument[0];ReturnValue;taint;df-manual |
+| System.Xml;XmlDictionaryReader;CreateBinaryReader;(System.IO.Stream,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas);Argument[1];ReturnValue;taint;df-manual |
+| System.Xml;XmlDictionaryReader;CreateBinaryReader;(System.IO.Stream,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas,System.Xml.XmlBinaryReaderSession);Argument[0];ReturnValue;taint;df-manual |
+| System.Xml;XmlDictionaryReader;CreateBinaryReader;(System.IO.Stream,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas,System.Xml.XmlBinaryReaderSession);Argument[1];ReturnValue;taint;df-manual |
+| System.Xml;XmlDictionaryReader;CreateBinaryReader;(System.IO.Stream,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas,System.Xml.XmlBinaryReaderSession);Argument[3];ReturnValue;taint;df-manual |
+| System.Xml;XmlDictionaryReader;CreateBinaryReader;(System.IO.Stream,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas,System.Xml.XmlBinaryReaderSession,System.Xml.OnXmlDictionaryReaderClose);Argument[0];ReturnValue;taint;manual |
+| System.Xml;XmlDictionaryReader;CreateBinaryReader;(System.IO.Stream,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas,System.Xml.XmlBinaryReaderSession,System.Xml.OnXmlDictionaryReaderClose);Argument[1];ReturnValue;taint;manual |
+| System.Xml;XmlDictionaryReader;CreateBinaryReader;(System.IO.Stream,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas,System.Xml.XmlBinaryReaderSession,System.Xml.OnXmlDictionaryReaderClose);Argument[3];ReturnValue;taint;manual |
+| System.Xml;XmlDictionaryReader;CreateBinaryReader;(System.IO.Stream,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas,System.Xml.XmlBinaryReaderSession,System.Xml.OnXmlDictionaryReaderClose);Argument[4];Argument[4].Parameter[delegate-self];value;manual |
+| System.Xml;XmlDictionaryReader;CreateBinaryReader;(System.IO.Stream,System.Xml.XmlDictionaryReaderQuotas);Argument[0];ReturnValue;taint;df-manual |
| System.Xml;XmlDictionaryReader;CreateDictionaryReader;(System.Xml.XmlReader);Argument[0];ReturnValue;value;dfc-generated |
| System.Xml;XmlDictionaryReader;CreateMtomReader;(System.Byte[],System.Int32,System.Int32,System.Text.Encoding[],System.String,System.Xml.XmlDictionaryReaderQuotas,System.Int32,System.Xml.OnXmlDictionaryReaderClose);Argument[7];Argument[7].Parameter[delegate-self];value;hq-generated |
| System.Xml;XmlDictionaryReader;CreateMtomReader;(System.IO.Stream,System.Text.Encoding[],System.String,System.Xml.XmlDictionaryReaderQuotas,System.Int32,System.Xml.OnXmlDictionaryReaderClose);Argument[5];Argument[5].Parameter[delegate-self];value;hq-generated |
diff --git a/csharp/ql/test/library-tests/dataflow/library/FlowSummariesFiltered.expected b/csharp/ql/test/library-tests/dataflow/library/FlowSummariesFiltered.expected
index 8c0a26ee4039..faf716f4d7be 100644
--- a/csharp/ql/test/library-tests/dataflow/library/FlowSummariesFiltered.expected
+++ b/csharp/ql/test/library-tests/dataflow/library/FlowSummariesFiltered.expected
@@ -9208,7 +9208,7 @@
| System.IO;FileSystemWatcher;remove_Error;(System.IO.ErrorEventHandler);Argument[0];Argument[0].Parameter[delegate-self];value;hq-generated |
| System.IO;FileSystemWatcher;remove_Renamed;(System.IO.RenamedEventHandler);Argument[0];Argument[0].Parameter[delegate-self];value;hq-generated |
| System.IO;MemoryStream;GetBuffer;();Argument[this];ReturnValue;taint;df-generated |
-| System.IO;MemoryStream;MemoryStream;(System.Byte[]);Argument[0];Argument[this];taint;manual |
+| System.IO;MemoryStream;MemoryStream;(System.Byte[]);Argument[0].Element;Argument[this];taint;manual |
| System.IO;MemoryStream;MemoryStream;(System.Byte[],System.Boolean);Argument[0].Element;Argument[this];taint;manual |
| System.IO;MemoryStream;MemoryStream;(System.Byte[],System.Int32,System.Int32);Argument[0].Element;Argument[this];taint;manual |
| System.IO;MemoryStream;MemoryStream;(System.Byte[],System.Int32,System.Int32,System.Boolean);Argument[0].Element;Argument[this];taint;manual |
@@ -13222,28 +13222,20 @@
| System.Runtime.Serialization;SerializationInfo;AddValue;(System.String,System.Int16);Argument[0];Argument[this].SyntheticField[System.Runtime.Serialization.SerializationInfo._names].Element;value;dfc-generated |
| System.Runtime.Serialization;SerializationInfo;AddValue;(System.String,System.Int32);Argument[0];Argument[this].SyntheticField[System.Runtime.Serialization.SerializationInfo._names].Element;value;dfc-generated |
| System.Runtime.Serialization;SerializationInfo;AddValue;(System.String,System.Int64);Argument[0];Argument[this].SyntheticField[System.Runtime.Serialization.SerializationInfo._names].Element;value;dfc-generated |
-| System.Runtime.Serialization;SerializationInfo;AddValue;(System.String,System.Object);Argument[0];Argument[this].SyntheticField[System.Runtime.Serialization.SerializationInfo._names].Element;value;dfc-generated |
-| System.Runtime.Serialization;SerializationInfo;AddValue;(System.String,System.Object);Argument[1];Argument[this].SyntheticField[System.Runtime.Serialization.SerializationInfo._values].Element;value;dfc-generated |
-| System.Runtime.Serialization;SerializationInfo;AddValue;(System.String,System.Object,System.Type);Argument[0];Argument[this].SyntheticField[System.Runtime.Serialization.SerializationInfo._names].Element;value;dfc-generated |
-| System.Runtime.Serialization;SerializationInfo;AddValue;(System.String,System.Object,System.Type);Argument[1];Argument[this].SyntheticField[System.Runtime.Serialization.SerializationInfo._values].Element;value;dfc-generated |
+| System.Runtime.Serialization;SerializationInfo;AddValue;(System.String,System.Object);Argument[1];Argument[this];taint;manual |
+| System.Runtime.Serialization;SerializationInfo;AddValue;(System.String,System.Object,System.Type);Argument[1];Argument[this];taint;manual |
| System.Runtime.Serialization;SerializationInfo;AddValue;(System.String,System.SByte);Argument[0];Argument[this].SyntheticField[System.Runtime.Serialization.SerializationInfo._names].Element;value;dfc-generated |
| System.Runtime.Serialization;SerializationInfo;AddValue;(System.String,System.Single);Argument[0];Argument[this].SyntheticField[System.Runtime.Serialization.SerializationInfo._names].Element;value;dfc-generated |
| System.Runtime.Serialization;SerializationInfo;AddValue;(System.String,System.UInt16);Argument[0];Argument[this].SyntheticField[System.Runtime.Serialization.SerializationInfo._names].Element;value;dfc-generated |
| System.Runtime.Serialization;SerializationInfo;AddValue;(System.String,System.UInt32);Argument[0];Argument[this].SyntheticField[System.Runtime.Serialization.SerializationInfo._names].Element;value;dfc-generated |
| System.Runtime.Serialization;SerializationInfo;AddValue;(System.String,System.UInt64);Argument[0];Argument[this].SyntheticField[System.Runtime.Serialization.SerializationInfo._names].Element;value;dfc-generated |
-| System.Runtime.Serialization;SerializationInfo;GetEnumerator;();Argument[this].SyntheticField[System.Runtime.Serialization.SerializationInfo._names];ReturnValue.SyntheticField[System.Runtime.Serialization.SerializationInfoEnumerator._members];value;dfc-generated |
-| System.Runtime.Serialization;SerializationInfo;GetEnumerator;();Argument[this].SyntheticField[System.Runtime.Serialization.SerializationInfo._values];ReturnValue.SyntheticField[System.Runtime.Serialization.SerializationInfoEnumerator._data];value;dfc-generated |
-| System.Runtime.Serialization;SerializationInfo;GetString;(System.String);Argument[this].SyntheticField[System.Runtime.Serialization.SerializationInfo._values].Element;ReturnValue;value;dfc-generated |
-| System.Runtime.Serialization;SerializationInfo;GetValue;(System.String,System.Type);Argument[this].SyntheticField[System.Runtime.Serialization.SerializationInfo._values].Element;ReturnValue;value;dfc-generated |
+| System.Runtime.Serialization;SerializationInfo;GetEnumerator;();Argument[this];ReturnValue;taint;manual |
+| System.Runtime.Serialization;SerializationInfo;GetString;(System.String);Argument[this];ReturnValue;taint;manual |
+| System.Runtime.Serialization;SerializationInfo;GetValue;(System.String,System.Type);Argument[this];ReturnValue;taint;manual |
| System.Runtime.Serialization;SerializationInfo;SerializationInfo;(System.Type,System.Runtime.Serialization.IFormatterConverter);Argument[1];Argument[this];taint;df-generated |
-| System.Runtime.Serialization;SerializationInfoEnumerator;get_Current;();Argument[this].Property[System.Runtime.Serialization.SerializationInfoEnumerator.Current];ReturnValue;value;df-generated |
-| System.Runtime.Serialization;SerializationInfoEnumerator;get_Current;();Argument[this].Property[System.Runtime.Serialization.SerializationInfoEnumerator.Current];ReturnValue;value;dfc-generated |
-| System.Runtime.Serialization;SerializationInfoEnumerator;get_Current;();Argument[this].SyntheticField[System.Runtime.Serialization.SerializationInfoEnumerator._data].Element;ReturnValue.SyntheticField[System.Runtime.Serialization.SerializationEntry._value];value;df-generated |
-| System.Runtime.Serialization;SerializationInfoEnumerator;get_Current;();Argument[this].SyntheticField[System.Runtime.Serialization.SerializationInfoEnumerator._data].Element;ReturnValue.SyntheticField[System.Runtime.Serialization.SerializationEntry._value];value;dfc-generated |
-| System.Runtime.Serialization;SerializationInfoEnumerator;get_Current;();Argument[this].SyntheticField[System.Runtime.Serialization.SerializationInfoEnumerator._members].Element;ReturnValue.SyntheticField[System.Runtime.Serialization.SerializationEntry._name];value;df-generated |
-| System.Runtime.Serialization;SerializationInfoEnumerator;get_Current;();Argument[this].SyntheticField[System.Runtime.Serialization.SerializationInfoEnumerator._members].Element;ReturnValue.SyntheticField[System.Runtime.Serialization.SerializationEntry._name];value;dfc-generated |
+| System.Runtime.Serialization;SerializationInfoEnumerator;get_Current;();Argument[this];ReturnValue;taint;manual |
| System.Runtime.Serialization;SerializationInfoEnumerator;get_Name;();Argument[this].SyntheticField[System.Runtime.Serialization.SerializationInfoEnumerator._members].Element;ReturnValue;value;dfc-generated |
-| System.Runtime.Serialization;SerializationInfoEnumerator;get_Value;();Argument[this].SyntheticField[System.Runtime.Serialization.SerializationInfoEnumerator._data].Element;ReturnValue;value;dfc-generated |
+| System.Runtime.Serialization;SerializationInfoEnumerator;get_Value;();Argument[this];ReturnValue;taint;manual |
| System.Runtime.Serialization;SerializationObjectManager;SerializationObjectManager;(System.Runtime.Serialization.StreamingContext);Argument[0];Argument[this];taint;df-generated |
| System.Runtime.Serialization;StreamingContext;StreamingContext;(System.Runtime.Serialization.StreamingContextStates,System.Object);Argument[1];Argument[this].SyntheticField[System.Runtime.Serialization.StreamingContext._additionalContext];value;dfc-generated |
| System.Runtime.Serialization;StreamingContext;get_Context;();Argument[this].SyntheticField[System.Runtime.Serialization.StreamingContext._additionalContext];ReturnValue;value;dfc-generated |
@@ -14074,18 +14066,18 @@
| System.Text;Encoding;CreateTranscodingStream;(System.IO.Stream,System.Text.Encoding,System.Text.Encoding,System.Boolean);Argument[2];ReturnValue;taint;df-generated |
| System.Text;Encoding;Encoding;(System.Int32,System.Text.EncoderFallback,System.Text.DecoderFallback);Argument[1];Argument[this];taint;df-generated |
| System.Text;Encoding;Encoding;(System.Int32,System.Text.EncoderFallback,System.Text.DecoderFallback);Argument[2];Argument[this];taint;df-generated |
-| System.Text;Encoding;GetBytes;(System.Char*,System.Int32,System.Byte*,System.Int32);Argument[0];ReturnValue;taint;manual |
+| System.Text;Encoding;GetBytes;(System.Char*,System.Int32,System.Byte*,System.Int32);Argument[0].Element;Argument[2];taint;manual |
| System.Text;Encoding;GetBytes;(System.Char[]);Argument[0].Element;ReturnValue;taint;manual |
| System.Text;Encoding;GetBytes;(System.Char[],System.Int32,System.Int32);Argument[0].Element;ReturnValue;taint;manual |
-| System.Text;Encoding;GetBytes;(System.Char[],System.Int32,System.Int32,System.Byte[],System.Int32);Argument[0].Element;ReturnValue;taint;manual |
-| System.Text;Encoding;GetBytes;(System.ReadOnlySpan,System.Span);Argument[0];ReturnValue;taint;manual |
+| System.Text;Encoding;GetBytes;(System.Char[],System.Int32,System.Int32,System.Byte[],System.Int32);Argument[0].Element;Argument[3];taint;manual |
+| System.Text;Encoding;GetBytes;(System.ReadOnlySpan,System.Span);Argument[0].Element;Argument[1];taint;manual |
| System.Text;Encoding;GetBytes;(System.String);Argument[0];ReturnValue;taint;manual |
| System.Text;Encoding;GetBytes;(System.String,System.Int32,System.Int32);Argument[0];ReturnValue;taint;manual |
-| System.Text;Encoding;GetBytes;(System.String,System.Int32,System.Int32,System.Byte[],System.Int32);Argument[0];ReturnValue;taint;manual |
-| System.Text;Encoding;GetChars;(System.Byte*,System.Int32,System.Char*,System.Int32);Argument[0].Element;ReturnValue;taint;manual |
+| System.Text;Encoding;GetBytes;(System.String,System.Int32,System.Int32,System.Byte[],System.Int32);Argument[0];Argument[3];taint;manual |
+| System.Text;Encoding;GetChars;(System.Byte*,System.Int32,System.Char*,System.Int32);Argument[0].Element;Argument[2];taint;manual |
| System.Text;Encoding;GetChars;(System.Byte[]);Argument[0].Element;ReturnValue;taint;manual |
| System.Text;Encoding;GetChars;(System.Byte[],System.Int32,System.Int32);Argument[0].Element;ReturnValue;taint;manual |
-| System.Text;Encoding;GetChars;(System.Byte[],System.Int32,System.Int32,System.Char[],System.Int32);Argument[0].Element;ReturnValue;taint;manual |
+| System.Text;Encoding;GetChars;(System.Byte[],System.Int32,System.Int32,System.Char[],System.Int32);Argument[0].Element;Argument[3];taint;manual |
| System.Text;Encoding;GetChars;(System.ReadOnlySpan,System.Span);Argument[0].Element;ReturnValue;taint;manual |
| System.Text;Encoding;GetDecoder;();Argument[this];ReturnValue;taint;df-generated |
| System.Text;Encoding;GetEncoder;();Argument[this];ReturnValue;taint;df-generated |
@@ -16194,21 +16186,27 @@
| System.Xml;XmlDeclaration;XmlDeclaration;(System.String,System.String,System.String,System.Xml.XmlDocument);Argument[2];Argument[this];taint;df-generated |
| System.Xml;XmlDictionary;Add;(System.String);Argument[0];ReturnValue.SyntheticField[System.Xml.XmlDictionaryString._value];value;dfc-generated |
| System.Xml;XmlDictionary;Add;(System.String);Argument[this];ReturnValue.SyntheticField[System.Xml.XmlDictionaryString._dictionary];value;dfc-generated |
-| System.Xml;XmlDictionaryReader;CreateBinaryReader;(System.Byte[],System.Int32,System.Int32,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas);Argument[0].Element;ReturnValue;taint;df-generated |
-| System.Xml;XmlDictionaryReader;CreateBinaryReader;(System.Byte[],System.Int32,System.Int32,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas);Argument[3];ReturnValue;taint;df-generated |
-| System.Xml;XmlDictionaryReader;CreateBinaryReader;(System.Byte[],System.Int32,System.Int32,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas,System.Xml.XmlBinaryReaderSession);Argument[0].Element;ReturnValue;taint;df-generated |
-| System.Xml;XmlDictionaryReader;CreateBinaryReader;(System.Byte[],System.Int32,System.Int32,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas,System.Xml.XmlBinaryReaderSession);Argument[3];ReturnValue;taint;df-generated |
-| System.Xml;XmlDictionaryReader;CreateBinaryReader;(System.Byte[],System.Int32,System.Int32,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas,System.Xml.XmlBinaryReaderSession);Argument[5];ReturnValue;taint;df-generated |
-| System.Xml;XmlDictionaryReader;CreateBinaryReader;(System.Byte[],System.Int32,System.Int32,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas,System.Xml.XmlBinaryReaderSession,System.Xml.OnXmlDictionaryReaderClose);Argument[6];Argument[6].Parameter[delegate-self];value;hq-generated |
-| System.Xml;XmlDictionaryReader;CreateBinaryReader;(System.Byte[],System.Int32,System.Int32,System.Xml.XmlDictionaryReaderQuotas);Argument[0].Element;ReturnValue;taint;df-generated |
-| System.Xml;XmlDictionaryReader;CreateBinaryReader;(System.Byte[],System.Xml.XmlDictionaryReaderQuotas);Argument[0].Element;ReturnValue;taint;df-generated |
-| System.Xml;XmlDictionaryReader;CreateBinaryReader;(System.IO.Stream,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas);Argument[0];ReturnValue;taint;df-generated |
-| System.Xml;XmlDictionaryReader;CreateBinaryReader;(System.IO.Stream,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas);Argument[1];ReturnValue;taint;df-generated |
-| System.Xml;XmlDictionaryReader;CreateBinaryReader;(System.IO.Stream,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas,System.Xml.XmlBinaryReaderSession);Argument[0];ReturnValue;taint;df-generated |
-| System.Xml;XmlDictionaryReader;CreateBinaryReader;(System.IO.Stream,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas,System.Xml.XmlBinaryReaderSession);Argument[1];ReturnValue;taint;df-generated |
-| System.Xml;XmlDictionaryReader;CreateBinaryReader;(System.IO.Stream,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas,System.Xml.XmlBinaryReaderSession);Argument[3];ReturnValue;taint;df-generated |
-| System.Xml;XmlDictionaryReader;CreateBinaryReader;(System.IO.Stream,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas,System.Xml.XmlBinaryReaderSession,System.Xml.OnXmlDictionaryReaderClose);Argument[4];Argument[4].Parameter[delegate-self];value;hq-generated |
-| System.Xml;XmlDictionaryReader;CreateBinaryReader;(System.IO.Stream,System.Xml.XmlDictionaryReaderQuotas);Argument[0];ReturnValue;taint;df-generated |
+| System.Xml;XmlDictionaryReader;CreateBinaryReader;(System.Byte[],System.Int32,System.Int32,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas);Argument[0].Element;ReturnValue;taint;df-manual |
+| System.Xml;XmlDictionaryReader;CreateBinaryReader;(System.Byte[],System.Int32,System.Int32,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas);Argument[3];ReturnValue;taint;df-manual |
+| System.Xml;XmlDictionaryReader;CreateBinaryReader;(System.Byte[],System.Int32,System.Int32,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas,System.Xml.XmlBinaryReaderSession);Argument[0].Element;ReturnValue;taint;df-manual |
+| System.Xml;XmlDictionaryReader;CreateBinaryReader;(System.Byte[],System.Int32,System.Int32,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas,System.Xml.XmlBinaryReaderSession);Argument[3];ReturnValue;taint;df-manual |
+| System.Xml;XmlDictionaryReader;CreateBinaryReader;(System.Byte[],System.Int32,System.Int32,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas,System.Xml.XmlBinaryReaderSession);Argument[5];ReturnValue;taint;df-manual |
+| System.Xml;XmlDictionaryReader;CreateBinaryReader;(System.Byte[],System.Int32,System.Int32,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas,System.Xml.XmlBinaryReaderSession,System.Xml.OnXmlDictionaryReaderClose);Argument[0].Element;ReturnValue;taint;manual |
+| System.Xml;XmlDictionaryReader;CreateBinaryReader;(System.Byte[],System.Int32,System.Int32,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas,System.Xml.XmlBinaryReaderSession,System.Xml.OnXmlDictionaryReaderClose);Argument[3];ReturnValue;taint;manual |
+| System.Xml;XmlDictionaryReader;CreateBinaryReader;(System.Byte[],System.Int32,System.Int32,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas,System.Xml.XmlBinaryReaderSession,System.Xml.OnXmlDictionaryReaderClose);Argument[5];ReturnValue;taint;manual |
+| System.Xml;XmlDictionaryReader;CreateBinaryReader;(System.Byte[],System.Int32,System.Int32,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas,System.Xml.XmlBinaryReaderSession,System.Xml.OnXmlDictionaryReaderClose);Argument[6];Argument[6].Parameter[delegate-self];value;manual |
+| System.Xml;XmlDictionaryReader;CreateBinaryReader;(System.Byte[],System.Int32,System.Int32,System.Xml.XmlDictionaryReaderQuotas);Argument[0].Element;ReturnValue;taint;df-manual |
+| System.Xml;XmlDictionaryReader;CreateBinaryReader;(System.Byte[],System.Xml.XmlDictionaryReaderQuotas);Argument[0].Element;ReturnValue;taint;df-manual |
+| System.Xml;XmlDictionaryReader;CreateBinaryReader;(System.IO.Stream,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas);Argument[0];ReturnValue;taint;df-manual |
+| System.Xml;XmlDictionaryReader;CreateBinaryReader;(System.IO.Stream,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas);Argument[1];ReturnValue;taint;df-manual |
+| System.Xml;XmlDictionaryReader;CreateBinaryReader;(System.IO.Stream,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas,System.Xml.XmlBinaryReaderSession);Argument[0];ReturnValue;taint;df-manual |
+| System.Xml;XmlDictionaryReader;CreateBinaryReader;(System.IO.Stream,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas,System.Xml.XmlBinaryReaderSession);Argument[1];ReturnValue;taint;df-manual |
+| System.Xml;XmlDictionaryReader;CreateBinaryReader;(System.IO.Stream,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas,System.Xml.XmlBinaryReaderSession);Argument[3];ReturnValue;taint;df-manual |
+| System.Xml;XmlDictionaryReader;CreateBinaryReader;(System.IO.Stream,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas,System.Xml.XmlBinaryReaderSession,System.Xml.OnXmlDictionaryReaderClose);Argument[0];ReturnValue;taint;manual |
+| System.Xml;XmlDictionaryReader;CreateBinaryReader;(System.IO.Stream,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas,System.Xml.XmlBinaryReaderSession,System.Xml.OnXmlDictionaryReaderClose);Argument[1];ReturnValue;taint;manual |
+| System.Xml;XmlDictionaryReader;CreateBinaryReader;(System.IO.Stream,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas,System.Xml.XmlBinaryReaderSession,System.Xml.OnXmlDictionaryReaderClose);Argument[3];ReturnValue;taint;manual |
+| System.Xml;XmlDictionaryReader;CreateBinaryReader;(System.IO.Stream,System.Xml.IXmlDictionary,System.Xml.XmlDictionaryReaderQuotas,System.Xml.XmlBinaryReaderSession,System.Xml.OnXmlDictionaryReaderClose);Argument[4];Argument[4].Parameter[delegate-self];value;manual |
+| System.Xml;XmlDictionaryReader;CreateBinaryReader;(System.IO.Stream,System.Xml.XmlDictionaryReaderQuotas);Argument[0];ReturnValue;taint;df-manual |
| System.Xml;XmlDictionaryReader;CreateDictionaryReader;(System.Xml.XmlReader);Argument[0];ReturnValue;value;dfc-generated |
| System.Xml;XmlDictionaryReader;CreateMtomReader;(System.Byte[],System.Int32,System.Int32,System.Text.Encoding[],System.String,System.Xml.XmlDictionaryReaderQuotas,System.Int32,System.Xml.OnXmlDictionaryReaderClose);Argument[7];Argument[7].Parameter[delegate-self];value;hq-generated |
| System.Xml;XmlDictionaryReader;CreateMtomReader;(System.IO.Stream,System.Text.Encoding[],System.String,System.Xml.XmlDictionaryReaderQuotas,System.Int32,System.Xml.OnXmlDictionaryReaderClose);Argument[5];Argument[5].Parameter[delegate-self];value;hq-generated |
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-502/DeserializedDelegate/DeserializedDelegate.cs b/csharp/ql/test/query-tests/Security Features/CWE-502/DeserializedDelegate/DeserializedDelegate.cs
index 93dede10b15d..a2d0c24ff4c4 100644
--- a/csharp/ql/test/query-tests/Security Features/CWE-502/DeserializedDelegate/DeserializedDelegate.cs
+++ b/csharp/ql/test/query-tests/Security Features/CWE-502/DeserializedDelegate/DeserializedDelegate.cs
@@ -11,11 +11,11 @@ public static void M(FileStream fs)
{
var formatter = new BinaryFormatter();
// BAD
- var a = (Func)formatter.Deserialize(fs);
+ var a = (Func)formatter.Deserialize(fs); // $ Alert[cs/deserialized-delegate]
// BAD
- var b = (Expression>)formatter.Deserialize(fs);
+ var b = (Expression>)formatter.Deserialize(fs); // $ Alert[cs/deserialized-delegate]
// BAD
- var c = (D)formatter.Deserialize(fs);
+ var c = (D)formatter.Deserialize(fs); // $ Alert[cs/deserialized-delegate]
// GOOD
var d = (int)formatter.Deserialize(fs);
}
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-502/DeserializedDelegate/DeserializedDelegate.qlref b/csharp/ql/test/query-tests/Security Features/CWE-502/DeserializedDelegate/DeserializedDelegate.qlref
index 913c61338c47..dbfd493cef5b 100644
--- a/csharp/ql/test/query-tests/Security Features/CWE-502/DeserializedDelegate/DeserializedDelegate.qlref
+++ b/csharp/ql/test/query-tests/Security Features/CWE-502/DeserializedDelegate/DeserializedDelegate.qlref
@@ -1 +1,4 @@
-Security Features/CWE-502/DeserializedDelegate.ql
\ No newline at end of file
+query: Security Features/CWE-502/DeserializedDelegate.ql
+postprocess:
+ - utils/test/PrettyPrintModels.ql
+ - utils/test/InlineExpectationsTestQuery.ql
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-502/DeserializedDelegate/DeserializedDelegateBad.cs b/csharp/ql/test/query-tests/Security Features/CWE-502/DeserializedDelegate/DeserializedDelegateBad.cs
index 12b2dc76987d..48c2ed2b4140 100644
--- a/csharp/ql/test/query-tests/Security Features/CWE-502/DeserializedDelegate/DeserializedDelegateBad.cs
+++ b/csharp/ql/test/query-tests/Security Features/CWE-502/DeserializedDelegate/DeserializedDelegateBad.cs
@@ -8,7 +8,7 @@ public static int InvokeSerialized(FileStream fs)
{
var formatter = new BinaryFormatter();
// BAD
- var f = (Func)formatter.Deserialize(fs);
+ var f = (Func)formatter.Deserialize(fs); // $ Alert[cs/deserialized-delegate]
return f();
}
}
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserialization/BinaryFormatterBad.cs b/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserialization/BinaryFormatterBad.cs
index 1170a37ad3b9..7fbe5499dbb7 100644
--- a/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserialization/BinaryFormatterBad.cs
+++ b/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserialization/BinaryFormatterBad.cs
@@ -7,6 +7,6 @@ public static object Deserialize(Stream s)
{
var ds = new BinaryFormatter();
// BAD
- return ds.Deserialize(s);
+ return ds.Deserialize(s); // $ Alert[cs/unsafe-deserialization]
}
}
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserialization/DataContractJsonSerializerBad.cs b/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserialization/DataContractJsonSerializerBad.cs
index 1256428176c5..2e2b80cc25ae 100644
--- a/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserialization/DataContractJsonSerializerBad.cs
+++ b/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserialization/DataContractJsonSerializerBad.cs
@@ -8,6 +8,6 @@ public static object Deserialize(Type type, Stream s)
{
var ds = new DataContractJsonSerializer(type);
// BAD
- return ds.ReadObject(s);
+ return ds.ReadObject(s); // $ Alert[cs/unsafe-deserialization]
}
}
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserialization/DataContractSerializerBad.cs b/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserialization/DataContractSerializerBad.cs
index 35cff0b45f1d..e98bd0c0aa0b 100644
--- a/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserialization/DataContractSerializerBad.cs
+++ b/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserialization/DataContractSerializerBad.cs
@@ -8,6 +8,6 @@ public static object Deserialize(Type type, Stream s)
{
var ds = new DataContractSerializer(type);
// BAD
- return ds.ReadObject(s);
+ return ds.ReadObject(s); // $ Alert[cs/unsafe-deserialization]
}
}
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserialization/ResourceReaderBad.cs b/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserialization/ResourceReaderBad.cs
index 2da5dc1aa6a5..e39a87769900 100644
--- a/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserialization/ResourceReaderBad.cs
+++ b/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserialization/ResourceReaderBad.cs
@@ -6,11 +6,11 @@ class BadResourceReader
{
public static void Deserialize(Stream s)
{
- var ds = new ResourceReader(s);
+ var ds = new ResourceReader(s); // $ Alert[cs/unsafe-deserialization]
// BAD
var dict = ds.GetEnumerator();
while (dict.MoveNext())
- Console.WriteLine(" {0}: '{1}' (Type {2})",
+ Console.WriteLine(" {0}: '{1}' (Type {2})",
dict.Key, dict.Value, dict.Value.GetType().Name);
ds.Close();
}
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserialization/UnsafeDeserialization.qlref b/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserialization/UnsafeDeserialization.qlref
index 78efa2399c0b..25a133ff8a71 100644
--- a/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserialization/UnsafeDeserialization.qlref
+++ b/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserialization/UnsafeDeserialization.qlref
@@ -1 +1,4 @@
-Security Features/CWE-502/UnsafeDeserialization.ql
\ No newline at end of file
+query: Security Features/CWE-502/UnsafeDeserialization.ql
+postprocess:
+ - utils/test/PrettyPrintModels.ql
+ - utils/test/InlineExpectationsTestQuery.ql
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserialization/UnsafeDeserializationBad.cs b/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserialization/UnsafeDeserializationBad.cs
index 385e700a0bf9..ce178961b9b6 100644
--- a/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserialization/UnsafeDeserializationBad.cs
+++ b/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserialization/UnsafeDeserializationBad.cs
@@ -6,6 +6,6 @@ public static object Deserialize(string s)
{
JavaScriptSerializer sr = new JavaScriptSerializer(new SimpleTypeResolver());
// BAD
- return sr.DeserializeObject(s);
+ return sr.DeserializeObject(s); // $ Alert[cs/unsafe-deserialization]
}
}
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserialization/XmlObjectSerializerBad.cs b/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserialization/XmlObjectSerializerBad.cs
index 4096934da0ba..a8e1bc42e2fc 100644
--- a/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserialization/XmlObjectSerializerBad.cs
+++ b/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserialization/XmlObjectSerializerBad.cs
@@ -8,6 +8,6 @@ public static object Deserialize(Type type, Stream s)
{
XmlObjectSerializer ds = new DataContractSerializer(type);
// BAD
- return ds.ReadObject(s);
+ return ds.ReadObject(s); // $ Alert[cs/unsafe-deserialization]
}
}
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserialization/XmlSerializerBad.cs b/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserialization/XmlSerializerBad.cs
index 4d32bae9c082..a5f3287cd55d 100644
--- a/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserialization/XmlSerializerBad.cs
+++ b/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserialization/XmlSerializerBad.cs
@@ -8,6 +8,6 @@ public static object Deserialize(Type type, Stream s)
{
var ds = new XmlSerializer(type);
// BAD
- return ds.Deserialize(s);
+ return ds.Deserialize(s); // $ Alert[cs/unsafe-deserialization]
}
}
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserializationUntrustedInput/BinaryFormatterUntrustedInputBad.cs b/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserializationUntrustedInput/BinaryFormatterUntrustedInputBad.cs
index 73c6c35413bc..8f19580b68a8 100644
--- a/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserializationUntrustedInput/BinaryFormatterUntrustedInputBad.cs
+++ b/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserializationUntrustedInput/BinaryFormatterUntrustedInputBad.cs
@@ -1,14 +1,25 @@
-using System.Web.UI.WebControls;
-using System.Runtime.Serialization.Formatters.Binary;
+using System;
using System.IO;
+using System.Runtime.Serialization.Formatters.Binary;
using System.Text;
+using System.Web.UI.WebControls;
-class BadBinaryFormatter
+class BadBinaryFormatter1
{
public static object Deserialize(TextBox textBox)
{
var ds = new BinaryFormatter();
// BAD
- return ds.Deserialize(new MemoryStream(Encoding.UTF8.GetBytes(textBox.Text)));
+ return ds.Deserialize(new MemoryStream(Encoding.UTF8.GetBytes(textBox.Text))); // $ Alert[cs/unsafe-deserialization-untrusted-input]
+ }
+}
+
+class BadBinaryFormatter2
+{
+ public static object Deserialize(TextBox type, TextBox data)
+ {
+ var ds = new BinaryFormatter();
+ // BAD
+ return ds.Deserialize(new MemoryStream(Convert.FromBase64String(data.Text))); // $ Alert[cs/unsafe-deserialization-untrusted-input]
}
}
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserializationUntrustedInput/DataContractJsonSerializerUntrustedInputBad.cs b/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserializationUntrustedInput/DataContractJsonSerializerUntrustedInputBad.cs
index 2d3efe3ae269..e1e389c0a67f 100644
--- a/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserializationUntrustedInput/DataContractJsonSerializerUntrustedInputBad.cs
+++ b/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserializationUntrustedInput/DataContractJsonSerializerUntrustedInputBad.cs
@@ -10,6 +10,6 @@ public static object Deserialize(TextBox type, TextBox data)
{
var ds = new DataContractJsonSerializer(Type.GetType(type.Text));
// BAD
- return ds.ReadObject(new MemoryStream(Encoding.UTF8.GetBytes(data.Text)));
+ return ds.ReadObject(new MemoryStream(Encoding.UTF8.GetBytes(data.Text))); // $ Alert[cs/unsafe-deserialization-untrusted-input]
}
}
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserializationUntrustedInput/DataContractSerializerUntrustedInputBad.cs b/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserializationUntrustedInput/DataContractSerializerUntrustedInputBad.cs
index f4f266ed3e00..2e979b2387d6 100644
--- a/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserializationUntrustedInput/DataContractSerializerUntrustedInputBad.cs
+++ b/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserializationUntrustedInput/DataContractSerializerUntrustedInputBad.cs
@@ -10,6 +10,6 @@ public static object Deserialize(TextBox type, TextBox data)
{
var ds = new DataContractSerializer(Type.GetType(type.Text));
// BAD
- return ds.ReadObject(new MemoryStream(Encoding.UTF8.GetBytes(data.Text)));
+ return ds.ReadObject(new MemoryStream(Encoding.UTF8.GetBytes(data.Text))); // $ Alert[cs/unsafe-deserialization-untrusted-input]
}
}
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserializationUntrustedInput/ResourceReaderUntrustedInputBad.cs b/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserializationUntrustedInput/ResourceReaderUntrustedInputBad.cs
index cd5468afc2d2..33ca758ac9cf 100644
--- a/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserializationUntrustedInput/ResourceReaderUntrustedInputBad.cs
+++ b/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserializationUntrustedInput/ResourceReaderUntrustedInputBad.cs
@@ -8,11 +8,11 @@ class BadResourceReader
{
public static void Deserialize(TextBox data)
{
- var ds = new ResourceReader(new MemoryStream(Encoding.UTF8.GetBytes(data.Text)));
+ var ds = new ResourceReader(new MemoryStream(Encoding.UTF8.GetBytes(data.Text))); // $ Alert[cs/unsafe-deserialization-untrusted-input]
// BAD
var dict = ds.GetEnumerator();
while (dict.MoveNext())
- Console.WriteLine(" {0}: '{1}' (Type {2})",
+ Console.WriteLine(" {0}: '{1}' (Type {2})",
dict.Key, dict.Value, dict.Value.GetType().Name);
ds.Close();
}
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserializationUntrustedInput/UnsafeDeserializationUntrustedInput.expected b/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserializationUntrustedInput/UnsafeDeserializationUntrustedInput.expected
index 37cba1c28bff..c3377fcb04f0 100644
--- a/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserializationUntrustedInput/UnsafeDeserializationUntrustedInput.expected
+++ b/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserializationUntrustedInput/UnsafeDeserializationUntrustedInput.expected
@@ -1,5 +1,6 @@
#select
-| BinaryFormatterUntrustedInputBad.cs:12:31:12:84 | object creation of type MemoryStream | BinaryFormatterUntrustedInputBad.cs:12:71:12:77 | access to parameter textBox : TextBox | BinaryFormatterUntrustedInputBad.cs:12:31:12:84 | object creation of type MemoryStream | $@ flows to unsafe deserializer. | BinaryFormatterUntrustedInputBad.cs:12:71:12:77 | access to parameter textBox : TextBox | User-provided data |
+| BinaryFormatterUntrustedInputBad.cs:13:31:13:84 | object creation of type MemoryStream | BinaryFormatterUntrustedInputBad.cs:13:71:13:77 | access to parameter textBox : TextBox | BinaryFormatterUntrustedInputBad.cs:13:31:13:84 | object creation of type MemoryStream | $@ flows to unsafe deserializer. | BinaryFormatterUntrustedInputBad.cs:13:71:13:77 | access to parameter textBox : TextBox | User-provided data |
+| BinaryFormatterUntrustedInputBad.cs:23:31:23:83 | object creation of type MemoryStream | BinaryFormatterUntrustedInputBad.cs:23:73:23:76 | access to parameter data : TextBox | BinaryFormatterUntrustedInputBad.cs:23:31:23:83 | object creation of type MemoryStream | $@ flows to unsafe deserializer. | BinaryFormatterUntrustedInputBad.cs:23:73:23:76 | access to parameter data : TextBox | User-provided data |
| DataContractJsonSerializerUntrustedInputBad.cs:13:30:13:80 | object creation of type MemoryStream | DataContractJsonSerializerUntrustedInputBad.cs:13:70:13:73 | access to parameter data : TextBox | DataContractJsonSerializerUntrustedInputBad.cs:13:30:13:80 | object creation of type MemoryStream | $@ flows to unsafe deserializer. | DataContractJsonSerializerUntrustedInputBad.cs:13:70:13:73 | access to parameter data : TextBox | User-provided data |
| DataContractSerializerUntrustedInputBad.cs:13:30:13:80 | object creation of type MemoryStream | DataContractSerializerUntrustedInputBad.cs:13:70:13:73 | access to parameter data : TextBox | DataContractSerializerUntrustedInputBad.cs:13:30:13:80 | object creation of type MemoryStream | $@ flows to unsafe deserializer. | DataContractSerializerUntrustedInputBad.cs:13:70:13:73 | access to parameter data : TextBox | User-provided data |
| ResourceReaderUntrustedInputBad.cs:11:37:11:87 | object creation of type MemoryStream | ResourceReaderUntrustedInputBad.cs:11:77:11:80 | access to parameter data : TextBox | ResourceReaderUntrustedInputBad.cs:11:37:11:87 | object creation of type MemoryStream | $@ flows to unsafe deserializer. | ResourceReaderUntrustedInputBad.cs:11:77:11:80 | access to parameter data : TextBox | User-provided data |
@@ -7,9 +8,12 @@
| XmlObjectSerializerUntrustedInputBad.cs:13:30:13:80 | object creation of type MemoryStream | XmlObjectSerializerUntrustedInputBad.cs:13:70:13:73 | access to parameter data : TextBox | XmlObjectSerializerUntrustedInputBad.cs:13:30:13:80 | object creation of type MemoryStream | $@ flows to unsafe deserializer. | XmlObjectSerializerUntrustedInputBad.cs:13:70:13:73 | access to parameter data : TextBox | User-provided data |
| XmlSerializerUntrustedInputBad.cs:13:31:13:81 | object creation of type MemoryStream | XmlSerializerUntrustedInputBad.cs:13:71:13:74 | access to parameter data : TextBox | XmlSerializerUntrustedInputBad.cs:13:31:13:81 | object creation of type MemoryStream | $@ flows to unsafe deserializer. | XmlSerializerUntrustedInputBad.cs:13:71:13:74 | access to parameter data : TextBox | User-provided data |
edges
-| BinaryFormatterUntrustedInputBad.cs:12:48:12:83 | call to method GetBytes : Byte[] | BinaryFormatterUntrustedInputBad.cs:12:31:12:84 | object creation of type MemoryStream | provenance | MaD:1 |
-| BinaryFormatterUntrustedInputBad.cs:12:71:12:77 | access to parameter textBox : TextBox | BinaryFormatterUntrustedInputBad.cs:12:71:12:82 | access to property Text : String | provenance | MaD:3 |
-| BinaryFormatterUntrustedInputBad.cs:12:71:12:82 | access to property Text : String | BinaryFormatterUntrustedInputBad.cs:12:48:12:83 | call to method GetBytes : Byte[] | provenance | MaD:2 |
+| BinaryFormatterUntrustedInputBad.cs:13:48:13:83 | call to method GetBytes : Byte[] | BinaryFormatterUntrustedInputBad.cs:13:31:13:84 | object creation of type MemoryStream | provenance | MaD:1 |
+| BinaryFormatterUntrustedInputBad.cs:13:71:13:77 | access to parameter textBox : TextBox | BinaryFormatterUntrustedInputBad.cs:13:71:13:82 | access to property Text : String | provenance | MaD:3 |
+| BinaryFormatterUntrustedInputBad.cs:13:71:13:82 | access to property Text : String | BinaryFormatterUntrustedInputBad.cs:13:48:13:83 | call to method GetBytes : Byte[] | provenance | MaD:2 |
+| BinaryFormatterUntrustedInputBad.cs:23:48:23:82 | call to method FromBase64String : Byte[] [element] : Object | BinaryFormatterUntrustedInputBad.cs:23:31:23:83 | object creation of type MemoryStream | provenance | MaD:1 |
+| BinaryFormatterUntrustedInputBad.cs:23:73:23:76 | access to parameter data : TextBox | BinaryFormatterUntrustedInputBad.cs:23:73:23:81 | access to property Text : String | provenance | MaD:3 |
+| BinaryFormatterUntrustedInputBad.cs:23:73:23:81 | access to property Text : String | BinaryFormatterUntrustedInputBad.cs:23:48:23:82 | call to method FromBase64String : Byte[] [element] : Object | provenance | MaD:4 |
| DataContractJsonSerializerUntrustedInputBad.cs:13:47:13:79 | call to method GetBytes : Byte[] | DataContractJsonSerializerUntrustedInputBad.cs:13:30:13:80 | object creation of type MemoryStream | provenance | MaD:1 |
| DataContractJsonSerializerUntrustedInputBad.cs:13:70:13:73 | access to parameter data : TextBox | DataContractJsonSerializerUntrustedInputBad.cs:13:70:13:78 | access to property Text : String | provenance | MaD:3 |
| DataContractJsonSerializerUntrustedInputBad.cs:13:70:13:78 | access to property Text : String | DataContractJsonSerializerUntrustedInputBad.cs:13:47:13:79 | call to method GetBytes : Byte[] | provenance | MaD:2 |
@@ -27,14 +31,19 @@ edges
| XmlSerializerUntrustedInputBad.cs:13:71:13:74 | access to parameter data : TextBox | XmlSerializerUntrustedInputBad.cs:13:71:13:79 | access to property Text : String | provenance | MaD:3 |
| XmlSerializerUntrustedInputBad.cs:13:71:13:79 | access to property Text : String | XmlSerializerUntrustedInputBad.cs:13:48:13:80 | call to method GetBytes : Byte[] | provenance | MaD:2 |
models
-| 1 | Summary: System.IO; MemoryStream; false; MemoryStream; (System.Byte[]); ; Argument[0]; Argument[this]; taint; manual |
+| 1 | Summary: System.IO; MemoryStream; false; MemoryStream; (System.Byte[]); ; Argument[0].Element; Argument[this]; taint; manual |
| 2 | Summary: System.Text; Encoding; true; GetBytes; (System.String); ; Argument[0]; ReturnValue; taint; manual |
| 3 | Summary: System.Web.UI.WebControls; TextBox; false; get_Text; (); ; Argument[this]; ReturnValue; taint; manual |
+| 4 | Summary: System; Convert; false; FromBase64String; (System.String); ; Argument[0]; ReturnValue.Element; taint; manual |
nodes
-| BinaryFormatterUntrustedInputBad.cs:12:31:12:84 | object creation of type MemoryStream | semmle.label | object creation of type MemoryStream |
-| BinaryFormatterUntrustedInputBad.cs:12:48:12:83 | call to method GetBytes : Byte[] | semmle.label | call to method GetBytes : Byte[] |
-| BinaryFormatterUntrustedInputBad.cs:12:71:12:77 | access to parameter textBox : TextBox | semmle.label | access to parameter textBox : TextBox |
-| BinaryFormatterUntrustedInputBad.cs:12:71:12:82 | access to property Text : String | semmle.label | access to property Text : String |
+| BinaryFormatterUntrustedInputBad.cs:13:31:13:84 | object creation of type MemoryStream | semmle.label | object creation of type MemoryStream |
+| BinaryFormatterUntrustedInputBad.cs:13:48:13:83 | call to method GetBytes : Byte[] | semmle.label | call to method GetBytes : Byte[] |
+| BinaryFormatterUntrustedInputBad.cs:13:71:13:77 | access to parameter textBox : TextBox | semmle.label | access to parameter textBox : TextBox |
+| BinaryFormatterUntrustedInputBad.cs:13:71:13:82 | access to property Text : String | semmle.label | access to property Text : String |
+| BinaryFormatterUntrustedInputBad.cs:23:31:23:83 | object creation of type MemoryStream | semmle.label | object creation of type MemoryStream |
+| BinaryFormatterUntrustedInputBad.cs:23:48:23:82 | call to method FromBase64String : Byte[] [element] : Object | semmle.label | call to method FromBase64String : Byte[] [element] : Object |
+| BinaryFormatterUntrustedInputBad.cs:23:73:23:76 | access to parameter data : TextBox | semmle.label | access to parameter data : TextBox |
+| BinaryFormatterUntrustedInputBad.cs:23:73:23:81 | access to property Text : String | semmle.label | access to property Text : String |
| DataContractJsonSerializerUntrustedInputBad.cs:13:30:13:80 | object creation of type MemoryStream | semmle.label | object creation of type MemoryStream |
| DataContractJsonSerializerUntrustedInputBad.cs:13:47:13:79 | call to method GetBytes : Byte[] | semmle.label | call to method GetBytes : Byte[] |
| DataContractJsonSerializerUntrustedInputBad.cs:13:70:13:73 | access to parameter data : TextBox | semmle.label | access to parameter data : TextBox |
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserializationUntrustedInput/UnsafeDeserializationUntrustedInput.qlref b/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserializationUntrustedInput/UnsafeDeserializationUntrustedInput.qlref
index a1ffb72bf108..195452ad5675 100644
--- a/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserializationUntrustedInput/UnsafeDeserializationUntrustedInput.qlref
+++ b/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserializationUntrustedInput/UnsafeDeserializationUntrustedInput.qlref
@@ -1,2 +1,4 @@
query: Security Features/CWE-502/UnsafeDeserializationUntrustedInput.ql
-postprocess: utils/test/PrettyPrintModels.ql
+postprocess:
+ - utils/test/PrettyPrintModels.ql
+ - utils/test/InlineExpectationsTestQuery.ql
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserializationUntrustedInput/UnsafeDeserializationUntrustedInputBad.cs b/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserializationUntrustedInput/UnsafeDeserializationUntrustedInputBad.cs
index db2b25097bac..6af634af09c5 100644
--- a/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserializationUntrustedInput/UnsafeDeserializationUntrustedInputBad.cs
+++ b/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserializationUntrustedInput/UnsafeDeserializationUntrustedInputBad.cs
@@ -7,6 +7,6 @@ public static object Deserialize(TextBox textBox)
{
JavaScriptSerializer sr = new JavaScriptSerializer(new SimpleTypeResolver());
// BAD
- return sr.DeserializeObject(textBox.Text);
+ return sr.DeserializeObject(textBox.Text); // $ Alert[cs/unsafe-deserialization-untrusted-input]
}
}
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserializationUntrustedInput/XmlObjectSerializerUntrustedInputBad.cs b/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserializationUntrustedInput/XmlObjectSerializerUntrustedInputBad.cs
index b525dd28692b..c7a0d94cb45b 100644
--- a/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserializationUntrustedInput/XmlObjectSerializerUntrustedInputBad.cs
+++ b/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserializationUntrustedInput/XmlObjectSerializerUntrustedInputBad.cs
@@ -10,6 +10,6 @@ public static object Deserialize(TextBox type, TextBox data)
{
XmlObjectSerializer ds = new DataContractSerializer(Type.GetType(type.Text));
// BAD
- return ds.ReadObject(new MemoryStream(Encoding.UTF8.GetBytes(data.Text)));
+ return ds.ReadObject(new MemoryStream(Encoding.UTF8.GetBytes(data.Text))); // $ Alert[cs/unsafe-deserialization-untrusted-input]
}
}
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserializationUntrustedInput/XmlSerializerUntrustedInputBad.cs b/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserializationUntrustedInput/XmlSerializerUntrustedInputBad.cs
index f658f2a9e1a7..b5299c01f3f4 100644
--- a/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserializationUntrustedInput/XmlSerializerUntrustedInputBad.cs
+++ b/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserializationUntrustedInput/XmlSerializerUntrustedInputBad.cs
@@ -10,6 +10,6 @@ public static object Deserialize(TextBox type, TextBox data)
{
var ds = new XmlSerializer(Type.GetType(type.Text));
// BAD
- return ds.Deserialize(new MemoryStream(Encoding.UTF8.GetBytes(data.Text)));
+ return ds.Deserialize(new MemoryStream(Encoding.UTF8.GetBytes(data.Text))); // $ Alert[cs/unsafe-deserialization-untrusted-input]
}
}
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserializationUntrustedInputNewtonsoftJson/Test.cs b/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserializationUntrustedInputNewtonsoftJson/Test.cs
index c8c5cbb00988..90bdeef83368 100644
--- a/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserializationUntrustedInputNewtonsoftJson/Test.cs
+++ b/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserializationUntrustedInputNewtonsoftJson/Test.cs
@@ -14,9 +14,9 @@ public static object Deserialize1(TextBox data)
public static object Deserialize2(TextBox data)
{
- return JsonConvert.DeserializeObject(data.Text, new JsonSerializerSettings
+ return JsonConvert.DeserializeObject(data.Text, new JsonSerializerSettings // $ Alert[cs/unsafe-deserialization-untrusted-input]
{
- TypeNameHandling = TypeNameHandling.Auto // BAD
+ TypeNameHandling = TypeNameHandling.Auto
});
}
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserializationUntrustedInputNewtonsoftJson/UnsafeDeserializationUntrustedInput.qlref b/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserializationUntrustedInputNewtonsoftJson/UnsafeDeserializationUntrustedInput.qlref
index a1ffb72bf108..195452ad5675 100644
--- a/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserializationUntrustedInputNewtonsoftJson/UnsafeDeserializationUntrustedInput.qlref
+++ b/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserializationUntrustedInputNewtonsoftJson/UnsafeDeserializationUntrustedInput.qlref
@@ -1,2 +1,4 @@
query: Security Features/CWE-502/UnsafeDeserializationUntrustedInput.ql
-postprocess: utils/test/PrettyPrintModels.ql
+postprocess:
+ - utils/test/PrettyPrintModels.ql
+ - utils/test/InlineExpectationsTestQuery.ql
diff --git a/docs/codeql/reusables/supported-versions-compilers.rst b/docs/codeql/reusables/supported-versions-compilers.rst
index 904a60b71cbd..78641764660b 100644
--- a/docs/codeql/reusables/supported-versions-compilers.rst
+++ b/docs/codeql/reusables/supported-versions-compilers.rst
@@ -21,7 +21,7 @@
Java,"Java 7 to 24 [6]_","javac (OpenJDK and Oracle JDK),
Eclipse compiler for Java (ECJ) [7]_",``.java``
- Kotlin,"Kotlin 1.6.0 to 2.2.0\ *x*","kotlinc",``.kt``
+ Kotlin,"Kotlin 1.6.0 to 2.2.2\ *x*","kotlinc",``.kt``
JavaScript,ECMAScript 2022 or lower,Not applicable,"``.js``, ``.jsx``, ``.mjs``, ``.es``, ``.es6``, ``.htm``, ``.html``, ``.xhtm``, ``.xhtml``, ``.vue``, ``.hbs``, ``.ejs``, ``.njk``, ``.json``, ``.yaml``, ``.yml``, ``.raml``, ``.xml`` [8]_"
Python [9]_,"2.7, 3.5, 3.6, 3.7, 3.8, 3.9, 3.10, 3.11, 3.12, 3.13",Not applicable,``.py``
Ruby [10]_,"up to 3.3",Not applicable,"``.rb``, ``.erb``, ``.gemspec``, ``Gemfile``"
diff --git a/docs/query-metadata-style-guide.md b/docs/query-metadata-style-guide.md
index 18fa5d1880f5..f6cc6f883fc1 100644
--- a/docs/query-metadata-style-guide.md
+++ b/docs/query-metadata-style-guide.md
@@ -157,7 +157,7 @@ Each code quality related query should have **one** of these two "top-level" cat
* `@tags maintainability`–for queries that detect patterns that make it harder for developers to make changes to the code.
* `@tags reliability`–for queries that detect issues that affect whether the code will perform as expected during execution.
-In addition to the "top-level" categories, we will also add sub-categories to further group code quality related queries:
+In addition to the "top-level" categories, we may also add sub-categories to further group code quality related queries:
* `@tags maintainability`–for queries that detect patterns that make it harder for developers to make changes to the code.
* `@tags readability`–for queries that detect confusing patterns that make it harder for developers to read the code.
@@ -171,6 +171,7 @@ In addition to the "top-level" categories, we will also add sub-categories to fu
* `@tags concurrency`-for queries that detect concurrency related issues such as race conditions, deadlocks, thread safety, etc
* `@tags error-handling`-for queries that detect issues related to unsafe error handling such as uncaught exceptions, etc
+You may use sub-categories from both top-level categories on the same query. However, if you only use sub-categories from a single top-level category, then you must also tag the query with that top-level category.
There are also more specific `@tags` that can be added. See, the following pages for examples of the low-level tags:
diff --git a/go/ql/consistency-queries/CHANGELOG.md b/go/ql/consistency-queries/CHANGELOG.md
index 7b90353d01a8..6e50e04a5141 100644
--- a/go/ql/consistency-queries/CHANGELOG.md
+++ b/go/ql/consistency-queries/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 1.0.28
+
+No user-facing changes.
+
## 1.0.27
No user-facing changes.
diff --git a/go/ql/consistency-queries/change-notes/released/1.0.28.md b/go/ql/consistency-queries/change-notes/released/1.0.28.md
new file mode 100644
index 000000000000..d851ee200cbe
--- /dev/null
+++ b/go/ql/consistency-queries/change-notes/released/1.0.28.md
@@ -0,0 +1,3 @@
+## 1.0.28
+
+No user-facing changes.
diff --git a/go/ql/consistency-queries/codeql-pack.release.yml b/go/ql/consistency-queries/codeql-pack.release.yml
index 1d6c59bacdbf..328402fb34f0 100644
--- a/go/ql/consistency-queries/codeql-pack.release.yml
+++ b/go/ql/consistency-queries/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 1.0.27
+lastReleaseVersion: 1.0.28
diff --git a/go/ql/consistency-queries/qlpack.yml b/go/ql/consistency-queries/qlpack.yml
index 821033dff0e8..706e295580eb 100644
--- a/go/ql/consistency-queries/qlpack.yml
+++ b/go/ql/consistency-queries/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql-go-consistency-queries
-version: 1.0.28-dev
+version: 1.0.29-dev
groups:
- go
- queries
diff --git a/go/ql/lib/CHANGELOG.md b/go/ql/lib/CHANGELOG.md
index 48c938830d6b..b047f838925b 100644
--- a/go/ql/lib/CHANGELOG.md
+++ b/go/ql/lib/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 4.3.1
+
+No user-facing changes.
+
## 4.3.0
### Deprecated APIs
@@ -7,6 +11,7 @@
### Minor Analysis Improvements
+* Added models for the `Head` function and the `Client.Head` method, from the `net/http` package, to the `Http::ClientRequest` class. This means that they will be recognized as sinks for the query `go/request-forgery` and the experimental query `go/ssrf`.
* Previously, `DefinedType.getBaseType` gave the underlying type. It now gives the right hand side of the type declaration, as the documentation indicated that it should.
## 4.2.8
diff --git a/go/ql/lib/change-notes/2025-07-08-request-forgery-sinks.md b/go/ql/lib/change-notes/2025-07-08-request-forgery-sinks.md
deleted file mode 100644
index 6204749d9d62..000000000000
--- a/go/ql/lib/change-notes/2025-07-08-request-forgery-sinks.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Added models for the `Head` function and the `Client.Head` method, from the `net/http` package, to the `Http::ClientRequest` class. This means that they will be recognized as sinks for the query `go/request-forgery` and the experimental query `go/ssrf`.
diff --git a/go/ql/lib/change-notes/released/4.3.0.md b/go/ql/lib/change-notes/released/4.3.0.md
index 1b7d48fbe568..2b2369b2d690 100644
--- a/go/ql/lib/change-notes/released/4.3.0.md
+++ b/go/ql/lib/change-notes/released/4.3.0.md
@@ -7,4 +7,5 @@
### Minor Analysis Improvements
+* Added models for the `Head` function and the `Client.Head` method, from the `net/http` package, to the `Http::ClientRequest` class. This means that they will be recognized as sinks for the query `go/request-forgery` and the experimental query `go/ssrf`.
* Previously, `DefinedType.getBaseType` gave the underlying type. It now gives the right hand side of the type declaration, as the documentation indicated that it should.
diff --git a/go/ql/lib/change-notes/released/4.3.1.md b/go/ql/lib/change-notes/released/4.3.1.md
new file mode 100644
index 000000000000..dbc6b39e3ecf
--- /dev/null
+++ b/go/ql/lib/change-notes/released/4.3.1.md
@@ -0,0 +1,3 @@
+## 4.3.1
+
+No user-facing changes.
diff --git a/go/ql/lib/codeql-pack.release.yml b/go/ql/lib/codeql-pack.release.yml
index c46c103a0bd7..70ac3707fcda 100644
--- a/go/ql/lib/codeql-pack.release.yml
+++ b/go/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 4.3.0
+lastReleaseVersion: 4.3.1
diff --git a/go/ql/lib/qlpack.yml b/go/ql/lib/qlpack.yml
index 42bb03d9fe34..391245fa6895 100644
--- a/go/ql/lib/qlpack.yml
+++ b/go/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/go-all
-version: 4.3.1-dev
+version: 4.3.2-dev
groups: go
dbscheme: go.dbscheme
extractor: go
diff --git a/go/ql/lib/semmle/go/dataflow/internal/DataFlowImplConsistency.qll b/go/ql/lib/semmle/go/dataflow/internal/DataFlowImplConsistency.qll
index 58b849858416..aa9c9da1bd13 100644
--- a/go/ql/lib/semmle/go/dataflow/internal/DataFlowImplConsistency.qll
+++ b/go/ql/lib/semmle/go/dataflow/internal/DataFlowImplConsistency.qll
@@ -4,11 +4,11 @@
*/
private import go
-private import DataFlowImplSpecific
+private import DataFlowImplSpecific as Impl
private import TaintTrackingImplSpecific
private import codeql.dataflow.internal.DataFlowImplConsistency
private import semmle.go.dataflow.internal.DataFlowNodes
-private module Input implements InputSig { }
+private module Input implements InputSig { }
-module Consistency = MakeConsistency;
+module Consistency = MakeConsistency;
diff --git a/go/ql/src/CHANGELOG.md b/go/ql/src/CHANGELOG.md
index cc2a0b46f7fb..eb21b53b4f79 100644
--- a/go/ql/src/CHANGELOG.md
+++ b/go/ql/src/CHANGELOG.md
@@ -1,7 +1,13 @@
-## 1.4.1
+## 1.4.2
No user-facing changes.
+## 1.4.1
+
+### Minor Analysis Improvements
+
+* `filepath.IsLocal` is now recognized as a sanitizer against path-traversal and related vulnerabilities.
+
## 1.4.0
### Query Metadata Changes
diff --git a/go/ql/src/change-notes/2025-07-15-islocal-sanitizer.md b/go/ql/src/change-notes/2025-07-15-islocal-sanitizer.md
deleted file mode 100644
index 35f04aacb582..000000000000
--- a/go/ql/src/change-notes/2025-07-15-islocal-sanitizer.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* `filepath.IsLocal` is now recognised as a sanitizer against path-traversal and related vulnerabilities.
diff --git a/go/ql/src/change-notes/released/1.4.1.md b/go/ql/src/change-notes/released/1.4.1.md
index 38987aa49cd0..8d054d1eb688 100644
--- a/go/ql/src/change-notes/released/1.4.1.md
+++ b/go/ql/src/change-notes/released/1.4.1.md
@@ -1,3 +1,5 @@
## 1.4.1
-No user-facing changes.
+### Minor Analysis Improvements
+
+* `filepath.IsLocal` is now recognized as a sanitizer against path-traversal and related vulnerabilities.
diff --git a/go/ql/src/change-notes/released/1.4.2.md b/go/ql/src/change-notes/released/1.4.2.md
new file mode 100644
index 000000000000..37be01f40d98
--- /dev/null
+++ b/go/ql/src/change-notes/released/1.4.2.md
@@ -0,0 +1,3 @@
+## 1.4.2
+
+No user-facing changes.
diff --git a/go/ql/src/codeql-pack.release.yml b/go/ql/src/codeql-pack.release.yml
index 43ccf4467bed..a76cacdf7997 100644
--- a/go/ql/src/codeql-pack.release.yml
+++ b/go/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 1.4.1
+lastReleaseVersion: 1.4.2
diff --git a/go/ql/src/qlpack.yml b/go/ql/src/qlpack.yml
index 2e46e90c1f24..d3c411a74f79 100644
--- a/go/ql/src/qlpack.yml
+++ b/go/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/go-queries
-version: 1.4.2-dev
+version: 1.4.3-dev
groups:
- go
- queries
diff --git a/java/documentation/library-coverage/coverage.csv b/java/documentation/library-coverage/coverage.csv
index fc3620ca4bc6..7ec0b4c5f0fc 100644
--- a/java/documentation/library-coverage/coverage.csv
+++ b/java/documentation/library-coverage/coverage.csv
@@ -1,284 +1,292 @@
-package,sink,source,summary,sink:bean-validation,sink:command-injection,sink:credentials-key,sink:credentials-password,sink:credentials-username,sink:encryption-iv,sink:encryption-salt,sink:environment-injection,sink:file-content-store,sink:fragment-injection,sink:groovy-injection,sink:hostname-verification,sink:html-injection,sink:information-leak,sink:intent-redirection,sink:jexl-injection,sink:jndi-injection,sink:js-injection,sink:ldap-injection,sink:log-injection,sink:mvel-injection,sink:notification,sink:ognl-injection,sink:path-injection,sink:pending-intents,sink:regex-use,sink:regex-use[-1],sink:regex-use[0],sink:regex-use[],sink:regex-use[f-1],sink:regex-use[f1],sink:regex-use[f],sink:request-forgery,sink:response-splitting,sink:sql-injection,sink:template-injection,sink:trust-boundary-violation,sink:url-forward,sink:url-redirection,sink:xpath-injection,sink:xslt-injection,source:android-external-storage-dir,source:contentprovider,source:database,source:environment,source:file,source:remote,summary:taint,summary:value
-actions.osgi,,,6,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,6,
-android.app,77,,103,,,,,,,,,,11,,,,,7,,,,,,,42,,,17,,,,,,,,,,,,,,,,,,,,,,,18,85
-android.content,24,31,154,,,,,,,,,,,,,,,16,,,,,,,,,,,,,,,,,,,,8,,,,,,,4,27,,,,,63,91
-android.database,59,,41,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,59,,,,,,,,,,,,,41,
-android.net,,,60,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,45,15
-android.os,1,2,122,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,2,,,,,,41,81
-android.support.v4.app,11,,,,,,,,,,,,11,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-android.util,6,16,,,,,,,,,,,,,,,,,,,,,6,,,,,,,,,,,,,,,,,,,,,,,,,,,16,,
-android.webkit,3,2,,,,,,,,,,,,,,2,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,
-android.widget,,1,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,1,
-androidx.core.app,47,,95,,,,,,,,,,,,,,,,,,,,,,41,,,6,,,,,,,,,,,,,,,,,,,,,,,12,83
-androidx.fragment.app,11,,,,,,,,,,,,11,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-androidx.slice,2,5,88,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,,,,,,,,,,5,,,,,27,61
-antlr,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,
-ch.ethz.ssh2,2,,,,,,1,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-cn.hutool.core.codec,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,
-com.alibaba.druid.sql,1,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,1,
-com.alibaba.fastjson2,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,
-com.amazonaws.auth,2,,,,,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-com.auth0.jwt.algorithms,6,,,,,6,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-com.azure.identity,3,,,,,1,1,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-com.esotericsoftware.kryo.io,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,
-com.esotericsoftware.kryo5.io,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,
-com.fasterxml.jackson.core,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,
-com.fasterxml.jackson.databind,2,,8,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,,,,,,,,,,,,,,,,8,
-com.google.common.base,4,,87,,,,,,,,,,,,,,,,,,,,,,,,,,,,3,1,,,,,,,,,,,,,,,,,,,63,24
-com.google.common.cache,,,17,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,17
-com.google.common.collect,,,553,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,551
-com.google.common.flogger,29,,,,,,,,,,,,,,,,,,,,,,29,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-com.google.common.io,10,,73,,,,,,,,,1,,,,,,,,,,,,,,,9,,,,,,,,,,,,,,,,,,,,,,,,72,1
-com.google.gson,,,52,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,38,14
-com.hubspot.jinjava,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,,,,,
-com.jcraft.jsch,5,,1,,,,2,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,1,
-com.microsoft.sqlserver.jdbc,4,,,,,,2,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-com.mitchellbosecke.pebble,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,,,,,
-com.mongodb,10,,,,,,4,6,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-com.opensymphony.xwork2,56,,961,,,,,,,,,,,,,,,,,,,,,,,56,,,,,,,,,,,,,,,,,,,,,,,,,867,94
-com.rabbitmq.client,,21,7,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,21,7,
-com.sshtools.j2ssh.authentication,3,,,,,,1,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-com.sun.crypto.provider,19,,,,,17,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-com.sun.jndi.ldap,4,,,,,,,4,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-com.sun.net.httpserver,3,,,,,,1,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-com.sun.net.ssl,3,,,,,,3,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-com.sun.rowset,3,,,,,,2,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-com.sun.security.auth.module,2,,,,,,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-com.sun.security.ntlm,5,,,,,,3,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-com.sun.security.sasl.digest,3,,,,,,2,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-com.thoughtworks.xstream,1,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,
-com.trilead.ssh2,13,,,,,2,4,7,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-com.unboundid.ldap.sdk,17,,,,,,,,,,,,,,,,,,,,,17,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-com.zaxxer.hikari,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,,,,,,,,
-flexjson,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1
-freemarker.cache,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,
-freemarker.template,7,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,7,,,,,,,,,,,,,
-groovy.lang,26,,,,,,,,,,,,,26,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-groovy.text,1,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-groovy.util,5,,,,,,,,,,,,,5,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-hudson,75,9,2648,,4,,,,,,3,2,,,,4,,,,,,,,,,,56,,,,,,,,,6,,,,,,,,,,,,,5,4,2572,76
-io.jsonwebtoken,,2,4,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,4,
-io.netty.bootstrap,3,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,3,,,,,,,,,,,,,,,,
-io.netty.buffer,,,207,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,130,77
-io.netty.channel,9,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,9,,,,,,,,,,,,,,2,,
-io.netty.handler.codec,4,13,259,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,3,,,,,,,,,,,,,,13,143,116
-io.netty.handler.ssl,4,,,,,,,,,,,,,,,,,,,,,,,,,,4,,,,,,,,,,,,,,,,,,,,,,,,,
-io.netty.handler.stream,1,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,
-io.netty.resolver,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,
-io.netty.util,2,,23,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,1,,,,,,,,,,,,,,,21,2
-io.undertow.server.handlers.resource,1,,3,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,3,
-jakarta.activation,2,,2,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,1,,,,,,,,,,,,,,,2,
-jakarta.faces.context,4,7,,,,,,,,,,,,,,2,,,,,,,,,,,2,,,,,,,,,,,,,,,,,,,,,,,7,,
-jakarta.json,,,123,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,100,23
-jakarta.persistence,2,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,,,,,1,
-jakarta.servlet,2,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,1,,
-jakarta.ws.rs.client,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,
-jakarta.ws.rs.container,,9,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,9,,
-jakarta.ws.rs.core,2,,149,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,94,55
-jakarta.xml.bind.attachment,,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,
-java.applet,,,11,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,11,
-java.awt,1,,3,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,3
-java.beans,,,177,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,82,95
-java.io,66,1,225,,,,,,,,,22,,,,,,,,,,,,,,,44,,,,,,,,,,,,,,,,,,,,,,1,,202,23
-java.lang,38,3,783,,13,,,,,,1,,,,,,,,,,,,8,,,,11,,,4,,,1,,,,,,,,,,,,,,,3,,,506,277
-java.math,,,9,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,9
-java.net,23,3,347,,,,1,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,21,,,,,,,,,,,,,,3,248,99
-java.nio,47,,499,,,,,,,,,5,,,,,,,,,,,,,,,41,,,,,,,,,1,,,,,,,,,,,,,,,302,197
-java.rmi,,,68,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,45,23
-java.security,21,,583,,,11,10,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,285,298
-java.sql,15,1,292,,,,1,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,4,,9,,,,,,,,,1,,,,274,18
-java.text,,,154,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,72,82
-java.time,,,131,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,27,104
-java.util,48,2,1339,,,,,,,,,1,,,,,,,,,,,34,,,,3,,,,5,2,,1,2,,,,,,,,,,,,,2,,,558,781
-javafx.scene.web,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,
-javax.accessibility,,,63,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,28,35
-javax.activation,2,,7,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,1,,,,,,,,,,,,,,,7,
-javax.annotation.processing,,,28,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,25,3
-javax.crypto,19,,114,,,12,3,,2,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,61,53
-javax.faces.context,4,7,,,,,,,,,,,,,,2,,,,,,,,,,,2,,,,,,,,,,,,,,,,,,,,,,,7,,
-javax.imageio,1,,304,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,138,166
-javax.jms,,9,57,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,9,57,
-javax.json,,,123,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,100,23
-javax.lang.model,,,277,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,217,60
-javax.management,2,,766,,,,,,,,,,,,,,,,,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,363,403
-javax.naming,7,,341,,,,,,,,,,,,,,,,,6,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,191,150
-javax.net,4,,136,,,,2,,,,,,,,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,87,49
-javax.portlet,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,
-javax.print,2,,133,,,,,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,102,31
-javax.rmi.ssl,,,6,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,6
-javax.script,1,,50,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,14,36
-javax.security.auth,7,,147,,,4,3,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,50,97
-javax.security.cert,,,5,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,5,
-javax.security.sasl,,,49,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,42,7
-javax.servlet,10,22,3,,,,,,,,,,,,,,1,,,,,,,,,,2,,,,,,,,,,3,,,2,2,,,,,,,,,22,3,
-javax.smartcardio,,,34,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,24,10
-javax.sound.midi,,,60,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,51,9
-javax.sound.sampled,,,90,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,53,37
-javax.sql,7,,126,,,,4,3,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,68,58
-javax.tools,,,66,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,62,4
-javax.transaction.xa,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,
-javax.validation,1,1,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,
-javax.ws.rs.client,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,
-javax.ws.rs.container,,9,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,9,,
-javax.ws.rs.core,3,,149,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,2,,,,,,,,,94,55
-javax.xml.bind.attachment,,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,
-javax.xml.catalog,,,12,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,11,1
-javax.xml.crypto,,,269,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,172,97
-javax.xml.datatype,,,6,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,5,1
-javax.xml.namespace,,,15,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,5,10
-javax.xml.parsers,,,37,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,35,2
-javax.xml.stream,,,221,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,201,20
-javax.xml.transform,2,,134,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,1,,,,,,,72,62
-javax.xml.validation,,,29,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,29,
-javax.xml.xpath,3,,26,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,3,,,,,,,,26,
-jenkins,,,523,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,500,23
-jodd.json,,,10,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,10
-kotlin,16,,1849,,,,,,,,,,,,,,,,,,,,,,,,14,,,,,,,,,2,,,,,,,,,,,,,,,1836,13
-liquibase.database.jvm,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,
-liquibase.statement.core,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,
-net.lingala.zip4j,2,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,,,,,,,,,,,,,,,,,
-net.schmizz.sshj,4,,,,,,2,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-net.sf.json,2,,338,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,,,,,,,321,17
-net.sf.saxon.s9api,5,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,5,,,,,,,,
-ognl,6,,,,,,,,,,,,,,,,,,,,,,,,,6,,,,,,,,,,,,,,,,,,,,,,,,,,
-okhttp3,4,,50,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,4,,,,,,,,,,,,,,,23,27
-org.acegisecurity,,,49,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,49,
-org.antlr.runtime,1,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,
-org.apache.commons.codec,,,6,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,6,
-org.apache.commons.collections,,,800,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,17,783
-org.apache.commons.collections4,,,800,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,17,783
-org.apache.commons.compress.archivers.tar,,,4,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,4,
-org.apache.commons.exec,10,,,,6,,,,,,4,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-org.apache.commons.httpclient.util,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,
-org.apache.commons.io,124,,570,,,,,,,,,4,,,,,,,,,,,,,,,105,,,,,,,,,15,,,,,,,,,,,,,,,556,14
-org.apache.commons.jelly,6,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,6,,,,,,,,,,,,,,,,
-org.apache.commons.jexl2,15,,,,,,,,,,,,,,,,,,15,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-org.apache.commons.jexl3,15,,,,,,,,,,,,,,,,,,15,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-org.apache.commons.lang,,,767,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,596,171
-org.apache.commons.lang3,6,,425,,,,,,,,,,,,,,,,,,,,,,,,,,6,,,,,,,,,,,,,,,,,,,,,,294,131
-org.apache.commons.logging,6,,,,,,,,,,,,,,,,,,,,,,6,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-org.apache.commons.net,13,12,,,,,2,2,,,,,,,,,,,,,,,,,,,3,,,,,,,,,6,,,,,,,,,,,,,,12,,
-org.apache.commons.ognl,6,,,,,,,,,,,,,,,,,,,,,,,,,6,,,,,,,,,,,,,,,,,,,,,,,,,,
-org.apache.commons.text,,,272,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,220,52
-org.apache.cxf.catalog,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,
-org.apache.cxf.common.classloader,3,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,2,,,,,,,,,,,,,,,,
-org.apache.cxf.common.jaxb,1,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,
-org.apache.cxf.common.logging,6,,,,,,,,,,,,,,,,,,,,,,6,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-org.apache.cxf.configuration.jsse,2,,,,,,,,,,,,,,1,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,
-org.apache.cxf.helpers,10,,,,,,,,,,,,,,,,,,,,,,,,,,5,,,,,,,,,,,,,,,,5,,,,,,,,,
-org.apache.cxf.resource,9,,,,,,,,,,,,,,,,,,,,,,,,,,4,,,,,,,,,5,,,,,,,,,,,,,,,,
-org.apache.cxf.staxutils,1,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,
-org.apache.cxf.tools.corba.utils,4,,,,,,,,,,,,,,,,,,,,,,,,,,4,,,,,,,,,,,,,,,,,,,,,,,,,
-org.apache.cxf.tools.util,10,,,,,,,,,,,,,,,,,,,,,,,,,,10,,,,,,,,,,,,,,,,,,,,,,,,,
-org.apache.cxf.transform,3,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,3,,,,,,,,
-org.apache.directory.ldap.client.api,1,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-org.apache.hadoop.fs,3,,11,,,,,,,,,,,,,,,,,,,,,,,,3,,,,,,,,,,,,,,,,,,,,,,,,11,
-org.apache.hadoop.hive.metastore,3,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,3,,,,,,,,,,,,,,
-org.apache.hadoop.hive.ql.exec,1,,1,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,1,
-org.apache.hadoop.hive.ql.metadata,1,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,
-org.apache.hc.client5.http.async.methods,84,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,84,,,,,,,,,,,,,,,,
-org.apache.hc.client5.http.classic.methods,37,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,37,,,,,,,,,,,,,,,,
-org.apache.hc.client5.http.fluent,19,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,19,,,,,,,,,,,,,,,,
-org.apache.hc.core5.benchmark,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,
-org.apache.hc.core5.function,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,
-org.apache.hc.core5.http,73,2,45,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,72,,,,,,,,,,,,,,2,45,
-org.apache.hc.core5.net,,,18,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,18,
-org.apache.hc.core5.util,,,24,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,18,6
-org.apache.hive.hcatalog.templeton,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,
-org.apache.http,48,3,95,,,,,,,,,,,,,2,,,,,,,,,,,,,,,,,,,,46,,,,,,,,,,,,,,3,86,9
-org.apache.ibatis.jdbc,6,,57,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,6,,,,,,,,,,,,,57,
-org.apache.ibatis.mapping,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,
-org.apache.log4j,11,,,,,,,,,,,,,,,,,,,,,,11,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-org.apache.logging.log4j,359,,8,,,,,,,,,,,,,,,,,,,,359,,,,,,,,,,,,,,,,,,,,,,,,,,,,4,4
-org.apache.shiro.authc,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,
-org.apache.shiro.codec,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,
-org.apache.shiro.jndi,1,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-org.apache.shiro.mgt,1,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-org.apache.sshd.client.session,3,,,,,,1,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-org.apache.struts.beanvalidation.validation.interceptor,,,4,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,4,
-org.apache.struts2,14,,3873,,,,,,,,,,,,,,,,,,,,,,,11,,,,,,,,,,,,,,3,,,,,,,,,,,3839,34
-org.apache.tools.ant,14,,,,1,,,,,,,,,,,,,,,,,,,,,,13,,,,,,,,,,,,,,,,,,,,,,,,,
-org.apache.tools.zip,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,
-org.apache.velocity.app,4,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,4,,,,,,,,,,,,,
-org.apache.velocity.runtime,4,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,4,,,,,,,,,,,,,
-org.codehaus.cargo.container.installer,3,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,1,,,,,,,,,,,,,,,,
-org.codehaus.groovy.control,1,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-org.dom4j,20,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,20,,,,,,,,,
-org.eclipse.jetty.client,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,,,,,,,,
-org.fusesource.leveldbjni,1,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,
-org.geogebra.web.full.main,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,
-org.gradle.api.file,,,3,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,3,
-org.hibernate,7,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,7,,,,,,,,,,,,,,
-org.influxdb,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,
-org.jboss.logging,324,,,,,,,,,,,,,,,,,,,,,,324,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-org.jboss.vfs,1,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,
-org.jdbi.v3.core,6,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,6,,,,,,,,,,,,,,,,
-org.jenkins.ui.icon,,,49,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,48,1
-org.jenkins.ui.symbol,,,33,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,25,8
-org.jooq,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,
-org.json,,,236,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,198,38
-org.keycloak.models.map.storage,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,
-org.kohsuke.stapler,20,24,363,,,,,,,,,,,,,2,,,,,,,,,,,9,,,,,,,,,3,,,,,1,5,,,,,,,,24,352,11
-org.lastaflute.web,,1,4,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,4,
-org.mvel2,16,,,,,,,,,,,,,,,,,,,,,,,16,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-org.openjdk.jmh.runner.options,1,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,
-org.owasp.esapi,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,
-org.pac4j.jwt.config.encryption,4,,,,,4,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-org.pac4j.jwt.config.signature,4,,,,,4,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-org.scijava.log,13,,,,,,,,,,,,,,,,,,,,,,13,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-org.slf4j,55,,6,,,,,,,,,,,,,,,,,,,,55,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,4
-org.springframework.beans,,,30,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,30
-org.springframework.boot.jdbc,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,
-org.springframework.cache,,,13,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,13
-org.springframework.context,,,3,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,3,
-org.springframework.core.io,17,,6,,,,,,,,,,,,,,,,,,,,,,,,16,,,,,,,,,1,,,,,,,,,,,,,,,6,
-org.springframework.data.repository,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1
-org.springframework.http,14,,77,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,14,,,,,,,,,,,,,,,67,10
-org.springframework.jdbc.core,19,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,19,,,,,,,,,,,,,,
-org.springframework.jdbc.datasource,4,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,4,,,,,,,,,,,,,,,,
-org.springframework.jdbc.object,9,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,9,,,,,,,,,,,,,,
-org.springframework.jndi,1,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-org.springframework.ldap,47,,,,,,,,,,,,,,,,,,,33,,14,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-org.springframework.security.core.userdetails,2,,,,,,1,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-org.springframework.security.web.savedrequest,,6,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,6,,
-org.springframework.ui,,,32,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,32
-org.springframework.util,10,,142,,,,,,,,,,,,,,,,,,,,,,,,10,,,,,,,,,,,,,,,,,,,,,,,,90,52
-org.springframework.validation,,,13,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,13,
-org.springframework.web.client,13,3,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,13,,,,,,,,,,,,,,3,,
-org.springframework.web.context.request,,8,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,8,,
-org.springframework.web.multipart,,12,12,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,12,12,
-org.springframework.web.portlet,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,,,
-org.springframework.web.reactive.function.client,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,,,,,,,,
-org.springframework.web.servlet,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,,,
-org.springframework.web.util,,9,157,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,9,132,25
-org.thymeleaf,2,,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,,,,2,
-org.xml.sax,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,
-org.xmlpull.v1,,3,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,3,,
-org.yaml.snakeyaml,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,
-play.libs.ws,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,,,,,,,,
-play.mvc,1,13,24,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,13,24,
-ratpack.core.form,,,3,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,3,
-ratpack.core.handling,,6,4,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,6,4,
-ratpack.core.http,,10,10,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,10,10,
-ratpack.exec,,,48,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,48
-ratpack.form,,,3,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,3,
-ratpack.func,,,35,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,35
-ratpack.handling,,6,4,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,6,4,
-ratpack.http,,10,10,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,10,10,
-ratpack.util,,,35,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,35
-retrofit2,1,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,1,
-software.amazon.awssdk.transfer.s3.model,8,,,,,,,,,,,,,,,,,,,,,,,,,,8,,,,,,,,,,,,,,,,,,,,,,,,,
-sun.jvmstat.perfdata.monitor.protocol.local,3,,,,,,,3,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-sun.jvmstat.perfdata.monitor.protocol.rmi,1,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-sun.misc,3,,,,,,,3,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-sun.net.ftp,5,,,,,,2,3,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-sun.net.www.protocol.http,3,,,,,,2,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-sun.security.acl,1,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-sun.security.jgss.krb5,2,,,,,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-sun.security.krb5,9,,,,,3,6,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-sun.security.pkcs,4,,,,,4,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-sun.security.pkcs11,3,,,,,1,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-sun.security.provider,2,,,,,,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-sun.security.ssl,3,,,,,,3,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-sun.security.x509,1,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-sun.tools.jconsole,28,,,,,,13,15,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+package,sink,source,summary,sink:bean-validation,sink:command-injection,sink:credentials-key,sink:credentials-password,sink:credentials-username,sink:encryption-iv,sink:encryption-salt,sink:environment-injection,sink:file-content-store,sink:fragment-injection,sink:groovy-injection,sink:hostname-verification,sink:html-injection,sink:information-leak,sink:intent-redirection,sink:jexl-injection,sink:jndi-injection,sink:js-injection,sink:ldap-injection,sink:log-injection,sink:mvel-injection,sink:notification,sink:ognl-injection,sink:path-injection,sink:pending-intents,sink:regex-use,sink:regex-use[-1],sink:regex-use[0],sink:regex-use[],sink:regex-use[f-1],sink:regex-use[f1],sink:regex-use[f],sink:request-forgery,sink:response-splitting,sink:sql-injection,sink:template-injection,sink:trust-boundary-violation,sink:unsafe-deserialization,sink:url-forward,sink:url-redirection,sink:xpath-injection,sink:xslt-injection,source:android-external-storage-dir,source:contentprovider,source:database,source:environment,source:file,source:remote,summary:taint,summary:value
+actions.osgi,,,6,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,6,
+android.app,77,,103,,,,,,,,,,11,,,,,7,,,,,,,42,,,17,,,,,,,,,,,,,,,,,,,,,,,,18,85
+android.content,24,31,154,,,,,,,,,,,,,,,16,,,,,,,,,,,,,,,,,,,,8,,,,,,,,4,27,,,,,63,91
+android.database,59,,41,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,59,,,,,,,,,,,,,,41,
+android.net,,,60,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,45,15
+android.os,1,2,122,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,2,,,,,,41,81
+android.support.v4.app,11,,,,,,,,,,,,11,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+android.util,6,16,,,,,,,,,,,,,,,,,,,,,6,,,,,,,,,,,,,,,,,,,,,,,,,,,,16,,
+android.webkit,3,2,,,,,,,,,,,,,,2,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,
+android.widget,,1,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,1,
+androidx.core.app,47,,95,,,,,,,,,,,,,,,,,,,,,,41,,,6,,,,,,,,,,,,,,,,,,,,,,,,12,83
+androidx.fragment.app,11,,,,,,,,,,,,11,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+androidx.slice,2,5,88,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,,,,,,,,,,,5,,,,,27,61
+antlr,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,
+ch.ethz.ssh2,2,,,,,,1,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+cn.hutool.core.codec,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,
+com.alibaba.com.caucho.hessian.io,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,,,,
+com.alibaba.druid.sql,1,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,1,
+com.alibaba.fastjson2,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,
+com.amazonaws.auth,2,,,,,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+com.auth0.jwt.algorithms,6,,,,,6,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+com.azure.identity,3,,,,,1,1,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+com.caucho.burlap.io,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,
+com.caucho.hessian.io,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,,,,
+com.cedarsoftware.util.io,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,,,,
+com.esotericsoftware.kryo.io,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,
+com.esotericsoftware.kryo5.io,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,
+com.esotericsoftware.yamlbeans,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,
+com.fasterxml.jackson.core,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,
+com.fasterxml.jackson.databind,2,,8,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,,,,,,,,,,,,,,,,,8,
+com.google.common.base,4,,87,,,,,,,,,,,,,,,,,,,,,,,,,,,,3,1,,,,,,,,,,,,,,,,,,,,63,24
+com.google.common.cache,,,17,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,17
+com.google.common.collect,,,553,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,551
+com.google.common.flogger,29,,,,,,,,,,,,,,,,,,,,,,29,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+com.google.common.io,10,,73,,,,,,,,,1,,,,,,,,,,,,,,,9,,,,,,,,,,,,,,,,,,,,,,,,,72,1
+com.google.gson,,,52,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,38,14
+com.hubspot.jinjava,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,,,,,,
+com.jcraft.jsch,5,,1,,,,2,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,1,
+com.microsoft.sqlserver.jdbc,4,,,,,,2,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+com.mitchellbosecke.pebble,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,,,,,,
+com.mongodb,10,,,,,,4,6,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+com.opensymphony.xwork2,56,,961,,,,,,,,,,,,,,,,,,,,,,,56,,,,,,,,,,,,,,,,,,,,,,,,,,867,94
+com.rabbitmq.client,,21,7,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,21,7,
+com.sshtools.j2ssh.authentication,3,,,,,,1,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+com.sun.crypto.provider,19,,,,,17,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+com.sun.jndi.ldap,4,,,,,,,4,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+com.sun.net.httpserver,3,,,,,,1,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+com.sun.net.ssl,3,,,,,,3,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+com.sun.rowset,3,,,,,,2,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+com.sun.security.auth.module,2,,,,,,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+com.sun.security.ntlm,5,,,,,,3,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+com.sun.security.sasl.digest,3,,,,,,2,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+com.thoughtworks.xstream,1,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,
+com.trilead.ssh2,13,,,,,2,4,7,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+com.unboundid.ldap.sdk,17,,,,,,,,,,,,,,,,,,,,,17,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+com.zaxxer.hikari,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,,,,,,,,,
+flexjson,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1
+freemarker.cache,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,
+freemarker.template,7,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,7,,,,,,,,,,,,,,
+groovy.lang,26,,,,,,,,,,,,,26,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+groovy.text,1,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+groovy.util,5,,,,,,,,,,,,,5,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+hudson,75,9,2648,,4,,,,,,3,2,,,,4,,,,,,,,,,,56,,,,,,,,,6,,,,,,,,,,,,,,5,4,2572,76
+io.jsonwebtoken,,2,4,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,4,
+io.netty.bootstrap,3,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,3,,,,,,,,,,,,,,,,,
+io.netty.buffer,,,207,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,130,77
+io.netty.channel,9,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,9,,,,,,,,,,,,,,,2,,
+io.netty.handler.codec,4,13,259,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,3,,,,,,,,,,,,,,,13,143,116
+io.netty.handler.ssl,4,,,,,,,,,,,,,,,,,,,,,,,,,,4,,,,,,,,,,,,,,,,,,,,,,,,,,
+io.netty.handler.stream,1,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,
+io.netty.resolver,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,
+io.netty.util,2,,23,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,1,,,,,,,,,,,,,,,,21,2
+io.undertow.server.handlers.resource,1,,3,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,3,
+jakarta.activation,2,,2,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,1,,,,,,,,,,,,,,,,2,
+jakarta.faces.context,4,7,,,,,,,,,,,,,,2,,,,,,,,,,,2,,,,,,,,,,,,,,,,,,,,,,,,7,,
+jakarta.json,,,123,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,100,23
+jakarta.persistence,2,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,,,,,,1,
+jakarta.servlet,2,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,1,,
+jakarta.ws.rs.client,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,
+jakarta.ws.rs.container,,9,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,9,,
+jakarta.ws.rs.core,2,,149,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,94,55
+jakarta.xml.bind.attachment,,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,
+java.applet,,,11,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,11,
+java.awt,1,,3,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,3
+java.beans,1,,177,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,82,95
+java.io,66,1,225,,,,,,,,,22,,,,,,,,,,,,,,,44,,,,,,,,,,,,,,,,,,,,,,,1,,202,23
+java.lang,38,3,783,,13,,,,,,1,,,,,,,,,,,,8,,,,11,,,4,,,1,,,,,,,,,,,,,,,,3,,,506,277
+java.math,,,9,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,9
+java.net,23,3,347,,,,1,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,21,,,,,,,,,,,,,,,3,248,99
+java.nio,47,,499,,,,,,,,,5,,,,,,,,,,,,,,,41,,,,,,,,,1,,,,,,,,,,,,,,,,302,197
+java.rmi,,,68,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,45,23
+java.security,21,,583,,,11,10,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,285,298
+java.sql,15,1,292,,,,1,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,4,,9,,,,,,,,,,1,,,,274,18
+java.text,,,154,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,72,82
+java.time,,,131,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,27,104
+java.util,48,2,1339,,,,,,,,,1,,,,,,,,,,,34,,,,3,,,,5,2,,1,2,,,,,,,,,,,,,,2,,,558,781
+javafx.scene.web,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,
+javax.accessibility,,,63,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,28,35
+javax.activation,2,,7,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,1,,,,,,,,,,,,,,,,7,
+javax.annotation.processing,,,28,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,25,3
+javax.crypto,19,,114,,,12,3,,2,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,61,53
+javax.faces.context,4,7,,,,,,,,,,,,,,2,,,,,,,,,,,2,,,,,,,,,,,,,,,,,,,,,,,,7,,
+javax.imageio,1,,304,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,138,166
+javax.jms,,9,57,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,9,57,
+javax.json,,,123,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,100,23
+javax.lang.model,,,277,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,217,60
+javax.management,2,,766,,,,,,,,,,,,,,,,,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,363,403
+javax.naming,7,,341,,,,,,,,,,,,,,,,,6,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,191,150
+javax.net,4,,136,,,,2,,,,,,,,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,87,49
+javax.portlet,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,
+javax.print,2,,133,,,,,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,102,31
+javax.rmi.ssl,,,6,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,6
+javax.script,1,,50,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,14,36
+javax.security.auth,7,,147,,,4,3,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,50,97
+javax.security.cert,,,5,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,5,
+javax.security.sasl,,,49,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,42,7
+javax.servlet,10,22,3,,,,,,,,,,,,,,1,,,,,,,,,,2,,,,,,,,,,3,,,2,,2,,,,,,,,,22,3,
+javax.smartcardio,,,34,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,24,10
+javax.sound.midi,,,60,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,51,9
+javax.sound.sampled,,,90,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,53,37
+javax.sql,7,,126,,,,4,3,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,68,58
+javax.tools,,,66,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,62,4
+javax.transaction.xa,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,
+javax.validation,1,1,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,
+javax.ws.rs.client,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,
+javax.ws.rs.container,,9,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,9,,
+javax.ws.rs.core,3,,149,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,2,,,,,,,,,94,55
+javax.xml.bind.attachment,,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,
+javax.xml.catalog,,,12,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,11,1
+javax.xml.crypto,,,269,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,172,97
+javax.xml.datatype,,,6,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,5,1
+javax.xml.namespace,,,15,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,5,10
+javax.xml.parsers,,,37,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,35,2
+javax.xml.stream,,,221,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,201,20
+javax.xml.transform,2,,134,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,1,,,,,,,72,62
+javax.xml.validation,,,29,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,29,
+javax.xml.xpath,3,,26,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,3,,,,,,,,26,
+jenkins,,,523,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,500,23
+jodd.json,,,10,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,10
+kotlin,16,,1849,,,,,,,,,,,,,,,,,,,,,,,,14,,,,,,,,,2,,,,,,,,,,,,,,,,1836,13
+liquibase.database.jvm,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,
+liquibase.statement.core,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,
+net.lingala.zip4j,2,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,,,,,,,,,,,,,,,,,,
+net.schmizz.sshj,4,,,,,,2,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+net.sf.json,2,,338,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,,,,,,,,321,17
+net.sf.saxon.s9api,5,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,5,,,,,,,,
+ognl,6,,,,,,,,,,,,,,,,,,,,,,,,,6,,,,,,,,,,,,,,,,,,,,,,,,,,,
+okhttp3,4,,50,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,4,,,,,,,,,,,,,,,,23,27
+org.acegisecurity,,,49,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,49,
+org.antlr.runtime,1,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,
+org.apache.commons.codec,,,6,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,6,
+org.apache.commons.collections,,,800,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,17,783
+org.apache.commons.collections4,,,800,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,17,783
+org.apache.commons.compress.archivers.tar,,,4,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,4,
+org.apache.commons.exec,10,,,,6,,,,,,4,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+org.apache.commons.httpclient.util,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,
+org.apache.commons.io,124,,570,,,,,,,,,4,,,,,,,,,,,,,,,105,,,,,,,,,15,,,,,,,,,,,,,,,,556,14
+org.apache.commons.jelly,6,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,6,,,,,,,,,,,,,,,,,
+org.apache.commons.jexl2,15,,,,,,,,,,,,,,,,,,15,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+org.apache.commons.jexl3,15,,,,,,,,,,,,,,,,,,15,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+org.apache.commons.lang,1,,767,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,596,171
+org.apache.commons.lang3,7,,425,,,,,,,,,,,,,,,,,,,,,,,,,,6,,,,,,,,,,,,1,,,,,,,,,,,294,131
+org.apache.commons.logging,6,,,,,,,,,,,,,,,,,,,,,,6,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+org.apache.commons.net,13,12,,,,,2,2,,,,,,,,,,,,,,,,,,,3,,,,,,,,,6,,,,,,,,,,,,,,,12,,
+org.apache.commons.ognl,6,,,,,,,,,,,,,,,,,,,,,,,,,6,,,,,,,,,,,,,,,,,,,,,,,,,,,
+org.apache.commons.text,,,272,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,220,52
+org.apache.cxf.catalog,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,
+org.apache.cxf.common.classloader,3,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,2,,,,,,,,,,,,,,,,,
+org.apache.cxf.common.jaxb,1,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,
+org.apache.cxf.common.logging,6,,,,,,,,,,,,,,,,,,,,,,6,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+org.apache.cxf.configuration.jsse,2,,,,,,,,,,,,,,1,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,
+org.apache.cxf.helpers,10,,,,,,,,,,,,,,,,,,,,,,,,,,5,,,,,,,,,,,,,,,,,5,,,,,,,,,
+org.apache.cxf.resource,9,,,,,,,,,,,,,,,,,,,,,,,,,,4,,,,,,,,,5,,,,,,,,,,,,,,,,,
+org.apache.cxf.staxutils,1,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,
+org.apache.cxf.tools.corba.utils,4,,,,,,,,,,,,,,,,,,,,,,,,,,4,,,,,,,,,,,,,,,,,,,,,,,,,,
+org.apache.cxf.tools.util,10,,,,,,,,,,,,,,,,,,,,,,,,,,10,,,,,,,,,,,,,,,,,,,,,,,,,,
+org.apache.cxf.transform,3,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,3,,,,,,,,
+org.apache.directory.ldap.client.api,1,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+org.apache.hadoop.fs,3,,11,,,,,,,,,,,,,,,,,,,,,,,,3,,,,,,,,,,,,,,,,,,,,,,,,,11,
+org.apache.hadoop.hive.metastore,3,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,3,,,,,,,,,,,,,,,
+org.apache.hadoop.hive.ql.exec,1,,1,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,1,
+org.apache.hadoop.hive.ql.metadata,1,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,
+org.apache.hc.client5.http.async.methods,84,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,84,,,,,,,,,,,,,,,,,
+org.apache.hc.client5.http.classic.methods,37,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,37,,,,,,,,,,,,,,,,,
+org.apache.hc.client5.http.fluent,19,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,19,,,,,,,,,,,,,,,,,
+org.apache.hc.core5.benchmark,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,
+org.apache.hc.core5.function,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,
+org.apache.hc.core5.http,73,2,45,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,72,,,,,,,,,,,,,,,2,45,
+org.apache.hc.core5.net,,,18,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,18,
+org.apache.hc.core5.util,,,24,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,18,6
+org.apache.hive.hcatalog.templeton,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,
+org.apache.http,48,3,95,,,,,,,,,,,,,2,,,,,,,,,,,,,,,,,,,,46,,,,,,,,,,,,,,,3,86,9
+org.apache.ibatis.jdbc,6,,57,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,6,,,,,,,,,,,,,,57,
+org.apache.ibatis.mapping,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,
+org.apache.log4j,11,,,,,,,,,,,,,,,,,,,,,,11,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+org.apache.logging.log4j,359,,8,,,,,,,,,,,,,,,,,,,,359,,,,,,,,,,,,,,,,,,,,,,,,,,,,,4,4
+org.apache.shiro.authc,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,
+org.apache.shiro.codec,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,
+org.apache.shiro.jndi,1,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+org.apache.shiro.mgt,1,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+org.apache.sshd.client.session,3,,,,,,1,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+org.apache.struts.beanvalidation.validation.interceptor,,,4,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,4,
+org.apache.struts2,14,,3873,,,,,,,,,,,,,,,,,,,,,,,11,,,,,,,,,,,,,,3,,,,,,,,,,,,3839,34
+org.apache.tools.ant,14,,,,1,,,,,,,,,,,,,,,,,,,,,,13,,,,,,,,,,,,,,,,,,,,,,,,,,
+org.apache.tools.zip,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,
+org.apache.velocity.app,4,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,4,,,,,,,,,,,,,,
+org.apache.velocity.runtime,4,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,4,,,,,,,,,,,,,,
+org.codehaus.cargo.container.installer,3,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,1,,,,,,,,,,,,,,,,,
+org.codehaus.groovy.control,1,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+org.dom4j,20,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,20,,,,,,,,,
+org.eclipse.jetty.client,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,,,,,,,,,
+org.exolab.castor.xml,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,
+org.fusesource.leveldbjni,1,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,
+org.geogebra.web.full.main,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,
+org.gradle.api.file,,,3,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,3,
+org.hibernate,7,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,7,,,,,,,,,,,,,,,
+org.ho.yaml,8,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,8,,,,,,,,,,,,
+org.influxdb,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,
+org.jabsorb,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,
+org.jboss.logging,324,,,,,,,,,,,,,,,,,,,,,,324,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+org.jboss.vfs,1,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,
+org.jdbi.v3.core,6,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,6,,,,,,,,,,,,,,,,,
+org.jenkins.ui.icon,,,49,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,48,1
+org.jenkins.ui.symbol,,,33,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,25,8
+org.jooq,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,
+org.json,,,236,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,198,38
+org.keycloak.models.map.storage,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,
+org.kohsuke.stapler,20,24,363,,,,,,,,,,,,,2,,,,,,,,,,,9,,,,,,,,,3,,,,,,1,5,,,,,,,,24,352,11
+org.lastaflute.web,,1,4,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,4,
+org.mvel2,16,,,,,,,,,,,,,,,,,,,,,,,16,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+org.openjdk.jmh.runner.options,1,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,
+org.owasp.esapi,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,
+org.pac4j.jwt.config.encryption,4,,,,,4,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+org.pac4j.jwt.config.signature,4,,,,,4,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+org.scijava.log,13,,,,,,,,,,,,,,,,,,,,,,13,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+org.slf4j,55,,6,,,,,,,,,,,,,,,,,,,,55,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,4
+org.springframework.beans,,,30,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,30
+org.springframework.boot.jdbc,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,
+org.springframework.cache,,,13,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,13
+org.springframework.context,,,3,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,3,
+org.springframework.core.io,17,,6,,,,,,,,,,,,,,,,,,,,,,,,16,,,,,,,,,1,,,,,,,,,,,,,,,,6,
+org.springframework.data.repository,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1
+org.springframework.http,14,,77,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,14,,,,,,,,,,,,,,,,67,10
+org.springframework.jdbc.core,19,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,19,,,,,,,,,,,,,,,
+org.springframework.jdbc.datasource,4,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,4,,,,,,,,,,,,,,,,,
+org.springframework.jdbc.object,9,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,9,,,,,,,,,,,,,,,
+org.springframework.jndi,1,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+org.springframework.ldap,47,,,,,,,,,,,,,,,,,,,33,,14,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+org.springframework.security.core.userdetails,2,,,,,,1,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+org.springframework.security.web.savedrequest,,6,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,6,,
+org.springframework.ui,,,32,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,32
+org.springframework.util,10,,142,,,,,,,,,,,,,,,,,,,,,,,,10,,,,,,,,,,,,,,,,,,,,,,,,,90,52
+org.springframework.validation,,,13,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,13,
+org.springframework.web.client,13,3,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,13,,,,,,,,,,,,,,,3,,
+org.springframework.web.context.request,,8,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,8,,
+org.springframework.web.multipart,,12,12,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,12,12,
+org.springframework.web.portlet,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,,,
+org.springframework.web.reactive.function.client,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,,,,,,,,,
+org.springframework.web.servlet,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,,,
+org.springframework.web.util,,9,157,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,9,132,25
+org.thymeleaf,2,,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,,,,,2,
+org.xml.sax,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,
+org.xmlpull.v1,,3,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,3,,
+org.yaml.snakeyaml,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,
+play.libs.ws,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,,,,,,,,,
+play.mvc,1,13,24,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,13,24,
+ratpack.core.form,,,3,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,3,
+ratpack.core.handling,,6,4,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,6,4,
+ratpack.core.http,,10,10,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,10,10,
+ratpack.exec,,,48,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,48
+ratpack.form,,,3,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,3,
+ratpack.func,,,35,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,35
+ratpack.handling,,6,4,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,6,4,
+ratpack.http,,10,10,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,10,10,
+ratpack.util,,,35,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,35
+retrofit2,1,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,1,
+software.amazon.awssdk.transfer.s3.model,8,,,,,,,,,,,,,,,,,,,,,,,,,,8,,,,,,,,,,,,,,,,,,,,,,,,,,
+sun.jvmstat.perfdata.monitor.protocol.local,3,,,,,,,3,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+sun.jvmstat.perfdata.monitor.protocol.rmi,1,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+sun.misc,3,,,,,,,3,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+sun.net.ftp,5,,,,,,2,3,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+sun.net.www.protocol.http,3,,,,,,2,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+sun.security.acl,1,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+sun.security.jgss.krb5,2,,,,,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+sun.security.krb5,9,,,,,3,6,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+sun.security.pkcs,4,,,,,4,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+sun.security.pkcs11,3,,,,,1,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+sun.security.provider,2,,,,,,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+sun.security.ssl,3,,,,,,3,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+sun.security.x509,1,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+sun.tools.jconsole,28,,,,,,13,15,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
diff --git a/java/documentation/library-coverage/coverage.rst b/java/documentation/library-coverage/coverage.rst
index 3851cb041664..aa6a3f2c1713 100644
--- a/java/documentation/library-coverage/coverage.rst
+++ b/java/documentation/library-coverage/coverage.rst
@@ -11,17 +11,17 @@ Java framework & library support
Android extensions,``androidx.*``,5,183,60,,,,,,
`Apache Commons Collections `_,"``org.apache.commons.collections``, ``org.apache.commons.collections4``",,1600,,,,,,,
`Apache Commons IO `_,``org.apache.commons.io``,,570,124,105,,,,,15
- `Apache Commons Lang `_,``org.apache.commons.lang3``,,425,6,,,,,,
+ `Apache Commons Lang `_,``org.apache.commons.lang3``,,425,7,,,,,,
`Apache Commons Text `_,``org.apache.commons.text``,,272,,,,,,,
`Apache HttpComponents `_,"``org.apache.hc.core5.*``, ``org.apache.http``",5,183,122,,3,,,,119
`Apache Log4j 2 `_,``org.apache.logging.log4j``,,8,359,,,,,,
`Google Guava `_,``com.google.common.*``,,730,43,9,,,,,
JBoss Logging,``org.jboss.logging``,,,324,,,,,,
`JSON-java `_,``org.json``,,236,,,,,,,
- Java Standard Library,``java.*``,10,4621,259,99,,9,,,26
+ Java Standard Library,``java.*``,10,4621,260,99,,9,,,26
Java extensions,"``javax.*``, ``jakarta.*``",69,4159,90,10,4,2,1,1,4
Kotlin Standard Library,``kotlin*``,,1849,16,14,,,,,2
`Spring `_,``org.springframework.*``,38,486,143,26,,28,14,,35
- Others,"``actions.osgi``, ``antlr``, ``ch.ethz.ssh2``, ``cn.hutool.core.codec``, ``com.alibaba.druid.sql``, ``com.alibaba.fastjson2``, ``com.amazonaws.auth``, ``com.auth0.jwt.algorithms``, ``com.azure.identity``, ``com.esotericsoftware.kryo.io``, ``com.esotericsoftware.kryo5.io``, ``com.fasterxml.jackson.core``, ``com.fasterxml.jackson.databind``, ``com.google.gson``, ``com.hubspot.jinjava``, ``com.jcraft.jsch``, ``com.microsoft.sqlserver.jdbc``, ``com.mitchellbosecke.pebble``, ``com.mongodb``, ``com.opensymphony.xwork2``, ``com.rabbitmq.client``, ``com.sshtools.j2ssh.authentication``, ``com.sun.crypto.provider``, ``com.sun.jndi.ldap``, ``com.sun.net.httpserver``, ``com.sun.net.ssl``, ``com.sun.rowset``, ``com.sun.security.auth.module``, ``com.sun.security.ntlm``, ``com.sun.security.sasl.digest``, ``com.thoughtworks.xstream``, ``com.trilead.ssh2``, ``com.unboundid.ldap.sdk``, ``com.zaxxer.hikari``, ``flexjson``, ``freemarker.cache``, ``freemarker.template``, ``groovy.lang``, ``groovy.text``, ``groovy.util``, ``hudson``, ``io.jsonwebtoken``, ``io.netty.bootstrap``, ``io.netty.buffer``, ``io.netty.channel``, ``io.netty.handler.codec``, ``io.netty.handler.ssl``, ``io.netty.handler.stream``, ``io.netty.resolver``, ``io.netty.util``, ``io.undertow.server.handlers.resource``, ``javafx.scene.web``, ``jenkins``, ``jodd.json``, ``liquibase.database.jvm``, ``liquibase.statement.core``, ``net.lingala.zip4j``, ``net.schmizz.sshj``, ``net.sf.json``, ``net.sf.saxon.s9api``, ``ognl``, ``okhttp3``, ``org.acegisecurity``, ``org.antlr.runtime``, ``org.apache.commons.codec``, ``org.apache.commons.compress.archivers.tar``, ``org.apache.commons.exec``, ``org.apache.commons.httpclient.util``, ``org.apache.commons.jelly``, ``org.apache.commons.jexl2``, ``org.apache.commons.jexl3``, ``org.apache.commons.lang``, ``org.apache.commons.logging``, ``org.apache.commons.net``, ``org.apache.commons.ognl``, ``org.apache.cxf.catalog``, ``org.apache.cxf.common.classloader``, ``org.apache.cxf.common.jaxb``, ``org.apache.cxf.common.logging``, ``org.apache.cxf.configuration.jsse``, ``org.apache.cxf.helpers``, ``org.apache.cxf.resource``, ``org.apache.cxf.staxutils``, ``org.apache.cxf.tools.corba.utils``, ``org.apache.cxf.tools.util``, ``org.apache.cxf.transform``, ``org.apache.directory.ldap.client.api``, ``org.apache.hadoop.fs``, ``org.apache.hadoop.hive.metastore``, ``org.apache.hadoop.hive.ql.exec``, ``org.apache.hadoop.hive.ql.metadata``, ``org.apache.hc.client5.http.async.methods``, ``org.apache.hc.client5.http.classic.methods``, ``org.apache.hc.client5.http.fluent``, ``org.apache.hive.hcatalog.templeton``, ``org.apache.ibatis.jdbc``, ``org.apache.ibatis.mapping``, ``org.apache.log4j``, ``org.apache.shiro.authc``, ``org.apache.shiro.codec``, ``org.apache.shiro.jndi``, ``org.apache.shiro.mgt``, ``org.apache.sshd.client.session``, ``org.apache.struts.beanvalidation.validation.interceptor``, ``org.apache.struts2``, ``org.apache.tools.ant``, ``org.apache.tools.zip``, ``org.apache.velocity.app``, ``org.apache.velocity.runtime``, ``org.codehaus.cargo.container.installer``, ``org.codehaus.groovy.control``, ``org.dom4j``, ``org.eclipse.jetty.client``, ``org.fusesource.leveldbjni``, ``org.geogebra.web.full.main``, ``org.gradle.api.file``, ``org.hibernate``, ``org.influxdb``, ``org.jboss.vfs``, ``org.jdbi.v3.core``, ``org.jenkins.ui.icon``, ``org.jenkins.ui.symbol``, ``org.jooq``, ``org.keycloak.models.map.storage``, ``org.kohsuke.stapler``, ``org.lastaflute.web``, ``org.mvel2``, ``org.openjdk.jmh.runner.options``, ``org.owasp.esapi``, ``org.pac4j.jwt.config.encryption``, ``org.pac4j.jwt.config.signature``, ``org.scijava.log``, ``org.slf4j``, ``org.thymeleaf``, ``org.xml.sax``, ``org.xmlpull.v1``, ``org.yaml.snakeyaml``, ``play.libs.ws``, ``play.mvc``, ``ratpack.core.form``, ``ratpack.core.handling``, ``ratpack.core.http``, ``ratpack.exec``, ``ratpack.form``, ``ratpack.func``, ``ratpack.handling``, ``ratpack.http``, ``ratpack.util``, ``retrofit2``, ``software.amazon.awssdk.transfer.s3.model``, ``sun.jvmstat.perfdata.monitor.protocol.local``, ``sun.jvmstat.perfdata.monitor.protocol.rmi``, ``sun.misc``, ``sun.net.ftp``, ``sun.net.www.protocol.http``, ``sun.security.acl``, ``sun.security.jgss.krb5``, ``sun.security.krb5``, ``sun.security.pkcs``, ``sun.security.pkcs11``, ``sun.security.provider``, ``sun.security.ssl``, ``sun.security.x509``, ``sun.tools.jconsole``",133,10525,908,140,6,22,18,,208
- Totals,,312,26328,2635,404,16,128,33,1,409
+ Others,"``actions.osgi``, ``antlr``, ``ch.ethz.ssh2``, ``cn.hutool.core.codec``, ``com.alibaba.com.caucho.hessian.io``, ``com.alibaba.druid.sql``, ``com.alibaba.fastjson2``, ``com.amazonaws.auth``, ``com.auth0.jwt.algorithms``, ``com.azure.identity``, ``com.caucho.burlap.io``, ``com.caucho.hessian.io``, ``com.cedarsoftware.util.io``, ``com.esotericsoftware.kryo.io``, ``com.esotericsoftware.kryo5.io``, ``com.esotericsoftware.yamlbeans``, ``com.fasterxml.jackson.core``, ``com.fasterxml.jackson.databind``, ``com.google.gson``, ``com.hubspot.jinjava``, ``com.jcraft.jsch``, ``com.microsoft.sqlserver.jdbc``, ``com.mitchellbosecke.pebble``, ``com.mongodb``, ``com.opensymphony.xwork2``, ``com.rabbitmq.client``, ``com.sshtools.j2ssh.authentication``, ``com.sun.crypto.provider``, ``com.sun.jndi.ldap``, ``com.sun.net.httpserver``, ``com.sun.net.ssl``, ``com.sun.rowset``, ``com.sun.security.auth.module``, ``com.sun.security.ntlm``, ``com.sun.security.sasl.digest``, ``com.thoughtworks.xstream``, ``com.trilead.ssh2``, ``com.unboundid.ldap.sdk``, ``com.zaxxer.hikari``, ``flexjson``, ``freemarker.cache``, ``freemarker.template``, ``groovy.lang``, ``groovy.text``, ``groovy.util``, ``hudson``, ``io.jsonwebtoken``, ``io.netty.bootstrap``, ``io.netty.buffer``, ``io.netty.channel``, ``io.netty.handler.codec``, ``io.netty.handler.ssl``, ``io.netty.handler.stream``, ``io.netty.resolver``, ``io.netty.util``, ``io.undertow.server.handlers.resource``, ``javafx.scene.web``, ``jenkins``, ``jodd.json``, ``liquibase.database.jvm``, ``liquibase.statement.core``, ``net.lingala.zip4j``, ``net.schmizz.sshj``, ``net.sf.json``, ``net.sf.saxon.s9api``, ``ognl``, ``okhttp3``, ``org.acegisecurity``, ``org.antlr.runtime``, ``org.apache.commons.codec``, ``org.apache.commons.compress.archivers.tar``, ``org.apache.commons.exec``, ``org.apache.commons.httpclient.util``, ``org.apache.commons.jelly``, ``org.apache.commons.jexl2``, ``org.apache.commons.jexl3``, ``org.apache.commons.lang``, ``org.apache.commons.logging``, ``org.apache.commons.net``, ``org.apache.commons.ognl``, ``org.apache.cxf.catalog``, ``org.apache.cxf.common.classloader``, ``org.apache.cxf.common.jaxb``, ``org.apache.cxf.common.logging``, ``org.apache.cxf.configuration.jsse``, ``org.apache.cxf.helpers``, ``org.apache.cxf.resource``, ``org.apache.cxf.staxutils``, ``org.apache.cxf.tools.corba.utils``, ``org.apache.cxf.tools.util``, ``org.apache.cxf.transform``, ``org.apache.directory.ldap.client.api``, ``org.apache.hadoop.fs``, ``org.apache.hadoop.hive.metastore``, ``org.apache.hadoop.hive.ql.exec``, ``org.apache.hadoop.hive.ql.metadata``, ``org.apache.hc.client5.http.async.methods``, ``org.apache.hc.client5.http.classic.methods``, ``org.apache.hc.client5.http.fluent``, ``org.apache.hive.hcatalog.templeton``, ``org.apache.ibatis.jdbc``, ``org.apache.ibatis.mapping``, ``org.apache.log4j``, ``org.apache.shiro.authc``, ``org.apache.shiro.codec``, ``org.apache.shiro.jndi``, ``org.apache.shiro.mgt``, ``org.apache.sshd.client.session``, ``org.apache.struts.beanvalidation.validation.interceptor``, ``org.apache.struts2``, ``org.apache.tools.ant``, ``org.apache.tools.zip``, ``org.apache.velocity.app``, ``org.apache.velocity.runtime``, ``org.codehaus.cargo.container.installer``, ``org.codehaus.groovy.control``, ``org.dom4j``, ``org.eclipse.jetty.client``, ``org.exolab.castor.xml``, ``org.fusesource.leveldbjni``, ``org.geogebra.web.full.main``, ``org.gradle.api.file``, ``org.hibernate``, ``org.ho.yaml``, ``org.influxdb``, ``org.jabsorb``, ``org.jboss.vfs``, ``org.jdbi.v3.core``, ``org.jenkins.ui.icon``, ``org.jenkins.ui.symbol``, ``org.jooq``, ``org.keycloak.models.map.storage``, ``org.kohsuke.stapler``, ``org.lastaflute.web``, ``org.mvel2``, ``org.openjdk.jmh.runner.options``, ``org.owasp.esapi``, ``org.pac4j.jwt.config.encryption``, ``org.pac4j.jwt.config.signature``, ``org.scijava.log``, ``org.slf4j``, ``org.thymeleaf``, ``org.xml.sax``, ``org.xmlpull.v1``, ``org.yaml.snakeyaml``, ``play.libs.ws``, ``play.mvc``, ``ratpack.core.form``, ``ratpack.core.handling``, ``ratpack.core.http``, ``ratpack.exec``, ``ratpack.form``, ``ratpack.func``, ``ratpack.handling``, ``ratpack.http``, ``ratpack.util``, ``retrofit2``, ``software.amazon.awssdk.transfer.s3.model``, ``sun.jvmstat.perfdata.monitor.protocol.local``, ``sun.jvmstat.perfdata.monitor.protocol.rmi``, ``sun.misc``, ``sun.net.ftp``, ``sun.net.www.protocol.http``, ``sun.security.acl``, ``sun.security.jgss.krb5``, ``sun.security.krb5``, ``sun.security.pkcs``, ``sun.security.pkcs11``, ``sun.security.provider``, ``sun.security.ssl``, ``sun.security.x509``, ``sun.tools.jconsole``",133,10525,927,140,6,22,18,,208
+ Totals,,312,26328,2656,404,16,128,33,1,409
diff --git a/java/kotlin-extractor/BUILD.bazel b/java/kotlin-extractor/BUILD.bazel
index 575b9788e8c5..a714e06d4111 100644
--- a/java/kotlin-extractor/BUILD.bazel
+++ b/java/kotlin-extractor/BUILD.bazel
@@ -83,7 +83,7 @@ kt_javac_options(
"kotlin.RequiresOptIn",
"org.jetbrains.kotlin.ir.symbols.%s" %
("IrSymbolInternals" if version_less(v, "2.0.0") else "UnsafeDuringIrConstructionAPI"),
- ],
+ ] + ([] if version_less(v, "2.2.20") else ["org.jetbrains.kotlin.DeprecatedForRemovalCompilerApi"]),
x_suppress_version_warnings = True,
),
# * extractor.name is different for each version, so we need to put it in different output dirs
diff --git a/java/kotlin-extractor/deps/kotlin-compiler-2.2.20-Beta2.jar b/java/kotlin-extractor/deps/kotlin-compiler-2.2.20-Beta2.jar
new file mode 100644
index 000000000000..8e720a86a1d4
--- /dev/null
+++ b/java/kotlin-extractor/deps/kotlin-compiler-2.2.20-Beta2.jar
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:c7f4befaac8055b86f648e82c13b86e2775d7ace4eb896e2d7a5b8669a0f29a7
+size 58317000
diff --git a/java/kotlin-extractor/deps/kotlin-compiler-embeddable-2.2.20-Beta2.jar b/java/kotlin-extractor/deps/kotlin-compiler-embeddable-2.2.20-Beta2.jar
new file mode 100644
index 000000000000..db9a090c35be
--- /dev/null
+++ b/java/kotlin-extractor/deps/kotlin-compiler-embeddable-2.2.20-Beta2.jar
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:6017df3eca219e1c970468631f81333bfd8739482a5de4d33688949b5a1af376
+size 56885422
diff --git a/java/kotlin-extractor/deps/kotlin-stdlib-2.2.20-Beta2.jar b/java/kotlin-extractor/deps/kotlin-stdlib-2.2.20-Beta2.jar
new file mode 100644
index 000000000000..a6b812f7cea2
--- /dev/null
+++ b/java/kotlin-extractor/deps/kotlin-stdlib-2.2.20-Beta2.jar
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:d01259e6090de3ff8e938144970980978eb4e764d755a70d4cd077552315a39c
+size 1761449
diff --git a/java/kotlin-extractor/dev/wrapper.py b/java/kotlin-extractor/dev/wrapper.py
index 08969528c926..aeef81e5c1d2 100755
--- a/java/kotlin-extractor/dev/wrapper.py
+++ b/java/kotlin-extractor/dev/wrapper.py
@@ -27,7 +27,7 @@
import io
import os
-DEFAULT_VERSION = "2.1.20"
+DEFAULT_VERSION = "2.2.0"
def options():
diff --git a/java/kotlin-extractor/src/main/kotlin/KotlinUsesExtractor.kt b/java/kotlin-extractor/src/main/kotlin/KotlinUsesExtractor.kt
index 56deb81da012..2f87c77f8ee1 100644
--- a/java/kotlin-extractor/src/main/kotlin/KotlinUsesExtractor.kt
+++ b/java/kotlin-extractor/src/main/kotlin/KotlinUsesExtractor.kt
@@ -37,7 +37,6 @@ import org.jetbrains.kotlin.load.java.JvmAbi
import org.jetbrains.kotlin.load.java.sources.JavaSourceElement
import org.jetbrains.kotlin.load.java.structure.*
import org.jetbrains.kotlin.load.java.typeEnhancement.hasEnhancedNullability
-import org.jetbrains.kotlin.load.kotlin.getJvmModuleNameForDeserializedDescriptor
import org.jetbrains.kotlin.name.FqName
import org.jetbrains.kotlin.name.NameUtils
import org.jetbrains.kotlin.name.SpecialNames
diff --git a/java/kotlin-extractor/src/main/kotlin/utils/versions/v_1_6_0/getJvmModuleNameForDeserializedDescriptor.kt b/java/kotlin-extractor/src/main/kotlin/utils/versions/v_1_6_0/getJvmModuleNameForDeserializedDescriptor.kt
new file mode 100644
index 000000000000..003be521ce0e
--- /dev/null
+++ b/java/kotlin-extractor/src/main/kotlin/utils/versions/v_1_6_0/getJvmModuleNameForDeserializedDescriptor.kt
@@ -0,0 +1,9 @@
+package com.github.codeql.utils.versions
+
+import org.jetbrains.kotlin.descriptors.CallableMemberDescriptor
+import org.jetbrains.kotlin.load.kotlin.getJvmModuleNameForDeserializedDescriptor
+
+fun getJvmModuleNameForDeserializedDescriptor(descriptor: CallableMemberDescriptor): String? {
+ return org.jetbrains.kotlin.load.kotlin.getJvmModuleNameForDeserializedDescriptor(descriptor)
+}
+
diff --git a/java/kotlin-extractor/src/main/kotlin/utils/versions/v_2_2_20-Beta2/getJvmModuleNameForDeserializedDescriptor.kt b/java/kotlin-extractor/src/main/kotlin/utils/versions/v_2_2_20-Beta2/getJvmModuleNameForDeserializedDescriptor.kt
new file mode 100644
index 000000000000..7a29d2dd4fc3
--- /dev/null
+++ b/java/kotlin-extractor/src/main/kotlin/utils/versions/v_2_2_20-Beta2/getJvmModuleNameForDeserializedDescriptor.kt
@@ -0,0 +1,32 @@
+package com.github.codeql.utils.versions
+
+import org.jetbrains.kotlin.descriptors.*
+import org.jetbrains.kotlin.load.kotlin.JvmPackagePartSource
+import org.jetbrains.kotlin.metadata.deserialization.*
+import org.jetbrains.kotlin.metadata.jvm.deserialization.*
+import org.jetbrains.kotlin.metadata.jvm.JvmProtoBuf
+import org.jetbrains.kotlin.resolve.DescriptorUtils.*
+import org.jetbrains.kotlin.serialization.deserialization.descriptors.*
+
+fun getJvmModuleNameForDeserializedDescriptor(descriptor: CallableMemberDescriptor): String? {
+ val parent = getParentOfType(descriptor, ClassOrPackageFragmentDescriptor::class.java, false)
+
+ when {
+ parent is DeserializedClassDescriptor -> {
+ val classProto = parent.classProto
+ val nameResolver = parent.c.nameResolver
+ return classProto.getExtensionOrNull(JvmProtoBuf.classModuleName)
+ ?.let(nameResolver::getString)
+ ?: JvmProtoBufUtil.DEFAULT_MODULE_NAME
+ }
+ descriptor is DeserializedMemberDescriptor -> {
+ val source = descriptor.containerSource
+ if (source is JvmPackagePartSource) {
+ return source.moduleName
+ }
+ }
+ }
+
+ return null
+}
+
diff --git a/java/kotlin-extractor/versions.bzl b/java/kotlin-extractor/versions.bzl
index e389bfd9514d..95897f49cc81 100644
--- a/java/kotlin-extractor/versions.bzl
+++ b/java/kotlin-extractor/versions.bzl
@@ -12,6 +12,7 @@ VERSIONS = [
"2.1.0-Beta1",
"2.1.20-Beta1",
"2.2.0-Beta1",
+ "2.2.20-Beta2",
]
def _version_to_tuple(v):
diff --git a/java/ql/integration-tests/kotlin/all-platforms/diagnostics/kotlin-version-too-new/diagnostics.expected b/java/ql/integration-tests/kotlin/all-platforms/diagnostics/kotlin-version-too-new/diagnostics.expected
index 39e1f6e6b984..50cbd2609f26 100644
--- a/java/ql/integration-tests/kotlin/all-platforms/diagnostics/kotlin-version-too-new/diagnostics.expected
+++ b/java/ql/integration-tests/kotlin/all-platforms/diagnostics/kotlin-version-too-new/diagnostics.expected
@@ -1,5 +1,5 @@
{
- "markdownMessage": "The Kotlin version installed (`999.999.999`) is too recent for this version of CodeQL. Install a version lower than 2.2.10.",
+ "markdownMessage": "The Kotlin version installed (`999.999.999`) is too recent for this version of CodeQL. Install a version lower than 2.2.30.",
"severity": "error",
"source": {
"extractorName": "java",
diff --git a/java/ql/integration-tests/kotlin/all-platforms/extractor_information_kotlin1/ExtractorInformation.ext.yml b/java/ql/integration-tests/kotlin/all-platforms/extractor_information_kotlin1/ExtractorInformation.ext.yml
index 3b6ffa4a3771..e4f5148ee404 100644
--- a/java/ql/integration-tests/kotlin/all-platforms/extractor_information_kotlin1/ExtractorInformation.ext.yml
+++ b/java/ql/integration-tests/kotlin/all-platforms/extractor_information_kotlin1/ExtractorInformation.ext.yml
@@ -1,6 +1,6 @@
extensions:
- addsTo:
- pack: codeql/java-queries
+ pack: codeql/java-all
extensible: extractorInformationSkipKey
data:
# These will have unstable values, as they are dependent on the
diff --git a/java/ql/integration-tests/kotlin/all-platforms/extractor_information_kotlin2/ExtractorInformation.ext.yml b/java/ql/integration-tests/kotlin/all-platforms/extractor_information_kotlin2/ExtractorInformation.ext.yml
index be02d9554f81..6d95b68726ae 100644
--- a/java/ql/integration-tests/kotlin/all-platforms/extractor_information_kotlin2/ExtractorInformation.ext.yml
+++ b/java/ql/integration-tests/kotlin/all-platforms/extractor_information_kotlin2/ExtractorInformation.ext.yml
@@ -1,6 +1,6 @@
extensions:
- addsTo:
- pack: codeql/java-queries
+ pack: codeql/java-all
extensible: extractorInformationSkipKey
data:
# These will have unstable values, as they are dependent on the
diff --git a/java/ql/integration-tests/kotlin/linux/custom_plugin/test.py b/java/ql/integration-tests/kotlin/linux/custom_plugin/test.py-disabled
similarity index 91%
rename from java/ql/integration-tests/kotlin/linux/custom_plugin/test.py
rename to java/ql/integration-tests/kotlin/linux/custom_plugin/test.py-disabled
index f9da92683868..2b3a104ed0b1 100644
--- a/java/ql/integration-tests/kotlin/linux/custom_plugin/test.py
+++ b/java/ql/integration-tests/kotlin/linux/custom_plugin/test.py-disabled
@@ -3,6 +3,8 @@
import commands
+# This test is temporarily disabled until it is updated to work with Kotlin 2.2
+
@runs_on.linux
def test(codeql, java_full, cwd, semmle_code_dir, test_dir):
build_dir = cwd / "build"
diff --git a/java/ql/lib/CHANGELOG.md b/java/ql/lib/CHANGELOG.md
index 47c1234d8422..e15d695efea6 100644
--- a/java/ql/lib/CHANGELOG.md
+++ b/java/ql/lib/CHANGELOG.md
@@ -1,6 +1,26 @@
-## 7.3.3
+## 7.5.0
-No user-facing changes.
+### New Features
+
+* Kotlin versions up to 2.2.2\ *x* are now supported.
+
+## 7.4.0
+
+### Deprecated APIs
+
+* The module `semmle.code.java.frameworks.Castor` has been deprecated and will be removed in a future release.
+* The module `semmle.code.java.frameworks.JYaml` has been deprecated and will be removed in a future release.
+* The classes `UnsafeHessianInputReadObjectMethod` and `BurlapInputReadObjectMethod` in the module `semmle.code.java.frameworks.HessianBurlap` have been deprecated and will be removed in a future release.
+* The class `YamlBeansReaderReadMethod` in the module `semmle.code.java.frameworks.YamlBeans` has been deprecated and will be removed in a future release.
+* The class `MethodApacheSerializationUtilsDeserialize` in the module `semmle.code.java.frameworks.apache.Lang` has been deprecated and will be removed in a future release.
+
+### New Features
+
+* You can now add sinks for the query "Deserialization of user-controlled data" (`java/unsafe-deserialization`) using [data extensions](https://codeql.github.com/docs/codeql-language-guides/customizing-library-models-for-java-and-kotlin/#extensible-predicates-used-to-create-custom-models-in-java-and-kotlin) by extending `sinkModel` and using the kind "unsafe-deserialization". The existing sinks that do not require extra logic to determine if they are unsafe are now defined in this way.
+
+### Minor Analysis Improvements
+
+* The qualifiers of a calls to `readObject` on any classes that implement `java.io.ObjectInput` are now recognised as sinks for `java/unsafe-deserialization`. Previously this was only the case for classes which extend `java.io.ObjectInputStream`.
## 7.3.2
diff --git a/java/ql/lib/change-notes/2025-07-11-unsafe-deserialization-extra-sink.md b/java/ql/lib/change-notes/2025-07-11-unsafe-deserialization-extra-sink.md
deleted file mode 100644
index 26f745a2bb72..000000000000
--- a/java/ql/lib/change-notes/2025-07-11-unsafe-deserialization-extra-sink.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* The qualifiers of a calls to `readObject` on any classes that implement `java.io.ObjectInput` are now recognised as sinks for `java/unsafe-deserialization`. Previously this was only the case for classes which extend `java.io.ObjectInputStream`.
diff --git a/java/ql/lib/change-notes/2025-07-28-guardwrappers.md b/java/ql/lib/change-notes/2025-07-28-guardwrappers.md
new file mode 100644
index 000000000000..cf976fe77896
--- /dev/null
+++ b/java/ql/lib/change-notes/2025-07-28-guardwrappers.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Guard implication logic involving wrapper methods has been improved. In particular, this means fewer false positives for `java/dereferenced-value-may-be-null`.
diff --git a/java/ql/lib/change-notes/released/7.4.0.md b/java/ql/lib/change-notes/released/7.4.0.md
new file mode 100644
index 000000000000..103b19767a04
--- /dev/null
+++ b/java/ql/lib/change-notes/released/7.4.0.md
@@ -0,0 +1,17 @@
+## 7.4.0
+
+### Deprecated APIs
+
+* The module `semmle.code.java.frameworks.Castor` has been deprecated and will be removed in a future release.
+* The module `semmle.code.java.frameworks.JYaml` has been deprecated and will be removed in a future release.
+* The classes `UnsafeHessianInputReadObjectMethod` and `BurlapInputReadObjectMethod` in the module `semmle.code.java.frameworks.HessianBurlap` have been deprecated and will be removed in a future release.
+* The class `YamlBeansReaderReadMethod` in the module `semmle.code.java.frameworks.YamlBeans` has been deprecated and will be removed in a future release.
+* The class `MethodApacheSerializationUtilsDeserialize` in the module `semmle.code.java.frameworks.apache.Lang` has been deprecated and will be removed in a future release.
+
+### New Features
+
+* You can now add sinks for the query "Deserialization of user-controlled data" (`java/unsafe-deserialization`) using [data extensions](https://codeql.github.com/docs/codeql-language-guides/customizing-library-models-for-java-and-kotlin/#extensible-predicates-used-to-create-custom-models-in-java-and-kotlin) by extending `sinkModel` and using the kind "unsafe-deserialization". The existing sinks that do not require extra logic to determine if they are unsafe are now defined in this way.
+
+### Minor Analysis Improvements
+
+* The qualifiers of a calls to `readObject` on any classes that implement `java.io.ObjectInput` are now recognised as sinks for `java/unsafe-deserialization`. Previously this was only the case for classes which extend `java.io.ObjectInputStream`.
diff --git a/java/ql/lib/change-notes/released/7.5.0.md b/java/ql/lib/change-notes/released/7.5.0.md
new file mode 100644
index 000000000000..415dab5dfe4f
--- /dev/null
+++ b/java/ql/lib/change-notes/released/7.5.0.md
@@ -0,0 +1,5 @@
+## 7.5.0
+
+### New Features
+
+* Kotlin versions up to 2.2.2\ *x* are now supported.
diff --git a/java/ql/lib/codeql-pack.release.yml b/java/ql/lib/codeql-pack.release.yml
index 8175ad157401..7ed5cb290ca0 100644
--- a/java/ql/lib/codeql-pack.release.yml
+++ b/java/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 7.3.3
+lastReleaseVersion: 7.5.0
diff --git a/java/ql/lib/ext/com.alibaba.com.caucho.hessian.io.model.yml b/java/ql/lib/ext/com.alibaba.com.caucho.hessian.io.model.yml
new file mode 100644
index 000000000000..af8824aae0c1
--- /dev/null
+++ b/java/ql/lib/ext/com.alibaba.com.caucho.hessian.io.model.yml
@@ -0,0 +1,7 @@
+extensions:
+ - addsTo:
+ pack: codeql/java-all
+ extensible: sinkModel
+ data:
+ - ["com.alibaba.com.caucho.hessian.io", "AbstractHessianInput", True, "readObject", "", "", "Argument[this]", "unsafe-deserialization", "manual"]
+ - ["com.alibaba.com.caucho.hessian.io", "Hessian2StreamingInput", True, "readObject", "", "", "Argument[this]", "unsafe-deserialization", "manual"]
diff --git a/java/ql/lib/ext/com.caucho.burlap.io.model.yml b/java/ql/lib/ext/com.caucho.burlap.io.model.yml
new file mode 100644
index 000000000000..862804438ca4
--- /dev/null
+++ b/java/ql/lib/ext/com.caucho.burlap.io.model.yml
@@ -0,0 +1,6 @@
+extensions:
+ - addsTo:
+ pack: codeql/java-all
+ extensible: sinkModel
+ data:
+ - ["com.caucho.burlap.io", "BurlapInput", True, "readObject", "", "", "Argument[this]", "unsafe-deserialization", "manual"]
diff --git a/java/ql/lib/ext/com.caucho.hessian.io.model.yml b/java/ql/lib/ext/com.caucho.hessian.io.model.yml
new file mode 100644
index 000000000000..73c3ddebf451
--- /dev/null
+++ b/java/ql/lib/ext/com.caucho.hessian.io.model.yml
@@ -0,0 +1,7 @@
+extensions:
+ - addsTo:
+ pack: codeql/java-all
+ extensible: sinkModel
+ data:
+ - ["com.caucho.hessian.io", "AbstractHessianInput", True, "readObject", "", "", "Argument[this]", "unsafe-deserialization", "manual"]
+ - ["com.caucho.hessian.io", "Hessian2StreamingInput", True, "readObject", "", "", "Argument[this]", "unsafe-deserialization", "manual"]
diff --git a/java/ql/lib/ext/com.cedarsoftware.util.io.model.yml b/java/ql/lib/ext/com.cedarsoftware.util.io.model.yml
new file mode 100644
index 000000000000..926a86238114
--- /dev/null
+++ b/java/ql/lib/ext/com.cedarsoftware.util.io.model.yml
@@ -0,0 +1,7 @@
+extensions:
+ - addsTo:
+ pack: codeql/java-all
+ extensible: sinkModel
+ data:
+ - ["com.cedarsoftware.util.io", "JsonReader", False, "jsonToJava", "", "", "Argument[0]", "unsafe-deserialization", "manual"]
+ - ["com.cedarsoftware.util.io", "JsonReader", True, "readObject", "", "", "Argument[this]", "unsafe-deserialization", "manual"]
diff --git a/java/ql/lib/ext/com.esotericsoftware.yamlbeans.model.yml b/java/ql/lib/ext/com.esotericsoftware.yamlbeans.model.yml
new file mode 100644
index 000000000000..944222c420b6
--- /dev/null
+++ b/java/ql/lib/ext/com.esotericsoftware.yamlbeans.model.yml
@@ -0,0 +1,6 @@
+extensions:
+ - addsTo:
+ pack: codeql/java-all
+ extensible: sinkModel
+ data:
+ - ["com.esotericsoftware.yamlbeans", "YamlReader", True, "read", "", "", "Argument[this]", "unsafe-deserialization", "manual"]
diff --git a/java/ql/lib/ext/java.beans.model.yml b/java/ql/lib/ext/java.beans.model.yml
index 30667ec69615..07291296612d 100644
--- a/java/ql/lib/ext/java.beans.model.yml
+++ b/java/ql/lib/ext/java.beans.model.yml
@@ -13,3 +13,8 @@ extensions:
- ["java.beans", "PropertyEditor", "getValue", "()", "summary", "df-manual"] # needs to be modeled by regular CodeQL matching the get and set keys to reduce FPs
- ["java.beans", "PropertyEditor", "setAsText", "()", "summary", "df-manual"] # needs to be modeled by regular CodeQL matching the get and set keys to reduce FPs
- ["java.beans", "PropertyEditor", "setValue", "()", "summary", "df-manual"] # needs to be modeled by regular CodeQL matching the get and set keys to reduce FPs
+ - addsTo:
+ pack: codeql/java-all
+ extensible: sinkModel
+ data:
+ - ["java.beans", "XMLDecoder", True, "readObject", "()", "", "Argument[this]", "unsafe-deserialization", "manual"]
diff --git a/java/ql/lib/ext/org.apache.commons.lang.model.yml b/java/ql/lib/ext/org.apache.commons.lang.model.yml
index 8dd3fd003f9d..0d38b845c9ca 100644
--- a/java/ql/lib/ext/org.apache.commons.lang.model.yml
+++ b/java/ql/lib/ext/org.apache.commons.lang.model.yml
@@ -5,3 +5,8 @@ extensions:
data:
- ["org.apache.commons.lang", "StringEscapeUtils", true, "escapeHtml", "(String)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
- ["org.apache.commons.lang", "StringEscapeUtils", true, "escapeHtml", "(Writer,String)", "", "Argument[1]", "Argument[0]", "taint", "manual"]
+ - addsTo:
+ pack: codeql/java-all
+ extensible: sinkModel
+ data:
+ - ["org.apache.commons.lang", "SerializationUtils", False, "deserialize", "", "", "Argument[0]", "unsafe-deserialization", "manual"]
diff --git a/java/ql/lib/ext/org.apache.commons.lang3.model.yml b/java/ql/lib/ext/org.apache.commons.lang3.model.yml
index 541db005f0b6..7c455d780b13 100644
--- a/java/ql/lib/ext/org.apache.commons.lang3.model.yml
+++ b/java/ql/lib/ext/org.apache.commons.lang3.model.yml
@@ -3,6 +3,7 @@ extensions:
pack: codeql/java-all
extensible: sinkModel
data:
+ - ["org.apache.commons.lang3", "SerializationUtils", False, "deserialize", "", "", "Argument[0]", "unsafe-deserialization", "manual"]
# Note these sinks do not use the sink kind `regex-use[0]` because the regex injection query needs to select them separately from
# other `regex-use[0]` sinks in order to avoid FPs. As a result, these sinks are currently not used in the polynomial ReDoS query.
# TODO: refactor the `regex-use%` sink kind so that the polynomial ReDoS query can also use these sinks.
diff --git a/java/ql/lib/ext/org.exolab.castor.xml.model.yml b/java/ql/lib/ext/org.exolab.castor.xml.model.yml
new file mode 100644
index 000000000000..7113a9ab94a7
--- /dev/null
+++ b/java/ql/lib/ext/org.exolab.castor.xml.model.yml
@@ -0,0 +1,6 @@
+extensions:
+ - addsTo:
+ pack: codeql/java-all
+ extensible: sinkModel
+ data:
+ - ["org.exolab.castor.xml", "Unmarshaller", True, "unmarshal", "", "", "Argument[0..1]", "unsafe-deserialization", "manual"]
diff --git a/java/ql/lib/ext/org.ho.yaml.model.yml b/java/ql/lib/ext/org.ho.yaml.model.yml
new file mode 100644
index 000000000000..fd6e0e363563
--- /dev/null
+++ b/java/ql/lib/ext/org.ho.yaml.model.yml
@@ -0,0 +1,13 @@
+extensions:
+ - addsTo:
+ pack: codeql/java-all
+ extensible: sinkModel
+ data:
+ - ["org.ho.yaml", "Yaml", False, "load", "", "", "Argument[0]", "unsafe-deserialization", "manual"]
+ - ["org.ho.yaml", "Yaml", False, "loadStream", "", "", "Argument[0]", "unsafe-deserialization", "manual"]
+ - ["org.ho.yaml", "Yaml", False, "loadStreamOfType", "", "", "Argument[0]", "unsafe-deserialization", "manual"]
+ - ["org.ho.yaml", "Yaml", False, "loadType", "", "", "Argument[0]", "unsafe-deserialization", "manual"]
+ - ["org.ho.yaml", "YamlConfig", False, "load", "", "", "Argument[0]", "unsafe-deserialization", "manual"]
+ - ["org.ho.yaml", "YamlConfig", False, "loadStream", "", "", "Argument[0]", "unsafe-deserialization", "manual"]
+ - ["org.ho.yaml", "YamlConfig", False, "loadStreamOfType", "", "", "Argument[0]", "unsafe-deserialization", "manual"]
+ - ["org.ho.yaml", "YamlConfig", False, "loadType", "", "", "Argument[0]", "unsafe-deserialization", "manual"]
diff --git a/java/ql/lib/ext/org.jabsorb.model.yml b/java/ql/lib/ext/org.jabsorb.model.yml
new file mode 100644
index 000000000000..5c50178e9937
--- /dev/null
+++ b/java/ql/lib/ext/org.jabsorb.model.yml
@@ -0,0 +1,6 @@
+extensions:
+ - addsTo:
+ pack: codeql/java-all
+ extensible: sinkModel
+ data:
+ - ["org.jabsorb", "JSONSerializer", True, "fromJSON", "", "", "Argument[0]", "unsafe-deserialization", "manual"]
diff --git a/java/ql/lib/qlpack.yml b/java/ql/lib/qlpack.yml
index c7a6a045451e..0e69cc38681c 100644
--- a/java/ql/lib/qlpack.yml
+++ b/java/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/java-all
-version: 7.3.4-dev
+version: 7.5.1-dev
groups: java
dbscheme: config/semmlecode.dbscheme
extractor: java
@@ -23,3 +23,4 @@ dataExtensions:
- ext/generated/*.model.yml
- ext/experimental/*.model.yml
warnOnImplicitThis: true
+compileForOverlayEval: true
diff --git a/java/ql/lib/semmle/code/java/ControlFlowGraph.qll b/java/ql/lib/semmle/code/java/ControlFlowGraph.qll
index 33b7a6c0a9fc..612bca35a600 100644
--- a/java/ql/lib/semmle/code/java/ControlFlowGraph.qll
+++ b/java/ql/lib/semmle/code/java/ControlFlowGraph.qll
@@ -82,6 +82,7 @@ module;
*/
import java
+private import codeql.util.Boolean
private import Completion
private import controlflow.internal.Preconditions
private import controlflow.internal.SwitchCases
@@ -102,6 +103,7 @@ module ControlFlow {
private newtype TNode =
TExprNode(Expr e) { hasControlFlow(e) } or
TStmtNode(Stmt s) or
+ TAnnotatedExitNode(Callable c, Boolean normal) { exists(c.getBody()) } or
TExitNode(Callable c) { exists(c.getBody()) } or
TAssertThrowNode(AssertStmt s)
@@ -191,6 +193,38 @@ module ControlFlow {
override Location getLocation() { result = s.getLocation() }
}
+ /** A control flow node indicating the normal or exceptional termination of a callable. */
+ class AnnotatedExitNode extends Node, TAnnotatedExitNode {
+ Callable c;
+ boolean normal;
+
+ AnnotatedExitNode() { this = TAnnotatedExitNode(c, normal) }
+
+ override Callable getEnclosingCallable() { result = c }
+
+ override ExprParent getAstNode() { result = c }
+
+ /** Gets a textual representation of this element. */
+ override string toString() {
+ normal = true and result = "Normal Exit"
+ or
+ normal = false and result = "Exceptional Exit"
+ }
+
+ /** Gets the source location for this element. */
+ override Location getLocation() { result = c.getLocation() }
+ }
+
+ /** A control flow node indicating normal termination of a callable. */
+ class NormalExitNode extends AnnotatedExitNode {
+ NormalExitNode() { this = TAnnotatedExitNode(_, true) }
+ }
+
+ /** A control flow node indicating exceptional termination of a callable. */
+ class ExceptionalExitNode extends AnnotatedExitNode {
+ ExceptionalExitNode() { this = TAnnotatedExitNode(_, false) }
+ }
+
/** A control flow node indicating the termination of a callable. */
class ExitNode extends Node, TExitNode {
Callable c;
@@ -1266,11 +1300,17 @@ private module ControlFlowGraphImpl {
*/
cached
Node succ(Node n, Completion completion) {
- // After executing the callable body, the final node is the exit node.
+ // After executing the callable body, the final nodes are first the
+ // annotated exit node and then the final exit node.
exists(Callable c | last(c.getBody(), n, completion) |
- result.(ExitNode).getEnclosingCallable() = c
+ if completion instanceof ThrowCompletion
+ then result.(ExceptionalExitNode).getEnclosingCallable() = c
+ else result.(NormalExitNode).getEnclosingCallable() = c
)
or
+ completion = NormalCompletion() and
+ n.(AnnotatedExitNode).getEnclosingCallable() = result.(ExitNode).getEnclosingCallable()
+ or
// Logic expressions and conditional expressions execute in AST pre-order.
completion = NormalCompletion() and
(
@@ -1581,7 +1621,8 @@ private module ControlFlowGraphImpl {
result.(AssertThrowNode).getAstNode() = assertstmt
)
or
- last(assertstmt.getMessage(), n, NormalCompletion()) and
+ last(assertstmt.getMessage(), n, completion) and
+ completion = NormalCompletion() and
result.(AssertThrowNode).getAstNode() = assertstmt
)
or
diff --git a/java/ql/lib/semmle/code/java/Diagnostics.qll b/java/ql/lib/semmle/code/java/Diagnostics.qll
index c93e6850b3de..8a4b543aa4a1 100644
--- a/java/ql/lib/semmle/code/java/Diagnostics.qll
+++ b/java/ql/lib/semmle/code/java/Diagnostics.qll
@@ -61,3 +61,9 @@ class Diagnostic extends @diagnostic {
/** Gets a textual representation of this diagnostic. */
string toString() { result = this.getMessage() }
}
+
+/**
+ * Holds for extraction information keys that should be skipped from telemetry reports.
+ * This predicate can be extended by other packs to filter out specific telemetry keys.
+ */
+extensible predicate extractorInformationSkipKey(string key);
diff --git a/java/ql/lib/semmle/code/java/Generics.qll b/java/ql/lib/semmle/code/java/Generics.qll
index e0204b1beace..fbd979a03694 100644
--- a/java/ql/lib/semmle/code/java/Generics.qll
+++ b/java/ql/lib/semmle/code/java/Generics.qll
@@ -521,7 +521,13 @@ private predicate unificationTargets(RefType t1, Type t2) {
t2 = a2.getComponentType()
)
or
- exists(ParameterizedType pt1, ParameterizedType pt2, int pos |
+ unificationTargetsParameterized(_, _, t1, t2)
+}
+
+private predicate unificationTargetsParameterized(
+ ParameterizedType pt1, ParameterizedType pt2, RefType t1, RefType t2
+) {
+ exists(int pos |
unificationTargets(pt1, pt2) and
t1 = pt1.getTypeArgument(pos) and
t2 = pt2.getTypeArgument(pos)
@@ -565,10 +571,12 @@ private predicate hasParameterSubstitution(
GenericType g1, ParameterizedType pt1, GenericType g2, ParameterizedType pt2, TypeVariable v,
RefType subst
) {
- unificationTargets(pt1, pt2) and
- exists(int pos | hasSubstitution(pt1.getTypeArgument(pos), pt2.getTypeArgument(pos), v, subst)) and
- g1 = pt1.getGenericType() and
- g2 = pt2.getGenericType()
+ exists(RefType t1, RefType t2 |
+ unificationTargetsParameterized(pt1, pt2, t1, t2) and
+ hasSubstitution(t1, t2, v, subst) and
+ g1 = pt1.getGenericType() and
+ g2 = pt2.getGenericType()
+ )
}
/**
diff --git a/java/ql/lib/semmle/code/java/Type.qll b/java/ql/lib/semmle/code/java/Type.qll
index aa1cc5fdc7f7..dd646e74285c 100644
--- a/java/ql/lib/semmle/code/java/Type.qll
+++ b/java/ql/lib/semmle/code/java/Type.qll
@@ -1261,14 +1261,21 @@ private Type erase(Type t) {
*
* For the definition of the notion of *erasure* see JLS v8, section 4.6 (Type Erasure).
*/
+bindingset[t1, t2]
overlay[caller?]
-pragma[inline]
+pragma[inline_late]
predicate haveIntersection(RefType t1, RefType t2) {
exists(RefType e1, RefType e2 | e1 = erase(t1) and e2 = erase(t2) |
- erasedHaveIntersection(e1, e2)
+ erasedHaveIntersectionFilter(e1, e2)
)
}
+bindingset[t1, t2]
+pragma[inline_late]
+private predicate erasedHaveIntersectionFilter(RefType t1, RefType t2) {
+ erasedHaveIntersection(t1, t2)
+}
+
/**
* Holds if there is no common (reflexive, transitive) subtype of the erasures
* of types `t1` and `t2`.
diff --git a/java/ql/lib/semmle/code/java/controlflow/BasicBlocks.qll b/java/ql/lib/semmle/code/java/controlflow/BasicBlocks.qll
index 844371da36b8..e974f711ec45 100644
--- a/java/ql/lib/semmle/code/java/controlflow/BasicBlocks.qll
+++ b/java/ql/lib/semmle/code/java/controlflow/BasicBlocks.qll
@@ -57,7 +57,7 @@ private module Input implements BB::InputSig {
* Holds if `node` represents an exit node to be used when calculating
* post dominance.
*/
- predicate nodeIsPostDominanceExit(Node node) { node instanceof ControlFlow::ExitNode }
+ predicate nodeIsPostDominanceExit(Node node) { node instanceof ControlFlow::NormalExitNode }
}
private module BbImpl = BB::Make;
diff --git a/java/ql/lib/semmle/code/java/controlflow/Guards.qll b/java/ql/lib/semmle/code/java/controlflow/Guards.qll
index 8cead5b666bb..c33658cb67b6 100644
--- a/java/ql/lib/semmle/code/java/controlflow/Guards.qll
+++ b/java/ql/lib/semmle/code/java/controlflow/Guards.qll
@@ -146,6 +146,8 @@ private module GuardsInput implements SharedGuards::InputSig {
class ControlFlowNode = J::ControlFlowNode;
+ class NormalExitNode = ControlFlow::NormalExitNode;
+
class BasicBlock = J::BasicBlock;
predicate dominatingEdge(BasicBlock bb1, BasicBlock bb2) { J::dominatingEdge(bb1, bb2) }
@@ -322,6 +324,55 @@ private module GuardsInput implements SharedGuards::InputSig {
Expr getElse() { result = super.getFalseExpr() }
}
+
+ class Parameter = J::Parameter;
+
+ private int parameterPosition() { result in [-1, any(Parameter p).getPosition()] }
+
+ /** A parameter position represented by an integer. */
+ class ParameterPosition extends int {
+ ParameterPosition() { this = parameterPosition() }
+ }
+
+ /** An argument position represented by an integer. */
+ class ArgumentPosition extends int {
+ ArgumentPosition() { this = parameterPosition() }
+ }
+
+ /** Holds if arguments at position `apos` match parameters at position `ppos`. */
+ overlay[caller?]
+ pragma[inline]
+ predicate parameterMatch(ParameterPosition ppos, ArgumentPosition apos) { ppos = apos }
+
+ final private class FinalMethod = Method;
+
+ class NonOverridableMethod extends FinalMethod {
+ NonOverridableMethod() { not super.isOverridable() }
+
+ Parameter getParameter(ParameterPosition ppos) {
+ super.getParameter(ppos) = result and
+ not result.isVarargs()
+ }
+
+ GuardsInput::Expr getAReturnExpr() {
+ exists(ReturnStmt ret |
+ this = ret.getEnclosingCallable() and
+ ret.getResult() = result
+ )
+ }
+ }
+
+ private predicate nonOverridableMethodCall(MethodCall call, NonOverridableMethod m) {
+ call.getMethod().getSourceDeclaration() = m
+ }
+
+ class NonOverridableMethodCall extends GuardsInput::Expr instanceof MethodCall {
+ NonOverridableMethodCall() { nonOverridableMethodCall(this, _) }
+
+ NonOverridableMethod getMethod() { nonOverridableMethodCall(this, result) }
+
+ GuardsInput::Expr getArgument(ArgumentPosition apos) { result = super.getArgument(apos) }
+ }
}
private module GuardsImpl = SharedGuards::Make;
@@ -340,6 +391,17 @@ private module LogicInputCommon {
NullGuards::nullCheckMethod(call.getMethod(), val.asBooleanValue(), isNull)
)
}
+
+ predicate additionalImpliesStep(
+ GuardsImpl::PreGuard g1, GuardValue v1, GuardsImpl::PreGuard g2, GuardValue v2
+ ) {
+ exists(MethodCall check, int argIndex |
+ g1 = check and
+ v1.getDualValue().isThrowsException() and
+ conditionCheckArgument(check, argIndex, v2.asBooleanValue()) and
+ g2 = check.getArgument(argIndex)
+ )
+ }
}
private module LogicInput_v1 implements GuardsImpl::LogicInputSig {
@@ -364,18 +426,13 @@ private module LogicInput_v1 implements GuardsImpl::LogicInputSig {
}
}
+ predicate parameterDefinition(Parameter p, SsaDefinition def) {
+ def.(BaseSsaImplicitInit).isParameterDefinition(p)
+ }
+
predicate additionalNullCheck = LogicInputCommon::additionalNullCheck/4;
- predicate additionalImpliesStep(
- GuardsImpl::PreGuard g1, GuardValue v1, GuardsImpl::PreGuard g2, GuardValue v2
- ) {
- exists(MethodCall check, int argIndex |
- g1 = check and
- v1.getDualValue().isThrowsException() and
- conditionCheckArgument(check, argIndex, v2.asBooleanValue()) and
- g2 = check.getArgument(argIndex)
- )
- }
+ predicate additionalImpliesStep = LogicInputCommon::additionalImpliesStep/4;
}
private module LogicInput_v2 implements GuardsImpl::LogicInputSig {
@@ -400,15 +457,13 @@ private module LogicInput_v2 implements GuardsImpl::LogicInputSig {
}
}
+ predicate parameterDefinition(Parameter p, SsaDefinition def) {
+ def.(SSA::SsaImplicitInit).isParameterDefinition(p)
+ }
+
predicate additionalNullCheck = LogicInputCommon::additionalNullCheck/4;
- predicate additionalImpliesStep(
- GuardsImpl::PreGuard g1, GuardValue v1, GuardsImpl::PreGuard g2, GuardValue v2
- ) {
- LogicInput_v1::additionalImpliesStep(g1, v1, g2, v2)
- or
- CustomGuard::additionalImpliesStep(g1, v1, g2, v2)
- }
+ predicate additionalImpliesStep = LogicInputCommon::additionalImpliesStep/4;
}
private module LogicInput_v3 implements GuardsImpl::LogicInputSig {
@@ -421,70 +476,11 @@ private module LogicInput_v3 implements GuardsImpl::LogicInputSig {
predicate additionalNullCheck = LogicInputCommon::additionalNullCheck/4;
- predicate additionalImpliesStep = LogicInput_v2::additionalImpliesStep/4;
-}
-
-private module CustomGuardInput implements Guards_v2::CustomGuardInputSig {
- private import semmle.code.java.dataflow.SSA
-
- private int parameterPosition() { result in [-1, any(Parameter p).getPosition()] }
-
- /** A parameter position represented by an integer. */
- class ParameterPosition extends int {
- ParameterPosition() { this = parameterPosition() }
- }
-
- /** An argument position represented by an integer. */
- class ArgumentPosition extends int {
- ArgumentPosition() { this = parameterPosition() }
- }
-
- /** Holds if arguments at position `apos` match parameters at position `ppos`. */
- overlay[caller?]
- pragma[inline]
- predicate parameterMatch(ParameterPosition ppos, ArgumentPosition apos) { ppos = apos }
-
- final private class FinalMethod = Method;
-
- class BooleanMethod extends FinalMethod {
- BooleanMethod() {
- super.getReturnType().(PrimitiveType).hasName("boolean") and
- not super.isOverridable()
- }
-
- LogicInput_v2::SsaDefinition getParameter(ParameterPosition ppos) {
- exists(Parameter p |
- super.getParameter(ppos) = p and
- not p.isVarargs() and
- result.(SsaImplicitInit).isParameterDefinition(p)
- )
- }
-
- GuardsInput::Expr getAReturnExpr() {
- exists(ReturnStmt ret |
- this = ret.getEnclosingCallable() and
- ret.getResult() = result
- )
- }
- }
-
- private predicate booleanMethodCall(MethodCall call, BooleanMethod m) {
- call.getMethod().getSourceDeclaration() = m
- }
-
- class BooleanMethodCall extends GuardsInput::Expr instanceof MethodCall {
- BooleanMethodCall() { booleanMethodCall(this, _) }
-
- BooleanMethod getMethod() { booleanMethodCall(this, result) }
-
- GuardsInput::Expr getArgument(ArgumentPosition apos) { result = super.getArgument(apos) }
- }
+ predicate additionalImpliesStep = LogicInputCommon::additionalImpliesStep/4;
}
class GuardValue = GuardsImpl::GuardValue;
-private module CustomGuard = Guards_v2::CustomGuard;
-
/** INTERNAL: Don't use. */
module Guards_v1 = GuardsImpl::Logic;
diff --git a/java/ql/lib/semmle/code/java/controlflow/Paths.qll b/java/ql/lib/semmle/code/java/controlflow/Paths.qll
index fb14c226484d..abc56e32b5ca 100644
--- a/java/ql/lib/semmle/code/java/controlflow/Paths.qll
+++ b/java/ql/lib/semmle/code/java/controlflow/Paths.qll
@@ -66,6 +66,10 @@ private class JoinBlock extends BasicBlock {
JoinBlock() { 2 <= strictcount(this.getAPredecessor()) }
}
+private class ReachableBlock extends BasicBlock {
+ ReachableBlock() { hasDominanceInformation(this) }
+}
+
/**
* Holds if `bb` is a block that is collectively dominated by a set of one or
* more actions that individually does not dominate the exit.
@@ -74,7 +78,7 @@ private predicate postActionBlock(BasicBlock bb, ActionConfiguration conf) {
bb = nonDominatingActionBlock(conf)
or
if bb instanceof JoinBlock
- then forall(BasicBlock pred | pred = bb.getAPredecessor() | postActionBlock(pred, conf))
+ then forall(ReachableBlock pred | pred = bb.getAPredecessor() | postActionBlock(pred, conf))
else postActionBlock(bb.getAPredecessor(), conf)
}
diff --git a/java/ql/lib/semmle/code/java/dataflow/internal/DataFlowPrivate.qll b/java/ql/lib/semmle/code/java/dataflow/internal/DataFlowPrivate.qll
index 164e2d8aa262..8b9087ecbdc5 100644
--- a/java/ql/lib/semmle/code/java/dataflow/internal/DataFlowPrivate.qll
+++ b/java/ql/lib/semmle/code/java/dataflow/internal/DataFlowPrivate.qll
@@ -348,6 +348,16 @@ predicate expectsContent(Node n, ContentSet c) {
FlowSummaryImpl::Private::Steps::summaryExpectsContent(n.(FlowSummaryNode).getSummaryNode(), c)
}
+pragma[nomagic]
+private predicate numericRepresentative(RefType t) {
+ t.(BoxedType).getPrimitiveType().getName() = "double"
+}
+
+pragma[nomagic]
+private predicate booleanRepresentative(RefType t) {
+ t.(BoxedType).getPrimitiveType().getName() = "boolean"
+}
+
/**
* Gets a representative (boxed) type for `t` for the purpose of pruning
* possible flow. A single type is used for all numeric types to account for
@@ -356,10 +366,10 @@ predicate expectsContent(Node n, ContentSet c) {
RefType getErasedRepr(Type t) {
exists(Type e | e = t.getErasure() |
if e instanceof NumericOrCharType
- then result.(BoxedType).getPrimitiveType().getName() = "double"
+ then numericRepresentative(result)
else
if e instanceof BooleanType
- then result.(BoxedType).getPrimitiveType().getName() = "boolean"
+ then booleanRepresentative(result)
else result = e
)
or
diff --git a/java/ql/lib/semmle/code/java/dataflow/internal/SsaImpl.qll b/java/ql/lib/semmle/code/java/dataflow/internal/SsaImpl.qll
index 45ad9d0a73b7..5a6c5ff6339b 100644
--- a/java/ql/lib/semmle/code/java/dataflow/internal/SsaImpl.qll
+++ b/java/ql/lib/semmle/code/java/dataflow/internal/SsaImpl.qll
@@ -563,9 +563,9 @@ private module Cached {
cached // nothing is actually cached
module BarrierGuard {
private predicate guardChecksAdjTypes(
- DataFlowIntegrationInput::Guard g, DataFlowIntegrationInput::Expr e, boolean branch
+ DataFlowIntegrationInput::Guard g, DataFlowIntegrationInput::Expr e, Guards::GuardValue val
) {
- guardChecks(g, e, branch)
+ guardChecks(g, e, val.asBooleanValue())
}
private Node getABarrierNodeImpl() {
@@ -657,16 +657,18 @@ private module DataFlowIntegrationInput implements Impl::DataFlowIntegrationInpu
def instanceof SsaUncertainImplicitUpdate
}
+ class GuardValue = Guards::GuardValue;
+
class Guard = Guards::Guard;
- /** Holds if the guard `guard` directly controls block `bb` upon evaluating to `branch`. */
- predicate guardDirectlyControlsBlock(Guard guard, BasicBlock bb, boolean branch) {
- guard.directlyControls(bb, branch)
+ /** Holds if the guard `guard` directly controls block `bb` upon evaluating to `val`. */
+ predicate guardDirectlyControlsBlock(Guard guard, BasicBlock bb, GuardValue val) {
+ guard.directlyValueControls(bb, val)
}
- /** Holds if the guard `guard` controls block `bb` upon evaluating to `branch`. */
- predicate guardControlsBlock(Guard guard, BasicBlock bb, boolean branch) {
- guard.controls(bb, branch)
+ /** Holds if the guard `guard` controls block `bb` upon evaluating to `val`. */
+ predicate guardControlsBlock(Guard guard, BasicBlock bb, GuardValue val) {
+ guard.valueControls(bb, val)
}
predicate includeWriteDefsInFlowStep() { none() }
diff --git a/java/ql/lib/semmle/code/java/dispatch/ObjFlow.qll b/java/ql/lib/semmle/code/java/dispatch/ObjFlow.qll
index 12fe1cba5e99..86915f802743 100644
--- a/java/ql/lib/semmle/code/java/dispatch/ObjFlow.qll
+++ b/java/ql/lib/semmle/code/java/dispatch/ObjFlow.qll
@@ -214,24 +214,35 @@ private predicate relevantNode(ObjNode n) {
exists(ObjNode mid | relevantNode(mid) and objStep(mid, n) and relevantNodeBack(n))
}
-pragma[noinline]
-private predicate objStepPruned(ObjNode n1, ObjNode n2) {
- objStep(n1, n2) and relevantNode(n1) and relevantNode(n2)
+private newtype TObjFlowNode =
+ TObjNode(ObjNode n) { relevantNode(n) } or
+ TObjType(RefType t) { source(t, _) }
+
+private predicate objStepPruned(TObjFlowNode node1, TObjFlowNode node2) {
+ exists(ObjNode n1, ObjNode n2 |
+ node1 = TObjNode(n1) and
+ node2 = TObjNode(n2) and
+ objStep(n1, n2)
+ )
+ or
+ exists(RefType t, ObjNode n |
+ node1 = TObjType(t) and
+ node2 = TObjNode(n) and
+ source(t, n)
+ )
}
-private predicate stepPlus(Node n1, Node n2) = fastTC(objStepPruned/2)(n1, n2)
+private predicate flowSrc(TObjFlowNode src) { src instanceof TObjType }
+
+private predicate flowSink(TObjFlowNode sink) { exists(ObjNode n | sink = TObjNode(n) and sink(n)) }
+
+private predicate stepPlus(TObjFlowNode n1, TObjFlowNode n2) =
+ doublyBoundedFastTC(objStepPruned/2, flowSrc/1, flowSink/1)(n1, n2)
/**
* Holds if the qualifier `n` of an `Object.toString()` call might have type `t`.
*/
-pragma[noopt]
-private predicate objType(ObjNode n, RefType t) {
- exists(ObjNode n2 |
- sink(n) and
- (stepPlus(n2, n) or n2 = n) and
- source(t, n2)
- )
-}
+private predicate objType(ObjNode n, RefType t) { stepPlus(TObjType(t), TObjNode(n)) }
private VirtualMethodCall objectToString(ObjNode n) {
result.getQualifier() = n.asExpr() and sink(n)
diff --git a/java/ql/lib/semmle/code/java/frameworks/Castor.qll b/java/ql/lib/semmle/code/java/frameworks/Castor.qll
index 2becb2fbf178..5be64575bc2a 100644
--- a/java/ql/lib/semmle/code/java/frameworks/Castor.qll
+++ b/java/ql/lib/semmle/code/java/frameworks/Castor.qll
@@ -1,8 +1,10 @@
/**
+ * DEPRECATED: Now modeled using data extensions instead.
+ *
* Provides classes and predicates for working with the Castor framework.
*/
overlay[local?]
-module;
+deprecated module;
import java
@@ -13,7 +15,9 @@ class CastorUnmarshaller extends RefType {
CastorUnmarshaller() { this.hasQualifiedName("org.exolab.castor.xml", "Unmarshaller") }
}
-/** A method with the name `unmarshal` declared in `org.exolab.castor.xml.Unmarshaller`. */
+/**
+ * A method with the name `unmarshal` declared in `org.exolab.castor.xml.Unmarshaller`.
+ */
class CastorUnmarshalMethod extends Method {
CastorUnmarshalMethod() {
this.getDeclaringType() instanceof CastorUnmarshaller and
diff --git a/java/ql/lib/semmle/code/java/frameworks/HessianBurlap.qll b/java/ql/lib/semmle/code/java/frameworks/HessianBurlap.qll
index 3a10b75a2a69..25449b351abd 100644
--- a/java/ql/lib/semmle/code/java/frameworks/HessianBurlap.qll
+++ b/java/ql/lib/semmle/code/java/frameworks/HessianBurlap.qll
@@ -17,10 +17,12 @@ class UnsafeHessianInput extends RefType {
}
/**
+ * DEPRECATED: Now modeled using data extensions instead.
+ *
* A AbstractHessianInput or Hessian2StreamingInput subclass readObject method.
* This is either `AbstractHessianInput.readObject` or `Hessian2StreamingInput.readObject`.
*/
-class UnsafeHessianInputReadObjectMethod extends Method {
+deprecated class UnsafeHessianInputReadObjectMethod extends Method {
UnsafeHessianInputReadObjectMethod() {
this.getDeclaringType().getAnAncestor() instanceof UnsafeHessianInput and
this.getName() = "readObject"
@@ -34,8 +36,12 @@ class BurlapInput extends RefType {
BurlapInput() { this.hasQualifiedName("com.caucho.burlap.io", "BurlapInput") }
}
-/** A method with the name `readObject` declared in `com.caucho.burlap.io.BurlapInput`. */
-class BurlapInputReadObjectMethod extends Method {
+/**
+ * DEPRECATED: Now modeled using data extensions instead.
+ *
+ * A method with the name `readObject` declared in `com.caucho.burlap.io.BurlapInput`.
+ */
+deprecated class BurlapInputReadObjectMethod extends Method {
BurlapInputReadObjectMethod() {
this.getDeclaringType() instanceof BurlapInput and
this.getName() = "readObject"
diff --git a/java/ql/lib/semmle/code/java/frameworks/JYaml.qll b/java/ql/lib/semmle/code/java/frameworks/JYaml.qll
index cd9414521c4e..4f39c8cd23fc 100644
--- a/java/ql/lib/semmle/code/java/frameworks/JYaml.qll
+++ b/java/ql/lib/semmle/code/java/frameworks/JYaml.qll
@@ -1,8 +1,10 @@
/**
+ * DEPRECATED: Now modeled using data extensions instead.
+ *
* Provides classes and predicates for working with the JYaml framework.
*/
overlay[local?]
-module;
+deprecated module;
import java
diff --git a/java/ql/lib/semmle/code/java/frameworks/Jabsorb.qll b/java/ql/lib/semmle/code/java/frameworks/Jabsorb.qll
index e8bb82f156fe..1997fd74f645 100644
--- a/java/ql/lib/semmle/code/java/frameworks/Jabsorb.qll
+++ b/java/ql/lib/semmle/code/java/frameworks/Jabsorb.qll
@@ -19,8 +19,12 @@ class JabsorbUnmarshallMethod extends Method {
}
}
-/** The deserialization method `fromJSON`. */
-class JabsorbFromJsonMethod extends Method {
+/**
+ * DEPRECATED: Now modeled using data extensions instead.
+ *
+ * The deserialization method `fromJSON`.
+ */
+deprecated class JabsorbFromJsonMethod extends Method {
JabsorbFromJsonMethod() {
this.getDeclaringType().getAnAncestor() instanceof JabsorbSerializer and
this.getName() = "fromJSON"
diff --git a/java/ql/lib/semmle/code/java/frameworks/YamlBeans.qll b/java/ql/lib/semmle/code/java/frameworks/YamlBeans.qll
index 040ae60fc710..55ff862d3410 100644
--- a/java/ql/lib/semmle/code/java/frameworks/YamlBeans.qll
+++ b/java/ql/lib/semmle/code/java/frameworks/YamlBeans.qll
@@ -13,8 +13,12 @@ class YamlBeansReader extends RefType {
YamlBeansReader() { this.hasQualifiedName("com.esotericsoftware.yamlbeans", "YamlReader") }
}
-/** A method with the name `read` declared in `com.esotericsoftware.yamlbeans.YamlReader`. */
-class YamlBeansReaderReadMethod extends Method {
+/**
+ * DEPRECATED: Now modeled using data extensions instead.
+ *
+ * A method with the name `read` declared in `com.esotericsoftware.yamlbeans.YamlReader`.
+ */
+deprecated class YamlBeansReaderReadMethod extends Method {
YamlBeansReaderReadMethod() {
this.getDeclaringType() instanceof YamlBeansReader and
this.getName() = "read"
diff --git a/java/ql/lib/semmle/code/java/frameworks/apache/Lang.qll b/java/ql/lib/semmle/code/java/frameworks/apache/Lang.qll
index 27c7f9530ad1..a58500eb20df 100644
--- a/java/ql/lib/semmle/code/java/frameworks/apache/Lang.qll
+++ b/java/ql/lib/semmle/code/java/frameworks/apache/Lang.qll
@@ -16,10 +16,12 @@ class TypeApacheRandomStringUtils extends Class {
}
/**
+ * DEPRECATED: Now modeled using data extensions instead.
+ *
* The method `deserialize` in either `org.apache.commons.lang.SerializationUtils`
* or `org.apache.commons.lang3.SerializationUtils`.
*/
-class MethodApacheSerializationUtilsDeserialize extends Method {
+deprecated class MethodApacheSerializationUtilsDeserialize extends Method {
MethodApacheSerializationUtilsDeserialize() {
this.getDeclaringType()
.hasQualifiedName(["org.apache.commons.lang", "org.apache.commons.lang3"],
diff --git a/java/ql/lib/semmle/code/java/security/AndroidSensitiveCommunicationQuery.qll b/java/ql/lib/semmle/code/java/security/AndroidSensitiveCommunicationQuery.qll
index 2ba13c06feb8..9aa60e391dc4 100644
--- a/java/ql/lib/semmle/code/java/security/AndroidSensitiveCommunicationQuery.qll
+++ b/java/ql/lib/semmle/code/java/security/AndroidSensitiveCommunicationQuery.qll
@@ -149,6 +149,8 @@ module SensitiveCommunicationConfig implements DataFlow::ConfigSig {
predicate allowImplicitRead(DataFlow::Node node, DataFlow::ContentSet c) {
isSink(node) and exists(c)
}
+
+ predicate observeDiffInformedIncrementalMode() { any() }
}
/**
diff --git a/java/ql/lib/semmle/code/java/security/ArithmeticTaintedQuery.qll b/java/ql/lib/semmle/code/java/security/ArithmeticTaintedQuery.qll
index 51d6c284e1ca..fbb8509f48f9 100644
--- a/java/ql/lib/semmle/code/java/security/ArithmeticTaintedQuery.qll
+++ b/java/ql/lib/semmle/code/java/security/ArithmeticTaintedQuery.qll
@@ -13,6 +13,14 @@ module ArithmeticOverflowConfig implements DataFlow::ConfigSig {
predicate isBarrier(DataFlow::Node n) { overflowBarrier(n) }
predicate isBarrierIn(DataFlow::Node node) { isSource(node) }
+
+ predicate observeDiffInformedIncrementalMode() {
+ any() // merged with ArithmeticUnderflow in ArithmeticTainted.ql
+ }
+
+ Location getASelectedSinkLocation(DataFlow::Node sink) {
+ exists(ArithExpr exp | result = exp.getLocation() | overflowSink(exp, sink.asExpr()))
+ }
}
/**
@@ -29,6 +37,14 @@ module ArithmeticUnderflowConfig implements DataFlow::ConfigSig {
predicate isBarrier(DataFlow::Node n) { underflowBarrier(n) }
predicate isBarrierIn(DataFlow::Node node) { isSource(node) }
+
+ predicate observeDiffInformedIncrementalMode() {
+ any() // merged with ArithmeticOverflow in ArithmeticTainted.ql
+ }
+
+ Location getASelectedSinkLocation(DataFlow::Node sink) {
+ exists(ArithExpr exp | result = exp.getLocation() | underflowSink(exp, sink.asExpr()))
+ }
}
/**
diff --git a/java/ql/lib/semmle/code/java/security/ArithmeticUncontrolledQuery.qll b/java/ql/lib/semmle/code/java/security/ArithmeticUncontrolledQuery.qll
index a5fa0d3ee4b1..6b7b337ad656 100644
--- a/java/ql/lib/semmle/code/java/security/ArithmeticUncontrolledQuery.qll
+++ b/java/ql/lib/semmle/code/java/security/ArithmeticUncontrolledQuery.qll
@@ -19,6 +19,14 @@ module ArithmeticUncontrolledOverflowConfig implements DataFlow::ConfigSig {
predicate isSink(DataFlow::Node sink) { overflowSink(_, sink.asExpr()) }
predicate isBarrier(DataFlow::Node n) { overflowBarrier(n) }
+
+ predicate observeDiffInformedIncrementalMode() {
+ any() // merged with ArithmeticUncontrolledUnderflow in ArithmeticUncontrolled.ql
+ }
+
+ Location getASelectedSinkLocation(DataFlow::Node sink) {
+ exists(ArithExpr exp | result = exp.getLocation() | overflowSink(exp, sink.asExpr()))
+ }
}
/** Taint-tracking flow to reason about overflow from arithmetic with uncontrolled values. */
@@ -32,6 +40,14 @@ module ArithmeticUncontrolledUnderflowConfig implements DataFlow::ConfigSig {
predicate isSink(DataFlow::Node sink) { underflowSink(_, sink.asExpr()) }
predicate isBarrier(DataFlow::Node n) { underflowBarrier(n) }
+
+ predicate observeDiffInformedIncrementalMode() {
+ any() // merged with ArithmeticUncontrolledOverflow in ArithmeticUncontrolled.ql
+ }
+
+ Location getASelectedSinkLocation(DataFlow::Node sink) {
+ exists(ArithExpr exp | result = exp.getLocation() | underflowSink(exp, sink.asExpr()))
+ }
}
/** Taint-tracking flow to reason about underflow from arithmetic with uncontrolled values. */
diff --git a/java/ql/lib/semmle/code/java/security/ConditionalBypassQuery.qll b/java/ql/lib/semmle/code/java/security/ConditionalBypassQuery.qll
index 03ba8d461979..314570369377 100644
--- a/java/ql/lib/semmle/code/java/security/ConditionalBypassQuery.qll
+++ b/java/ql/lib/semmle/code/java/security/ConditionalBypassQuery.qll
@@ -47,6 +47,15 @@ module ConditionalBypassFlowConfig implements DataFlow::ConfigSig {
predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
endsWithStep(node1, node2)
}
+
+ predicate observeDiffInformedIncrementalMode() { any() }
+
+ Location getASelectedSinkLocation(DataFlow::Node sink) {
+ exists(MethodCall m, Expr e | result = [m, e].getLocation() |
+ conditionControlsMethod(m, e) and
+ sink.asExpr() = e
+ )
+ }
}
/**
diff --git a/java/ql/lib/semmle/code/java/security/CsrfUnprotectedRequestTypeQuery.qll b/java/ql/lib/semmle/code/java/security/CsrfUnprotectedRequestTypeQuery.qll
index 42d6db246c0e..80d100d3d9e1 100644
--- a/java/ql/lib/semmle/code/java/security/CsrfUnprotectedRequestTypeQuery.qll
+++ b/java/ql/lib/semmle/code/java/security/CsrfUnprotectedRequestTypeQuery.qll
@@ -237,12 +237,35 @@ private predicate sink(CallPathNode sinkMethodCall) {
)
}
+private predicate fwdFlow(CallPathNode n) {
+ source(n)
+ or
+ exists(CallPathNode mid | fwdFlow(mid) and CallGraph::edges(mid, n))
+}
+
+private predicate revFlow(CallPathNode n) {
+ fwdFlow(n) and
+ (
+ sink(n)
+ or
+ exists(CallPathNode mid | revFlow(mid) and CallGraph::edges(n, mid))
+ )
+}
+
+/**
+ * Holds if `pred` has a successor node `succ` and this edge is in an
+ * `unprotectedStateChange` path.
+ */
+predicate relevantEdge(CallPathNode pred, CallPathNode succ) {
+ CallGraph::edges(pred, succ) and revFlow(pred) and revFlow(succ)
+}
+
/**
* Holds if `sourceMethod` is an unprotected request handler that reaches a
* `sinkMethodCall` that updates a database.
*/
private predicate unprotectedDatabaseUpdate(CallPathNode sourceMethod, CallPathNode sinkMethodCall) =
- doublyBoundedFastTC(CallGraph::edges/2, source/1, sink/1)(sourceMethod, sinkMethodCall)
+ doublyBoundedFastTC(relevantEdge/2, source/1, sink/1)(sourceMethod, sinkMethodCall)
/**
* Holds if `sourceMethod` is an unprotected request handler that appears to
diff --git a/java/ql/lib/semmle/code/java/security/ExternalAPIs.qll b/java/ql/lib/semmle/code/java/security/ExternalAPIs.qll
index 809f45aa45a3..df941be97448 100644
--- a/java/ql/lib/semmle/code/java/security/ExternalAPIs.qll
+++ b/java/ql/lib/semmle/code/java/security/ExternalAPIs.qll
@@ -101,6 +101,10 @@ module UntrustedDataToExternalApiConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }
predicate isSink(DataFlow::Node sink) { sink instanceof ExternalApiDataNode }
+
+ predicate observeDiffInformedIncrementalMode() {
+ any() // Simple use in UntrustedDataToExternalAPI.ql; also used through ExternalApiUsedWithUntrustedData in ExternalAPIsUsedWithUntrustedData.ql
+ }
}
/**
diff --git a/java/ql/lib/semmle/code/java/security/ImproperValidationOfArrayConstructionCodeSpecifiedQuery.qll b/java/ql/lib/semmle/code/java/security/ImproperValidationOfArrayConstructionCodeSpecifiedQuery.qll
index a6f10913da58..e952971c389f 100644
--- a/java/ql/lib/semmle/code/java/security/ImproperValidationOfArrayConstructionCodeSpecifiedQuery.qll
+++ b/java/ql/lib/semmle/code/java/security/ImproperValidationOfArrayConstructionCodeSpecifiedQuery.qll
@@ -17,6 +17,15 @@ module BoundedFlowSourceConfig implements DataFlow::ConfigSig {
predicate isSink(DataFlow::Node sink) {
any(CheckableArrayAccess caa).canThrowOutOfBoundsDueToEmptyArray(sink.asExpr(), _)
}
+
+ predicate observeDiffInformedIncrementalMode() { any() }
+
+ Location getASelectedSinkLocation(DataFlow::Node sink) {
+ exists(ArrayCreationExpr arrayCreation, CheckableArrayAccess arrayAccess |
+ result = [arrayCreation, arrayAccess.getIndexExpr()].getLocation() and
+ arrayAccess.canThrowOutOfBoundsDueToEmptyArray(sink.asExpr(), arrayCreation)
+ )
+ }
}
/**
diff --git a/java/ql/lib/semmle/code/java/security/ImproperValidationOfArrayConstructionQuery.qll b/java/ql/lib/semmle/code/java/security/ImproperValidationOfArrayConstructionQuery.qll
index 2af9396a119e..913d50b3159d 100644
--- a/java/ql/lib/semmle/code/java/security/ImproperValidationOfArrayConstructionQuery.qll
+++ b/java/ql/lib/semmle/code/java/security/ImproperValidationOfArrayConstructionQuery.qll
@@ -14,6 +14,15 @@ module ImproperValidationOfArrayConstructionConfig implements DataFlow::ConfigSi
predicate isSink(DataFlow::Node sink) {
any(CheckableArrayAccess caa).canThrowOutOfBoundsDueToEmptyArray(sink.asExpr(), _)
}
+
+ predicate observeDiffInformedIncrementalMode() { any() }
+
+ Location getASelectedSinkLocation(DataFlow::Node sink) {
+ exists(ArrayCreationExpr arrayCreation, CheckableArrayAccess arrayAccess |
+ result = [arrayCreation, arrayAccess.getIndexExpr()].getLocation() and
+ arrayAccess.canThrowOutOfBoundsDueToEmptyArray(sink.asExpr(), arrayCreation)
+ )
+ }
}
/**
diff --git a/java/ql/lib/semmle/code/java/security/ImproperValidationOfArrayIndexCodeSpecifiedQuery.qll b/java/ql/lib/semmle/code/java/security/ImproperValidationOfArrayIndexCodeSpecifiedQuery.qll
index 2ae9eb2c696f..01a924de78e4 100644
--- a/java/ql/lib/semmle/code/java/security/ImproperValidationOfArrayIndexCodeSpecifiedQuery.qll
+++ b/java/ql/lib/semmle/code/java/security/ImproperValidationOfArrayIndexCodeSpecifiedQuery.qll
@@ -14,6 +14,8 @@ module BoundedFlowSourceConfig implements DataFlow::ConfigSig {
predicate isSink(DataFlow::Node sink) {
exists(CheckableArrayAccess arrayAccess | arrayAccess.canThrowOutOfBounds(sink.asExpr()))
}
+
+ predicate observeDiffInformedIncrementalMode() { any() }
}
/**
diff --git a/java/ql/lib/semmle/code/java/security/ImproperValidationOfArrayIndexQuery.qll b/java/ql/lib/semmle/code/java/security/ImproperValidationOfArrayIndexQuery.qll
index 6d11962f2f45..7cb3d1724830 100644
--- a/java/ql/lib/semmle/code/java/security/ImproperValidationOfArrayIndexQuery.qll
+++ b/java/ql/lib/semmle/code/java/security/ImproperValidationOfArrayIndexQuery.qll
@@ -18,6 +18,8 @@ module ImproperValidationOfArrayIndexConfig implements DataFlow::ConfigSig {
predicate isBarrier(DataFlow::Node node) { node.getType() instanceof BooleanType }
predicate isBarrierIn(DataFlow::Node node) { isSource(node) }
+
+ predicate observeDiffInformedIncrementalMode() { any() }
}
/**
diff --git a/java/ql/lib/semmle/code/java/security/InsecureCookieQuery.qll b/java/ql/lib/semmle/code/java/security/InsecureCookieQuery.qll
index e8c3052acdfb..eda07658866c 100644
--- a/java/ql/lib/semmle/code/java/security/InsecureCookieQuery.qll
+++ b/java/ql/lib/semmle/code/java/security/InsecureCookieQuery.qll
@@ -35,6 +35,10 @@ module SecureCookieConfig implements DataFlow::ConfigSig {
sink.asExpr() =
any(MethodCall add | add.getMethod() instanceof ResponseAddCookieMethod).getArgument(0)
}
+
+ predicate observeDiffInformedIncrementalMode() {
+ none() // only used negatively in InsecureCookie.ql
+ }
}
/** Data flow to reason about the failure to use secure cookies. */
diff --git a/java/ql/lib/semmle/code/java/security/InsecureLdapAuthQuery.qll b/java/ql/lib/semmle/code/java/security/InsecureLdapAuthQuery.qll
index 94d80b9b37b0..a4cbf474dded 100644
--- a/java/ql/lib/semmle/code/java/security/InsecureLdapAuthQuery.qll
+++ b/java/ql/lib/semmle/code/java/security/InsecureLdapAuthQuery.qll
@@ -40,6 +40,10 @@ private module BasicAuthConfig implements DataFlow::ConfigSig {
}
predicate isSink(DataFlow::Node sink) { sink instanceof InsecureLdapUrlSink }
+
+ predicate observeDiffInformedIncrementalMode() {
+ none() // used as secondary flow to InsecureLdapUrlFlow in InsecureLdapAuth.ql
+ }
}
module BasicAuthFlow = DataFlow::Global;
@@ -56,6 +60,10 @@ private module RequiresSslConfig implements DataFlow::ConfigSig {
}
predicate isSink(DataFlow::Node sink) { sink instanceof InsecureLdapUrlSink }
+
+ predicate observeDiffInformedIncrementalMode() {
+ none() // only used negatively in InsecureLdapAuth.ql
+ }
}
module RequiresSslFlow = DataFlow::Global;
diff --git a/java/ql/lib/semmle/code/java/security/LogInjectionQuery.qll b/java/ql/lib/semmle/code/java/security/LogInjectionQuery.qll
index 64d59993b3da..c34ba0e48499 100644
--- a/java/ql/lib/semmle/code/java/security/LogInjectionQuery.qll
+++ b/java/ql/lib/semmle/code/java/security/LogInjectionQuery.qll
@@ -19,6 +19,10 @@ module LogInjectionConfig implements DataFlow::ConfigSig {
}
predicate isBarrierIn(DataFlow::Node node) { isSource(node) }
+
+ predicate observeDiffInformedIncrementalMode() {
+ none() // straightforward case; but the large test source is causing OOMs under `--check-diff-informed`.
+ }
}
/**
diff --git a/java/ql/lib/semmle/code/java/security/MaybeBrokenCryptoAlgorithmQuery.qll b/java/ql/lib/semmle/code/java/security/MaybeBrokenCryptoAlgorithmQuery.qll
index 060a30f87e6a..57622b367f31 100644
--- a/java/ql/lib/semmle/code/java/security/MaybeBrokenCryptoAlgorithmQuery.qll
+++ b/java/ql/lib/semmle/code/java/security/MaybeBrokenCryptoAlgorithmQuery.qll
@@ -77,6 +77,12 @@ module InsecureCryptoConfig implements DataFlow::ConfigSig {
objectToString(n.asExpr()) or
n.getType().getErasure() instanceof TypeObject
}
+
+ predicate observeDiffInformedIncrementalMode() { any() }
+
+ Location getASelectedSinkLocation(DataFlow::Node sink) {
+ exists(CryptoAlgoSpec c | result = c.getLocation() | sink.asExpr() = c.getAlgoSpec())
+ }
}
/**
diff --git a/java/ql/lib/semmle/code/java/security/PathSanitizer.qll b/java/ql/lib/semmle/code/java/security/PathSanitizer.qll
index ed0761f6869e..e789d3c47785 100644
--- a/java/ql/lib/semmle/code/java/security/PathSanitizer.qll
+++ b/java/ql/lib/semmle/code/java/security/PathSanitizer.qll
@@ -31,20 +31,10 @@ private module ValidationMethod {
* Holds if `m` validates its `arg`th parameter by using `validationGuard`.
*/
private predicate validationMethod(Method m, int arg) {
- exists(
- Guard g, SsaImplicitInit var, ControlFlow::ExitNode exit, ControlFlowNode normexit,
- boolean branch
- |
+ exists(Guard g, SsaImplicitInit var, ControlFlow::NormalExitNode normexit, boolean branch |
validationGuard(g, var.getAUse(), branch) and
var.isParameterDefinition(m.getParameter(arg)) and
- exit.getEnclosingCallable() = m and
- normexit.getANormalSuccessor() = exit and
- 1 = strictcount(ControlFlowNode n | n.getANormalSuccessor() = exit)
- |
- exists(ConditionNode conditionNode |
- g = conditionNode.getCondition() and conditionNode.getABranchSuccessor(branch) = exit
- )
- or
+ normexit.getEnclosingCallable() = m and
g.controls(normexit.getBasicBlock(), branch)
)
}
diff --git a/java/ql/lib/semmle/code/java/security/SensitiveLoggingQuery.qll b/java/ql/lib/semmle/code/java/security/SensitiveLoggingQuery.qll
index 201b347e014c..25454d80c717 100644
--- a/java/ql/lib/semmle/code/java/security/SensitiveLoggingQuery.qll
+++ b/java/ql/lib/semmle/code/java/security/SensitiveLoggingQuery.qll
@@ -53,6 +53,8 @@ module SensitiveLoggerConfig implements DataFlow::ConfigSig {
}
predicate isBarrierIn(DataFlow::Node node) { isSource(node) }
+
+ predicate observeDiffInformedIncrementalMode() { any() }
}
module SensitiveLoggerFlow = TaintTracking::Global;
diff --git a/java/ql/lib/semmle/code/java/security/SqlConcatenatedQuery.qll b/java/ql/lib/semmle/code/java/security/SqlConcatenatedQuery.qll
index fe6e31900e1f..7cfea41a8d77 100644
--- a/java/ql/lib/semmle/code/java/security/SqlConcatenatedQuery.qll
+++ b/java/ql/lib/semmle/code/java/security/SqlConcatenatedQuery.qll
@@ -24,6 +24,15 @@ module UncontrolledStringBuilderSourceFlowConfig implements DataFlow::ConfigSig
predicate isSink(DataFlow::Node sink) { sink instanceof QueryInjectionSink }
predicate isBarrier(DataFlow::Node node) { node instanceof SimpleTypeSanitizer }
+
+ predicate observeDiffInformedIncrementalMode() { any() }
+
+ Location getASelectedSourceLocation(DataFlow::Node source) {
+ exists(Expr uncontrolled, StringBuilderVar sbv | result = uncontrolled.getLocation() |
+ uncontrolledStringBuilderQuery(sbv, uncontrolled) and
+ source = DataFlow::exprNode(sbv.getToStringCall())
+ )
+ }
}
/**
diff --git a/java/ql/lib/semmle/code/java/security/TaintedEnvironmentVariableQuery.qll b/java/ql/lib/semmle/code/java/security/TaintedEnvironmentVariableQuery.qll
index 597c05b04541..d972b59986a6 100644
--- a/java/ql/lib/semmle/code/java/security/TaintedEnvironmentVariableQuery.qll
+++ b/java/ql/lib/semmle/code/java/security/TaintedEnvironmentVariableQuery.qll
@@ -38,6 +38,10 @@ module ExecTaintedEnvironmentConfig implements DataFlow::ConfigSig {
ProcessBuilderEnvironmentFlow::flowToExpr(mm.getQualifier())
)
}
+
+ predicate observeDiffInformedIncrementalMode() { any() }
+
+ Location getASelectedSourceLocation(DataFlow::Node source) { none() }
}
/**
diff --git a/java/ql/lib/semmle/code/java/security/TempDirLocalInformationDisclosureQuery.qll b/java/ql/lib/semmle/code/java/security/TempDirLocalInformationDisclosureQuery.qll
index 1caadd3f8acd..098362f2bd53 100644
--- a/java/ql/lib/semmle/code/java/security/TempDirLocalInformationDisclosureQuery.qll
+++ b/java/ql/lib/semmle/code/java/security/TempDirLocalInformationDisclosureQuery.qll
@@ -145,6 +145,10 @@ module TempDirSystemGetPropertyToCreateConfig implements DataFlow::ConfigSig {
or
sanitizer instanceof WindowsOsSanitizer
}
+
+ predicate observeDiffInformedIncrementalMode() { any() }
+
+ Location getASelectedSinkLocation(DataFlow::Node sink) { none() }
}
/**
diff --git a/java/ql/lib/semmle/code/java/security/TrustBoundaryViolationQuery.qll b/java/ql/lib/semmle/code/java/security/TrustBoundaryViolationQuery.qll
index f70542486dee..b2f49834b5ab 100644
--- a/java/ql/lib/semmle/code/java/security/TrustBoundaryViolationQuery.qll
+++ b/java/ql/lib/semmle/code/java/security/TrustBoundaryViolationQuery.qll
@@ -62,6 +62,8 @@ module TrustBoundaryConfig implements DataFlow::ConfigSig {
}
predicate isSink(DataFlow::Node sink) { sink instanceof TrustBoundaryViolationSink }
+
+ predicate observeDiffInformedIncrementalMode() { any() }
}
/**
diff --git a/java/ql/lib/semmle/code/java/security/UnsafeCertTrustQuery.qll b/java/ql/lib/semmle/code/java/security/UnsafeCertTrustQuery.qll
index 803e3836ab0e..b395692804cf 100644
--- a/java/ql/lib/semmle/code/java/security/UnsafeCertTrustQuery.qll
+++ b/java/ql/lib/semmle/code/java/security/UnsafeCertTrustQuery.qll
@@ -14,6 +14,10 @@ module SslEndpointIdentificationFlowConfig implements DataFlow::ConfigSig {
predicate isSink(DataFlow::Node sink) { sink instanceof SslConnectionCreation }
predicate isBarrier(DataFlow::Node sanitizer) { sanitizer instanceof SslUnsafeCertTrustSanitizer }
+
+ predicate observeDiffInformedIncrementalMode() { any() }
+
+ Location getASelectedSourceLocation(DataFlow::Node source) { none() }
}
/**
diff --git a/java/ql/lib/semmle/code/java/security/UnsafeDeserializationQuery.qll b/java/ql/lib/semmle/code/java/security/UnsafeDeserializationQuery.qll
index 7489fbd00ef9..ce0f649eff35 100644
--- a/java/ql/lib/semmle/code/java/security/UnsafeDeserializationQuery.qll
+++ b/java/ql/lib/semmle/code/java/security/UnsafeDeserializationQuery.qll
@@ -3,17 +3,16 @@
*/
import semmle.code.java.dataflow.FlowSources
+private import semmle.code.java.dataflow.ExternalFlow
private import semmle.code.java.dataflow.FlowSinks
private import semmle.code.java.dispatch.VirtualDispatch
private import semmle.code.java.frameworks.Kryo
private import semmle.code.java.frameworks.XStream
private import semmle.code.java.frameworks.SnakeYaml
private import semmle.code.java.frameworks.FastJson
-private import semmle.code.java.frameworks.JYaml
private import semmle.code.java.frameworks.JsonIo
private import semmle.code.java.frameworks.YamlBeans
private import semmle.code.java.frameworks.HessianBurlap
-private import semmle.code.java.frameworks.Castor
private import semmle.code.java.frameworks.Jackson
private import semmle.code.java.frameworks.Jabsorb
private import semmle.code.java.frameworks.Jms
@@ -51,13 +50,6 @@ private class SafeObjectInputStreamType extends RefType {
}
}
-private class XmlDecoderReadObjectMethod extends Method {
- XmlDecoderReadObjectMethod() {
- this.getDeclaringType().hasQualifiedName("java.beans", "XMLDecoder") and
- this.hasName("readObject")
- }
-}
-
private module SafeXStreamConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node src) {
any(XStreamEnableWhiteListing ma).getQualifier().(VarAccess).getVariable().getAnAccess() =
@@ -149,8 +141,15 @@ private module SafeKryoConfig implements DataFlow::ConfigSig {
private module SafeKryoFlow = DataFlow::Global;
+private class DefaultUnsafeDeserializationSink extends DataFlow::Node {
+ DefaultUnsafeDeserializationSink() { sinkNode(this, "unsafe-deserialization") }
+}
+
/**
* Holds if `ma` is a call that deserializes data from `sink`.
+ *
+ * Note that this does not include deserialization methods that have been
+ * specified using models-as-data.
*/
predicate unsafeDeserialization(MethodCall ma, Expr sink) {
exists(Method m | m = ma.getMethod() |
@@ -162,9 +161,6 @@ predicate unsafeDeserialization(MethodCall ma, Expr sink) {
sink = ma.getQualifier() and
not DataFlow::exprNode(sink).getTypeBound() instanceof SafeObjectInputStreamType
or
- m instanceof XmlDecoderReadObjectMethod and
- sink = ma.getQualifier()
- or
m instanceof XStreamReadObjectMethod and
sink = ma.getAnArgument() and
not SafeXStreamFlow::flowToExpr(ma.getQualifier())
@@ -173,9 +169,6 @@ predicate unsafeDeserialization(MethodCall ma, Expr sink) {
sink = ma.getAnArgument() and
not SafeKryoFlow::flowToExpr(ma.getQualifier())
or
- m instanceof MethodApacheSerializationUtilsDeserialize and
- sink = ma.getArgument(0)
- or
ma instanceof UnsafeSnakeYamlParse and
sink = ma.getArgument(0)
or
@@ -183,23 +176,6 @@ predicate unsafeDeserialization(MethodCall ma, Expr sink) {
not fastJsonLooksSafe() and
sink = ma.getArgument(0)
or
- ma.getMethod() instanceof JYamlLoaderUnsafeLoadMethod and
- sink = ma.getArgument(0)
- or
- ma.getMethod() instanceof JsonIoJsonToJavaMethod and
- sink = ma.getArgument(0)
- or
- ma.getMethod() instanceof JsonIoReadObjectMethod and
- sink = ma.getQualifier()
- or
- ma.getMethod() instanceof YamlBeansReaderReadMethod and sink = ma.getQualifier()
- or
- ma.getMethod() instanceof UnsafeHessianInputReadObjectMethod and sink = ma.getQualifier()
- or
- ma.getMethod() instanceof CastorUnmarshalMethod and sink = ma.getAnArgument()
- or
- ma.getMethod() instanceof BurlapInputReadObjectMethod and sink = ma.getQualifier()
- or
ma.getMethod() instanceof ObjectMapperReadMethod and
sink = ma.getArgument(0) and
(
@@ -215,9 +191,6 @@ predicate unsafeDeserialization(MethodCall ma, Expr sink) {
sink = ma.getArgument(2) and
UnsafeTypeFlow::flowToExpr(ma.getArgument(1))
or
- m instanceof JabsorbFromJsonMethod and
- sink = ma.getArgument(0)
- or
m instanceof JoddJsonParseMethod and
sink = ma.getArgument(0) and
(
@@ -244,10 +217,17 @@ predicate unsafeDeserialization(MethodCall ma, Expr sink) {
/** A sink for unsafe deserialization. */
class UnsafeDeserializationSink extends ApiSinkNode, DataFlow::ExprNode {
- UnsafeDeserializationSink() { unsafeDeserialization(_, this.getExpr()) }
+ MethodCall mc;
+
+ UnsafeDeserializationSink() {
+ unsafeDeserialization(mc, this.getExpr())
+ or
+ this instanceof DefaultUnsafeDeserializationSink and
+ this.getExpr() = [mc.getQualifier(), mc.getAnArgument()]
+ }
/** Gets a call that triggers unsafe deserialization. */
- MethodCall getMethodCall() { unsafeDeserialization(result, this.getExpr()) }
+ MethodCall getMethodCall() { result = mc }
}
/** Holds if `node` is a sanitizer for unsafe deserialization */
diff --git a/java/ql/src/CHANGELOG.md b/java/ql/src/CHANGELOG.md
index 50afa2ea9bfb..9d630f16f4bd 100644
--- a/java/ql/src/CHANGELOG.md
+++ b/java/ql/src/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 1.6.2
+
+No user-facing changes.
+
## 1.6.1
### Minor Analysis Improvements
diff --git a/java/ql/src/Language Abuse/TypeVariableHidesType.ql b/java/ql/src/Language Abuse/TypeVariableHidesType.ql
index 81da0e9703e6..42d0a7bea2bf 100644
--- a/java/ql/src/Language Abuse/TypeVariableHidesType.ql
+++ b/java/ql/src/Language Abuse/TypeVariableHidesType.ql
@@ -6,10 +6,10 @@
* @problem.severity warning
* @precision medium
* @id java/type-variable-hides-type
- * @tags reliability
+ * @tags quality
+ * maintainability
* readability
* types
- * quality
*/
import java
diff --git a/java/ql/src/Likely Bugs/Collections/ArrayIndexOutOfBounds.ql b/java/ql/src/Likely Bugs/Collections/ArrayIndexOutOfBounds.ql
index ecd83e39719b..845aae01a3e8 100644
--- a/java/ql/src/Likely Bugs/Collections/ArrayIndexOutOfBounds.ql
+++ b/java/ql/src/Likely Bugs/Collections/ArrayIndexOutOfBounds.ql
@@ -18,6 +18,15 @@ import semmle.code.java.dataflow.SSA
import semmle.code.java.dataflow.RangeUtils
import semmle.code.java.dataflow.RangeAnalysis
+pragma[nomagic]
+predicate ssaArrayLengthBound(SsaVariable arr, Bound b) {
+ exists(FieldAccess len |
+ len.getField() instanceof ArrayLengthField and
+ len.getQualifier() = arr.getAUse() and
+ b.getExpr() = len
+ )
+}
+
/**
* Holds if the index expression of `aa` is less than or equal to the array length plus `k`.
*/
@@ -27,12 +36,8 @@ predicate boundedArrayAccess(ArrayAccess aa, int k) {
aa.getArray() = arr.getAUse() and
bounded(index, b, delta, true, _)
|
- exists(FieldAccess len |
- len.getField() instanceof ArrayLengthField and
- len.getQualifier() = arr.getAUse() and
- b.getExpr() = len and
- k = delta
- )
+ ssaArrayLengthBound(arr, b) and
+ k = delta
or
exists(ArrayCreationExpr arraycreation | arraycreation = getArrayDef(arr) |
k = delta and
diff --git a/java/ql/src/Likely Bugs/Collections/ContainsTypeMismatch.ql b/java/ql/src/Likely Bugs/Collections/ContainsTypeMismatch.ql
index d1a398d1322c..497aa10cb4de 100644
--- a/java/ql/src/Likely Bugs/Collections/ContainsTypeMismatch.ql
+++ b/java/ql/src/Likely Bugs/Collections/ContainsTypeMismatch.ql
@@ -103,8 +103,8 @@ class MismatchedContainerAccess extends MethodCall {
|
this.getCallee()
.getDeclaringType()
- .getASourceSupertype*()
.getSourceDeclaration()
+ .getASourceSupertype*()
.hasQualifiedName(package, type) and
this.getCallee().getParameter(i).getType() instanceof TypeObject
)
@@ -119,7 +119,7 @@ class MismatchedContainerAccess extends MethodCall {
containerAccess(package, type, p, this.getCallee().getSignature(), i)
|
t = this.getCallee().getDeclaringType() and
- t.getASourceSupertype*().getSourceDeclaration() = g and
+ t.getSourceDeclaration().getASourceSupertype*() = g and
g.hasQualifiedName(package, type) and
indirectlyInstantiates(t, g, p, result)
)
diff --git a/java/ql/src/Likely Bugs/Resource Leaks/CloseType.qll b/java/ql/src/Likely Bugs/Resource Leaks/CloseType.qll
index 41239f249a27..aca95c9bc1f5 100644
--- a/java/ql/src/Likely Bugs/Resource Leaks/CloseType.qll
+++ b/java/ql/src/Likely Bugs/Resource Leaks/CloseType.qll
@@ -212,33 +212,35 @@ private LocalVariableDecl getCloseableVariable(CloseableInitExpr cie) {
/**
* A variable on which a "close" method is called, implicitly or explicitly, directly or indirectly.
*/
-private predicate closeCalled(Variable v) {
+private predicate closeCalled(LocalScopeVariable v) {
// `close()` is implicitly called on variables declared or referenced
// in the resources clause of try-with-resource statements.
exists(TryStmt try | try.getAResourceVariable() = v)
or
// Otherwise, there should be an explicit call to a method whose name contains "close".
exists(MethodCall e |
- v = getCloseableVariable(_) or v instanceof Parameter or v instanceof LocalVariableDecl
- |
e.getMethod().getName().toLowerCase().matches("%close%") and
exists(VarAccess va | va = v.getAnAccess() |
e.getQualifier() = va or
e.getAnArgument() = va
)
- or
- // The "close" call could happen indirectly inside a helper method of unknown name.
- exists(int i | e.getArgument(i) = v.getAnAccess() |
- exists(Parameter p, int j | p.getPosition() = j and p.getCallable() = e.getMethod() |
- closeCalled(p) and i = j
- or
- // The helper method could be iterating over a varargs parameter.
- exists(EnhancedForStmt for | for.getExpr() = p.getAnAccess() |
- closeCalled(for.getVariable().getVariable())
- ) and
- p.isVarargs() and
- j <= i
- )
+ )
+ or
+ // The "close" call could happen indirectly inside a helper method of unknown name.
+ exists(Parameter p |
+ closeCalled(p) and p.getAnArgument() = v.getAnAccess() and p.getCallable() instanceof Method
+ )
+ or
+ exists(MethodCall e, int i | e.getArgument(i) = v.getAnAccess() |
+ exists(Parameter p, int j |
+ p.getPosition() = j and p.getCallable() = e.getMethod().getSourceDeclaration()
+ |
+ // The helper method could be iterating over a varargs parameter.
+ exists(EnhancedForStmt for | for.getExpr() = p.getAnAccess() |
+ closeCalled(for.getVariable().getVariable())
+ ) and
+ p.isVarargs() and
+ j <= i
)
)
}
diff --git a/java/ql/src/Likely Bugs/Statements/PartiallyMaskedCatch.ql b/java/ql/src/Likely Bugs/Statements/PartiallyMaskedCatch.ql
index eb5c2d380c65..b9a0229b60ff 100644
--- a/java/ql/src/Likely Bugs/Statements/PartiallyMaskedCatch.ql
+++ b/java/ql/src/Likely Bugs/Statements/PartiallyMaskedCatch.ql
@@ -15,14 +15,34 @@
import java
+pragma[nomagic]
+predicate mayThrow(Stmt s, RefType rt) {
+ s.(ThrowStmt).getExpr().getType() = rt
+ or
+ exists(Call call |
+ call.getEnclosingStmt() = s and
+ call.getCallee().getAnException().getType() = rt
+ )
+}
+
+pragma[nomagic]
+predicate caughtBy(TryStmt try, Stmt s, RefType rt) {
+ mayThrow(s, rt) and
+ s.getEnclosingStmt+() = try.getBlock() and
+ caughtType(try, _).hasSubtype*(rt)
+}
+
+pragma[nomagic]
+predicate nestedTry(TryStmt outer, TryStmt inner) { inner.getEnclosingStmt+() = outer.getBlock() }
+
/**
* Exceptions of type `rt` thrown from within statement `s` are caught by an inner try block
* and are therefore not propagated to the outer try block `t`.
*/
private predicate caughtInside(TryStmt t, Stmt s, RefType rt) {
- exists(TryStmt innerTry | innerTry.getEnclosingStmt+() = t.getBlock() |
- s.getEnclosingStmt+() = innerTry.getBlock() and
- caughtType(innerTry, _).hasSubtype*(rt)
+ exists(TryStmt innerTry |
+ nestedTry(t, innerTry) and
+ caughtBy(innerTry, s, rt)
)
}
diff --git a/java/ql/src/Metrics/RefTypes/TInheritanceDepth.qhelp b/java/ql/src/Metrics/RefTypes/TInheritanceDepth.qhelp
index 7d78490985bf..970b1c4e19e2 100644
--- a/java/ql/src/Metrics/RefTypes/TInheritanceDepth.qhelp
+++ b/java/ql/src/Metrics/RefTypes/TInheritanceDepth.qhelp
@@ -29,14 +29,13 @@ that something is amiss, but further investigation will be needed to clarify
the cause of the problem. Here are two possibilities:
-
-
--
-A class and its superclass represent fundamentally the same abstraction.
+
+1. A class and its superclass represent fundamentally the same abstraction.
In this case, they should generally be merged together (see the 'Collapse
Hierarchy' refactoring on pp.279-80 of [Fowler]). For example, suppose
that in the following class hierarchy both A and C represent fundamentally
the same thing, then they should be merged together as shown:
+
@@ -48,11 +47,9 @@ the same thing, then they should be merged together as shown:
After |
-
--
-The class hierarchy is trying to represent variation in more than one
+2. The class hierarchy is trying to represent variation in more than one
dimension using single inheritance. This can lead to an unnecessarily
deep class hierarchy with lots of code duplication. For example, consider
the following:
@@ -81,9 +78,6 @@ amount of code duplication that will be necessary.
For readers who are interested in this sort of approach, a good reference is
[West].
-
-
-
diff --git a/java/ql/src/Metrics/RefTypes/TNumberOfCallables.qhelp b/java/ql/src/Metrics/RefTypes/TNumberOfCallables.qhelp
index 49827592849d..4f9452789a89 100644
--- a/java/ql/src/Metrics/RefTypes/TNumberOfCallables.qhelp
+++ b/java/ql/src/Metrics/RefTypes/TNumberOfCallables.qhelp
@@ -49,21 +49,17 @@ need to be part of the class. (A classic example of this is the
std::string
class in the C++ Standard Library.) As [Sutter]
observes, there are at least two key problems with this approach:
-
--
-It may be possible to generalize some of the utility methods beyond the
+
+1. It may be possible to generalize some of the utility methods beyond the
narrow context of the class in question -- by bundling them with the class,
the class author reduces the scope for functionality reuse.
-
--
-It's usually impossible for the class author to know every possible
+2. It's usually impossible for the class author to know every possible
operation that the user might want to perform on the class, so the public
interface will inherently be incomplete. New utility methods will end up
having a different syntax to the privileged public methods in the class,
negatively impacting on code consistency.
-
-
+
To refactor a class like this, simply move its utility methods elsewhere,
paring its public interface down to the bare minimum.
diff --git a/java/ql/src/Metrics/RefTypes/TNumberOfFields.qhelp b/java/ql/src/Metrics/RefTypes/TNumberOfFields.qhelp
index befc6409449e..2934ba958b52 100644
--- a/java/ql/src/Metrics/RefTypes/TNumberOfFields.qhelp
+++ b/java/ql/src/Metrics/RefTypes/TNumberOfFields.qhelp
@@ -25,11 +25,9 @@ If the class is too big, you should split it into multiple smaller classes.
-
If several of the fields are part of the same abstraction, you should
group them into a separate class, using the 'Extract Class' refactoring described
in [Fowler].
-
diff --git a/java/ql/src/Metrics/RefTypes/TSizeOfAPI.qhelp b/java/ql/src/Metrics/RefTypes/TSizeOfAPI.qhelp
index 3095d82049a6..eda183a287c2 100644
--- a/java/ql/src/Metrics/RefTypes/TSizeOfAPI.qhelp
+++ b/java/ql/src/Metrics/RefTypes/TSizeOfAPI.qhelp
@@ -46,21 +46,17 @@ need to be part of the class. (A classic example of this is the
std::string
class in the C++ Standard Library.) As [Sutter]
observes, there are at least two key problems with this approach:
-
--
-It may be possible to generalize some of the utility methods beyond the
+
+1. It may be possible to generalize some of the utility methods beyond the
narrow context of the class in question -- by bundling them with the class,
the class author reduces the scope for functionality reuse.
-
--
-It's usually impossible for the class author to know every possible
+2. It's usually impossible for the class author to know every possible
operation that the user might want to perform on the class, so the public
interface will inherently be incomplete. New utility methods will end up
having a different syntax to the privileged public methods in the class,
negatively impacting on code consistency.
-
-
+
To refactor a class like this, simply move its utility methods elsewhere,
paring its public interface down to the bare minimum.
diff --git a/java/ql/src/Security/CWE/CWE-200/AndroidWebViewSettingsAllowsContentAccess.ql b/java/ql/src/Security/CWE/CWE-200/AndroidWebViewSettingsAllowsContentAccess.ql
index bd5cc2a5b76f..45767185dfd2 100644
--- a/java/ql/src/Security/CWE/CWE-200/AndroidWebViewSettingsAllowsContentAccess.ql
+++ b/java/ql/src/Security/CWE/CWE-200/AndroidWebViewSettingsAllowsContentAccess.ql
@@ -97,6 +97,10 @@ module WebViewDisallowContentAccessConfig implements DataFlow::StateConfigSig {
state instanceof IsSettings and
node instanceof WebSettingsDisallowContentAccessSink
}
+
+ predicate observeDiffInformedIncrementalMode() {
+ none() // only used negatively
+ }
}
module WebViewDisallowContentAccessFlow =
diff --git a/java/ql/src/Security/CWE/CWE-352/CsrfUnprotectedRequestType.ql b/java/ql/src/Security/CWE/CWE-352/CsrfUnprotectedRequestType.ql
index e338cb84c005..cf5c0b385ccf 100644
--- a/java/ql/src/Security/CWE/CWE-352/CsrfUnprotectedRequestType.ql
+++ b/java/ql/src/Security/CWE/CWE-352/CsrfUnprotectedRequestType.ql
@@ -15,7 +15,7 @@
import java
import semmle.code.java.security.CsrfUnprotectedRequestTypeQuery
-query predicate edges(CallPathNode pred, CallPathNode succ) { CallGraph::edges(pred, succ) }
+query predicate edges(CallPathNode pred, CallPathNode succ) { relevantEdge(pred, succ) }
from CallPathNode source, CallPathNode sink
where unprotectedStateChange(source, sink)
diff --git a/java/ql/src/Security/CWE/CWE-502/UnsafeDeserialization.qhelp b/java/ql/src/Security/CWE/CWE-502/UnsafeDeserialization.qhelp
index 087a873dfc77..bf7205d535ff 100644
--- a/java/ql/src/Security/CWE/CWE-502/UnsafeDeserialization.qhelp
+++ b/java/ql/src/Security/CWE/CWE-502/UnsafeDeserialization.qhelp
@@ -64,8 +64,8 @@ Recommendations specific to particular frameworks supported by this query:
SnakeYAML - org.yaml:snakeyaml
- - Secure by Default: No
- - Recommendation: Pass an instance of
org.yaml.snakeyaml.constructor.SafeConstructor
to org.yaml.snakeyaml.Yaml
's constructor before using it to deserialize untrusted data.
+ - Secure by Default: As of version 2.0.
+ - Recommendation: For versions before 2.0, pass an instance of
org.yaml.snakeyaml.constructor.SafeConstructor
to org.yaml.snakeyaml.Yaml
's constructor before using it to deserialize untrusted data.
XML Decoder - Standard Java Library
@@ -121,7 +121,7 @@ Alvaro Muñoz & Christian Schneider, RSAConference 2016:
SnakeYaml documentation on deserialization:
-SnakeYaml deserialization.
+SnakeYaml deserialization (not updated for new behaviour in version 2.0).
Hessian deserialization and related gadget chains:
diff --git a/java/ql/src/Telemetry/ExtractorInformation.ql b/java/ql/src/Telemetry/ExtractorInformation.ql
index ea6d6fc2d41e..f5bc8b426972 100644
--- a/java/ql/src/Telemetry/ExtractorInformation.ql
+++ b/java/ql/src/Telemetry/ExtractorInformation.ql
@@ -10,8 +10,6 @@ import java
import semmle.code.java.Diagnostics
import DatabaseQuality
-extensible predicate extractorInformationSkipKey(string key);
-
predicate compilationInfo(string key, int value) {
exists(Compilation c, string infoKey |
key = infoKey + ": " + c.getInfo(infoKey) and
diff --git a/java/ql/src/Telemetry/ExtractorInformation.yml b/java/ql/src/Telemetry/ExtractorInformation.yml
index 74a7f99520b7..18e691a79e99 100644
--- a/java/ql/src/Telemetry/ExtractorInformation.yml
+++ b/java/ql/src/Telemetry/ExtractorInformation.yml
@@ -1,5 +1,5 @@
extensions:
- addsTo:
- pack: codeql/java-queries
+ pack: codeql/java-all
extensible: extractorInformationSkipKey
data: []
diff --git a/java/ql/src/change-notes/released/1.6.2.md b/java/ql/src/change-notes/released/1.6.2.md
new file mode 100644
index 000000000000..bbe3747556fb
--- /dev/null
+++ b/java/ql/src/change-notes/released/1.6.2.md
@@ -0,0 +1,3 @@
+## 1.6.2
+
+No user-facing changes.
diff --git a/java/ql/src/codeql-pack.release.yml b/java/ql/src/codeql-pack.release.yml
index ef7a789e0cf1..5f5beb68311a 100644
--- a/java/ql/src/codeql-pack.release.yml
+++ b/java/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 1.6.1
+lastReleaseVersion: 1.6.2
diff --git a/java/ql/src/qlpack.yml b/java/ql/src/qlpack.yml
index 6dd07b9c631c..aa899419ad90 100644
--- a/java/ql/src/qlpack.yml
+++ b/java/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/java-queries
-version: 1.6.2-dev
+version: 1.6.3-dev
groups:
- java
- queries
diff --git a/java/ql/test-kotlin1/library-tests/controlflow/basic/bbStmts.expected b/java/ql/test-kotlin1/library-tests/controlflow/basic/bbStmts.expected
index 8fe0abd91c0e..116bde45f980 100644
--- a/java/ql/test-kotlin1/library-tests/controlflow/basic/bbStmts.expected
+++ b/java/ql/test-kotlin1/library-tests/controlflow/basic/bbStmts.expected
@@ -1,8 +1,12 @@
+| Test.kt:3:8:80:1 | Exceptional Exit | 0 | Test.kt:3:8:80:1 | Exceptional Exit |
+| Test.kt:3:8:80:1 | Exit | 0 | Test.kt:3:8:80:1 | Exit |
| Test.kt:3:8:80:1 | { ... } | 0 | Test.kt:3:8:80:1 | { ... } |
| Test.kt:3:8:80:1 | { ... } | 1 | Test.kt:3:1:80:1 | super(...) |
| Test.kt:3:8:80:1 | { ... } | 2 | Test.kt:3:8:80:1 | { ... } |
-| Test.kt:3:8:80:1 | { ... } | 3 | Test.kt:3:8:80:1 | Exit |
+| Test.kt:3:8:80:1 | { ... } | 3 | Test.kt:3:8:80:1 | Normal Exit |
+| Test.kt:4:2:79:2 | Exceptional Exit | 0 | Test.kt:4:2:79:2 | Exceptional Exit |
| Test.kt:4:2:79:2 | Exit | 0 | Test.kt:4:2:79:2 | Exit |
+| Test.kt:4:2:79:2 | Normal Exit | 0 | Test.kt:4:2:79:2 | Normal Exit |
| Test.kt:4:13:79:2 | { ... } | 0 | Test.kt:4:13:79:2 | { ... } |
| Test.kt:4:13:79:2 | { ... } | 1 | Test.kt:5:7:5:7 | var ...; |
| Test.kt:4:13:79:2 | { ... } | 2 | Test.kt:5:16:5:16 | 0 |
@@ -102,7 +106,9 @@
| Test.kt:43:3:43:3 | ; | 8 | Test.kt:77:3:77:8 | ...=... |
| Test.kt:43:3:43:3 | ; | 9 | Test.kt:78:3:78:8 | INSTANCE |
| Test.kt:43:3:43:3 | ; | 10 | Test.kt:78:3:78:8 | return ... |
+| Test.kt:82:1:89:1 | Exceptional Exit | 0 | Test.kt:82:1:89:1 | Exceptional Exit |
| Test.kt:82:1:89:1 | Exit | 0 | Test.kt:82:1:89:1 | Exit |
+| Test.kt:82:1:89:1 | Normal Exit | 0 | Test.kt:82:1:89:1 | Normal Exit |
| Test.kt:82:21:89:1 | { ... } | 0 | Test.kt:82:21:89:1 | { ... } |
| Test.kt:82:21:89:1 | { ... } | 1 | Test.kt:83:2:88:2 | try ... |
| Test.kt:82:21:89:1 | { ... } | 2 | Test.kt:83:6:86:2 | { ... } |
@@ -117,7 +123,9 @@
| Test.kt:86:4:88:2 | catch (...) | 2 | Test.kt:86:34:88:2 | { ... } |
| Test.kt:86:4:88:2 | catch (...) | 3 | Test.kt:87:10:87:10 | 2 |
| Test.kt:86:4:88:2 | catch (...) | 4 | Test.kt:87:3:87:10 | return ... |
+| Test.kt:91:1:98:1 | Exceptional Exit | 0 | Test.kt:91:1:98:1 | Exceptional Exit |
| Test.kt:91:1:98:1 | Exit | 0 | Test.kt:91:1:98:1 | Exit |
+| Test.kt:91:1:98:1 | Normal Exit | 0 | Test.kt:91:1:98:1 | Normal Exit |
| Test.kt:91:22:98:1 | { ... } | 0 | Test.kt:91:22:98:1 | { ... } |
| Test.kt:91:22:98:1 | { ... } | 1 | Test.kt:92:2:97:2 | try ... |
| Test.kt:91:22:98:1 | { ... } | 2 | Test.kt:92:6:95:2 | { ... } |
@@ -133,6 +141,7 @@
| Test.kt:95:4:97:2 | catch (...) | 3 | Test.kt:96:10:96:10 | 2 |
| Test.kt:95:4:97:2 | catch (...) | 4 | Test.kt:96:3:96:10 | return ... |
| Test.kt:100:1:110:1 | Exit | 0 | Test.kt:100:1:110:1 | Exit |
+| Test.kt:100:1:110:1 | Normal Exit | 0 | Test.kt:100:1:110:1 | Normal Exit |
| Test.kt:100:25:110:1 | { ... } | 0 | Test.kt:100:25:110:1 | { ... } |
| Test.kt:100:25:110:1 | { ... } | 1 | Test.kt:101:5:103:5 | ; |
| Test.kt:100:25:110:1 | { ... } | 2 | Test.kt:101:5:103:5 | when ... |
@@ -147,6 +156,7 @@
| Test.kt:101:33:103:5 | { ... } | 0 | Test.kt:101:33:103:5 | { ... } |
| Test.kt:101:33:103:5 | { ... } | 1 | Test.kt:102:15:102:25 | new Exception(...) |
| Test.kt:101:33:103:5 | { ... } | 2 | Test.kt:102:9:102:25 | throw ... |
+| Test.kt:101:33:103:5 | { ... } | 3 | Test.kt:100:1:110:1 | Exceptional Exit |
| Test.kt:105:5:109:5 | ; | 0 | Test.kt:105:5:109:5 | ; |
| Test.kt:105:5:109:5 | ; | 1 | Test.kt:105:5:109:5 | when ... |
| Test.kt:105:5:109:5 | ; | 2 | Test.kt:105:9:107:5 | ... -> ... |
@@ -165,7 +175,9 @@
| Test.kt:107:27:109:5 | { ... } | 1 | Test.kt:108:9:108:29 | ; |
| Test.kt:107:27:109:5 | { ... } | 2 | Test.kt:108:17:108:28 | "y not null" |
| Test.kt:107:27:109:5 | { ... } | 3 | Test.kt:108:9:108:29 | println(...) |
+| Test.kt:112:1:116:1 | Exceptional Exit | 0 | Test.kt:112:1:116:1 | Exceptional Exit |
| Test.kt:112:1:116:1 | Exit | 0 | Test.kt:112:1:116:1 | Exit |
+| Test.kt:112:1:116:1 | Normal Exit | 0 | Test.kt:112:1:116:1 | Normal Exit |
| Test.kt:112:32:116:1 | { ... } | 0 | Test.kt:112:32:116:1 | { ... } |
| Test.kt:112:32:116:1 | { ... } | 1 | Test.kt:113:5:115:5 | ; |
| Test.kt:112:32:116:1 | { ... } | 2 | Test.kt:113:5:115:5 | when ... |
@@ -174,7 +186,9 @@
| Test.kt:112:32:116:1 | { ... } | 5 | Test.kt:113:9:113:9 | x |
| Test.kt:113:14:113:14 | y | 0 | Test.kt:113:14:113:14 | y |
| Test.kt:113:17:115:5 | { ... } | 0 | Test.kt:113:17:115:5 | { ... } |
+| Test.kt:118:1:124:1 | Exceptional Exit | 0 | Test.kt:118:1:124:1 | Exceptional Exit |
| Test.kt:118:1:124:1 | Exit | 0 | Test.kt:118:1:124:1 | Exit |
+| Test.kt:118:1:124:1 | Normal Exit | 0 | Test.kt:118:1:124:1 | Normal Exit |
| Test.kt:118:37:124:1 | { ... } | 0 | Test.kt:118:37:124:1 | { ... } |
| Test.kt:118:37:124:1 | { ... } | 1 | Test.kt:119:2:123:12 | ; |
| Test.kt:118:37:124:1 | { ... } | 2 | Test.kt:119:2:123:12 | when ... |
diff --git a/java/ql/test-kotlin1/library-tests/controlflow/basic/bbStrictDominance.expected b/java/ql/test-kotlin1/library-tests/controlflow/basic/bbStrictDominance.expected
index fa358b39a35e..6d0cb2bab712 100644
--- a/java/ql/test-kotlin1/library-tests/controlflow/basic/bbStrictDominance.expected
+++ b/java/ql/test-kotlin1/library-tests/controlflow/basic/bbStrictDominance.expected
@@ -1,4 +1,7 @@
+| Test.kt:3:8:80:1 | { ... } | Test.kt:3:8:80:1 | Exit |
+| Test.kt:4:2:79:2 | Normal Exit | Test.kt:4:2:79:2 | Exit |
| Test.kt:4:13:79:2 | { ... } | Test.kt:4:2:79:2 | Exit |
+| Test.kt:4:13:79:2 | { ... } | Test.kt:4:2:79:2 | Normal Exit |
| Test.kt:4:13:79:2 | { ... } | Test.kt:11:3:16:3 | ... -> ... |
| Test.kt:4:13:79:2 | { ... } | Test.kt:11:14:14:3 | { ... } |
| Test.kt:4:13:79:2 | { ... } | Test.kt:18:3:18:3 | ; |
@@ -10,6 +13,7 @@
| Test.kt:4:13:79:2 | { ... } | Test.kt:38:16:41:3 | { ... } |
| Test.kt:4:13:79:2 | { ... } | Test.kt:43:3:43:3 | ; |
| Test.kt:18:3:18:3 | ; | Test.kt:4:2:79:2 | Exit |
+| Test.kt:18:3:18:3 | ; | Test.kt:4:2:79:2 | Normal Exit |
| Test.kt:18:3:18:3 | ; | Test.kt:21:3:24:9 | ... -> ... |
| Test.kt:18:3:18:3 | ; | Test.kt:22:4:22:4 | ; |
| Test.kt:18:3:18:3 | ; | Test.kt:30:15:33:3 | { ... } |
@@ -27,13 +31,18 @@
| Test.kt:35:3:35:3 | ; | Test.kt:43:3:43:3 | ; |
| Test.kt:38:9:38:9 | x | Test.kt:38:16:41:3 | { ... } |
| Test.kt:38:9:38:9 | x | Test.kt:43:3:43:3 | ; |
+| Test.kt:82:1:89:1 | Normal Exit | Test.kt:82:1:89:1 | Exit |
| Test.kt:82:21:89:1 | { ... } | Test.kt:82:1:89:1 | Exit |
+| Test.kt:82:21:89:1 | { ... } | Test.kt:82:1:89:1 | Normal Exit |
| Test.kt:82:21:89:1 | { ... } | Test.kt:84:7:84:7 | x |
| Test.kt:82:21:89:1 | { ... } | Test.kt:86:4:88:2 | catch (...) |
+| Test.kt:91:1:98:1 | Normal Exit | Test.kt:91:1:98:1 | Exit |
| Test.kt:91:22:98:1 | { ... } | Test.kt:91:1:98:1 | Exit |
+| Test.kt:91:22:98:1 | { ... } | Test.kt:91:1:98:1 | Normal Exit |
| Test.kt:91:22:98:1 | { ... } | Test.kt:93:7:93:7 | x |
| Test.kt:91:22:98:1 | { ... } | Test.kt:95:4:97:2 | catch (...) |
| Test.kt:100:25:110:1 | { ... } | Test.kt:100:1:110:1 | Exit |
+| Test.kt:100:25:110:1 | { ... } | Test.kt:100:1:110:1 | Normal Exit |
| Test.kt:100:25:110:1 | { ... } | Test.kt:101:22:101:22 | y |
| Test.kt:100:25:110:1 | { ... } | Test.kt:101:33:103:5 | { ... } |
| Test.kt:100:25:110:1 | { ... } | Test.kt:105:5:109:5 | ; |
@@ -41,15 +50,20 @@
| Test.kt:100:25:110:1 | { ... } | Test.kt:107:16:109:5 | ... -> ... |
| Test.kt:100:25:110:1 | { ... } | Test.kt:107:27:109:5 | { ... } |
| Test.kt:101:22:101:22 | y | Test.kt:101:33:103:5 | { ... } |
+| Test.kt:105:5:109:5 | ; | Test.kt:100:1:110:1 | Normal Exit |
| Test.kt:105:5:109:5 | ; | Test.kt:105:20:107:5 | { ... } |
| Test.kt:105:5:109:5 | ; | Test.kt:107:16:109:5 | ... -> ... |
| Test.kt:105:5:109:5 | ; | Test.kt:107:27:109:5 | { ... } |
| Test.kt:107:16:109:5 | ... -> ... | Test.kt:107:27:109:5 | { ... } |
+| Test.kt:112:1:116:1 | Normal Exit | Test.kt:112:1:116:1 | Exit |
| Test.kt:112:32:116:1 | { ... } | Test.kt:112:1:116:1 | Exit |
+| Test.kt:112:32:116:1 | { ... } | Test.kt:112:1:116:1 | Normal Exit |
| Test.kt:112:32:116:1 | { ... } | Test.kt:113:14:113:14 | y |
| Test.kt:112:32:116:1 | { ... } | Test.kt:113:17:115:5 | { ... } |
| Test.kt:113:14:113:14 | y | Test.kt:113:17:115:5 | { ... } |
+| Test.kt:118:1:124:1 | Normal Exit | Test.kt:118:1:124:1 | Exit |
| Test.kt:118:37:124:1 | { ... } | Test.kt:118:1:124:1 | Exit |
+| Test.kt:118:37:124:1 | { ... } | Test.kt:118:1:124:1 | Normal Exit |
| Test.kt:118:37:124:1 | { ... } | Test.kt:121:9:121:9 | ; |
| Test.kt:118:37:124:1 | { ... } | Test.kt:122:12:122:16 | ... -> ... |
| Test.kt:118:37:124:1 | { ... } | Test.kt:123:8:123:10 | { ... } |
diff --git a/java/ql/test-kotlin1/library-tests/controlflow/basic/bbSuccessor.expected b/java/ql/test-kotlin1/library-tests/controlflow/basic/bbSuccessor.expected
index 3768db75d7e8..cf5da7c83b77 100644
--- a/java/ql/test-kotlin1/library-tests/controlflow/basic/bbSuccessor.expected
+++ b/java/ql/test-kotlin1/library-tests/controlflow/basic/bbSuccessor.expected
@@ -1,10 +1,14 @@
+| Test.kt:3:8:80:1 | Exceptional Exit | Test.kt:3:8:80:1 | Exit |
+| Test.kt:3:8:80:1 | { ... } | Test.kt:3:8:80:1 | Exit |
+| Test.kt:4:2:79:2 | Exceptional Exit | Test.kt:4:2:79:2 | Exit |
+| Test.kt:4:2:79:2 | Normal Exit | Test.kt:4:2:79:2 | Exit |
| Test.kt:4:13:79:2 | { ... } | Test.kt:11:3:16:3 | ... -> ... |
| Test.kt:4:13:79:2 | { ... } | Test.kt:11:14:14:3 | { ... } |
| Test.kt:11:3:16:3 | ... -> ... | Test.kt:18:3:18:3 | ; |
| Test.kt:11:14:14:3 | { ... } | Test.kt:18:3:18:3 | ; |
| Test.kt:18:3:18:3 | ; | Test.kt:21:3:24:9 | ... -> ... |
| Test.kt:18:3:18:3 | ; | Test.kt:22:4:22:4 | ; |
-| Test.kt:21:3:24:9 | ... -> ... | Test.kt:4:2:79:2 | Exit |
+| Test.kt:21:3:24:9 | ... -> ... | Test.kt:4:2:79:2 | Normal Exit |
| Test.kt:22:4:22:4 | ; | Test.kt:30:15:33:3 | { ... } |
| Test.kt:22:4:22:4 | ; | Test.kt:35:3:35:3 | ; |
| Test.kt:30:15:33:3 | { ... } | Test.kt:35:3:35:3 | ; |
@@ -12,15 +16,20 @@
| Test.kt:38:9:38:9 | x | Test.kt:38:16:41:3 | { ... } |
| Test.kt:38:9:38:9 | x | Test.kt:43:3:43:3 | ; |
| Test.kt:38:16:41:3 | { ... } | Test.kt:38:9:38:9 | x |
-| Test.kt:43:3:43:3 | ; | Test.kt:4:2:79:2 | Exit |
+| Test.kt:43:3:43:3 | ; | Test.kt:4:2:79:2 | Normal Exit |
+| Test.kt:82:1:89:1 | Exceptional Exit | Test.kt:82:1:89:1 | Exit |
+| Test.kt:82:1:89:1 | Normal Exit | Test.kt:82:1:89:1 | Exit |
| Test.kt:82:21:89:1 | { ... } | Test.kt:84:7:84:7 | x |
| Test.kt:82:21:89:1 | { ... } | Test.kt:86:4:88:2 | catch (...) |
-| Test.kt:84:7:84:7 | x | Test.kt:82:1:89:1 | Exit |
-| Test.kt:86:4:88:2 | catch (...) | Test.kt:82:1:89:1 | Exit |
+| Test.kt:84:7:84:7 | x | Test.kt:82:1:89:1 | Normal Exit |
+| Test.kt:86:4:88:2 | catch (...) | Test.kt:82:1:89:1 | Normal Exit |
+| Test.kt:91:1:98:1 | Exceptional Exit | Test.kt:91:1:98:1 | Exit |
+| Test.kt:91:1:98:1 | Normal Exit | Test.kt:91:1:98:1 | Exit |
| Test.kt:91:22:98:1 | { ... } | Test.kt:93:7:93:7 | x |
| Test.kt:91:22:98:1 | { ... } | Test.kt:95:4:97:2 | catch (...) |
-| Test.kt:93:7:93:7 | x | Test.kt:91:1:98:1 | Exit |
-| Test.kt:95:4:97:2 | catch (...) | Test.kt:91:1:98:1 | Exit |
+| Test.kt:93:7:93:7 | x | Test.kt:91:1:98:1 | Normal Exit |
+| Test.kt:95:4:97:2 | catch (...) | Test.kt:91:1:98:1 | Normal Exit |
+| Test.kt:100:1:110:1 | Normal Exit | Test.kt:100:1:110:1 | Exit |
| Test.kt:100:25:110:1 | { ... } | Test.kt:101:22:101:22 | y |
| Test.kt:100:25:110:1 | { ... } | Test.kt:105:5:109:5 | ; |
| Test.kt:101:22:101:22 | y | Test.kt:101:33:103:5 | { ... } |
@@ -28,18 +37,22 @@
| Test.kt:101:33:103:5 | { ... } | Test.kt:100:1:110:1 | Exit |
| Test.kt:105:5:109:5 | ; | Test.kt:105:20:107:5 | { ... } |
| Test.kt:105:5:109:5 | ; | Test.kt:107:16:109:5 | ... -> ... |
-| Test.kt:105:20:107:5 | { ... } | Test.kt:100:1:110:1 | Exit |
-| Test.kt:107:16:109:5 | ... -> ... | Test.kt:100:1:110:1 | Exit |
+| Test.kt:105:20:107:5 | { ... } | Test.kt:100:1:110:1 | Normal Exit |
+| Test.kt:107:16:109:5 | ... -> ... | Test.kt:100:1:110:1 | Normal Exit |
| Test.kt:107:16:109:5 | ... -> ... | Test.kt:107:27:109:5 | { ... } |
-| Test.kt:107:27:109:5 | { ... } | Test.kt:100:1:110:1 | Exit |
-| Test.kt:112:32:116:1 | { ... } | Test.kt:112:1:116:1 | Exit |
+| Test.kt:107:27:109:5 | { ... } | Test.kt:100:1:110:1 | Normal Exit |
+| Test.kt:112:1:116:1 | Exceptional Exit | Test.kt:112:1:116:1 | Exit |
+| Test.kt:112:1:116:1 | Normal Exit | Test.kt:112:1:116:1 | Exit |
+| Test.kt:112:32:116:1 | { ... } | Test.kt:112:1:116:1 | Normal Exit |
| Test.kt:112:32:116:1 | { ... } | Test.kt:113:14:113:14 | y |
-| Test.kt:113:14:113:14 | y | Test.kt:112:1:116:1 | Exit |
+| Test.kt:113:14:113:14 | y | Test.kt:112:1:116:1 | Normal Exit |
| Test.kt:113:14:113:14 | y | Test.kt:113:17:115:5 | { ... } |
-| Test.kt:113:17:115:5 | { ... } | Test.kt:112:1:116:1 | Exit |
+| Test.kt:113:17:115:5 | { ... } | Test.kt:112:1:116:1 | Normal Exit |
+| Test.kt:118:1:124:1 | Exceptional Exit | Test.kt:118:1:124:1 | Exit |
+| Test.kt:118:1:124:1 | Normal Exit | Test.kt:118:1:124:1 | Exit |
| Test.kt:118:37:124:1 | { ... } | Test.kt:121:9:121:9 | ; |
| Test.kt:118:37:124:1 | { ... } | Test.kt:122:12:122:16 | ... -> ... |
-| Test.kt:121:9:121:9 | ; | Test.kt:118:1:124:1 | Exit |
+| Test.kt:121:9:121:9 | ; | Test.kt:118:1:124:1 | Normal Exit |
| Test.kt:121:9:121:9 | ; | Test.kt:123:8:123:10 | { ... } |
-| Test.kt:122:12:122:16 | ... -> ... | Test.kt:118:1:124:1 | Exit |
-| Test.kt:123:8:123:10 | { ... } | Test.kt:118:1:124:1 | Exit |
+| Test.kt:122:12:122:16 | ... -> ... | Test.kt:118:1:124:1 | Normal Exit |
+| Test.kt:123:8:123:10 | { ... } | Test.kt:118:1:124:1 | Normal Exit |
diff --git a/java/ql/test-kotlin1/library-tests/controlflow/basic/getASuccessor.expected b/java/ql/test-kotlin1/library-tests/controlflow/basic/getASuccessor.expected
index 81142abc1df8..1d07b13c9d75 100644
--- a/java/ql/test-kotlin1/library-tests/controlflow/basic/getASuccessor.expected
+++ b/java/ql/test-kotlin1/library-tests/controlflow/basic/getASuccessor.expected
@@ -1,9 +1,13 @@
#select
| Test.kt:3:1:80:1 | super(...) | SuperConstructorInvocationStmt | Test.kt:3:8:80:1 | { ... } | BlockStmt |
+| Test.kt:3:8:80:1 | Exceptional Exit | Constructor | Test.kt:3:8:80:1 | Exit | Constructor |
| Test.kt:3:8:80:1 | Exit | Constructor | file://:0:0:0:0 | | |
+| Test.kt:3:8:80:1 | Normal Exit | Constructor | Test.kt:3:8:80:1 | Exit | Constructor |
| Test.kt:3:8:80:1 | { ... } | BlockStmt | Test.kt:3:1:80:1 | super(...) | SuperConstructorInvocationStmt |
-| Test.kt:3:8:80:1 | { ... } | BlockStmt | Test.kt:3:8:80:1 | Exit | Constructor |
+| Test.kt:3:8:80:1 | { ... } | BlockStmt | Test.kt:3:8:80:1 | Normal Exit | Constructor |
+| Test.kt:4:2:79:2 | Exceptional Exit | Method | Test.kt:4:2:79:2 | Exit | Method |
| Test.kt:4:2:79:2 | Exit | Method | file://:0:0:0:0 | | |
+| Test.kt:4:2:79:2 | Normal Exit | Method | Test.kt:4:2:79:2 | Exit | Method |
| Test.kt:4:13:79:2 | { ... } | BlockStmt | Test.kt:5:7:5:7 | var ...; | LocalVariableDeclStmt |
| Test.kt:5:7:5:7 | var ...; | LocalVariableDeclStmt | Test.kt:5:16:5:16 | 0 | IntegerLiteral |
| Test.kt:5:7:5:7 | x | LocalVariableDeclExpr | Test.kt:6:7:6:7 | var ...; | LocalVariableDeclStmt |
@@ -53,7 +57,7 @@
| Test.kt:22:4:22:9 | ...=... | AssignExpr | Test.kt:27:3:27:3 | ; | ExprStmt |
| Test.kt:22:8:22:9 | 40 | LongLiteral | Test.kt:22:4:22:9 | ...=... | AssignExpr |
| Test.kt:24:4:24:9 | INSTANCE | VarAccess | Test.kt:24:4:24:9 | return ... | ReturnStmt |
-| Test.kt:24:4:24:9 | return ... | ReturnStmt | Test.kt:4:2:79:2 | Exit | Method |
+| Test.kt:24:4:24:9 | return ... | ReturnStmt | Test.kt:4:2:79:2 | Normal Exit | Method |
| Test.kt:27:3:27:3 | ; | ExprStmt | Test.kt:27:7:27:8 | 10 | IntegerLiteral |
| Test.kt:27:3:27:8 | ...=... | AssignExpr | Test.kt:30:3:33:3 | ; | ExprStmt |
| Test.kt:27:7:27:8 | 10 | IntegerLiteral | Test.kt:27:3:27:8 | ...=... | AssignExpr |
@@ -106,8 +110,10 @@
| Test.kt:77:3:77:8 | ...=... | AssignExpr | Test.kt:78:3:78:8 | INSTANCE | VarAccess |
| Test.kt:77:7:77:8 | 40 | IntegerLiteral | Test.kt:77:3:77:8 | ...=... | AssignExpr |
| Test.kt:78:3:78:8 | INSTANCE | VarAccess | Test.kt:78:3:78:8 | return ... | ReturnStmt |
-| Test.kt:78:3:78:8 | return ... | ReturnStmt | Test.kt:4:2:79:2 | Exit | Method |
+| Test.kt:78:3:78:8 | return ... | ReturnStmt | Test.kt:4:2:79:2 | Normal Exit | Method |
+| Test.kt:82:1:89:1 | Exceptional Exit | Method | Test.kt:82:1:89:1 | Exit | Method |
| Test.kt:82:1:89:1 | Exit | Method | file://:0:0:0:0 | | |
+| Test.kt:82:1:89:1 | Normal Exit | Method | Test.kt:82:1:89:1 | Exit | Method |
| Test.kt:82:21:89:1 | { ... } | BlockStmt | Test.kt:83:2:88:2 | try ... | TryStmt |
| Test.kt:83:2:88:2 | try ... | TryStmt | Test.kt:83:6:86:2 | { ... } | BlockStmt |
| Test.kt:83:6:86:2 | { ... } | BlockStmt | Test.kt:84:7:84:7 | var ...; | LocalVariableDeclStmt |
@@ -116,14 +122,16 @@
| Test.kt:84:11:84:11 | o | VarAccess | Test.kt:84:11:84:18 | (...)... | CastExpr |
| Test.kt:84:11:84:18 | (...)... | CastExpr | Test.kt:84:7:84:7 | x | LocalVariableDeclExpr |
| Test.kt:84:11:84:18 | (...)... | CastExpr | Test.kt:86:4:88:2 | catch (...) | CatchClause |
-| Test.kt:85:3:85:10 | return ... | ReturnStmt | Test.kt:82:1:89:1 | Exit | Method |
+| Test.kt:85:3:85:10 | return ... | ReturnStmt | Test.kt:82:1:89:1 | Normal Exit | Method |
| Test.kt:85:10:85:10 | 1 | IntegerLiteral | Test.kt:85:3:85:10 | return ... | ReturnStmt |
| Test.kt:86:4:88:2 | catch (...) | CatchClause | Test.kt:86:11:86:31 | e | LocalVariableDeclExpr |
| Test.kt:86:11:86:31 | e | LocalVariableDeclExpr | Test.kt:86:34:88:2 | { ... } | BlockStmt |
| Test.kt:86:34:88:2 | { ... } | BlockStmt | Test.kt:87:10:87:10 | 2 | IntegerLiteral |
-| Test.kt:87:3:87:10 | return ... | ReturnStmt | Test.kt:82:1:89:1 | Exit | Method |
+| Test.kt:87:3:87:10 | return ... | ReturnStmt | Test.kt:82:1:89:1 | Normal Exit | Method |
| Test.kt:87:10:87:10 | 2 | IntegerLiteral | Test.kt:87:3:87:10 | return ... | ReturnStmt |
+| Test.kt:91:1:98:1 | Exceptional Exit | Method | Test.kt:91:1:98:1 | Exit | Method |
| Test.kt:91:1:98:1 | Exit | Method | file://:0:0:0:0 | | |
+| Test.kt:91:1:98:1 | Normal Exit | Method | Test.kt:91:1:98:1 | Exit | Method |
| Test.kt:91:22:98:1 | { ... } | BlockStmt | Test.kt:92:2:97:2 | try ... | TryStmt |
| Test.kt:92:2:97:2 | try ... | TryStmt | Test.kt:92:6:95:2 | { ... } | BlockStmt |
| Test.kt:92:6:95:2 | { ... } | BlockStmt | Test.kt:93:7:93:7 | var ...; | LocalVariableDeclStmt |
@@ -132,14 +140,16 @@
| Test.kt:93:11:93:11 | o | VarAccess | Test.kt:93:12:93:13 | ...!! | NotNullExpr |
| Test.kt:93:12:93:13 | ...!! | NotNullExpr | Test.kt:93:7:93:7 | x | LocalVariableDeclExpr |
| Test.kt:93:12:93:13 | ...!! | NotNullExpr | Test.kt:95:4:97:2 | catch (...) | CatchClause |
-| Test.kt:94:3:94:10 | return ... | ReturnStmt | Test.kt:91:1:98:1 | Exit | Method |
+| Test.kt:94:3:94:10 | return ... | ReturnStmt | Test.kt:91:1:98:1 | Normal Exit | Method |
| Test.kt:94:10:94:10 | 1 | IntegerLiteral | Test.kt:94:3:94:10 | return ... | ReturnStmt |
| Test.kt:95:4:97:2 | catch (...) | CatchClause | Test.kt:95:11:95:33 | e | LocalVariableDeclExpr |
| Test.kt:95:11:95:33 | e | LocalVariableDeclExpr | Test.kt:95:36:97:2 | { ... } | BlockStmt |
| Test.kt:95:36:97:2 | { ... } | BlockStmt | Test.kt:96:10:96:10 | 2 | IntegerLiteral |
-| Test.kt:96:3:96:10 | return ... | ReturnStmt | Test.kt:91:1:98:1 | Exit | Method |
+| Test.kt:96:3:96:10 | return ... | ReturnStmt | Test.kt:91:1:98:1 | Normal Exit | Method |
| Test.kt:96:10:96:10 | 2 | IntegerLiteral | Test.kt:96:3:96:10 | return ... | ReturnStmt |
+| Test.kt:100:1:110:1 | Exceptional Exit | Method | Test.kt:100:1:110:1 | Exit | Method |
| Test.kt:100:1:110:1 | Exit | Method | file://:0:0:0:0 | | |
+| Test.kt:100:1:110:1 | Normal Exit | Method | Test.kt:100:1:110:1 | Exit | Method |
| Test.kt:100:25:110:1 | { ... } | BlockStmt | Test.kt:101:5:103:5 | ; | ExprStmt |
| Test.kt:101:5:103:5 | ... -> ... | WhenBranch | Test.kt:101:9:101:30 | ... && ... | AndLogicalExpr |
| Test.kt:101:5:103:5 | ; | ExprStmt | Test.kt:101:5:103:5 | when ... | WhenExpr |
@@ -154,7 +164,7 @@
| Test.kt:101:22:101:30 | ... (value equals) ... | ValueEQExpr | Test.kt:105:5:109:5 | ; | ExprStmt |
| Test.kt:101:27:101:30 | null | NullLiteral | Test.kt:101:22:101:30 | ... (value equals) ... | ValueEQExpr |
| Test.kt:101:33:103:5 | { ... } | BlockStmt | Test.kt:102:15:102:25 | new Exception(...) | ClassInstanceExpr |
-| Test.kt:102:9:102:25 | throw ... | ThrowStmt | Test.kt:100:1:110:1 | Exit | Method |
+| Test.kt:102:9:102:25 | throw ... | ThrowStmt | Test.kt:100:1:110:1 | Exceptional Exit | Method |
| Test.kt:102:15:102:25 | new Exception(...) | ClassInstanceExpr | Test.kt:102:9:102:25 | throw ... | ThrowStmt |
| Test.kt:105:5:109:5 | ; | ExprStmt | Test.kt:105:5:109:5 | when ... | WhenExpr |
| Test.kt:105:5:109:5 | when ... | WhenExpr | Test.kt:105:9:107:5 | ... -> ... | WhenBranch |
@@ -165,29 +175,33 @@
| Test.kt:105:14:105:17 | null | NullLiteral | Test.kt:105:9:105:17 | ... (value not-equals) ... | ValueNEExpr |
| Test.kt:105:20:107:5 | { ... } | BlockStmt | Test.kt:106:9:106:29 | ; | ExprStmt |
| Test.kt:106:9:106:29 | ; | ExprStmt | Test.kt:106:17:106:28 | "x not null" | StringLiteral |
-| Test.kt:106:9:106:29 | println(...) | MethodCall | Test.kt:100:1:110:1 | Exit | Method |
+| Test.kt:106:9:106:29 | println(...) | MethodCall | Test.kt:100:1:110:1 | Normal Exit | Method |
| Test.kt:106:17:106:28 | "x not null" | StringLiteral | Test.kt:106:9:106:29 | println(...) | MethodCall |
| Test.kt:107:16:107:16 | y | VarAccess | Test.kt:107:21:107:24 | null | NullLiteral |
-| Test.kt:107:16:107:24 | ... (value not-equals) ... | ValueNEExpr | Test.kt:100:1:110:1 | Exit | Method |
+| Test.kt:107:16:107:24 | ... (value not-equals) ... | ValueNEExpr | Test.kt:100:1:110:1 | Normal Exit | Method |
| Test.kt:107:16:107:24 | ... (value not-equals) ... | ValueNEExpr | Test.kt:107:27:109:5 | { ... } | BlockStmt |
| Test.kt:107:16:109:5 | ... -> ... | WhenBranch | Test.kt:107:16:107:16 | y | VarAccess |
| Test.kt:107:21:107:24 | null | NullLiteral | Test.kt:107:16:107:24 | ... (value not-equals) ... | ValueNEExpr |
| Test.kt:107:27:109:5 | { ... } | BlockStmt | Test.kt:108:9:108:29 | ; | ExprStmt |
| Test.kt:108:9:108:29 | ; | ExprStmt | Test.kt:108:17:108:28 | "y not null" | StringLiteral |
-| Test.kt:108:9:108:29 | println(...) | MethodCall | Test.kt:100:1:110:1 | Exit | Method |
+| Test.kt:108:9:108:29 | println(...) | MethodCall | Test.kt:100:1:110:1 | Normal Exit | Method |
| Test.kt:108:17:108:28 | "y not null" | StringLiteral | Test.kt:108:9:108:29 | println(...) | MethodCall |
+| Test.kt:112:1:116:1 | Exceptional Exit | Method | Test.kt:112:1:116:1 | Exit | Method |
| Test.kt:112:1:116:1 | Exit | Method | file://:0:0:0:0 | | |
+| Test.kt:112:1:116:1 | Normal Exit | Method | Test.kt:112:1:116:1 | Exit | Method |
| Test.kt:112:32:116:1 | { ... } | BlockStmt | Test.kt:113:5:115:5 | ; | ExprStmt |
| Test.kt:113:5:115:5 | ... -> ... | WhenBranch | Test.kt:113:9:113:14 | ... && ... | AndLogicalExpr |
| Test.kt:113:5:115:5 | ; | ExprStmt | Test.kt:113:5:115:5 | when ... | WhenExpr |
| Test.kt:113:5:115:5 | when ... | WhenExpr | Test.kt:113:5:115:5 | ... -> ... | WhenBranch |
-| Test.kt:113:9:113:9 | x | VarAccess | Test.kt:112:1:116:1 | Exit | Method |
+| Test.kt:113:9:113:9 | x | VarAccess | Test.kt:112:1:116:1 | Normal Exit | Method |
| Test.kt:113:9:113:9 | x | VarAccess | Test.kt:113:14:113:14 | y | VarAccess |
| Test.kt:113:9:113:14 | ... && ... | AndLogicalExpr | Test.kt:113:9:113:9 | x | VarAccess |
-| Test.kt:113:14:113:14 | y | VarAccess | Test.kt:112:1:116:1 | Exit | Method |
+| Test.kt:113:14:113:14 | y | VarAccess | Test.kt:112:1:116:1 | Normal Exit | Method |
| Test.kt:113:14:113:14 | y | VarAccess | Test.kt:113:17:115:5 | { ... } | BlockStmt |
-| Test.kt:113:17:115:5 | { ... } | BlockStmt | Test.kt:112:1:116:1 | Exit | Method |
+| Test.kt:113:17:115:5 | { ... } | BlockStmt | Test.kt:112:1:116:1 | Normal Exit | Method |
+| Test.kt:118:1:124:1 | Exceptional Exit | Method | Test.kt:118:1:124:1 | Exit | Method |
| Test.kt:118:1:124:1 | Exit | Method | file://:0:0:0:0 | | |
+| Test.kt:118:1:124:1 | Normal Exit | Method | Test.kt:118:1:124:1 | Exit | Method |
| Test.kt:118:37:124:1 | { ... } | BlockStmt | Test.kt:119:2:123:12 | ; | ExprStmt |
| Test.kt:119:2:123:12 | ; | ExprStmt | Test.kt:119:2:123:12 | when ... | WhenExpr |
| Test.kt:119:2:123:12 | when ... | WhenExpr | Test.kt:120:3:123:10 | ... -> ... | WhenBranch |
@@ -197,11 +211,11 @@
| Test.kt:121:4:121:4 | x | VarAccess | Test.kt:122:12:122:16 | ... -> ... | WhenBranch |
| Test.kt:121:4:121:9 | ... -> ... | WhenBranch | Test.kt:121:4:121:4 | x | VarAccess |
| Test.kt:121:9:121:9 | ; | ExprStmt | Test.kt:121:9:121:9 | y | VarAccess |
-| Test.kt:121:9:121:9 | y | VarAccess | Test.kt:118:1:124:1 | Exit | Method |
+| Test.kt:121:9:121:9 | y | VarAccess | Test.kt:118:1:124:1 | Normal Exit | Method |
| Test.kt:121:9:121:9 | y | VarAccess | Test.kt:123:8:123:10 | { ... } | BlockStmt |
| Test.kt:122:12:122:16 | ... -> ... | WhenBranch | Test.kt:122:12:122:16 | true | BooleanLiteral |
| Test.kt:122:12:122:16 | ; | ExprStmt | Test.kt:122:12:122:16 | false | BooleanLiteral |
-| Test.kt:122:12:122:16 | false | BooleanLiteral | Test.kt:118:1:124:1 | Exit | Method |
+| Test.kt:122:12:122:16 | false | BooleanLiteral | Test.kt:118:1:124:1 | Normal Exit | Method |
| Test.kt:122:12:122:16 | true | BooleanLiteral | Test.kt:122:12:122:16 | ; | ExprStmt |
-| Test.kt:123:8:123:10 | { ... } | BlockStmt | Test.kt:118:1:124:1 | Exit | Method |
+| Test.kt:123:8:123:10 | { ... } | BlockStmt | Test.kt:118:1:124:1 | Normal Exit | Method |
missingSuccessor
diff --git a/java/ql/test-kotlin1/library-tests/controlflow/basic/strictPostDominance.expected b/java/ql/test-kotlin1/library-tests/controlflow/basic/strictPostDominance.expected
index 9971f41a3be2..625fde1c41e5 100644
--- a/java/ql/test-kotlin1/library-tests/controlflow/basic/strictPostDominance.expected
+++ b/java/ql/test-kotlin1/library-tests/controlflow/basic/strictPostDominance.expected
@@ -208,6 +208,12 @@
| Test.kt:101:5:103:5 | ... -> ... | Test.kt:101:5:103:5 | ; |
| Test.kt:101:5:103:5 | ; | Test.kt:100:25:110:1 | { ... } |
| Test.kt:102:9:102:25 | throw ... | Test.kt:101:33:103:5 | { ... } |
+| Test.kt:105:5:109:5 | ; | Test.kt:100:25:110:1 | { ... } |
+| Test.kt:105:5:109:5 | ; | Test.kt:101:5:103:5 | ... -> ... |
+| Test.kt:105:5:109:5 | ; | Test.kt:101:5:103:5 | ; |
+| Test.kt:105:9:107:5 | ... -> ... | Test.kt:100:25:110:1 | { ... } |
+| Test.kt:105:9:107:5 | ... -> ... | Test.kt:101:5:103:5 | ... -> ... |
+| Test.kt:105:9:107:5 | ... -> ... | Test.kt:101:5:103:5 | ; |
| Test.kt:105:9:107:5 | ... -> ... | Test.kt:105:5:109:5 | ; |
| Test.kt:106:9:106:29 | ; | Test.kt:105:20:107:5 | { ... } |
| Test.kt:108:9:108:29 | ; | Test.kt:107:27:109:5 | { ... } |
diff --git a/java/ql/test-kotlin1/library-tests/controlflow/dominance/dominator.expected b/java/ql/test-kotlin1/library-tests/controlflow/dominance/dominator.expected
index 3eae23451868..31da586d6307 100644
--- a/java/ql/test-kotlin1/library-tests/controlflow/dominance/dominator.expected
+++ b/java/ql/test-kotlin1/library-tests/controlflow/dominance/dominator.expected
@@ -44,7 +44,7 @@
| Test.kt:21:3:24:11 | true | Test.kt:24:11:24:11 | z |
| Test.kt:21:3:24:11 | when ... | Test.kt:21:3:24:11 | ... -> ... |
| Test.kt:21:7:21:7 | x | Test.kt:21:11:21:11 | 0 |
-| Test.kt:21:7:21:11 | ... < ... | Test.kt:2:2:79:2 | Exit |
+| Test.kt:21:7:21:11 | ... < ... | Test.kt:2:2:79:2 | Normal Exit |
| Test.kt:21:7:21:11 | ... < ... | Test.kt:21:3:24:11 | ... -> ... |
| Test.kt:21:7:21:11 | ... < ... | Test.kt:22:4:22:4 | ; |
| Test.kt:21:11:21:11 | 0 | Test.kt:21:7:21:11 | ... < ... |
@@ -142,7 +142,7 @@
| Test.kt:92:4:93:9 | ; | Test.kt:92:4:93:9 | when ... |
| Test.kt:92:4:93:9 | when ... | Test.kt:92:4:93:9 | ... -> ... |
| Test.kt:92:8:92:8 | a | Test.kt:92:13:92:14 | 10 |
-| Test.kt:92:8:92:14 | ... (value equals) ... | Test.kt:81:2:98:2 | Exit |
+| Test.kt:92:8:92:14 | ... (value equals) ... | Test.kt:81:2:98:2 | Normal Exit |
| Test.kt:92:8:92:14 | ... (value equals) ... | Test.kt:93:5:93:9 | break |
| Test.kt:92:8:92:14 | ... (value equals) ... | Test.kt:94:4:95:12 | ; |
| Test.kt:92:13:92:14 | 10 | Test.kt:92:8:92:14 | ... (value equals) ... |
diff --git a/java/ql/test-kotlin2/library-tests/annotation_classes/PrintAst.expected b/java/ql/test-kotlin2/library-tests/annotation_classes/PrintAst.expected
index dfec79078ce8..1153b13c3bf9 100644
--- a/java/ql/test-kotlin2/library-tests/annotation_classes/PrintAst.expected
+++ b/java/ql/test-kotlin2/library-tests/annotation_classes/PrintAst.expected
@@ -169,7 +169,18 @@ def.kt:
# 33| 0: [SuperConstructorInvocationStmt] super(...)
# 33| 1: [BlockStmt] { ... }
# 34| 5: [Class] Y
-# 34| 2: [Constructor] Y
+# 0| 2: [Method] getEntries
+# 0| 3: [TypeAccess] EnumEntries
+# 0| 0: [TypeAccess] Y
+# 0| 3: [Method] valueOf
+# 0| 3: [TypeAccess] Y
+#-----| 4: (Parameters)
+# 34| 0: [Parameter] value
+# 34| 0: [TypeAccess] String
+# 0| 4: [Method] values
+# 0| 3: [TypeAccess] Y[]
+# 0| 0: [TypeAccess] Y
+# 34| 5: [Constructor] Y
# 34| 5: [BlockStmt] { ... }
# 34| 0: [ExprStmt] ;
# 34| 0: [ClassInstanceExpr] new Enum(...)
@@ -178,17 +189,6 @@ def.kt:
# 34| 0: [NullLiteral] null
# 34| 1: [IntegerLiteral] 0
# 34| 1: [BlockStmt] { ... }
-# 34| 3: [Method] getEntries
-# 34| 3: [TypeAccess] EnumEntries
-# 34| 0: [TypeAccess] Y
-# 34| 4: [Method] valueOf
-# 34| 3: [TypeAccess] Y
-#-----| 4: (Parameters)
-# 34| 0: [Parameter] value
-# 34| 0: [TypeAccess] String
-# 34| 5: [Method] values
-# 34| 3: [TypeAccess] Y[]
-# 34| 0: [TypeAccess] Y
# 35| 6: [FieldDeclaration] Y A;
# 35| -1: [TypeAccess] Y
# 35| 0: [ClassInstanceExpr] new Y(...)
diff --git a/java/ql/test-kotlin2/library-tests/classes/PrintAst.expected b/java/ql/test-kotlin2/library-tests/classes/PrintAst.expected
index 4abfda927996..6fe2874402f8 100644
--- a/java/ql/test-kotlin2/library-tests/classes/PrintAst.expected
+++ b/java/ql/test-kotlin2/library-tests/classes/PrintAst.expected
@@ -160,7 +160,18 @@ classes.kt:
# 42| -1: [TypeAccess] int
# 42| 0: [IntegerLiteral] 3
# 49| 11: [Class] Direction
-# 49| 2: [Constructor] Direction
+# 0| 2: [Method] getEntries
+# 0| 3: [TypeAccess] EnumEntries
+# 0| 0: [TypeAccess] Direction
+# 0| 3: [Method] valueOf
+# 0| 3: [TypeAccess] Direction
+#-----| 4: (Parameters)
+# 49| 0: [Parameter] value
+# 49| 0: [TypeAccess] String
+# 0| 4: [Method] values
+# 0| 3: [TypeAccess] Direction[]
+# 0| 0: [TypeAccess] Direction
+# 49| 5: [Constructor] Direction
# 49| 5: [BlockStmt] { ... }
# 49| 0: [ExprStmt] ;
# 49| 0: [ClassInstanceExpr] new Enum(...)
@@ -169,17 +180,6 @@ classes.kt:
# 49| 0: [NullLiteral] null
# 49| 1: [IntegerLiteral] 0
# 49| 1: [BlockStmt] { ... }
-# 49| 3: [Method] getEntries
-# 49| 3: [TypeAccess] EnumEntries
-# 49| 0: [TypeAccess] Direction
-# 49| 4: [Method] valueOf
-# 49| 3: [TypeAccess] Direction
-#-----| 4: (Parameters)
-# 49| 0: [Parameter] value
-# 49| 0: [TypeAccess] String
-# 49| 5: [Method] values
-# 49| 3: [TypeAccess] Direction[]
-# 49| 0: [TypeAccess] Direction
# 50| 6: [FieldDeclaration] Direction NORTH;
# 50| -1: [TypeAccess] Direction
# 50| 0: [ClassInstanceExpr] new Direction(...)
@@ -197,17 +197,17 @@ classes.kt:
# 50| 0: [ClassInstanceExpr] new Direction(...)
# 50| -3: [TypeAccess] Direction
# 53| 12: [Class] Color
-# 53| 2: [Method] getEntries
-# 53| 3: [TypeAccess] EnumEntries
-# 53| 0: [TypeAccess] Color
-# 53| 3: [Method] valueOf
-# 53| 3: [TypeAccess] Color
+# 0| 2: [Method] getEntries
+# 0| 3: [TypeAccess] EnumEntries
+# 0| 0: [TypeAccess] Color
+# 0| 3: [Method] valueOf
+# 0| 3: [TypeAccess] Color
#-----| 4: (Parameters)
# 53| 0: [Parameter] value
# 53| 0: [TypeAccess] String
-# 53| 4: [Method] values
-# 53| 3: [TypeAccess] Color[]
-# 53| 0: [TypeAccess] Color
+# 0| 4: [Method] values
+# 0| 3: [TypeAccess] Color[]
+# 0| 0: [TypeAccess] Color
# 53| 5: [Constructor] Color
#-----| 4: (Parameters)
# 53| 0: [Parameter] rgb
diff --git a/java/ql/test-kotlin2/library-tests/controlflow/basic/bbStmts.expected b/java/ql/test-kotlin2/library-tests/controlflow/basic/bbStmts.expected
index c0f86a6ec9be..c66d50a722d1 100644
--- a/java/ql/test-kotlin2/library-tests/controlflow/basic/bbStmts.expected
+++ b/java/ql/test-kotlin2/library-tests/controlflow/basic/bbStmts.expected
@@ -1,8 +1,12 @@
+| Test.kt:3:1:80:1 | Exceptional Exit | 0 | Test.kt:3:1:80:1 | Exceptional Exit |
+| Test.kt:3:1:80:1 | Exit | 0 | Test.kt:3:1:80:1 | Exit |
| Test.kt:3:1:80:1 | { ... } | 0 | Test.kt:3:1:80:1 | { ... } |
| Test.kt:3:1:80:1 | { ... } | 1 | Test.kt:3:1:80:1 | super(...) |
| Test.kt:3:1:80:1 | { ... } | 2 | Test.kt:3:1:80:1 | { ... } |
-| Test.kt:3:1:80:1 | { ... } | 3 | Test.kt:3:1:80:1 | Exit |
+| Test.kt:3:1:80:1 | { ... } | 3 | Test.kt:3:1:80:1 | Normal Exit |
+| Test.kt:4:2:79:2 | Exceptional Exit | 0 | Test.kt:4:2:79:2 | Exceptional Exit |
| Test.kt:4:2:79:2 | Exit | 0 | Test.kt:4:2:79:2 | Exit |
+| Test.kt:4:2:79:2 | Normal Exit | 0 | Test.kt:4:2:79:2 | Normal Exit |
| Test.kt:4:13:79:2 | { ... } | 0 | Test.kt:4:13:79:2 | { ... } |
| Test.kt:4:13:79:2 | { ... } | 1 | Test.kt:5:3:5:16 | var ...; |
| Test.kt:4:13:79:2 | { ... } | 2 | Test.kt:5:16:5:16 | 0 |
@@ -102,7 +106,9 @@
| Test.kt:43:3:43:8 | ; | 8 | Test.kt:77:3:77:8 | ...=... |
| Test.kt:43:3:43:8 | ; | 9 | Test.kt:78:9:78:9 | INSTANCE |
| Test.kt:43:3:43:8 | ; | 10 | Test.kt:78:3:78:8 | return ... |
+| Test.kt:82:1:89:1 | Exceptional Exit | 0 | Test.kt:82:1:89:1 | Exceptional Exit |
| Test.kt:82:1:89:1 | Exit | 0 | Test.kt:82:1:89:1 | Exit |
+| Test.kt:82:1:89:1 | Normal Exit | 0 | Test.kt:82:1:89:1 | Normal Exit |
| Test.kt:82:21:89:1 | { ... } | 0 | Test.kt:82:21:89:1 | { ... } |
| Test.kt:82:21:89:1 | { ... } | 1 | Test.kt:83:2:88:2 | try ... |
| Test.kt:82:21:89:1 | { ... } | 2 | Test.kt:83:6:86:2 | { ... } |
@@ -117,7 +123,9 @@
| Test.kt:86:4:88:2 | catch (...) | 2 | Test.kt:86:34:88:2 | { ... } |
| Test.kt:86:4:88:2 | catch (...) | 3 | Test.kt:87:10:87:10 | 2 |
| Test.kt:86:4:88:2 | catch (...) | 4 | Test.kt:87:3:87:10 | return ... |
+| Test.kt:91:1:98:1 | Exceptional Exit | 0 | Test.kt:91:1:98:1 | Exceptional Exit |
| Test.kt:91:1:98:1 | Exit | 0 | Test.kt:91:1:98:1 | Exit |
+| Test.kt:91:1:98:1 | Normal Exit | 0 | Test.kt:91:1:98:1 | Normal Exit |
| Test.kt:91:22:98:1 | { ... } | 0 | Test.kt:91:22:98:1 | { ... } |
| Test.kt:91:22:98:1 | { ... } | 1 | Test.kt:92:2:97:2 | try ... |
| Test.kt:91:22:98:1 | { ... } | 2 | Test.kt:92:6:95:2 | { ... } |
@@ -133,6 +141,7 @@
| Test.kt:95:4:97:2 | catch (...) | 3 | Test.kt:96:10:96:10 | 2 |
| Test.kt:95:4:97:2 | catch (...) | 4 | Test.kt:96:3:96:10 | return ... |
| Test.kt:100:1:110:1 | Exit | 0 | Test.kt:100:1:110:1 | Exit |
+| Test.kt:100:1:110:1 | Normal Exit | 0 | Test.kt:100:1:110:1 | Normal Exit |
| Test.kt:100:25:110:1 | { ... } | 0 | Test.kt:100:25:110:1 | { ... } |
| Test.kt:100:25:110:1 | { ... } | 1 | Test.kt:101:5:103:5 | ; |
| Test.kt:100:25:110:1 | { ... } | 2 | Test.kt:101:5:103:5 | when ... |
@@ -147,6 +156,7 @@
| Test.kt:101:33:103:5 | { ... } | 0 | Test.kt:101:33:103:5 | { ... } |
| Test.kt:101:33:103:5 | { ... } | 1 | Test.kt:102:15:102:25 | new Exception(...) |
| Test.kt:101:33:103:5 | { ... } | 2 | Test.kt:102:9:102:25 | throw ... |
+| Test.kt:101:33:103:5 | { ... } | 3 | Test.kt:100:1:110:1 | Exceptional Exit |
| Test.kt:105:5:109:5 | ; | 0 | Test.kt:105:5:109:5 | ; |
| Test.kt:105:5:109:5 | ; | 1 | Test.kt:105:5:109:5 | when ... |
| Test.kt:105:5:109:5 | ; | 2 | Test.kt:105:9:107:5 | ... -> ... |
@@ -165,7 +175,9 @@
| Test.kt:107:27:109:5 | { ... } | 1 | Test.kt:108:9:108:29 | ; |
| Test.kt:107:27:109:5 | { ... } | 2 | Test.kt:108:17:108:28 | "y not null" |
| Test.kt:107:27:109:5 | { ... } | 3 | Test.kt:108:9:108:29 | println(...) |
+| Test.kt:112:1:116:1 | Exceptional Exit | 0 | Test.kt:112:1:116:1 | Exceptional Exit |
| Test.kt:112:1:116:1 | Exit | 0 | Test.kt:112:1:116:1 | Exit |
+| Test.kt:112:1:116:1 | Normal Exit | 0 | Test.kt:112:1:116:1 | Normal Exit |
| Test.kt:112:32:116:1 | { ... } | 0 | Test.kt:112:32:116:1 | { ... } |
| Test.kt:112:32:116:1 | { ... } | 1 | Test.kt:113:5:115:5 | ; |
| Test.kt:112:32:116:1 | { ... } | 2 | Test.kt:113:5:115:5 | when ... |
@@ -174,7 +186,9 @@
| Test.kt:112:32:116:1 | { ... } | 5 | Test.kt:113:9:113:9 | x |
| Test.kt:113:14:113:14 | y | 0 | Test.kt:113:14:113:14 | y |
| Test.kt:113:17:115:5 | { ... } | 0 | Test.kt:113:17:115:5 | { ... } |
+| Test.kt:118:1:124:1 | Exceptional Exit | 0 | Test.kt:118:1:124:1 | Exceptional Exit |
| Test.kt:118:1:124:1 | Exit | 0 | Test.kt:118:1:124:1 | Exit |
+| Test.kt:118:1:124:1 | Normal Exit | 0 | Test.kt:118:1:124:1 | Normal Exit |
| Test.kt:118:37:124:1 | { ... } | 0 | Test.kt:118:37:124:1 | { ... } |
| Test.kt:118:37:124:1 | { ... } | 1 | Test.kt:119:2:123:12 | ; |
| Test.kt:118:37:124:1 | { ... } | 2 | Test.kt:119:2:123:12 | when ... |
diff --git a/java/ql/test-kotlin2/library-tests/controlflow/basic/bbStrictDominance.expected b/java/ql/test-kotlin2/library-tests/controlflow/basic/bbStrictDominance.expected
index aa23696bd555..c7e225ecc6f4 100644
--- a/java/ql/test-kotlin2/library-tests/controlflow/basic/bbStrictDominance.expected
+++ b/java/ql/test-kotlin2/library-tests/controlflow/basic/bbStrictDominance.expected
@@ -1,4 +1,7 @@
+| Test.kt:3:1:80:1 | { ... } | Test.kt:3:1:80:1 | Exit |
+| Test.kt:4:2:79:2 | Normal Exit | Test.kt:4:2:79:2 | Exit |
| Test.kt:4:13:79:2 | { ... } | Test.kt:4:2:79:2 | Exit |
+| Test.kt:4:13:79:2 | { ... } | Test.kt:4:2:79:2 | Normal Exit |
| Test.kt:4:13:79:2 | { ... } | Test.kt:11:14:14:3 | { ... } |
| Test.kt:4:13:79:2 | { ... } | Test.kt:14:10:16:3 | ... -> ... |
| Test.kt:4:13:79:2 | { ... } | Test.kt:18:3:18:7 | ; |
@@ -10,6 +13,7 @@
| Test.kt:4:13:79:2 | { ... } | Test.kt:38:16:41:3 | { ... } |
| Test.kt:4:13:79:2 | { ... } | Test.kt:43:3:43:8 | ; |
| Test.kt:18:3:18:7 | ; | Test.kt:4:2:79:2 | Exit |
+| Test.kt:18:3:18:7 | ; | Test.kt:4:2:79:2 | Normal Exit |
| Test.kt:18:3:18:7 | ; | Test.kt:22:4:22:9 | ; |
| Test.kt:18:3:18:7 | ; | Test.kt:24:4:24:9 | ... -> ... |
| Test.kt:18:3:18:7 | ; | Test.kt:30:15:33:3 | { ... } |
@@ -27,13 +31,18 @@
| Test.kt:35:3:35:8 | ; | Test.kt:43:3:43:8 | ; |
| Test.kt:38:9:38:9 | x | Test.kt:38:16:41:3 | { ... } |
| Test.kt:38:9:38:9 | x | Test.kt:43:3:43:8 | ; |
+| Test.kt:82:1:89:1 | Normal Exit | Test.kt:82:1:89:1 | Exit |
| Test.kt:82:21:89:1 | { ... } | Test.kt:82:1:89:1 | Exit |
+| Test.kt:82:21:89:1 | { ... } | Test.kt:82:1:89:1 | Normal Exit |
| Test.kt:82:21:89:1 | { ... } | Test.kt:84:3:84:18 | x |
| Test.kt:82:21:89:1 | { ... } | Test.kt:86:4:88:2 | catch (...) |
+| Test.kt:91:1:98:1 | Normal Exit | Test.kt:91:1:98:1 | Exit |
| Test.kt:91:22:98:1 | { ... } | Test.kt:91:1:98:1 | Exit |
+| Test.kt:91:22:98:1 | { ... } | Test.kt:91:1:98:1 | Normal Exit |
| Test.kt:91:22:98:1 | { ... } | Test.kt:93:3:93:13 | x |
| Test.kt:91:22:98:1 | { ... } | Test.kt:95:4:97:2 | catch (...) |
| Test.kt:100:25:110:1 | { ... } | Test.kt:100:1:110:1 | Exit |
+| Test.kt:100:25:110:1 | { ... } | Test.kt:100:1:110:1 | Normal Exit |
| Test.kt:100:25:110:1 | { ... } | Test.kt:101:22:101:22 | y |
| Test.kt:100:25:110:1 | { ... } | Test.kt:101:33:103:5 | { ... } |
| Test.kt:100:25:110:1 | { ... } | Test.kt:105:5:109:5 | ; |
@@ -41,15 +50,20 @@
| Test.kt:100:25:110:1 | { ... } | Test.kt:107:16:109:5 | ... -> ... |
| Test.kt:100:25:110:1 | { ... } | Test.kt:107:27:109:5 | { ... } |
| Test.kt:101:22:101:22 | y | Test.kt:101:33:103:5 | { ... } |
+| Test.kt:105:5:109:5 | ; | Test.kt:100:1:110:1 | Normal Exit |
| Test.kt:105:5:109:5 | ; | Test.kt:105:20:107:5 | { ... } |
| Test.kt:105:5:109:5 | ; | Test.kt:107:16:109:5 | ... -> ... |
| Test.kt:105:5:109:5 | ; | Test.kt:107:27:109:5 | { ... } |
| Test.kt:107:16:109:5 | ... -> ... | Test.kt:107:27:109:5 | { ... } |
+| Test.kt:112:1:116:1 | Normal Exit | Test.kt:112:1:116:1 | Exit |
| Test.kt:112:32:116:1 | { ... } | Test.kt:112:1:116:1 | Exit |
+| Test.kt:112:32:116:1 | { ... } | Test.kt:112:1:116:1 | Normal Exit |
| Test.kt:112:32:116:1 | { ... } | Test.kt:113:14:113:14 | y |
| Test.kt:112:32:116:1 | { ... } | Test.kt:113:17:115:5 | { ... } |
| Test.kt:113:14:113:14 | y | Test.kt:113:17:115:5 | { ... } |
+| Test.kt:118:1:124:1 | Normal Exit | Test.kt:118:1:124:1 | Exit |
| Test.kt:118:37:124:1 | { ... } | Test.kt:118:1:124:1 | Exit |
+| Test.kt:118:37:124:1 | { ... } | Test.kt:118:1:124:1 | Normal Exit |
| Test.kt:118:37:124:1 | { ... } | Test.kt:121:9:121:9 | ; |
| Test.kt:118:37:124:1 | { ... } | Test.kt:122:12:122:16 | ... -> ... |
| Test.kt:118:37:124:1 | { ... } | Test.kt:123:8:123:10 | { ... } |
diff --git a/java/ql/test-kotlin2/library-tests/controlflow/basic/bbSuccessor.expected b/java/ql/test-kotlin2/library-tests/controlflow/basic/bbSuccessor.expected
index 006bd71a6bac..219779e73dc7 100644
--- a/java/ql/test-kotlin2/library-tests/controlflow/basic/bbSuccessor.expected
+++ b/java/ql/test-kotlin2/library-tests/controlflow/basic/bbSuccessor.expected
@@ -1,3 +1,7 @@
+| Test.kt:3:1:80:1 | Exceptional Exit | Test.kt:3:1:80:1 | Exit |
+| Test.kt:3:1:80:1 | { ... } | Test.kt:3:1:80:1 | Exit |
+| Test.kt:4:2:79:2 | Exceptional Exit | Test.kt:4:2:79:2 | Exit |
+| Test.kt:4:2:79:2 | Normal Exit | Test.kt:4:2:79:2 | Exit |
| Test.kt:4:13:79:2 | { ... } | Test.kt:11:14:14:3 | { ... } |
| Test.kt:4:13:79:2 | { ... } | Test.kt:14:10:16:3 | ... -> ... |
| Test.kt:11:14:14:3 | { ... } | Test.kt:18:3:18:7 | ; |
@@ -6,21 +10,26 @@
| Test.kt:18:3:18:7 | ; | Test.kt:24:4:24:9 | ... -> ... |
| Test.kt:22:4:22:9 | ; | Test.kt:30:15:33:3 | { ... } |
| Test.kt:22:4:22:9 | ; | Test.kt:35:3:35:8 | ; |
-| Test.kt:24:4:24:9 | ... -> ... | Test.kt:4:2:79:2 | Exit |
+| Test.kt:24:4:24:9 | ... -> ... | Test.kt:4:2:79:2 | Normal Exit |
| Test.kt:30:15:33:3 | { ... } | Test.kt:35:3:35:8 | ; |
| Test.kt:35:3:35:8 | ; | Test.kt:38:9:38:9 | x |
| Test.kt:38:9:38:9 | x | Test.kt:38:16:41:3 | { ... } |
| Test.kt:38:9:38:9 | x | Test.kt:43:3:43:8 | ; |
| Test.kt:38:16:41:3 | { ... } | Test.kt:38:9:38:9 | x |
-| Test.kt:43:3:43:8 | ; | Test.kt:4:2:79:2 | Exit |
+| Test.kt:43:3:43:8 | ; | Test.kt:4:2:79:2 | Normal Exit |
+| Test.kt:82:1:89:1 | Exceptional Exit | Test.kt:82:1:89:1 | Exit |
+| Test.kt:82:1:89:1 | Normal Exit | Test.kt:82:1:89:1 | Exit |
| Test.kt:82:21:89:1 | { ... } | Test.kt:84:3:84:18 | x |
| Test.kt:82:21:89:1 | { ... } | Test.kt:86:4:88:2 | catch (...) |
-| Test.kt:84:3:84:18 | x | Test.kt:82:1:89:1 | Exit |
-| Test.kt:86:4:88:2 | catch (...) | Test.kt:82:1:89:1 | Exit |
+| Test.kt:84:3:84:18 | x | Test.kt:82:1:89:1 | Normal Exit |
+| Test.kt:86:4:88:2 | catch (...) | Test.kt:82:1:89:1 | Normal Exit |
+| Test.kt:91:1:98:1 | Exceptional Exit | Test.kt:91:1:98:1 | Exit |
+| Test.kt:91:1:98:1 | Normal Exit | Test.kt:91:1:98:1 | Exit |
| Test.kt:91:22:98:1 | { ... } | Test.kt:93:3:93:13 | x |
| Test.kt:91:22:98:1 | { ... } | Test.kt:95:4:97:2 | catch (...) |
-| Test.kt:93:3:93:13 | x | Test.kt:91:1:98:1 | Exit |
-| Test.kt:95:4:97:2 | catch (...) | Test.kt:91:1:98:1 | Exit |
+| Test.kt:93:3:93:13 | x | Test.kt:91:1:98:1 | Normal Exit |
+| Test.kt:95:4:97:2 | catch (...) | Test.kt:91:1:98:1 | Normal Exit |
+| Test.kt:100:1:110:1 | Normal Exit | Test.kt:100:1:110:1 | Exit |
| Test.kt:100:25:110:1 | { ... } | Test.kt:101:22:101:22 | y |
| Test.kt:100:25:110:1 | { ... } | Test.kt:105:5:109:5 | ; |
| Test.kt:101:22:101:22 | y | Test.kt:101:33:103:5 | { ... } |
@@ -28,18 +37,22 @@
| Test.kt:101:33:103:5 | { ... } | Test.kt:100:1:110:1 | Exit |
| Test.kt:105:5:109:5 | ; | Test.kt:105:20:107:5 | { ... } |
| Test.kt:105:5:109:5 | ; | Test.kt:107:16:109:5 | ... -> ... |
-| Test.kt:105:20:107:5 | { ... } | Test.kt:100:1:110:1 | Exit |
-| Test.kt:107:16:109:5 | ... -> ... | Test.kt:100:1:110:1 | Exit |
+| Test.kt:105:20:107:5 | { ... } | Test.kt:100:1:110:1 | Normal Exit |
+| Test.kt:107:16:109:5 | ... -> ... | Test.kt:100:1:110:1 | Normal Exit |
| Test.kt:107:16:109:5 | ... -> ... | Test.kt:107:27:109:5 | { ... } |
-| Test.kt:107:27:109:5 | { ... } | Test.kt:100:1:110:1 | Exit |
-| Test.kt:112:32:116:1 | { ... } | Test.kt:112:1:116:1 | Exit |
+| Test.kt:107:27:109:5 | { ... } | Test.kt:100:1:110:1 | Normal Exit |
+| Test.kt:112:1:116:1 | Exceptional Exit | Test.kt:112:1:116:1 | Exit |
+| Test.kt:112:1:116:1 | Normal Exit | Test.kt:112:1:116:1 | Exit |
+| Test.kt:112:32:116:1 | { ... } | Test.kt:112:1:116:1 | Normal Exit |
| Test.kt:112:32:116:1 | { ... } | Test.kt:113:14:113:14 | y |
-| Test.kt:113:14:113:14 | y | Test.kt:112:1:116:1 | Exit |
+| Test.kt:113:14:113:14 | y | Test.kt:112:1:116:1 | Normal Exit |
| Test.kt:113:14:113:14 | y | Test.kt:113:17:115:5 | { ... } |
-| Test.kt:113:17:115:5 | { ... } | Test.kt:112:1:116:1 | Exit |
+| Test.kt:113:17:115:5 | { ... } | Test.kt:112:1:116:1 | Normal Exit |
+| Test.kt:118:1:124:1 | Exceptional Exit | Test.kt:118:1:124:1 | Exit |
+| Test.kt:118:1:124:1 | Normal Exit | Test.kt:118:1:124:1 | Exit |
| Test.kt:118:37:124:1 | { ... } | Test.kt:121:9:121:9 | ; |
| Test.kt:118:37:124:1 | { ... } | Test.kt:122:12:122:16 | ... -> ... |
-| Test.kt:121:9:121:9 | ; | Test.kt:118:1:124:1 | Exit |
+| Test.kt:121:9:121:9 | ; | Test.kt:118:1:124:1 | Normal Exit |
| Test.kt:121:9:121:9 | ; | Test.kt:123:8:123:10 | { ... } |
-| Test.kt:122:12:122:16 | ... -> ... | Test.kt:118:1:124:1 | Exit |
-| Test.kt:123:8:123:10 | { ... } | Test.kt:118:1:124:1 | Exit |
+| Test.kt:122:12:122:16 | ... -> ... | Test.kt:118:1:124:1 | Normal Exit |
+| Test.kt:123:8:123:10 | { ... } | Test.kt:118:1:124:1 | Normal Exit |
diff --git a/java/ql/test-kotlin2/library-tests/controlflow/basic/getASuccessor.expected b/java/ql/test-kotlin2/library-tests/controlflow/basic/getASuccessor.expected
index 364b46d429e0..c4be613c5e99 100644
--- a/java/ql/test-kotlin2/library-tests/controlflow/basic/getASuccessor.expected
+++ b/java/ql/test-kotlin2/library-tests/controlflow/basic/getASuccessor.expected
@@ -1,9 +1,13 @@
#select
+| Test.kt:3:1:80:1 | Exceptional Exit | Constructor | Test.kt:3:1:80:1 | Exit | Constructor |
| Test.kt:3:1:80:1 | Exit | Constructor | file://:0:0:0:0 | | |
+| Test.kt:3:1:80:1 | Normal Exit | Constructor | Test.kt:3:1:80:1 | Exit | Constructor |
| Test.kt:3:1:80:1 | super(...) | SuperConstructorInvocationStmt | Test.kt:3:1:80:1 | { ... } | BlockStmt |
-| Test.kt:3:1:80:1 | { ... } | BlockStmt | Test.kt:3:1:80:1 | Exit | Constructor |
+| Test.kt:3:1:80:1 | { ... } | BlockStmt | Test.kt:3:1:80:1 | Normal Exit | Constructor |
| Test.kt:3:1:80:1 | { ... } | BlockStmt | Test.kt:3:1:80:1 | super(...) | SuperConstructorInvocationStmt |
+| Test.kt:4:2:79:2 | Exceptional Exit | Method | Test.kt:4:2:79:2 | Exit | Method |
| Test.kt:4:2:79:2 | Exit | Method | file://:0:0:0:0 | | |
+| Test.kt:4:2:79:2 | Normal Exit | Method | Test.kt:4:2:79:2 | Exit | Method |
| Test.kt:4:13:79:2 | { ... } | BlockStmt | Test.kt:5:3:5:16 | var ...; | LocalVariableDeclStmt |
| Test.kt:5:3:5:16 | var ...; | LocalVariableDeclStmt | Test.kt:5:16:5:16 | 0 | IntegerLiteral |
| Test.kt:5:3:5:16 | x | LocalVariableDeclExpr | Test.kt:6:3:6:18 | var ...; | LocalVariableDeclStmt |
@@ -51,7 +55,7 @@
| Test.kt:22:4:22:9 | ; | ExprStmt | Test.kt:22:8:22:9 | 40 | LongLiteral |
| Test.kt:22:8:22:9 | 40 | LongLiteral | Test.kt:22:4:22:9 | ...=... | AssignExpr |
| Test.kt:24:4:24:9 | ... -> ... | WhenBranch | Test.kt:24:4:24:9 | true | BooleanLiteral |
-| Test.kt:24:4:24:9 | return ... | ReturnStmt | Test.kt:4:2:79:2 | Exit | Method |
+| Test.kt:24:4:24:9 | return ... | ReturnStmt | Test.kt:4:2:79:2 | Normal Exit | Method |
| Test.kt:24:4:24:9 | true | BooleanLiteral | Test.kt:24:10:24:10 | INSTANCE | VarAccess |
| Test.kt:24:10:24:10 | INSTANCE | VarAccess | Test.kt:24:4:24:9 | return ... | ReturnStmt |
| Test.kt:27:3:27:8 | ...=... | AssignExpr | Test.kt:30:3:33:3 | ; | ExprStmt |
@@ -105,9 +109,11 @@
| Test.kt:77:3:77:8 | ...=... | AssignExpr | Test.kt:78:9:78:9 | INSTANCE | VarAccess |
| Test.kt:77:3:77:8 | ; | ExprStmt | Test.kt:77:7:77:8 | 40 | IntegerLiteral |
| Test.kt:77:7:77:8 | 40 | IntegerLiteral | Test.kt:77:3:77:8 | ...=... | AssignExpr |
-| Test.kt:78:3:78:8 | return ... | ReturnStmt | Test.kt:4:2:79:2 | Exit | Method |
+| Test.kt:78:3:78:8 | return ... | ReturnStmt | Test.kt:4:2:79:2 | Normal Exit | Method |
| Test.kt:78:9:78:9 | INSTANCE | VarAccess | Test.kt:78:3:78:8 | return ... | ReturnStmt |
+| Test.kt:82:1:89:1 | Exceptional Exit | Method | Test.kt:82:1:89:1 | Exit | Method |
| Test.kt:82:1:89:1 | Exit | Method | file://:0:0:0:0 | | |
+| Test.kt:82:1:89:1 | Normal Exit | Method | Test.kt:82:1:89:1 | Exit | Method |
| Test.kt:82:21:89:1 | { ... } | BlockStmt | Test.kt:83:2:88:2 | try ... | TryStmt |
| Test.kt:83:2:88:2 | try ... | TryStmt | Test.kt:83:6:86:2 | { ... } | BlockStmt |
| Test.kt:83:6:86:2 | { ... } | BlockStmt | Test.kt:84:3:84:18 | var ...; | LocalVariableDeclStmt |
@@ -116,14 +122,16 @@
| Test.kt:84:11:84:11 | o | VarAccess | Test.kt:84:11:84:18 | (...)... | CastExpr |
| Test.kt:84:11:84:18 | (...)... | CastExpr | Test.kt:84:3:84:18 | x | LocalVariableDeclExpr |
| Test.kt:84:11:84:18 | (...)... | CastExpr | Test.kt:86:4:88:2 | catch (...) | CatchClause |
-| Test.kt:85:3:85:10 | return ... | ReturnStmt | Test.kt:82:1:89:1 | Exit | Method |
+| Test.kt:85:3:85:10 | return ... | ReturnStmt | Test.kt:82:1:89:1 | Normal Exit | Method |
| Test.kt:85:10:85:10 | 1 | IntegerLiteral | Test.kt:85:3:85:10 | return ... | ReturnStmt |
| Test.kt:86:4:88:2 | catch (...) | CatchClause | Test.kt:86:11:86:31 | e | LocalVariableDeclExpr |
| Test.kt:86:11:86:31 | e | LocalVariableDeclExpr | Test.kt:86:34:88:2 | { ... } | BlockStmt |
| Test.kt:86:34:88:2 | { ... } | BlockStmt | Test.kt:87:10:87:10 | 2 | IntegerLiteral |
-| Test.kt:87:3:87:10 | return ... | ReturnStmt | Test.kt:82:1:89:1 | Exit | Method |
+| Test.kt:87:3:87:10 | return ... | ReturnStmt | Test.kt:82:1:89:1 | Normal Exit | Method |
| Test.kt:87:10:87:10 | 2 | IntegerLiteral | Test.kt:87:3:87:10 | return ... | ReturnStmt |
+| Test.kt:91:1:98:1 | Exceptional Exit | Method | Test.kt:91:1:98:1 | Exit | Method |
| Test.kt:91:1:98:1 | Exit | Method | file://:0:0:0:0 | | |
+| Test.kt:91:1:98:1 | Normal Exit | Method | Test.kt:91:1:98:1 | Exit | Method |
| Test.kt:91:22:98:1 | { ... } | BlockStmt | Test.kt:92:2:97:2 | try ... | TryStmt |
| Test.kt:92:2:97:2 | try ... | TryStmt | Test.kt:92:6:95:2 | { ... } | BlockStmt |
| Test.kt:92:6:95:2 | { ... } | BlockStmt | Test.kt:93:3:93:13 | var ...; | LocalVariableDeclStmt |
@@ -132,14 +140,16 @@
| Test.kt:93:11:93:11 | o | VarAccess | Test.kt:93:11:93:13 | ...!! | NotNullExpr |
| Test.kt:93:11:93:13 | ...!! | NotNullExpr | Test.kt:93:3:93:13 | x | LocalVariableDeclExpr |
| Test.kt:93:11:93:13 | ...!! | NotNullExpr | Test.kt:95:4:97:2 | catch (...) | CatchClause |
-| Test.kt:94:3:94:10 | return ... | ReturnStmt | Test.kt:91:1:98:1 | Exit | Method |
+| Test.kt:94:3:94:10 | return ... | ReturnStmt | Test.kt:91:1:98:1 | Normal Exit | Method |
| Test.kt:94:10:94:10 | 1 | IntegerLiteral | Test.kt:94:3:94:10 | return ... | ReturnStmt |
| Test.kt:95:4:97:2 | catch (...) | CatchClause | Test.kt:95:11:95:33 | e | LocalVariableDeclExpr |
| Test.kt:95:11:95:33 | e | LocalVariableDeclExpr | Test.kt:95:36:97:2 | { ... } | BlockStmt |
| Test.kt:95:36:97:2 | { ... } | BlockStmt | Test.kt:96:10:96:10 | 2 | IntegerLiteral |
-| Test.kt:96:3:96:10 | return ... | ReturnStmt | Test.kt:91:1:98:1 | Exit | Method |
+| Test.kt:96:3:96:10 | return ... | ReturnStmt | Test.kt:91:1:98:1 | Normal Exit | Method |
| Test.kt:96:10:96:10 | 2 | IntegerLiteral | Test.kt:96:3:96:10 | return ... | ReturnStmt |
+| Test.kt:100:1:110:1 | Exceptional Exit | Method | Test.kt:100:1:110:1 | Exit | Method |
| Test.kt:100:1:110:1 | Exit | Method | file://:0:0:0:0 | | |
+| Test.kt:100:1:110:1 | Normal Exit | Method | Test.kt:100:1:110:1 | Exit | Method |
| Test.kt:100:25:110:1 | { ... } | BlockStmt | Test.kt:101:5:103:5 | ; | ExprStmt |
| Test.kt:101:5:103:5 | ; | ExprStmt | Test.kt:101:5:103:5 | when ... | WhenExpr |
| Test.kt:101:5:103:5 | when ... | WhenExpr | Test.kt:101:9:103:5 | ... -> ... | WhenBranch |
@@ -154,7 +164,7 @@
| Test.kt:101:22:101:30 | ... (value equals) ... | ValueEQExpr | Test.kt:105:5:109:5 | ; | ExprStmt |
| Test.kt:101:27:101:30 | null | NullLiteral | Test.kt:101:22:101:30 | ... (value equals) ... | ValueEQExpr |
| Test.kt:101:33:103:5 | { ... } | BlockStmt | Test.kt:102:15:102:25 | new Exception(...) | ClassInstanceExpr |
-| Test.kt:102:9:102:25 | throw ... | ThrowStmt | Test.kt:100:1:110:1 | Exit | Method |
+| Test.kt:102:9:102:25 | throw ... | ThrowStmt | Test.kt:100:1:110:1 | Exceptional Exit | Method |
| Test.kt:102:15:102:25 | new Exception(...) | ClassInstanceExpr | Test.kt:102:9:102:25 | throw ... | ThrowStmt |
| Test.kt:105:5:109:5 | ; | ExprStmt | Test.kt:105:5:109:5 | when ... | WhenExpr |
| Test.kt:105:5:109:5 | when ... | WhenExpr | Test.kt:105:9:107:5 | ... -> ... | WhenBranch |
@@ -165,29 +175,33 @@
| Test.kt:105:14:105:17 | null | NullLiteral | Test.kt:105:9:105:17 | ... (value not-equals) ... | ValueNEExpr |
| Test.kt:105:20:107:5 | { ... } | BlockStmt | Test.kt:106:9:106:29 | ; | ExprStmt |
| Test.kt:106:9:106:29 | ; | ExprStmt | Test.kt:106:17:106:28 | "x not null" | StringLiteral |
-| Test.kt:106:9:106:29 | println(...) | MethodCall | Test.kt:100:1:110:1 | Exit | Method |
+| Test.kt:106:9:106:29 | println(...) | MethodCall | Test.kt:100:1:110:1 | Normal Exit | Method |
| Test.kt:106:17:106:28 | "x not null" | StringLiteral | Test.kt:106:9:106:29 | println(...) | MethodCall |
| Test.kt:107:16:107:16 | y | VarAccess | Test.kt:107:21:107:24 | null | NullLiteral |
-| Test.kt:107:16:107:24 | ... (value not-equals) ... | ValueNEExpr | Test.kt:100:1:110:1 | Exit | Method |
+| Test.kt:107:16:107:24 | ... (value not-equals) ... | ValueNEExpr | Test.kt:100:1:110:1 | Normal Exit | Method |
| Test.kt:107:16:107:24 | ... (value not-equals) ... | ValueNEExpr | Test.kt:107:27:109:5 | { ... } | BlockStmt |
| Test.kt:107:16:109:5 | ... -> ... | WhenBranch | Test.kt:107:16:107:16 | y | VarAccess |
| Test.kt:107:21:107:24 | null | NullLiteral | Test.kt:107:16:107:24 | ... (value not-equals) ... | ValueNEExpr |
| Test.kt:107:27:109:5 | { ... } | BlockStmt | Test.kt:108:9:108:29 | ; | ExprStmt |
| Test.kt:108:9:108:29 | ; | ExprStmt | Test.kt:108:17:108:28 | "y not null" | StringLiteral |
-| Test.kt:108:9:108:29 | println(...) | MethodCall | Test.kt:100:1:110:1 | Exit | Method |
+| Test.kt:108:9:108:29 | println(...) | MethodCall | Test.kt:100:1:110:1 | Normal Exit | Method |
| Test.kt:108:17:108:28 | "y not null" | StringLiteral | Test.kt:108:9:108:29 | println(...) | MethodCall |
+| Test.kt:112:1:116:1 | Exceptional Exit | Method | Test.kt:112:1:116:1 | Exit | Method |
| Test.kt:112:1:116:1 | Exit | Method | file://:0:0:0:0 | | |
+| Test.kt:112:1:116:1 | Normal Exit | Method | Test.kt:112:1:116:1 | Exit | Method |
| Test.kt:112:32:116:1 | { ... } | BlockStmt | Test.kt:113:5:115:5 | ; | ExprStmt |
| Test.kt:113:5:115:5 | ; | ExprStmt | Test.kt:113:5:115:5 | when ... | WhenExpr |
| Test.kt:113:5:115:5 | when ... | WhenExpr | Test.kt:113:9:115:5 | ... -> ... | WhenBranch |
-| Test.kt:113:9:113:9 | x | VarAccess | Test.kt:112:1:116:1 | Exit | Method |
+| Test.kt:113:9:113:9 | x | VarAccess | Test.kt:112:1:116:1 | Normal Exit | Method |
| Test.kt:113:9:113:9 | x | VarAccess | Test.kt:113:14:113:14 | y | VarAccess |
| Test.kt:113:9:113:14 | ... && ... | AndLogicalExpr | Test.kt:113:9:113:9 | x | VarAccess |
| Test.kt:113:9:115:5 | ... -> ... | WhenBranch | Test.kt:113:9:113:14 | ... && ... | AndLogicalExpr |
-| Test.kt:113:14:113:14 | y | VarAccess | Test.kt:112:1:116:1 | Exit | Method |
+| Test.kt:113:14:113:14 | y | VarAccess | Test.kt:112:1:116:1 | Normal Exit | Method |
| Test.kt:113:14:113:14 | y | VarAccess | Test.kt:113:17:115:5 | { ... } | BlockStmt |
-| Test.kt:113:17:115:5 | { ... } | BlockStmt | Test.kt:112:1:116:1 | Exit | Method |
+| Test.kt:113:17:115:5 | { ... } | BlockStmt | Test.kt:112:1:116:1 | Normal Exit | Method |
+| Test.kt:118:1:124:1 | Exceptional Exit | Method | Test.kt:118:1:124:1 | Exit | Method |
| Test.kt:118:1:124:1 | Exit | Method | file://:0:0:0:0 | | |
+| Test.kt:118:1:124:1 | Normal Exit | Method | Test.kt:118:1:124:1 | Exit | Method |
| Test.kt:118:37:124:1 | { ... } | BlockStmt | Test.kt:119:2:123:12 | ; | ExprStmt |
| Test.kt:119:2:123:12 | ; | ExprStmt | Test.kt:119:2:123:12 | when ... | WhenExpr |
| Test.kt:119:2:123:12 | when ... | WhenExpr | Test.kt:120:3:123:10 | ... -> ... | WhenBranch |
@@ -197,11 +211,11 @@
| Test.kt:121:4:121:4 | x | VarAccess | Test.kt:122:12:122:16 | ... -> ... | WhenBranch |
| Test.kt:121:4:121:9 | ... -> ... | WhenBranch | Test.kt:121:4:121:4 | x | VarAccess |
| Test.kt:121:9:121:9 | ; | ExprStmt | Test.kt:121:9:121:9 | y | VarAccess |
-| Test.kt:121:9:121:9 | y | VarAccess | Test.kt:118:1:124:1 | Exit | Method |
+| Test.kt:121:9:121:9 | y | VarAccess | Test.kt:118:1:124:1 | Normal Exit | Method |
| Test.kt:121:9:121:9 | y | VarAccess | Test.kt:123:8:123:10 | { ... } | BlockStmt |
| Test.kt:122:12:122:16 | ... -> ... | WhenBranch | Test.kt:122:12:122:16 | true | BooleanLiteral |
| Test.kt:122:12:122:16 | ; | ExprStmt | Test.kt:122:12:122:16 | false | BooleanLiteral |
-| Test.kt:122:12:122:16 | false | BooleanLiteral | Test.kt:118:1:124:1 | Exit | Method |
+| Test.kt:122:12:122:16 | false | BooleanLiteral | Test.kt:118:1:124:1 | Normal Exit | Method |
| Test.kt:122:12:122:16 | true | BooleanLiteral | Test.kt:122:12:122:16 | ; | ExprStmt |
-| Test.kt:123:8:123:10 | { ... } | BlockStmt | Test.kt:118:1:124:1 | Exit | Method |
+| Test.kt:123:8:123:10 | { ... } | BlockStmt | Test.kt:118:1:124:1 | Normal Exit | Method |
missingSuccessor
diff --git a/java/ql/test-kotlin2/library-tests/controlflow/basic/strictPostDominance.expected b/java/ql/test-kotlin2/library-tests/controlflow/basic/strictPostDominance.expected
index 257d82fc1a7f..df70e61a9785 100644
--- a/java/ql/test-kotlin2/library-tests/controlflow/basic/strictPostDominance.expected
+++ b/java/ql/test-kotlin2/library-tests/controlflow/basic/strictPostDominance.expected
@@ -208,6 +208,12 @@
| Test.kt:101:9:103:5 | ... -> ... | Test.kt:100:25:110:1 | { ... } |
| Test.kt:101:9:103:5 | ... -> ... | Test.kt:101:5:103:5 | ; |
| Test.kt:102:9:102:25 | throw ... | Test.kt:101:33:103:5 | { ... } |
+| Test.kt:105:5:109:5 | ; | Test.kt:100:25:110:1 | { ... } |
+| Test.kt:105:5:109:5 | ; | Test.kt:101:5:103:5 | ; |
+| Test.kt:105:5:109:5 | ; | Test.kt:101:9:103:5 | ... -> ... |
+| Test.kt:105:9:107:5 | ... -> ... | Test.kt:100:25:110:1 | { ... } |
+| Test.kt:105:9:107:5 | ... -> ... | Test.kt:101:5:103:5 | ; |
+| Test.kt:105:9:107:5 | ... -> ... | Test.kt:101:9:103:5 | ... -> ... |
| Test.kt:105:9:107:5 | ... -> ... | Test.kt:105:5:109:5 | ; |
| Test.kt:106:9:106:29 | ; | Test.kt:105:20:107:5 | { ... } |
| Test.kt:108:9:108:29 | ; | Test.kt:107:27:109:5 | { ... } |
diff --git a/java/ql/test-kotlin2/library-tests/controlflow/dominance/dominator.expected b/java/ql/test-kotlin2/library-tests/controlflow/dominance/dominator.expected
index d5ddea7a98ba..75662bfacd49 100644
--- a/java/ql/test-kotlin2/library-tests/controlflow/dominance/dominator.expected
+++ b/java/ql/test-kotlin2/library-tests/controlflow/dominance/dominator.expected
@@ -41,7 +41,7 @@
| Test.kt:21:3:24:11 | ; | Test.kt:21:3:24:11 | when ... |
| Test.kt:21:3:24:11 | when ... | Test.kt:21:7:22:9 | ... -> ... |
| Test.kt:21:7:21:7 | x | Test.kt:21:11:21:11 | 0 |
-| Test.kt:21:7:21:11 | ... < ... | Test.kt:2:2:79:2 | Exit |
+| Test.kt:21:7:21:11 | ... < ... | Test.kt:2:2:79:2 | Normal Exit |
| Test.kt:21:7:21:11 | ... < ... | Test.kt:22:4:22:9 | ; |
| Test.kt:21:7:21:11 | ... < ... | Test.kt:24:4:24:11 | ... -> ... |
| Test.kt:21:7:22:9 | ... -> ... | Test.kt:21:7:21:7 | x |
@@ -141,7 +141,7 @@
| Test.kt:92:4:93:9 | ; | Test.kt:92:4:93:9 | when ... |
| Test.kt:92:4:93:9 | when ... | Test.kt:92:8:93:9 | ... -> ... |
| Test.kt:92:8:92:8 | a | Test.kt:92:13:92:14 | 10 |
-| Test.kt:92:8:92:14 | ... (value equals) ... | Test.kt:81:2:98:2 | Exit |
+| Test.kt:92:8:92:14 | ... (value equals) ... | Test.kt:81:2:98:2 | Normal Exit |
| Test.kt:92:8:92:14 | ... (value equals) ... | Test.kt:93:5:93:9 | break |
| Test.kt:92:8:92:14 | ... (value equals) ... | Test.kt:94:4:95:12 | ; |
| Test.kt:92:8:93:9 | ... -> ... | Test.kt:92:8:92:8 | a |
diff --git a/java/ql/test-kotlin2/library-tests/exprs/PrintAst.expected b/java/ql/test-kotlin2/library-tests/exprs/PrintAst.expected
index 6a4ac3cab31d..78fc858d028e 100644
--- a/java/ql/test-kotlin2/library-tests/exprs/PrintAst.expected
+++ b/java/ql/test-kotlin2/library-tests/exprs/PrintAst.expected
@@ -3340,7 +3340,18 @@ exprs.kt:
# 154| 0: [SuperConstructorInvocationStmt] super(...)
# 154| 1: [BlockStmt] { ... }
# 174| 6: [Class] Direction
-# 174| 2: [Constructor] Direction
+# 0| 2: [Method] getEntries
+# 0| 3: [TypeAccess] EnumEntries
+# 0| 0: [TypeAccess] Direction
+# 0| 3: [Method] valueOf
+# 0| 3: [TypeAccess] Direction
+#-----| 4: (Parameters)
+# 174| 0: [Parameter] value
+# 174| 0: [TypeAccess] String
+# 0| 4: [Method] values
+# 0| 3: [TypeAccess] Direction[]
+# 0| 0: [TypeAccess] Direction
+# 174| 5: [Constructor] Direction
# 174| 5: [BlockStmt] { ... }
# 174| 0: [ExprStmt] ;
# 174| 0: [ClassInstanceExpr] new Enum(...)
@@ -3349,17 +3360,6 @@ exprs.kt:
# 174| 0: [NullLiteral] null
# 174| 1: [IntegerLiteral] 0
# 174| 1: [BlockStmt] { ... }
-# 174| 3: [Method] getEntries
-# 174| 3: [TypeAccess] EnumEntries
-# 174| 0: [TypeAccess] Direction
-# 174| 4: [Method] valueOf
-# 174| 3: [TypeAccess] Direction
-#-----| 4: (Parameters)
-# 174| 0: [Parameter] value
-# 174| 0: [TypeAccess] String
-# 174| 5: [Method] values
-# 174| 3: [TypeAccess] Direction[]
-# 174| 0: [TypeAccess] Direction
# 175| 6: [FieldDeclaration] Direction NORTH;
# 175| -1: [TypeAccess] Direction
# 175| 0: [ClassInstanceExpr] new Direction(...)
@@ -3377,17 +3377,17 @@ exprs.kt:
# 175| 0: [ClassInstanceExpr] new Direction(...)
# 175| -3: [TypeAccess] Direction
# 178| 7: [Class] Color
-# 178| 2: [Method] getEntries
-# 178| 3: [TypeAccess] EnumEntries
-# 178| 0: [TypeAccess] Color
-# 178| 3: [Method] valueOf
-# 178| 3: [TypeAccess] Color
+# 0| 2: [Method] getEntries
+# 0| 3: [TypeAccess] EnumEntries
+# 0| 0: [TypeAccess] Color
+# 0| 3: [Method] valueOf
+# 0| 3: [TypeAccess] Color
#-----| 4: (Parameters)
# 178| 0: [Parameter] value
# 178| 0: [TypeAccess] String
-# 178| 4: [Method] values
-# 178| 3: [TypeAccess] Color[]
-# 178| 0: [TypeAccess] Color
+# 0| 4: [Method] values
+# 0| 3: [TypeAccess] Color[]
+# 0| 0: [TypeAccess] Color
# 178| 5: [Constructor] Color
#-----| 4: (Parameters)
# 178| 0: [Parameter] rgb
diff --git a/java/ql/test-kotlin2/library-tests/exprs/exprs.expected b/java/ql/test-kotlin2/library-tests/exprs/exprs.expected
index 0acb9c221430..001794509ffb 100644
--- a/java/ql/test-kotlin2/library-tests/exprs/exprs.expected
+++ b/java/ql/test-kotlin2/library-tests/exprs/exprs.expected
@@ -883,6 +883,16 @@
| delegatedProperties.kt:87:34:87:46 | this | delegatedProperties.kt:87:34:87:46 | invoke | ThisAccess |
| delegatedProperties.kt:87:34:87:46 | this | delegatedProperties.kt:87:34:87:46 | invoke | ThisAccess |
| delegatedProperties.kt:87:34:87:46 | this | delegatedProperties.kt:87:34:87:46 | invoke | ThisAccess |
+| exprs.kt:0:0:0:0 | Color | file://:0:0:0:0 | | TypeAccess |
+| exprs.kt:0:0:0:0 | Color | file://:0:0:0:0 | | TypeAccess |
+| exprs.kt:0:0:0:0 | Color | file://:0:0:0:0 | | TypeAccess |
+| exprs.kt:0:0:0:0 | Color[] | file://:0:0:0:0 | | TypeAccess |
+| exprs.kt:0:0:0:0 | Direction | file://:0:0:0:0 | | TypeAccess |
+| exprs.kt:0:0:0:0 | Direction | file://:0:0:0:0 | | TypeAccess |
+| exprs.kt:0:0:0:0 | Direction | file://:0:0:0:0 | | TypeAccess |
+| exprs.kt:0:0:0:0 | Direction[] | file://:0:0:0:0 | | TypeAccess |
+| exprs.kt:0:0:0:0 | EnumEntries | file://:0:0:0:0 | | TypeAccess |
+| exprs.kt:0:0:0:0 | EnumEntries | file://:0:0:0:0 | | TypeAccess |
| exprs.kt:4:1:142:1 | int | file://:0:0:0:0 | | TypeAccess |
| exprs.kt:4:20:4:25 | int | file://:0:0:0:0 | | TypeAccess |
| exprs.kt:4:28:4:33 | int | file://:0:0:0:0 | | TypeAccess |
@@ -1461,12 +1471,7 @@
| exprs.kt:170:21:170:21 | 3 | exprs.kt:165:1:172:1 | foo | IntegerLiteral |
| exprs.kt:174:1:176:1 | 0 | exprs.kt:174:1:176:1 | Direction | IntegerLiteral |
| exprs.kt:174:1:176:1 | Direction | exprs.kt:174:1:176:1 | Direction | TypeAccess |
-| exprs.kt:174:1:176:1 | Direction | file://:0:0:0:0 | | TypeAccess |
-| exprs.kt:174:1:176:1 | Direction | file://:0:0:0:0 | | TypeAccess |
-| exprs.kt:174:1:176:1 | Direction | file://:0:0:0:0 | | TypeAccess |
-| exprs.kt:174:1:176:1 | Direction[] | file://:0:0:0:0 | | TypeAccess |
| exprs.kt:174:1:176:1 | Enum | exprs.kt:174:1:176:1 | Direction | TypeAccess |
-| exprs.kt:174:1:176:1 | EnumEntries | file://:0:0:0:0 | | TypeAccess |
| exprs.kt:174:1:176:1 | String | file://:0:0:0:0 | | TypeAccess |
| exprs.kt:174:1:176:1 | new Enum(...) | exprs.kt:174:1:176:1 | Direction | ClassInstanceExpr |
| exprs.kt:174:1:176:1 | null | exprs.kt:174:1:176:1 | Direction | NullLiteral |
@@ -1494,11 +1499,6 @@
| exprs.kt:175:25:175:28 | Direction | file://:0:0:0:0 | | TypeAccess |
| exprs.kt:175:25:175:28 | Direction.EAST | exprs.kt:0:0:0:0 | | VarAccess |
| exprs.kt:175:25:175:28 | new Direction(...) | exprs.kt:0:0:0:0 | | ClassInstanceExpr |
-| exprs.kt:178:1:182:1 | Color | file://:0:0:0:0 | | TypeAccess |
-| exprs.kt:178:1:182:1 | Color | file://:0:0:0:0 | | TypeAccess |
-| exprs.kt:178:1:182:1 | Color | file://:0:0:0:0 | | TypeAccess |
-| exprs.kt:178:1:182:1 | Color[] | file://:0:0:0:0 | | TypeAccess |
-| exprs.kt:178:1:182:1 | EnumEntries | file://:0:0:0:0 | | TypeAccess |
| exprs.kt:178:1:182:1 | String | file://:0:0:0:0 | | TypeAccess |
| exprs.kt:178:17:178:30 | 0 | exprs.kt:178:17:178:30 | Color | IntegerLiteral |
| exprs.kt:178:17:178:30 | Color | exprs.kt:178:17:178:30 | Color | TypeAccess |
diff --git a/java/ql/test-kotlin2/library-tests/exprs_typeaccess/PrintAst.expected b/java/ql/test-kotlin2/library-tests/exprs_typeaccess/PrintAst.expected
index a9cce8a012fb..3a7af6919ed8 100644
--- a/java/ql/test-kotlin2/library-tests/exprs_typeaccess/PrintAst.expected
+++ b/java/ql/test-kotlin2/library-tests/exprs_typeaccess/PrintAst.expected
@@ -73,7 +73,18 @@ A.kt:
# 20| 2: [ReturnStmt] return ...
# 20| 0: [IntegerLiteral] 5
# 23| 11: [Class] Enu
-# 23| 2: [Constructor] Enu
+# 0| 2: [Method] getEntries
+# 0| 3: [TypeAccess] EnumEntries
+# 0| 0: [TypeAccess] Enu
+# 0| 3: [Method] valueOf
+# 0| 3: [TypeAccess] Enu
+#-----| 4: (Parameters)
+# 23| 0: [Parameter] value
+# 23| 0: [TypeAccess] String
+# 0| 4: [Method] values
+# 0| 3: [TypeAccess] Enu[]
+# 0| 0: [TypeAccess] Enu
+# 23| 5: [Constructor] Enu
# 23| 5: [BlockStmt] { ... }
# 23| 0: [ExprStmt] ;
# 23| 0: [ClassInstanceExpr] new Enum(...)
@@ -82,17 +93,6 @@ A.kt:
# 23| 0: [NullLiteral] null
# 23| 1: [IntegerLiteral] 0
# 23| 1: [BlockStmt] { ... }
-# 23| 3: [Method] getEntries
-# 23| 3: [TypeAccess] EnumEntries
-# 23| 0: [TypeAccess] Enu
-# 23| 4: [Method] valueOf
-# 23| 3: [TypeAccess] Enu
-#-----| 4: (Parameters)
-# 23| 0: [Parameter] value
-# 23| 0: [TypeAccess] String
-# 23| 5: [Method] values
-# 23| 3: [TypeAccess] Enu[]
-# 23| 0: [TypeAccess] Enu
# 24| 6: [FieldDeclaration] Enu A;
# 24| -1: [TypeAccess] Enu
# 24| 0: [ClassInstanceExpr] new Enu(...)
diff --git a/java/ql/test-kotlin2/library-tests/methods/exprs.expected b/java/ql/test-kotlin2/library-tests/methods/exprs.expected
index 041ef562dfbd..accffb8beff8 100644
--- a/java/ql/test-kotlin2/library-tests/methods/exprs.expected
+++ b/java/ql/test-kotlin2/library-tests/methods/exprs.expected
@@ -223,11 +223,16 @@
| delegates.kt:10:23:10:25 | old | VarAccess |
| delegates.kt:10:26:10:31 | ", now " | StringLiteral |
| delegates.kt:10:33:10:35 | new | VarAccess |
-| enumClass.kt:1:1:4:1 | EnumClass | TypeAccess |
-| enumClass.kt:1:1:4:1 | EnumClass | TypeAccess |
-| enumClass.kt:1:1:4:1 | EnumClass | TypeAccess |
-| enumClass.kt:1:1:4:1 | EnumClass[] | TypeAccess |
-| enumClass.kt:1:1:4:1 | EnumEntries | TypeAccess |
+| enumClass.kt:0:0:0:0 | EnumClass | TypeAccess |
+| enumClass.kt:0:0:0:0 | EnumClass | TypeAccess |
+| enumClass.kt:0:0:0:0 | EnumClass | TypeAccess |
+| enumClass.kt:0:0:0:0 | EnumClass[] | TypeAccess |
+| enumClass.kt:0:0:0:0 | EnumEntries | TypeAccess |
+| enumClass.kt:0:0:0:0 | EnumEntries | TypeAccess |
+| enumClass.kt:0:0:0:0 | EnumWithFunctions | TypeAccess |
+| enumClass.kt:0:0:0:0 | EnumWithFunctions | TypeAccess |
+| enumClass.kt:0:0:0:0 | EnumWithFunctions | TypeAccess |
+| enumClass.kt:0:0:0:0 | EnumWithFunctions[] | TypeAccess |
| enumClass.kt:1:1:4:1 | String | TypeAccess |
| enumClass.kt:1:21:1:32 | 0 | IntegerLiteral |
| enumClass.kt:1:21:1:32 | Enum | TypeAccess |
@@ -258,12 +263,7 @@
| enumClass.kt:3:11:3:11 | 1 | IntegerLiteral |
| enumClass.kt:6:1:16:1 | 0 | IntegerLiteral |
| enumClass.kt:6:1:16:1 | Enum | TypeAccess |
-| enumClass.kt:6:1:16:1 | EnumEntries | TypeAccess |
| enumClass.kt:6:1:16:1 | EnumWithFunctions | TypeAccess |
-| enumClass.kt:6:1:16:1 | EnumWithFunctions | TypeAccess |
-| enumClass.kt:6:1:16:1 | EnumWithFunctions | TypeAccess |
-| enumClass.kt:6:1:16:1 | EnumWithFunctions | TypeAccess |
-| enumClass.kt:6:1:16:1 | EnumWithFunctions[] | TypeAccess |
| enumClass.kt:6:1:16:1 | String | TypeAccess |
| enumClass.kt:6:1:16:1 | new Enum(...) | ClassInstanceExpr |
| enumClass.kt:6:1:16:1 | null | NullLiteral |
diff --git a/java/ql/test-kotlin2/library-tests/methods/methods.expected b/java/ql/test-kotlin2/library-tests/methods/methods.expected
index 79f674e4d7c4..94c0d62e20b1 100644
--- a/java/ql/test-kotlin2/library-tests/methods/methods.expected
+++ b/java/ql/test-kotlin2/library-tests/methods/methods.expected
@@ -26,14 +26,14 @@ methods
| delegates.kt:8:35:11:5 | new KMutableProperty1(...) { ... } | delegates.kt:8:35:11:5 | set | set(MyClass,java.lang.String) | override, public | |
| delegates.kt:8:66:11:5 | new Function3,String,String,Unit>(...) { ... } | delegates.kt:8:66:11:5 | invoke | invoke(kotlin.reflect.KProperty,java.lang.String,java.lang.String) | final, override, public | |
| enumClass.kt:1:1:4:1 | EnumClass | enumClass.kt:0:0:0:0 | | () | static | Compiler generated |
-| enumClass.kt:1:1:4:1 | EnumClass | enumClass.kt:1:1:4:1 | getEntries | getEntries() | final, public, static | Compiler generated |
-| enumClass.kt:1:1:4:1 | EnumClass | enumClass.kt:1:1:4:1 | valueOf | valueOf(java.lang.String) | final, public, static | Compiler generated |
-| enumClass.kt:1:1:4:1 | EnumClass | enumClass.kt:1:1:4:1 | values | values() | final, public, static | Compiler generated |
+| enumClass.kt:1:1:4:1 | EnumClass | enumClass.kt:0:0:0:0 | getEntries | getEntries() | final, public, static | Compiler generated |
+| enumClass.kt:1:1:4:1 | EnumClass | enumClass.kt:0:0:0:0 | valueOf | valueOf(java.lang.String) | final, public, static | Compiler generated |
+| enumClass.kt:1:1:4:1 | EnumClass | enumClass.kt:0:0:0:0 | values | values() | final, public, static | Compiler generated |
| enumClass.kt:1:1:4:1 | EnumClass | enumClass.kt:1:22:1:31 | getV | getV() | final, public | Compiler generated |
| enumClass.kt:6:1:16:1 | EnumWithFunctions | enumClass.kt:0:0:0:0 | | () | static | Compiler generated |
-| enumClass.kt:6:1:16:1 | EnumWithFunctions | enumClass.kt:6:1:16:1 | getEntries | getEntries() | final, public, static | Compiler generated |
-| enumClass.kt:6:1:16:1 | EnumWithFunctions | enumClass.kt:6:1:16:1 | valueOf | valueOf(java.lang.String) | final, public, static | Compiler generated |
-| enumClass.kt:6:1:16:1 | EnumWithFunctions | enumClass.kt:6:1:16:1 | values | values() | final, public, static | Compiler generated |
+| enumClass.kt:6:1:16:1 | EnumWithFunctions | enumClass.kt:0:0:0:0 | getEntries | getEntries() | final, public, static | Compiler generated |
+| enumClass.kt:6:1:16:1 | EnumWithFunctions | enumClass.kt:0:0:0:0 | valueOf | valueOf(java.lang.String) | final, public, static | Compiler generated |
+| enumClass.kt:6:1:16:1 | EnumWithFunctions | enumClass.kt:0:0:0:0 | values | values() | final, public, static | Compiler generated |
| enumClass.kt:6:1:16:1 | EnumWithFunctions | enumClass.kt:13:3:13:29 | f | f(int) | abstract, public | |
| enumClass.kt:6:1:16:1 | EnumWithFunctions | enumClass.kt:14:3:14:29 | g | g(int) | abstract, public | |
| enumClass.kt:8:3:11:4 | VAL | enumClass.kt:9:5:9:30 | f | f(int) | override, public | |
diff --git a/java/ql/test-kotlin2/library-tests/methods/parameters.expected b/java/ql/test-kotlin2/library-tests/methods/parameters.expected
index f0c4ad719468..3e5485f27245 100644
--- a/java/ql/test-kotlin2/library-tests/methods/parameters.expected
+++ b/java/ql/test-kotlin2/library-tests/methods/parameters.expected
@@ -22,8 +22,8 @@
| delegates.kt:8:66:11:5 | invoke | delegates.kt:9:9:9:12 | prop | 0 |
| delegates.kt:8:66:11:5 | invoke | delegates.kt:9:15:9:17 | old | 1 |
| delegates.kt:8:66:11:5 | invoke | delegates.kt:9:20:9:22 | new | 2 |
-| enumClass.kt:1:1:4:1 | valueOf | enumClass.kt:1:1:4:1 | value | 0 |
-| enumClass.kt:6:1:16:1 | valueOf | enumClass.kt:6:1:16:1 | value | 0 |
+| enumClass.kt:0:0:0:0 | valueOf | enumClass.kt:1:1:4:1 | value | 0 |
+| enumClass.kt:0:0:0:0 | valueOf | enumClass.kt:6:1:16:1 | value | 0 |
| enumClass.kt:9:5:9:30 | f | enumClass.kt:9:20:9:25 | i | 0 |
| enumClass.kt:10:5:10:42 | g | enumClass.kt:10:20:10:25 | i | 0 |
| enumClass.kt:13:3:13:29 | f | enumClass.kt:13:18:13:23 | i | 0 |
diff --git a/java/ql/test/library-tests/controlflow/basic/bbStmts.expected b/java/ql/test/library-tests/controlflow/basic/bbStmts.expected
index 0fbf3623f089..df336ce90a22 100644
--- a/java/ql/test/library-tests/controlflow/basic/bbStmts.expected
+++ b/java/ql/test/library-tests/controlflow/basic/bbStmts.expected
@@ -1,7 +1,11 @@
+| Test.java:3:14:3:17 | Exceptional Exit | 0 | Test.java:3:14:3:17 | Exceptional Exit |
+| Test.java:3:14:3:17 | Exit | 0 | Test.java:3:14:3:17 | Exit |
| Test.java:3:14:3:17 | { ... } | 0 | Test.java:3:14:3:17 | { ... } |
| Test.java:3:14:3:17 | { ... } | 1 | Test.java:3:14:3:17 | super(...) |
-| Test.java:3:14:3:17 | { ... } | 2 | Test.java:3:14:3:17 | Exit |
+| Test.java:3:14:3:17 | { ... } | 2 | Test.java:3:14:3:17 | Normal Exit |
+| Test.java:4:14:4:17 | Exceptional Exit | 0 | Test.java:4:14:4:17 | Exceptional Exit |
| Test.java:4:14:4:17 | Exit | 0 | Test.java:4:14:4:17 | Exit |
+| Test.java:4:14:4:17 | Normal Exit | 0 | Test.java:4:14:4:17 | Normal Exit |
| Test.java:4:21:76:2 | { ... } | 0 | Test.java:4:21:76:2 | { ... } |
| Test.java:4:21:76:2 | { ... } | 1 | Test.java:5:3:5:12 | var ...; |
| Test.java:4:21:76:2 | { ... } | 2 | Test.java:5:11:5:11 | 0 |
diff --git a/java/ql/test/library-tests/controlflow/basic/bbStrictDominance.expected b/java/ql/test/library-tests/controlflow/basic/bbStrictDominance.expected
index 8440209d0a45..be658fb29158 100644
--- a/java/ql/test/library-tests/controlflow/basic/bbStrictDominance.expected
+++ b/java/ql/test/library-tests/controlflow/basic/bbStrictDominance.expected
@@ -1,4 +1,7 @@
+| Test.java:3:14:3:17 | { ... } | Test.java:3:14:3:17 | Exit |
+| Test.java:4:14:4:17 | Normal Exit | Test.java:4:14:4:17 | Exit |
| Test.java:4:21:76:2 | { ... } | Test.java:4:14:4:17 | Exit |
+| Test.java:4:21:76:2 | { ... } | Test.java:4:14:4:17 | Normal Exit |
| Test.java:4:21:76:2 | { ... } | Test.java:11:14:14:3 | { ... } |
| Test.java:4:21:76:2 | { ... } | Test.java:14:10:16:3 | { ... } |
| Test.java:4:21:76:2 | { ... } | Test.java:18:3:18:8 | ; |
@@ -21,6 +24,7 @@
| Test.java:4:21:76:2 | { ... } | Test.java:63:9:66:4 | { ... } |
| Test.java:4:21:76:2 | { ... } | Test.java:70:3:70:9 | ; |
| Test.java:18:3:18:8 | ; | Test.java:4:14:4:17 | Exit |
+| Test.java:18:3:18:8 |