diff --git a/.bazelrc b/.bazelrc
index 54a510f05dc6..679eeec77a32 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -33,10 +33,6 @@ common --@rules_dotnet//dotnet/settings:strict_deps=false
# we only configure a nightly toolchain
common --@rules_rust//rust/toolchain/channel=nightly
-# rust does not like the gold linker, while bazel does by default, so let's avoid using it
-common:linux --linkopt=-fuse-ld=lld
-common:macos --linkopt=-fuse-ld=lld
-
# Reduce this eventually to empty, once we've fixed all our usages of java, and https://github.com/bazel-contrib/rules_go/issues/4193 is fixed
common --incompatible_autoload_externally="+@rules_java,+@rules_shell"
diff --git a/Cargo.lock b/Cargo.lock
index 263b16482a98..b712c4f8d24b 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -40,9 +40,9 @@ dependencies = [
[[package]]
name = "anstream"
-version = "0.6.18"
+version = "0.6.19"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8acc5369981196006228e28809f761875c0327210a891e941f4c683b3a99529b"
+checksum = "301af1932e46185686725e0fad2f8f2aa7da69dd70bf6ecc44d6b703844a3933"
dependencies = [
"anstyle",
"anstyle-parse",
@@ -55,44 +55,44 @@ dependencies = [
[[package]]
name = "anstyle"
-version = "1.0.10"
+version = "1.0.11"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "55cc3b69f167a1ef2e161439aa98aed94e6028e5f9a59be9a6ffb47aef1651f9"
+checksum = "862ed96ca487e809f1c8e5a8447f6ee2cf102f846893800b20cebdf541fc6bbd"
[[package]]
name = "anstyle-parse"
-version = "0.2.6"
+version = "0.2.7"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b2d16507662817a6a20a9ea92df6652ee4f94f914589377d69f3b21bc5798a9"
+checksum = "4e7644824f0aa2c7b9384579234ef10eb7efb6a0deb83f9630a49594dd9c15c2"
dependencies = [
"utf8parse",
]
[[package]]
name = "anstyle-query"
-version = "1.1.2"
+version = "1.1.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "79947af37f4177cfead1110013d678905c37501914fba0efea834c3fe9a8d60c"
+checksum = "6c8bdeb6047d8983be085bab0ba1472e6dc604e7041dbf6fcd5e71523014fae9"
dependencies = [
"windows-sys 0.59.0",
]
[[package]]
name = "anstyle-wincon"
-version = "3.0.7"
+version = "3.0.9"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ca3534e77181a9cc07539ad51f2141fe32f6c3ffd4df76db8ad92346b003ae4e"
+checksum = "403f75924867bb1033c59fbf0797484329750cfbe3c4325cd33127941fabc882"
dependencies = [
"anstyle",
- "once_cell",
+ "once_cell_polyfill",
"windows-sys 0.59.0",
]
[[package]]
name = "anyhow"
-version = "1.0.98"
+version = "1.0.99"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e16d2d3311acee920a9eb8d33b8cbc1787ce4a264e85f964c2404b969bdcd487"
+checksum = "b0674a1ddeecb70197781e945de4b3b8ffb61fa939a5597bcf48503737663100"
[[package]]
name = "argfile"
@@ -136,9 +136,9 @@ dependencies = [
[[package]]
name = "autocfg"
-version = "1.4.0"
+version = "1.5.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ace50bade8e6234aa140d9a2f552bbee1db4d353f69b8217bc503490fc1a9f26"
+checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"
[[package]]
name = "base64"
@@ -160,9 +160,9 @@ checksum = "1b8e56985ec62d17e9c1001dc89c88ecd7dc08e47eba5ec7c29c7b5eeecde967"
[[package]]
name = "borsh"
-version = "1.5.5"
+version = "1.5.7"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5430e3be710b68d984d1391c854eb431a9d548640711faa54eecb1df93db91cc"
+checksum = "ad8646f98db542e39fc66e68a20b2144f6a732636df7c2354e74645faaa433ce"
dependencies = [
"cfg_aliases",
]
@@ -185,9 +185,9 @@ dependencies = [
[[package]]
name = "bumpalo"
-version = "3.16.0"
+version = "3.19.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "79296716171880943b8470b5f8d03aa55eb2e645a4874bdbb28adb49162e012c"
+checksum = "46c5e41b57b8bba42a04676d81cb89e9ee8e859a1a66f80a5a72e1cb76b34d43"
[[package]]
name = "bytemuck"
@@ -195,12 +195,6 @@ version = "1.21.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "ef657dfab802224e671f5818e9a4935f9b1957ed18e58292690cc39e7a4092a3"
-[[package]]
-name = "byteorder"
-version = "1.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
-
[[package]]
name = "camino"
version = "1.1.10"
@@ -221,25 +215,25 @@ dependencies = [
[[package]]
name = "cargo-util-schemas"
-version = "0.2.0"
+version = "0.8.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e63d2780ac94487eb9f1fea7b0d56300abc9eb488800854ca217f102f5caccca"
+checksum = "7dc1a6f7b5651af85774ae5a34b4e8be397d9cf4bc063b7e6dbd99a841837830"
dependencies = [
"semver",
"serde",
"serde-untagged",
"serde-value",
- "thiserror 1.0.69",
- "toml",
+ "thiserror",
+ "toml 0.8.23",
"unicode-xid",
"url",
]
[[package]]
name = "cargo_metadata"
-version = "0.20.0"
+version = "0.21.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4f7835cfc6135093070e95eb2b53e5d9b5c403dc3a6be6040ee026270aa82502"
+checksum = "5cfca2aaa699835ba88faf58a06342a314a950d2b9686165e038286c30316868"
dependencies = [
"camino",
"cargo-platform",
@@ -247,14 +241,14 @@ dependencies = [
"semver",
"serde",
"serde_json",
- "thiserror 2.0.12",
+ "thiserror",
]
[[package]]
name = "cc"
-version = "1.2.7"
+version = "1.2.29"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a012a0df96dd6d06ba9a1b29d6402d1a5d77c6befd2566afdc26e10603dc93d7"
+checksum = "5c1599538de2394445747c8cf7935946e3cc27e9625f889d979bfb2aaf569362"
dependencies = [
"jobserver",
"libc",
@@ -285,6 +279,18 @@ dependencies = [
"synstructure",
]
+[[package]]
+name = "chalk-derive"
+version = "0.104.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ea9b1e80910f66ae87c772247591432032ef3f6a67367ff17f8343db05beafa"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+ "synstructure",
+]
+
[[package]]
name = "chalk-ir"
version = "0.103.0"
@@ -292,7 +298,17 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "90a37d2ab99352b4caca135061e7b4ac67024b648c28ed0b787feec4bea4caed"
dependencies = [
"bitflags 2.9.1",
- "chalk-derive",
+ "chalk-derive 0.103.0",
+]
+
+[[package]]
+name = "chalk-ir"
+version = "0.104.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7047a516de16226cd17344d41a319d0ea1064bf9e60bd612ab341ab4a34bbfa8"
+dependencies = [
+ "bitflags 2.9.1",
+ "chalk-derive 0.104.0",
]
[[package]]
@@ -301,8 +317,8 @@ version = "0.103.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "c855be60e646664bc37c2496d3dc81ca5ef60520930e5e0f0057a0575aff6c19"
dependencies = [
- "chalk-derive",
- "chalk-ir",
+ "chalk-derive 0.103.0",
+ "chalk-ir 0.103.0",
"chalk-solve",
"rustc-hash 1.1.0",
"tracing",
@@ -314,10 +330,10 @@ version = "0.103.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "477ac6cdfd2013e9f93b09b036c2b607a67b2e728f4777b8422d55a79e9e3a34"
dependencies = [
- "chalk-derive",
- "chalk-ir",
+ "chalk-derive 0.103.0",
+ "chalk-ir 0.103.0",
"ena",
- "indexmap 2.9.0",
+ "indexmap 2.10.0",
"itertools 0.12.1",
"petgraph",
"rustc-hash 1.1.0",
@@ -341,9 +357,9 @@ dependencies = [
[[package]]
name = "clap"
-version = "4.5.40"
+version = "4.5.44"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "40b6887a1d8685cebccf115538db5c0efe625ccac9696ad45c409d96566e910f"
+checksum = "1c1f056bae57e3e54c3375c41ff79619ddd13460a17d7438712bd0d83fda4ff8"
dependencies = [
"clap_builder",
"clap_derive",
@@ -351,9 +367,9 @@ dependencies = [
[[package]]
name = "clap_builder"
-version = "4.5.40"
+version = "4.5.44"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e0c66c08ce9f0c698cbce5c0279d0bb6ac936d8674174fe48f736533b964f59e"
+checksum = "b3e7f4214277f3c7aa526a59dd3fbe306a370daee1f8b7b8c987069cd8e888a8"
dependencies = [
"anstream",
"anstyle",
@@ -363,9 +379,9 @@ dependencies = [
[[package]]
name = "clap_derive"
-version = "4.5.40"
+version = "4.5.41"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d2c7947ae4cc3d851207c1adb5b5e260ff0cca11446b1d6d1423788e442257ce"
+checksum = "ef4f52386a59ca4c860f7393bcf8abd8dfd91ecccc0f774635ff68e92eeef491"
dependencies = [
"heck",
"proc-macro2",
@@ -375,9 +391,9 @@ dependencies = [
[[package]]
name = "clap_lex"
-version = "0.7.4"
+version = "0.7.5"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f46ad14479a25103f283c0f10005961cf086d8dc42205bb44c46ac563475dca6"
+checksum = "b94f61472cee1439c0b966b47e3aca9ae07e45d070759512cd390ea2bebc6675"
[[package]]
name = "codeql-autobuilder-rust"
@@ -433,7 +449,7 @@ version = "0.1.0"
dependencies = [
"anyhow",
"argfile",
- "chalk-ir",
+ "chalk-ir 0.104.0",
"chrono",
"clap",
"codeql-extractor",
@@ -462,7 +478,7 @@ dependencies = [
"serde",
"serde_json",
"serde_with",
- "toml",
+ "toml 0.9.5",
"tracing",
"tracing-flame",
"tracing-subscriber",
@@ -471,9 +487,9 @@ dependencies = [
[[package]]
name = "colorchoice"
-version = "1.0.3"
+version = "1.0.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b63caa9aa9397e2d9480a9b13673856c78d8ac123288526c37d7839f2a86990"
+checksum = "b05b61dc5112cbb17e4b6cd61790d9845d13888356391624cbe7e41efeac1e75"
[[package]]
name = "core-foundation-sys"
@@ -547,9 +563,9 @@ checksum = "d0a5c400df2834b80a4c3327b3aad3a4c4cd4de0629063962b03235697506a28"
[[package]]
name = "darling"
-version = "0.20.10"
+version = "0.20.11"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6f63b86c8a8826a49b8c21f08a2d07338eec8d900540f8630dc76284be802989"
+checksum = "fc7f46116c46ff9ab3eb1597a45688b6715c6e628b5c133e288e709a29bcb4ee"
dependencies = [
"darling_core",
"darling_macro",
@@ -557,9 +573,9 @@ dependencies = [
[[package]]
name = "darling_core"
-version = "0.20.10"
+version = "0.20.11"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "95133861a8032aaea082871032f5815eb9e98cef03fa916ab4500513994df9e5"
+checksum = "0d00b9596d185e565c2207a0b01f8bd1a135483d02d9b7b0a54b11da8d53412e"
dependencies = [
"fnv",
"ident_case",
@@ -571,9 +587,9 @@ dependencies = [
[[package]]
name = "darling_macro"
-version = "0.20.10"
+version = "0.20.11"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d336a2a514f6ccccaa3e09b02d41d35330c07ddf03a62165fcec10bb561c7806"
+checksum = "fc34b93ccb385b40dc71c6fceac4b2ad23662c7eeb248cf10d529b7e055b6ead"
dependencies = [
"darling_core",
"quote",
@@ -596,9 +612,9 @@ dependencies = [
[[package]]
name = "deranged"
-version = "0.3.11"
+version = "0.4.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b42b6fa04a440b495c8b04d0e71b707c585f83cb9cb28cf8cd0d976c315e31b4"
+checksum = "9c9e6a11ca8224451684bc0d7d5a7adbf8f2fd6887261a1cfc3c0432f9d4068e"
dependencies = [
"powerfmt",
"serde",
@@ -817,21 +833,21 @@ checksum = "7ab85b9b05e3978cc9a9cf8fea7f01b494e1a09ed3037e16ba39edc7a29eb61a"
[[package]]
name = "getrandom"
-version = "0.3.1"
+version = "0.3.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "43a49c392881ce6d5c3b8cb70f98717b7c07aabbdff06687b9030dbfbe2725f8"
+checksum = "26145e563e54f2cadc477553f1ec5ee650b00862f0a58bcd12cbdc5f0ea2d2f4"
dependencies = [
"cfg-if",
"libc",
- "wasi 0.13.3+wasi-0.2.2",
- "windows-targets 0.52.6",
+ "r-efi",
+ "wasi 0.14.2+wasi-0.2.4",
]
[[package]]
name = "glob"
-version = "0.3.2"
+version = "0.3.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a8d1add55171497b4705a648c6b583acafb01d58050a51727785f0b2c8e0a2b2"
+checksum = "0cc23270f6e1808e30a928bdc84dea0b9b4136a8bc82338574f23baf47bbd280"
[[package]]
name = "globset"
@@ -860,9 +876,9 @@ checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
[[package]]
name = "hashbrown"
-version = "0.15.2"
+version = "0.15.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf151400ff0baff5465007dd2f3e717f3fe502074ca563069ce3a6629d07b289"
+checksum = "5971ac85611da7067dbfcabef3c70ebb5606018acd9e2a3903a0da507521e0d5"
dependencies = [
"allocator-api2",
"equivalent",
@@ -875,7 +891,7 @@ version = "0.10.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "7382cf6263419f2d8df38c55d7da83da5c18aef87fc7a7fc1fb1e344edfe14c1"
dependencies = [
- "hashbrown 0.15.2",
+ "hashbrown 0.15.4",
]
[[package]]
@@ -907,14 +923,15 @@ dependencies = [
[[package]]
name = "iana-time-zone"
-version = "0.1.61"
+version = "0.1.63"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "235e081f3925a06703c2d0117ea8b91f042756fd6e7a6e5d901e8ca1a996b220"
+checksum = "b0c919e5debc312ad217002b8048a17b7d83f80703865bbfcfebb0458b0b27d8"
dependencies = [
"android_system_properties",
"core-foundation-sys",
"iana-time-zone-haiku",
"js-sys",
+ "log 0.4.27",
"wasm-bindgen",
"windows-core",
]
@@ -1054,12 +1071,12 @@ dependencies = [
[[package]]
name = "indexmap"
-version = "2.9.0"
+version = "2.10.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cea70ddb795996207ad57735b50c5982d8844f38ba9ee5f1aedcfb708a2aa11e"
+checksum = "fe4cd85333e22411419a0bcae1297d25e58c9443848b11dc6a86fefe8c78a661"
dependencies = [
"equivalent",
- "hashbrown 0.15.2",
+ "hashbrown 0.15.4",
"serde",
]
@@ -1089,6 +1106,15 @@ dependencies = [
"libc",
]
+[[package]]
+name = "intrusive-collections"
+version = "0.9.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "189d0897e4cbe8c75efedf3502c18c887b05046e59d28404d4d8e46cbc4d1e86"
+dependencies = [
+ "memoffset",
+]
+
[[package]]
name = "is_terminal_polyfill"
version = "1.70.1"
@@ -1136,9 +1162,9 @@ checksum = "a037eddb7d28de1d0fc42411f501b53b75838d313908078d6698d064f3029b24"
[[package]]
name = "js-sys"
-version = "0.3.76"
+version = "0.3.77"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6717b6b5b077764fb5966237269cb3c64edddde4b14ce42647430a78ced9e7b7"
+checksum = "1cfaf33c695fc6e08064efbc1f72ec937429614f25eef83af942d0e227c3a28f"
dependencies = [
"once_cell",
"wasm-bindgen",
@@ -1146,9 +1172,9 @@ dependencies = [
[[package]]
name = "kqueue"
-version = "1.0.8"
+version = "1.1.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7447f1ca1b7b563588a205fe93dea8df60fd981423a768bc1c0ded35ed147d0c"
+checksum = "eac30106d7dce88daf4a3fcb4879ea939476d5074a9b7ddd0fb97fa4bed5596a"
dependencies = [
"kqueue-sys",
"libc",
@@ -1184,9 +1210,9 @@ checksum = "1171693293099992e19cddea4e8b849964e9846f4acee11b3948bcc337be8776"
[[package]]
name = "libredox"
-version = "0.1.3"
+version = "0.1.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0ff37bd590ca25063e35af745c343cb7a0271906fb7b37e4813e8f79f00268d"
+checksum = "1580801010e535496706ba011c15f8532df6b42297d2e471fec38ceadd8c0638"
dependencies = [
"bitflags 2.9.1",
"libc",
@@ -1211,9 +1237,9 @@ checksum = "241eaef5fd12c88705a01fc1066c48c4b36e0dd4377dcdc7ec3942cea7a69956"
[[package]]
name = "lock_api"
-version = "0.4.12"
+version = "0.4.13"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07af8b9cdd281b7915f413fa73f29ebd5d55d0d3f0155584dade1ff18cea1b17"
+checksum = "96936507f153605bddfcda068dd804796c84324ed2510809e5b2a624c81da765"
dependencies = [
"autocfg",
"scopeguard",
@@ -1269,14 +1295,14 @@ dependencies = [
[[package]]
name = "mio"
-version = "1.0.3"
+version = "1.0.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2886843bf800fba2e3377cff24abf6379b4c4d5c6681eaf9ea5b0d15090450bd"
+checksum = "78bed444cc8a2160f01cbcf811ef18cac863ad68ae8ca62092e8db51d51c761c"
dependencies = [
"libc",
"log 0.4.27",
- "wasi 0.11.0+wasi-snapshot-preview1",
- "windows-sys 0.52.0",
+ "wasi 0.11.1+wasi-snapshot-preview1",
+ "windows-sys 0.59.0",
]
[[package]]
@@ -1366,9 +1392,15 @@ dependencies = [
[[package]]
name = "once_cell"
-version = "1.20.3"
+version = "1.21.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "945462a4b81e43c4e3ba96bd7b49d834c6f61198356aa858733bc4acf3cbe62e"
+checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d"
+
+[[package]]
+name = "once_cell_polyfill"
+version = "1.70.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4895175b425cb1f87721b59f0f286c2092bd4af812243672510e1ac53e2e0ad"
[[package]]
name = "oorandom"
@@ -1400,11 +1432,21 @@ version = "0.1.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "b15813163c1d831bf4a13c3610c05c0d03b39feb07f7e09fa234dac9b15aaf39"
+[[package]]
+name = "papaya"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f92dd0b07c53a0a0c764db2ace8c541dc47320dad97c2200c2a637ab9dd2328f"
+dependencies = [
+ "equivalent",
+ "seize",
+]
+
[[package]]
name = "parking_lot"
-version = "0.12.3"
+version = "0.12.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1bf18183cf54e8d6059647fc3063646a1801cf30896933ec2311622cc4b9a27"
+checksum = "70d58bf43669b5795d1576d0641cfb6fbb2057bf629506267a92807158584a13"
dependencies = [
"lock_api",
"parking_lot_core",
@@ -1412,9 +1454,9 @@ dependencies = [
[[package]]
name = "parking_lot_core"
-version = "0.9.10"
+version = "0.9.11"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e401f977ab385c9e4e3ab30627d6f26d00e2c73eef317493c4ec6d468726cf8"
+checksum = "bc838d2a56b5b1a6c25f55575dfc605fabb63bb2365f6c2353ef9159aa69e4a5"
dependencies = [
"cfg-if",
"libc",
@@ -1478,7 +1520,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "b4c5cc86750666a3ed20bdaf5ca2a0344f9c67674cae0515bec2da16fbaa47db"
dependencies = [
"fixedbitset",
- "indexmap 2.9.0",
+ "indexmap 2.10.0",
]
[[package]]
@@ -1495,9 +1537,9 @@ checksum = "7edddbd0b52d732b21ad9a5fab5c704c14cd949e5e9a1ec5929a24fded1b904c"
[[package]]
name = "portable-atomic"
-version = "1.11.0"
+version = "1.11.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "350e9b48cbc6b0e028b0473b114454c6316e57336ee184ceab6e53f72c178b3e"
+checksum = "f84267b20a16ea918e43c6a88433c2d54fa145c92a811b5b047ccbe153674483"
[[package]]
name = "potential_utf"
@@ -1516,18 +1558,18 @@ checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
[[package]]
name = "ppv-lite86"
-version = "0.2.20"
+version = "0.2.21"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77957b295656769bb8ad2b6a6b09d897d94f05c41b069aede1fcdaa675eaea04"
+checksum = "85eae3c4ed2f50dcfe72643da4befc30deadb458a9b590d720cde2f2b1e97da9"
dependencies = [
- "zerocopy 0.7.35",
+ "zerocopy",
]
[[package]]
name = "proc-macro2"
-version = "1.0.95"
+version = "1.0.97"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "02b3e5e68a3a1a02aad3ec490a98007cbc13c37cbe84a3cd7b8e406d76e7f778"
+checksum = "d61789d7719defeb74ea5fe81f2fdfdbd28a803847077cecce2ff14e1472f6f1"
dependencies = [
"unicode-ident",
]
@@ -1554,11 +1596,17 @@ dependencies = [
"proc-macro2",
]
+[[package]]
+name = "r-efi"
+version = "5.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
+
[[package]]
name = "ra-ap-rustc_abi"
-version = "0.116.0"
+version = "0.123.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a967e3a9cd3e38b543f503978e0eccee461e3aea3f7b10e944959bff41dbe612"
+checksum = "f18c877575c259d127072e9bfc41d985202262fb4d6bfdae3d1252147c2562c2"
dependencies = [
"bitflags 2.9.1",
"ra-ap-rustc_hashes",
@@ -1568,18 +1616,18 @@ dependencies = [
[[package]]
name = "ra-ap-rustc_hashes"
-version = "0.116.0"
+version = "0.123.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ea4c755ecbbffa5743c251344f484ebe571ec7bc5b36d80b2a8ae775d1a7a40"
+checksum = "2439ed1df3472443133b66949f81080dff88089b42f825761455463709ee1cad"
dependencies = [
"rustc-stable-hash",
]
[[package]]
name = "ra-ap-rustc_index"
-version = "0.116.0"
+version = "0.123.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aca7ad7cf911538c619caa2162339fe98637e9e46f11bb0484ef96735df4d64a"
+checksum = "57a24fe0be21be1f8ebc21dcb40129214fb4cefb0f2753f3d46b6dbe656a1a45"
dependencies = [
"ra-ap-rustc_index_macros",
"smallvec",
@@ -1587,9 +1635,9 @@ dependencies = [
[[package]]
name = "ra-ap-rustc_index_macros"
-version = "0.116.0"
+version = "0.123.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8767ba551c9355bc3031be072cc4bb0381106e5e7cd275e72b7a8c76051c4070"
+checksum = "844a27ddcad0116facae2df8e741fd788662cf93dc13029cd864f2b8013b81f9"
dependencies = [
"proc-macro2",
"quote",
@@ -1598,9 +1646,20 @@ dependencies = [
[[package]]
name = "ra-ap-rustc_lexer"
-version = "0.116.0"
+version = "0.121.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6101374afb267e6c27e4e2eb0b1352e9f3504c1a8f716f619cd39244e2ed92ab"
+checksum = "22944e31fb91e9b3e75bcbc91e37d958b8c0825a6160927f2856831d2ce83b36"
+dependencies = [
+ "memchr",
+ "unicode-properties",
+ "unicode-xid",
+]
+
+[[package]]
+name = "ra-ap-rustc_lexer"
+version = "0.123.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b734cfcb577d09877799a22742f1bd398be6c00bc428d9de56d48d11ece5771"
dependencies = [
"memchr",
"unicode-properties",
@@ -1609,19 +1668,19 @@ dependencies = [
[[package]]
name = "ra-ap-rustc_parse_format"
-version = "0.116.0"
+version = "0.121.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ecd88a19f00da4f43e6727d5013444cbc399804b5046dfa2bbcd28ebed3970ce"
+checksum = "81057891bc2063ad9e353f29462fbc47a0f5072560af34428ae9313aaa5e9d97"
dependencies = [
- "ra-ap-rustc_lexer",
- "rustc-literal-escaper 0.0.2",
+ "ra-ap-rustc_lexer 0.121.0",
+ "rustc-literal-escaper",
]
[[package]]
name = "ra-ap-rustc_pattern_analysis"
-version = "0.116.0"
+version = "0.123.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bb332dd32d7850a799862533b1c021e6062558861a4ad57817bf522499fbb892"
+checksum = "75b0ee1f059b9dea0818c6c7267478926eee95ba4c7dcf89c8db32fa165d3904"
dependencies = [
"ra-ap-rustc_index",
"rustc-hash 2.1.1",
@@ -1632,12 +1691,12 @@ dependencies = [
[[package]]
name = "ra_ap_base_db"
-version = "0.0.288"
+version = "0.0.300"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "edf27fccb119fe85faf51f51847df9695d3cca30c2427fed9b4d71e6adebb54f"
+checksum = "47cac371778785196064f1a347fbbac0aafb1053786f17378bb138be59e57fc2"
dependencies = [
"dashmap",
- "indexmap 2.9.0",
+ "indexmap 2.10.0",
"la-arena",
"ra_ap_cfg",
"ra_ap_intern",
@@ -1655,9 +1714,9 @@ dependencies = [
[[package]]
name = "ra_ap_cfg"
-version = "0.0.288"
+version = "0.0.300"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3cea86a5d6e84fd73824c26f52442807af911db038db821124b2ac65fac24209"
+checksum = "6789ed14467e6625bef45b29555844d0168d8af1bea9edb0f1d44f0a9b69f398"
dependencies = [
"ra_ap_intern",
"ra_ap_tt",
@@ -1667,19 +1726,19 @@ dependencies = [
[[package]]
name = "ra_ap_edition"
-version = "0.0.288"
+version = "0.0.300"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fb5538d534eeb8526071610664dc64b71ca336b78f6933ff7241d10c1f37e91b"
+checksum = "637b74c692dc9d9b44394f8c0f91c063e1b6223c6e54f4ee89c943db2f2ee26e"
[[package]]
name = "ra_ap_hir"
-version = "0.0.288"
+version = "0.0.300"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "44796828650900565917ddcc944fecdf6c7d5c3a8a31141f17268ea8c1d2e6f0"
+checksum = "a94c69a3830f0b6fbc36c1d098fcc9430f63c8d47ee6f93e3d6810c3bf440296"
dependencies = [
"arrayvec",
"either",
- "indexmap 2.9.0",
+ "indexmap 2.10.0",
"itertools 0.14.0",
"ra_ap_base_db",
"ra_ap_cfg",
@@ -1699,9 +1758,9 @@ dependencies = [
[[package]]
name = "ra_ap_hir_def"
-version = "0.0.288"
+version = "0.0.300"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8949b2fb362a1e4eab4d90c7299f0fad3f2c887d9f7d9c286ac6530da4141f85"
+checksum = "7d94fcf7743db2f4f7e2c2911563847eb8efe2b7fb9fa430c107f0ac05962254"
dependencies = [
"arrayvec",
"bitflags 2.9.1",
@@ -1709,7 +1768,7 @@ dependencies = [
"drop_bomb",
"either",
"fst",
- "indexmap 2.9.0",
+ "indexmap 2.10.0",
"itertools 0.14.0",
"la-arena",
"ra-ap-rustc_abi",
@@ -1737,9 +1796,9 @@ dependencies = [
[[package]]
name = "ra_ap_hir_expand"
-version = "0.0.288"
+version = "0.0.300"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22457a431b5eeb67517e03266fddefe48839b060a674a6b18bd84269012ede1e"
+checksum = "67ea3f6a0ba0c1e8b63f4a41bc596c07aeb2db2f99b67fa077820cfb5fce58bd"
dependencies = [
"cov-mark",
"either",
@@ -1765,20 +1824,20 @@ dependencies = [
[[package]]
name = "ra_ap_hir_ty"
-version = "0.0.288"
+version = "0.0.300"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3a4b7a7531414203e11ae447627e2909250eff392c06278ab53ae2a022ecc9fc"
+checksum = "eccf6c291a88892e59e7591e081da8b9158f8c0b1ed9cb9b73d02d29a0d3d6d9"
dependencies = [
"arrayvec",
"bitflags 2.9.1",
- "chalk-derive",
- "chalk-ir",
+ "chalk-derive 0.103.0",
+ "chalk-ir 0.103.0",
"chalk-recursive",
"chalk-solve",
"cov-mark",
"either",
"ena",
- "indexmap 2.9.0",
+ "indexmap 2.10.0",
"itertools 0.14.0",
"la-arena",
"oorandom",
@@ -1806,9 +1865,9 @@ dependencies = [
[[package]]
name = "ra_ap_ide_db"
-version = "0.0.288"
+version = "0.0.300"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77741ceb096d4f5ecf5384210ea5a2b46878125047c6b0df2bdcfac08a20ea0c"
+checksum = "0bbbc97cc9837f91100711b65fb0d8ce9d7ed8da0dc418e08678d973d53da6a3"
dependencies = [
"arrayvec",
"bitflags 2.9.1",
@@ -1816,7 +1875,7 @@ dependencies = [
"crossbeam-channel",
"either",
"fst",
- "indexmap 2.9.0",
+ "indexmap 2.10.0",
"itertools 0.14.0",
"line-index",
"memchr",
@@ -1840,9 +1899,9 @@ dependencies = [
[[package]]
name = "ra_ap_intern"
-version = "0.0.288"
+version = "0.0.300"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4a1872cd5a425db6d5247a7deca11526e3104757f6732447ac6ee93c3e795725"
+checksum = "10f4785a674a41f9f52414fb7f19ab9a1d6886cad572e68721a883b0b85c256b"
dependencies = [
"dashmap",
"hashbrown 0.14.5",
@@ -1852,9 +1911,9 @@ dependencies = [
[[package]]
name = "ra_ap_load-cargo"
-version = "0.0.288"
+version = "0.0.300"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f30f5433f056594b02f1879c5c2ce76ea9fd395f21e2a55df6ce3229db993caa"
+checksum = "f3be9990782fd2c2d90b67e2e0b4a86e7412ec8a0719950d9a68292924e85691"
dependencies = [
"anyhow",
"crossbeam-channel",
@@ -1873,13 +1932,13 @@ dependencies = [
[[package]]
name = "ra_ap_mbe"
-version = "0.0.288"
+version = "0.0.300"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "222a993acaec35e90c08357aecd530b7170cc3a7f13b3ddfd15a200029ccd555"
+checksum = "5b713f4d927f9d86391f66237019b8e5dbcad4ddbbe37c91c2e21adca258b9aa"
dependencies = [
"arrayvec",
"cov-mark",
- "ra-ap-rustc_lexer",
+ "ra-ap-rustc_lexer 0.123.0",
"ra_ap_intern",
"ra_ap_parser",
"ra_ap_span",
@@ -1892,33 +1951,33 @@ dependencies = [
[[package]]
name = "ra_ap_parser"
-version = "0.0.288"
+version = "0.0.300"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1c5693f5efd27832e1ac572ea756a1a4a3f7eba07f1287268ca111710971c2e5"
+checksum = "0d3fb8a5891c1c1d6fba5e58caa86b88f831990c878e361c54c1c1ff44ca8401"
dependencies = [
"drop_bomb",
- "ra-ap-rustc_lexer",
+ "ra-ap-rustc_lexer 0.123.0",
"ra_ap_edition",
- "rustc-literal-escaper 0.0.3",
+ "rustc-literal-escaper",
"tracing",
]
[[package]]
name = "ra_ap_paths"
-version = "0.0.288"
+version = "0.0.300"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "39418eff64e59d4bf90dd825ac7d242576e9554669824ebc55a6628bde0aaf10"
+checksum = "9ccd5cfd0dae89ab2c70c4e5aa646f64bb8b5591622477342863c23a5f32dabc"
dependencies = [
"camino",
]
[[package]]
name = "ra_ap_proc_macro_api"
-version = "0.0.288"
+version = "0.0.300"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "14a315af8c4a9379c26abe7baa143d62e3975ff26f27c65332f9a5edccc56d38"
+checksum = "dae43c707bfb78f1b841ffb3731cc7876550463306c3b3986c20abd31033e7a2"
dependencies = [
- "indexmap 2.9.0",
+ "indexmap 2.10.0",
"ra_ap_intern",
"ra_ap_paths",
"ra_ap_span",
@@ -1933,9 +1992,9 @@ dependencies = [
[[package]]
name = "ra_ap_profile"
-version = "0.0.288"
+version = "0.0.300"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08274a0adbf8255f8b2672302452e31bbb2ed4d38324da9c72a7bf9cf1428483"
+checksum = "95a7b93ca94cf0821e8bcac6bf8464cc94d7b3cbe63ffb74946a58ad03991fae"
dependencies = [
"cfg-if",
"libc",
@@ -1945,9 +2004,9 @@ dependencies = [
[[package]]
name = "ra_ap_project_model"
-version = "0.0.288"
+version = "0.0.300"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "33deecb3724faf91f13b0f1b5115af7c4f5c9dc1dfbbf45f55261aa28f874838"
+checksum = "0751b9433a0dd49c6ae58c9572faf9557d2b53818370d72112b3adeaae5eabc4"
dependencies = [
"anyhow",
"cargo_metadata",
@@ -1965,15 +2024,16 @@ dependencies = [
"serde",
"serde_derive",
"serde_json",
+ "temp-dir",
"tracing",
"triomphe",
]
[[package]]
name = "ra_ap_query-group-macro"
-version = "0.0.288"
+version = "0.0.300"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5fdefdc9c8d6fd7d85ac572649378e83266262e09400bfdb7c8a7407d3cc2a3e"
+checksum = "5a82732eb8f5dc592d1d8d9bee23c1d66532e39293f02e23c7a546b60b35072b"
dependencies = [
"proc-macro2",
"quote",
@@ -1982,9 +2042,9 @@ dependencies = [
[[package]]
name = "ra_ap_span"
-version = "0.0.288"
+version = "0.0.300"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c20071c89e1f7dd63c803130634f4bb6ce7783dc0e7ff90839d1d0f4e625b7a8"
+checksum = "c498ddf2d71705dcef9fb142269c0027c959a5eb17c435eea5466af7c3b9c47c"
dependencies = [
"hashbrown 0.14.5",
"la-arena",
@@ -1998,9 +2058,9 @@ dependencies = [
[[package]]
name = "ra_ap_stdx"
-version = "0.0.288"
+version = "0.0.300"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "552df390b26624eca7936aea1dbbb3786d7a12477e26ef917ffabba19f75ad44"
+checksum = "26ade567b0d692c7efd4ceb921cdbe182beca0b5af9a5cf05c07cf0e14db512a"
dependencies = [
"crossbeam-channel",
"crossbeam-utils",
@@ -2014,9 +2074,9 @@ dependencies = [
[[package]]
name = "ra_ap_syntax"
-version = "0.0.288"
+version = "0.0.300"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a78db1a9966c0fa05446b8185da35a325680741119366c6246e4a9800f29143a"
+checksum = "dba62d25b0296eb095d9db77e56d096417a89db4f4de1956add0d472ebcaf922"
dependencies = [
"either",
"itertools 0.14.0",
@@ -2024,7 +2084,7 @@ dependencies = [
"ra_ap_stdx",
"rowan",
"rustc-hash 2.1.1",
- "rustc-literal-escaper 0.0.3",
+ "rustc-literal-escaper",
"smol_str",
"tracing",
"triomphe",
@@ -2032,9 +2092,9 @@ dependencies = [
[[package]]
name = "ra_ap_syntax-bridge"
-version = "0.0.288"
+version = "0.0.300"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e69ef7fad8598d5c9f14a375d56ec12200fa927bc805b600af419611f4642fdb"
+checksum = "664466f2e824e285b671366f81128aa4a91b501fedbf7956a6bfb1f13d8b0b39"
dependencies = [
"ra_ap_intern",
"ra_ap_parser",
@@ -2047,9 +2107,9 @@ dependencies = [
[[package]]
name = "ra_ap_toolchain"
-version = "0.0.288"
+version = "0.0.300"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "628f3f190def67b1116d8bdd6ec4f6f206fada2c93b84ba71086d60c63429282"
+checksum = "2ef82cfc5eb8f9d4a3be9876ce019b78fbfdb8ff4f7e4dee9e384d65122096ab"
dependencies = [
"camino",
"home",
@@ -2057,12 +2117,12 @@ dependencies = [
[[package]]
name = "ra_ap_tt"
-version = "0.0.288"
+version = "0.0.300"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e050f4ad13df59e90e38332860304a3e85ff2fa8d4585b8cc44fc982923c82b1"
+checksum = "cbc858f5208f0d00f8638d14ab5ffab5d1bc79ad7fe1db5c5e0d478b9a02155c"
dependencies = [
"arrayvec",
- "ra-ap-rustc_lexer",
+ "ra-ap-rustc_lexer 0.123.0",
"ra_ap_intern",
"ra_ap_stdx",
"text-size",
@@ -2070,13 +2130,13 @@ dependencies = [
[[package]]
name = "ra_ap_vfs"
-version = "0.0.288"
+version = "0.0.300"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "62082190f0b3551e4d941bcaaac51a7c39c85b2e193bcc50d0807e1701da4083"
+checksum = "e065b27829f5281d2ffc41de72551a0e4c4f49a9989ba7721676f414100c8af2"
dependencies = [
"crossbeam-channel",
"fst",
- "indexmap 2.9.0",
+ "indexmap 2.10.0",
"nohash-hasher",
"ra_ap_paths",
"ra_ap_stdx",
@@ -2086,9 +2146,9 @@ dependencies = [
[[package]]
name = "ra_ap_vfs-notify"
-version = "0.0.288"
+version = "0.0.300"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "efd7cfa1095b81bd1994ab70e5543c97a8733987eb0ddf390cf3ad58d4e2dc57"
+checksum = "5a3c795e86c9b5fcdbb99145e401a0d6348ed471ac96f1b7de151c0abe07a5af"
dependencies = [
"crossbeam-channel",
"notify",
@@ -2103,9 +2163,9 @@ dependencies = [
[[package]]
name = "rand"
-version = "0.9.1"
+version = "0.9.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9fbfd9d094a40bf3ae768db9361049ace4c0e04a4fd6b359518bd7b73a73dd97"
+checksum = "6db2770f06117d490610c7488547d543617b21bfa07796d7a12f6f1bd53850d1"
dependencies = [
"rand_chacha",
"rand_core",
@@ -2123,12 +2183,11 @@ dependencies = [
[[package]]
name = "rand_core"
-version = "0.9.2"
+version = "0.9.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a509b1a2ffbe92afab0e55c8fd99dea1c280e8171bd2d88682bb20bc41cbc2c"
+checksum = "99d9a13982dcf210057a8a78572b2217b667c3beacbf3a0d8b454f6f82837d38"
dependencies = [
"getrandom",
- "zerocopy 0.8.20",
]
[[package]]
@@ -2153,9 +2212,9 @@ dependencies = [
[[package]]
name = "redox_syscall"
-version = "0.5.8"
+version = "0.5.13"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "03a862b389f93e68874fbf580b9de08dd02facb9a788ebadaf4a3fd33cf58834"
+checksum = "0d04b7d0ee6b4a0207a0a7adb104d23ecb0b47d6beae7152d0fa34b692b29fd6"
dependencies = [
"bitflags 2.9.1",
]
@@ -2259,21 +2318,15 @@ checksum = "357703d41365b4b27c590e3ed91eabb1b663f07c4c084095e60cbed4362dff0d"
[[package]]
name = "rustc-literal-escaper"
-version = "0.0.2"
+version = "0.0.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0041b6238913c41fe704213a4a9329e2f685a156d1781998128b4149c230ad04"
-
-[[package]]
-name = "rustc-literal-escaper"
-version = "0.0.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "78744cd17f5d01c75b709e49807d1363e02a940ccee2e9e72435843fdb0d076e"
+checksum = "ab03008eb631b703dd16978282ae36c73282e7922fe101a4bd072a40ecea7b8b"
[[package]]
name = "rustc-stable-hash"
-version = "0.1.1"
+version = "0.1.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2febf9acc5ee5e99d1ad0afcdbccc02d87aa3f857a1f01f825b80eacf8edfcd1"
+checksum = "781442f29170c5c93b7185ad559492601acdc71d5bb0706f5868094f45cfcd08"
[[package]]
name = "rustc_apfloat"
@@ -2285,24 +2338,32 @@ dependencies = [
"smallvec",
]
+[[package]]
+name = "rustversion"
+version = "1.0.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a0d197bd2c9dc6e53b84da9556a69ba4cdfab8619eb41a8bd1cc2027a0f6b1d"
+
[[package]]
name = "ryu"
-version = "1.0.19"
+version = "1.0.20"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ea1a2d0a644769cc99faa24c3ad26b379b786fe7c36fd3c546254801650e6dd"
+checksum = "28d3b2b1366ec20994f1fd18c3c594f05c5dd4bc44d8bb0c1c632c8d6829481f"
[[package]]
name = "salsa"
-version = "0.22.0"
+version = "0.23.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8fff508e3d6ef42a32607f7538e17171a877a12015e32036f46e99d00c95781"
+checksum = "2e235afdb8e510f38a07138fbe5a0b64691894358a9c0cbd813b1aade110efc9"
dependencies = [
"boxcar",
"crossbeam-queue",
- "dashmap",
- "hashbrown 0.15.2",
+ "crossbeam-utils",
+ "hashbrown 0.15.4",
"hashlink",
- "indexmap 2.9.0",
+ "indexmap 2.10.0",
+ "intrusive-collections",
+ "papaya",
"parking_lot",
"portable-atomic",
"rayon",
@@ -2316,17 +2377,16 @@ dependencies = [
[[package]]
name = "salsa-macro-rules"
-version = "0.22.0"
+version = "0.23.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ea72b3c06f2ce6350fe3a0eeb7aaaf842d1d8352b706973c19c4f02e298a87c"
+checksum = "2edb86a7e9c91f6d30c9ce054312721dbe773a162db27bbfae834d16177b30ce"
[[package]]
name = "salsa-macros"
-version = "0.22.0"
+version = "0.23.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ce92025bc160b27814a207cb78d680973af17f863c7f4fc56cf3a535e22f378"
+checksum = "d0778d6e209051bc4e75acfe83bcd7848601ec3dbe9c3dbb982829020e9128af"
dependencies = [
- "heck",
"proc-macro2",
"quote",
"syn",
@@ -2354,6 +2414,18 @@ dependencies = [
"serde_json",
]
+[[package]]
+name = "schemars"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "82d20c4491bc164fa2f6c5d44565947a52ad80b9505d8e36f8d54c27c739fcd0"
+dependencies = [
+ "dyn-clone",
+ "ref-cast",
+ "serde",
+ "serde_json",
+]
+
[[package]]
name = "scoped-tls"
version = "1.0.1"
@@ -2366,6 +2438,16 @@ version = "1.2.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
+[[package]]
+name = "seize"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e4b8d813387d566f627f3ea1b914c068aac94c40ae27ec43f5f33bde65abefe7"
+dependencies = [
+ "libc",
+ "windows-sys 0.52.0",
+]
+
[[package]]
name = "semver"
version = "1.0.26"
@@ -2418,9 +2500,9 @@ dependencies = [
[[package]]
name = "serde_json"
-version = "1.0.140"
+version = "1.0.142"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "20068b6e96dc6c9bd23e01df8827e6c7e1f2fddd43c21810382803c136b99373"
+checksum = "030fedb782600dcbd6f02d479bf0d817ac3bb40d644745b769d6a96bc3afc5a7"
dependencies = [
"itoa",
"memchr",
@@ -2437,18 +2519,28 @@ dependencies = [
"serde",
]
+[[package]]
+name = "serde_spanned"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "40734c41988f7306bb04f0ecf60ec0f3f1caa34290e4e8ea471dcd3346483b83"
+dependencies = [
+ "serde",
+]
+
[[package]]
name = "serde_with"
-version = "3.13.0"
+version = "3.14.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf65a400f8f66fb7b0552869ad70157166676db75ed8181f8104ea91cf9d0b42"
+checksum = "f2c45cd61fefa9db6f254525d46e392b852e0e61d9a1fd36e5bd183450a556d5"
dependencies = [
"base64",
"chrono",
"hex",
"indexmap 1.9.3",
- "indexmap 2.9.0",
- "schemars",
+ "indexmap 2.10.0",
+ "schemars 0.9.0",
+ "schemars 1.0.4",
"serde",
"serde_derive",
"serde_json",
@@ -2458,9 +2550,9 @@ dependencies = [
[[package]]
name = "serde_with_macros"
-version = "3.13.0"
+version = "3.14.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "81679d9ed988d5e9a5e6531dc3f2c28efbd639cbd1dfb628df08edea6004da77"
+checksum = "de90945e6565ce0d9a25098082ed4ee4002e047cb59892c318d66821e14bb30f"
dependencies = [
"darling",
"proc-macro2",
@@ -2474,7 +2566,7 @@ version = "0.9.34+deprecated"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "6a8b1a1a2ebf674015cc02edccce75287f1a0130d394307b36743c2f5d504b47"
dependencies = [
- "indexmap 2.9.0",
+ "indexmap 2.10.0",
"itoa",
"ryu",
"serde",
@@ -2532,9 +2624,9 @@ checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
[[package]]
name = "syn"
-version = "2.0.103"
+version = "2.0.104"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e4307e30089d6fd6aff212f2da3a1f9e32f3223b1f010fb09b7c95f90f3ca1e8"
+checksum = "17b6f705963418cdb9927482fa304bc562ece2fdd4f616084c50b7023b435a40"
dependencies = [
"proc-macro2",
"quote",
@@ -2543,15 +2635,21 @@ dependencies = [
[[package]]
name = "synstructure"
-version = "0.13.1"
+version = "0.13.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8af7666ab7b6390ab78131fb5b0fce11d6b7a6951602017c35fa82800708971"
+checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2"
dependencies = [
"proc-macro2",
"quote",
"syn",
]
+[[package]]
+name = "temp-dir"
+version = "0.1.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "83176759e9416cf81ee66cb6508dbfe9c96f20b8b56265a39917551c23c70964"
+
[[package]]
name = "text-size"
version = "1.1.1"
@@ -2564,33 +2662,13 @@ version = "0.2.14"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "144f754d318415ac792f9d69fc87abbbfc043ce2ef041c60f16ad828f638717d"
-[[package]]
-name = "thiserror"
-version = "1.0.69"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6aaf5339b578ea85b50e080feb250a3e8ae8cfcdff9a461c9ec2904bc923f52"
-dependencies = [
- "thiserror-impl 1.0.69",
-]
-
[[package]]
name = "thiserror"
version = "2.0.12"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "567b8a2dae586314f7be2a752ec7474332959c6460e02bde30d702a66d488708"
dependencies = [
- "thiserror-impl 2.0.12",
-]
-
-[[package]]
-name = "thiserror-impl"
-version = "1.0.69"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
+ "thiserror-impl",
]
[[package]]
@@ -2616,9 +2694,9 @@ dependencies = [
[[package]]
name = "time"
-version = "0.3.37"
+version = "0.3.41"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "35e7868883861bd0e56d9ac6efcaaca0d6d5d82a2a7ec8209ff492c07cf37b21"
+checksum = "8a7619e19bc266e0f9c5e6686659d394bc57973859340060a69221e57dbc0c40"
dependencies = [
"deranged",
"itoa",
@@ -2631,15 +2709,15 @@ dependencies = [
[[package]]
name = "time-core"
-version = "0.1.2"
+version = "0.1.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ef927ca75afb808a4d64dd374f00a2adf8d0fcff8e7b184af886c3c87ec4a3f3"
+checksum = "c9e9a38711f559d9e3ce1cdb06dd7c5b8ea546bc90052da6d06bb76da74bb07c"
[[package]]
name = "time-macros"
-version = "0.2.19"
+version = "0.2.22"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2834e6017e3e5e4b9834939793b282bc03b37a3336245fa820e35e233e2a85de"
+checksum = "3526739392ec93fd8b359c8e98514cb3e8e021beb4e5f597b00a0221f8ed8a49"
dependencies = [
"num-conv",
"time-core",
@@ -2662,11 +2740,26 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "dc1beb996b9d83529a9e75c17a1686767d148d70663143c7854d8b4a09ced362"
dependencies = [
"serde",
- "serde_spanned",
- "toml_datetime",
+ "serde_spanned 0.6.9",
+ "toml_datetime 0.6.11",
"toml_edit",
]
+[[package]]
+name = "toml"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75129e1dc5000bfbaa9fee9d1b21f974f9fbad9daec557a521ee6e080825f6e8"
+dependencies = [
+ "indexmap 2.10.0",
+ "serde",
+ "serde_spanned 1.0.0",
+ "toml_datetime 0.7.0",
+ "toml_parser",
+ "toml_writer",
+ "winnow",
+]
+
[[package]]
name = "toml_datetime"
version = "0.6.11"
@@ -2676,26 +2769,50 @@ dependencies = [
"serde",
]
+[[package]]
+name = "toml_datetime"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bade1c3e902f58d73d3f294cd7f20391c1cb2fbcb643b73566bc773971df91e3"
+dependencies = [
+ "serde",
+]
+
[[package]]
name = "toml_edit"
version = "0.22.27"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "41fe8c660ae4257887cf66394862d21dbca4a6ddd26f04a3560410406a2f819a"
dependencies = [
- "indexmap 2.9.0",
+ "indexmap 2.10.0",
"serde",
- "serde_spanned",
- "toml_datetime",
+ "serde_spanned 0.6.9",
+ "toml_datetime 0.6.11",
"toml_write",
"winnow",
]
+[[package]]
+name = "toml_parser"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b551886f449aa90d4fe2bdaa9f4a2577ad2dde302c61ecf262d80b116db95c10"
+dependencies = [
+ "winnow",
+]
+
[[package]]
name = "toml_write"
version = "0.1.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "5d99f8c9a7727884afe522e9bd5edbfc91a3312b36a77b5fb8926e4c31a41801"
+[[package]]
+name = "toml_writer"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fcc842091f2def52017664b53082ecbbeb5c7731092bad69d2c63050401dfd64"
+
[[package]]
name = "tracing"
version = "0.1.41"
@@ -2709,9 +2826,9 @@ dependencies = [
[[package]]
name = "tracing-attributes"
-version = "0.1.28"
+version = "0.1.30"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "395ae124c09f9e6918a2310af6038fba074bcf474ac352496d5910dd59a2226d"
+checksum = "81383ab64e72a7a8b8e13130c49e3dab29def6d0c7d76a03087b3cf71c5c6903"
dependencies = [
"proc-macro2",
"quote",
@@ -2720,9 +2837,9 @@ dependencies = [
[[package]]
name = "tracing-core"
-version = "0.1.33"
+version = "0.1.34"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e672c95779cf947c5311f83787af4fa8fffd12fb27e4993211a84bdfd9610f9c"
+checksum = "b9d12581f227e93f094d3af2ae690a574abb8a2b9b7a96e7cfe9647b2b617678"
dependencies = [
"once_cell",
"valuable",
@@ -2866,9 +2983,9 @@ checksum = "a3e5df347f0bf3ec1d670aad6ca5c6a1859cd9ea61d2113125794654ccced68f"
[[package]]
name = "unicode-ident"
-version = "1.0.17"
+version = "1.0.18"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "00e2473a93778eb0bad35909dff6a10d28e63f792f16ed15e404fca9d5eeedbe"
+checksum = "5a5f39404a5da50712a4c1eecf25e90dd62b613502b7e925fd4e4d19b5c96512"
[[package]]
name = "unicode-properties"
@@ -2913,9 +3030,9 @@ checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
[[package]]
name = "valuable"
-version = "0.1.0"
+version = "0.1.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "830b7e5d4d90034032940e4ace0d9a9a057e7a45cd94e6c007832e39edb82f6d"
+checksum = "ba73ea9cf16a25df0c8caa16c51acb937d5712a8429db78a3ee29d5dcacd3a65"
[[package]]
name = "version_check"
@@ -2935,35 +3052,36 @@ dependencies = [
[[package]]
name = "wasi"
-version = "0.11.0+wasi-snapshot-preview1"
+version = "0.11.1+wasi-snapshot-preview1"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
+checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
[[package]]
name = "wasi"
-version = "0.13.3+wasi-0.2.2"
+version = "0.14.2+wasi-0.2.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26816d2e1a4a36a2940b96c5296ce403917633dff8f3440e9b236ed6f6bacad2"
+checksum = "9683f9a5a998d873c0d21fcbe3c083009670149a8fab228644b8bd36b2c48cb3"
dependencies = [
"wit-bindgen-rt",
]
[[package]]
name = "wasm-bindgen"
-version = "0.2.99"
+version = "0.2.100"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a474f6281d1d70c17ae7aa6a613c87fce69a127e2624002df63dcb39d6cf6396"
+checksum = "1edc8929d7499fc4e8f0be2262a241556cfc54a0bea223790e71446f2aab1ef5"
dependencies = [
"cfg-if",
"once_cell",
+ "rustversion",
"wasm-bindgen-macro",
]
[[package]]
name = "wasm-bindgen-backend"
-version = "0.2.99"
+version = "0.2.100"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f89bb38646b4f81674e8f5c3fb81b562be1fd936d84320f3264486418519c79"
+checksum = "2f0a0651a5c2bc21487bde11ee802ccaf4c51935d0d3d42a6101f98161700bc6"
dependencies = [
"bumpalo",
"log 0.4.27",
@@ -2975,9 +3093,9 @@ dependencies = [
[[package]]
name = "wasm-bindgen-macro"
-version = "0.2.99"
+version = "0.2.100"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2cc6181fd9a7492eef6fef1f33961e3695e4579b9872a6f7c83aee556666d4fe"
+checksum = "7fe63fc6d09ed3792bd0897b314f53de8e16568c2b3f7982f468c0bf9bd0b407"
dependencies = [
"quote",
"wasm-bindgen-macro-support",
@@ -2985,9 +3103,9 @@ dependencies = [
[[package]]
name = "wasm-bindgen-macro-support"
-version = "0.2.99"
+version = "0.2.100"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "30d7a95b763d3c45903ed6c81f156801839e5ee968bb07e534c44df0fcd330c2"
+checksum = "8ae87ea40c9f689fc23f209965b6fb8a99ad69aeeb0231408be24920604395de"
dependencies = [
"proc-macro2",
"quote",
@@ -2998,9 +3116,12 @@ dependencies = [
[[package]]
name = "wasm-bindgen-shared"
-version = "0.2.99"
+version = "0.2.100"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "943aab3fdaaa029a6e0271b35ea10b72b943135afe9bffca82384098ad0e06a6"
+checksum = "1a05d73b933a847d6cccdda8f838a22ff101ad9bf93e33684f39c1f5f0eece3d"
+dependencies = [
+ "unicode-ident",
+]
[[package]]
name = "winapi"
@@ -3035,18 +3156,62 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
[[package]]
name = "windows-core"
-version = "0.52.0"
+version = "0.61.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "33ab640c8d7e35bf8ba19b884ba838ceb4fba93a4e8c65a9059d08afcfc683d9"
+checksum = "c0fdd3ddb90610c7638aa2b3a3ab2904fb9e5cdbecc643ddb3647212781c4ae3"
dependencies = [
- "windows-targets 0.52.6",
+ "windows-implement",
+ "windows-interface",
+ "windows-link",
+ "windows-result",
+ "windows-strings",
+]
+
+[[package]]
+name = "windows-implement"
+version = "0.60.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a47fddd13af08290e67f4acabf4b459f647552718f683a7b415d290ac744a836"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "windows-interface"
+version = "0.59.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bd9211b69f8dcdfa817bfd14bf1c97c9188afa36f4750130fcdf3f400eca9fa8"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
]
[[package]]
name = "windows-link"
-version = "0.1.1"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e6ad25900d524eaabdbbb96d20b4311e1e7ae1699af4fb28c17ae66c80d798a"
+
+[[package]]
+name = "windows-result"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "56f42bd332cc6c8eac5af113fc0c1fd6a8fd2aa08a0119358686e5160d0586c6"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-strings"
+version = "0.4.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "76840935b766e1b0a05c0066835fb9ec80071d4c09a16f6bd5f7e655e3c14c38"
+checksum = "56e6c93f3a0c3b36176cb1327a4958a0353d5d166c2a35cb268ace15e91d3b57"
+dependencies = [
+ "windows-link",
+]
[[package]]
name = "windows-sys"
@@ -3280,9 +3445,9 @@ dependencies = [
[[package]]
name = "wit-bindgen-rt"
-version = "0.33.0"
+version = "0.39.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3268f3d866458b787f390cf61f4bbb563b922d091359f9608842999eaee3943c"
+checksum = "6f42320e61fe2cfd34354ecb597f86f413484a798ba44a8ca1165c58d42da6c1"
dependencies = [
"bitflags 2.9.1",
]
@@ -3325,39 +3490,18 @@ dependencies = [
[[package]]
name = "zerocopy"
-version = "0.7.35"
+version = "0.8.26"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b9b4fd18abc82b8136838da5d50bae7bdea537c574d8dc1a34ed098d6c166f0"
+checksum = "1039dd0d3c310cf05de012d8a39ff557cb0d23087fd44cad61df08fc31907a2f"
dependencies = [
- "byteorder",
- "zerocopy-derive 0.7.35",
-]
-
-[[package]]
-name = "zerocopy"
-version = "0.8.20"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dde3bb8c68a8f3f1ed4ac9221aad6b10cece3e60a8e2ea54a6a2dec806d0084c"
-dependencies = [
- "zerocopy-derive 0.8.20",
-]
-
-[[package]]
-name = "zerocopy-derive"
-version = "0.7.35"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fa4f8080344d4671fb4e831a13ad1e68092748387dfc4f55e356242fae12ce3e"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
+ "zerocopy-derive",
]
[[package]]
name = "zerocopy-derive"
-version = "0.8.20"
+version = "0.8.26"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eea57037071898bf96a6da35fd626f4f27e9cee3ead2a6c703cf09d472b2e700"
+checksum = "9ecf5b4cc5364572d7f4c329661bcc82724222973f2cab6f050a4e5c22f75181"
dependencies = [
"proc-macro2",
"quote",
diff --git a/MODULE.bazel b/MODULE.bazel
index 52c07a395b5e..2f7a18b35fa1 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -14,7 +14,7 @@ local_path_override(
# see https://registry.bazel.build/ for a list of available packages
-bazel_dep(name = "platforms", version = "0.0.11")
+bazel_dep(name = "platforms", version = "1.0.0")
bazel_dep(name = "rules_go", version = "0.56.1")
bazel_dep(name = "rules_pkg", version = "1.0.1")
bazel_dep(name = "rules_nodejs", version = "6.2.0-codeql.1")
@@ -98,49 +98,49 @@ use_repo(
tree_sitter_extractors_deps = use_extension("//misc/bazel/3rdparty:tree_sitter_extractors_extension.bzl", "r")
use_repo(
tree_sitter_extractors_deps,
- "vendor_ts__anyhow-1.0.98",
+ "vendor_ts__anyhow-1.0.99",
"vendor_ts__argfile-0.2.1",
- "vendor_ts__chalk-ir-0.103.0",
+ "vendor_ts__chalk-ir-0.104.0",
"vendor_ts__chrono-0.4.41",
- "vendor_ts__clap-4.5.40",
+ "vendor_ts__clap-4.5.44",
"vendor_ts__dunce-1.0.5",
"vendor_ts__either-1.15.0",
"vendor_ts__encoding-0.2.33",
"vendor_ts__figment-0.10.19",
"vendor_ts__flate2-1.1.0",
- "vendor_ts__glob-0.3.2",
+ "vendor_ts__glob-0.3.3",
"vendor_ts__globset-0.4.15",
"vendor_ts__itertools-0.14.0",
"vendor_ts__lazy_static-1.5.0",
"vendor_ts__mustache-0.9.0",
"vendor_ts__num-traits-0.2.19",
"vendor_ts__num_cpus-1.17.0",
- "vendor_ts__proc-macro2-1.0.95",
+ "vendor_ts__proc-macro2-1.0.97",
"vendor_ts__quote-1.0.40",
- "vendor_ts__ra_ap_base_db-0.0.288",
- "vendor_ts__ra_ap_cfg-0.0.288",
- "vendor_ts__ra_ap_hir-0.0.288",
- "vendor_ts__ra_ap_hir_def-0.0.288",
- "vendor_ts__ra_ap_hir_expand-0.0.288",
- "vendor_ts__ra_ap_hir_ty-0.0.288",
- "vendor_ts__ra_ap_ide_db-0.0.288",
- "vendor_ts__ra_ap_intern-0.0.288",
- "vendor_ts__ra_ap_load-cargo-0.0.288",
- "vendor_ts__ra_ap_parser-0.0.288",
- "vendor_ts__ra_ap_paths-0.0.288",
- "vendor_ts__ra_ap_project_model-0.0.288",
- "vendor_ts__ra_ap_span-0.0.288",
- "vendor_ts__ra_ap_stdx-0.0.288",
- "vendor_ts__ra_ap_syntax-0.0.288",
- "vendor_ts__ra_ap_vfs-0.0.288",
- "vendor_ts__rand-0.9.1",
+ "vendor_ts__ra_ap_base_db-0.0.300",
+ "vendor_ts__ra_ap_cfg-0.0.300",
+ "vendor_ts__ra_ap_hir-0.0.300",
+ "vendor_ts__ra_ap_hir_def-0.0.300",
+ "vendor_ts__ra_ap_hir_expand-0.0.300",
+ "vendor_ts__ra_ap_hir_ty-0.0.300",
+ "vendor_ts__ra_ap_ide_db-0.0.300",
+ "vendor_ts__ra_ap_intern-0.0.300",
+ "vendor_ts__ra_ap_load-cargo-0.0.300",
+ "vendor_ts__ra_ap_parser-0.0.300",
+ "vendor_ts__ra_ap_paths-0.0.300",
+ "vendor_ts__ra_ap_project_model-0.0.300",
+ "vendor_ts__ra_ap_span-0.0.300",
+ "vendor_ts__ra_ap_stdx-0.0.300",
+ "vendor_ts__ra_ap_syntax-0.0.300",
+ "vendor_ts__ra_ap_vfs-0.0.300",
+ "vendor_ts__rand-0.9.2",
"vendor_ts__rayon-1.10.0",
"vendor_ts__regex-1.11.1",
"vendor_ts__serde-1.0.219",
- "vendor_ts__serde_json-1.0.140",
- "vendor_ts__serde_with-3.13.0",
- "vendor_ts__syn-2.0.103",
- "vendor_ts__toml-0.8.23",
+ "vendor_ts__serde_json-1.0.142",
+ "vendor_ts__serde_with-3.14.0",
+ "vendor_ts__syn-2.0.104",
+ "vendor_ts__toml-0.9.5",
"vendor_ts__tracing-0.1.41",
"vendor_ts__tracing-flame-0.2.0",
"vendor_ts__tracing-subscriber-0.3.19",
diff --git a/actions/ql/lib/qlpack.yml b/actions/ql/lib/qlpack.yml
index 6ab370e2e979..c10bedbaef6f 100644
--- a/actions/ql/lib/qlpack.yml
+++ b/actions/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/actions-all
-version: 0.4.15
+version: 0.4.16-dev
library: true
warnOnImplicitThis: true
dependencies:
diff --git a/actions/ql/src/qlpack.yml b/actions/ql/src/qlpack.yml
index 416cd0e5c45a..11e5bb790b79 100644
--- a/actions/ql/src/qlpack.yml
+++ b/actions/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/actions-queries
-version: 0.6.7
+version: 0.6.8-dev
library: false
warnOnImplicitThis: true
groups: [actions, queries]
diff --git a/cpp/downgrades/c16b29b27f71247023321cc0d0360998b318837c/old.dbscheme b/cpp/downgrades/c16b29b27f71247023321cc0d0360998b318837c/old.dbscheme
new file mode 100644
index 000000000000..c16b29b27f71
--- /dev/null
+++ b/cpp/downgrades/c16b29b27f71247023321cc0d0360998b318837c/old.dbscheme
@@ -0,0 +1,2436 @@
+/*- Compilations -*/
+
+/**
+ * An invocation of the compiler. Note that more than one file may be
+ * compiled per invocation. For example, this command compiles three
+ * source files:
+ *
+ * gcc -c f1.c f2.c f3.c
+ *
+ * The `id` simply identifies the invocation, while `cwd` is the working
+ * directory from which the compiler was invoked.
+ */
+compilations(
+ /**
+ * An invocation of the compiler. Note that more than one file may
+ * be compiled per invocation. For example, this command compiles
+ * three source files:
+ *
+ * gcc -c f1.c f2.c f3.c
+ */
+ unique int id : @compilation,
+ string cwd : string ref
+);
+
+/**
+ * The arguments that were passed to the extractor for a compiler
+ * invocation. If `id` is for the compiler invocation
+ *
+ * gcc -c f1.c f2.c f3.c
+ *
+ * then typically there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0 | *path to extractor*
+ * 1 | `--mimic`
+ * 2 | `/usr/bin/gcc`
+ * 3 | `-c`
+ * 4 | f1.c
+ * 5 | f2.c
+ * 6 | f3.c
+ */
+#keyset[id, num]
+compilation_args(
+ int id : @compilation ref,
+ int num : int ref,
+ string arg : string ref
+);
+
+/**
+ * Optionally, record the build mode for each compilation.
+ */
+compilation_build_mode(
+ unique int id : @compilation ref,
+ int mode : int ref
+);
+
+/*
+case @compilation_build_mode.mode of
+ 0 = @build_mode_none
+| 1 = @build_mode_manual
+| 2 = @build_mode_auto
+;
+*/
+
+/**
+ * The source files that are compiled by a compiler invocation.
+ * If `id` is for the compiler invocation
+ *
+ * gcc -c f1.c f2.c f3.c
+ *
+ * then there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0 | f1.c
+ * 1 | f2.c
+ * 2 | f3.c
+ *
+ * Note that even if those files `#include` headers, those headers
+ * do not appear as rows.
+ */
+#keyset[id, num]
+compilation_compiling_files(
+ int id : @compilation ref,
+ int num : int ref,
+ int file : @file ref
+);
+
+/**
+ * The time taken by the extractor for a compiler invocation.
+ *
+ * For each file `num`, there will be rows for
+ *
+ * kind | seconds
+ * ---- | ---
+ * 1 | CPU seconds used by the extractor frontend
+ * 2 | Elapsed seconds during the extractor frontend
+ * 3 | CPU seconds used by the extractor backend
+ * 4 | Elapsed seconds during the extractor backend
+ */
+#keyset[id, num, kind]
+compilation_time(
+ int id : @compilation ref,
+ int num : int ref,
+ /* kind:
+ 1 = frontend_cpu_seconds
+ 2 = frontend_elapsed_seconds
+ 3 = extractor_cpu_seconds
+ 4 = extractor_elapsed_seconds
+ */
+ int kind : int ref,
+ float seconds : float ref
+);
+
+/**
+ * An error or warning generated by the extractor.
+ * The diagnostic message `diagnostic` was generated during compiler
+ * invocation `compilation`, and is the `file_number_diagnostic_number`th
+ * message generated while extracting the `file_number`th file of that
+ * invocation.
+ */
+#keyset[compilation, file_number, file_number_diagnostic_number]
+diagnostic_for(
+ int diagnostic : @diagnostic ref,
+ int compilation : @compilation ref,
+ int file_number : int ref,
+ int file_number_diagnostic_number : int ref
+);
+
+/**
+ * If extraction was successful, then `cpu_seconds` and
+ * `elapsed_seconds` are the CPU time and elapsed time (respectively)
+ * that extraction took for compiler invocation `id`.
+ */
+compilation_finished(
+ unique int id : @compilation ref,
+ float cpu_seconds : float ref,
+ float elapsed_seconds : float ref
+);
+
+/*- External data -*/
+
+/**
+ * External data, loaded from CSV files during snapshot creation. See
+ * [Tutorial: Incorporating external data](https://help.semmle.com/wiki/display/SD/Tutorial%3A+Incorporating+external+data)
+ * for more information.
+ */
+externalData(
+ int id : @externalDataElement,
+ string path : string ref,
+ int column: int ref,
+ string value : string ref
+);
+
+/*- Source location prefix -*/
+
+/**
+ * The source location of the snapshot.
+ */
+sourceLocationPrefix(string prefix : string ref);
+
+/*- Files and folders -*/
+
+/**
+ * The location of an element.
+ * The location spans column `startcolumn` of line `startline` to
+ * column `endcolumn` of line `endline` in file `file`.
+ * For more information, see
+ * [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
+ */
+locations_default(
+ unique int id: @location_default,
+ int file: @file ref,
+ int beginLine: int ref,
+ int beginColumn: int ref,
+ int endLine: int ref,
+ int endColumn: int ref
+);
+
+files(
+ unique int id: @file,
+ string name: string ref
+);
+
+folders(
+ unique int id: @folder,
+ string name: string ref
+);
+
+@container = @file | @folder
+
+containerparent(
+ int parent: @container ref,
+ unique int child: @container ref
+);
+
+/*- Lines of code -*/
+
+numlines(
+ int element_id: @sourceline ref,
+ int num_lines: int ref,
+ int num_code: int ref,
+ int num_comment: int ref
+);
+
+/*- Diagnostic messages -*/
+
+diagnostics(
+ unique int id: @diagnostic,
+ int severity: int ref,
+ string error_tag: string ref,
+ string error_message: string ref,
+ string full_error_message: string ref,
+ int location: @location_default ref
+);
+
+/*- C++ dbscheme -*/
+
+extractor_version(
+ string codeql_version: string ref,
+ string frontend_version: string ref
+)
+
+pch_uses(
+ int pch: @pch ref,
+ int compilation: @compilation ref,
+ int id: @file ref
+)
+
+#keyset[pch, compilation]
+pch_creations(
+ int pch: @pch,
+ int compilation: @compilation ref,
+ int from: @file ref
+)
+
+/** An element for which line-count information is available. */
+@sourceline = @file | @function | @variable | @enumconstant | @xmllocatable;
+
+fileannotations(
+ int id: @file ref,
+ int kind: int ref,
+ string name: string ref,
+ string value: string ref
+);
+
+inmacroexpansion(
+ int id: @element ref,
+ int inv: @macroinvocation ref
+);
+
+affectedbymacroexpansion(
+ int id: @element ref,
+ int inv: @macroinvocation ref
+);
+
+case @macroinvocation.kind of
+ 1 = @macro_expansion
+| 2 = @other_macro_reference
+;
+
+macroinvocations(
+ unique int id: @macroinvocation,
+ int macro_id: @ppd_define ref,
+ int location: @location_default ref,
+ int kind: int ref
+);
+
+macroparent(
+ unique int id: @macroinvocation ref,
+ int parent_id: @macroinvocation ref
+);
+
+// a macroinvocation may be part of another location
+// the way to find a constant expression that uses a macro
+// is thus to find a constant expression that has a location
+// to which a macro invocation is bound
+macrolocationbind(
+ int id: @macroinvocation ref,
+ int location: @location_default ref
+);
+
+#keyset[invocation, argument_index]
+macro_argument_unexpanded(
+ int invocation: @macroinvocation ref,
+ int argument_index: int ref,
+ string text: string ref
+);
+
+#keyset[invocation, argument_index]
+macro_argument_expanded(
+ int invocation: @macroinvocation ref,
+ int argument_index: int ref,
+ string text: string ref
+);
+
+case @function.kind of
+ 0 = @unknown_function
+| 1 = @normal_function
+| 2 = @constructor
+| 3 = @destructor
+| 4 = @conversion_function
+| 5 = @operator
+// ... 6 = @builtin_function deprecated // GCC built-in functions, e.g. __builtin___memcpy_chk
+| 7 = @user_defined_literal
+| 8 = @deduction_guide
+;
+
+functions(
+ unique int id: @function,
+ string name: string ref,
+ int kind: int ref
+);
+
+builtin_functions(
+ int id: @function ref
+)
+
+function_entry_point(
+ int id: @function ref,
+ unique int entry_point: @stmt ref
+);
+
+function_return_type(
+ int id: @function ref,
+ int return_type: @type ref
+);
+
+/**
+ * If `function` is a coroutine, then this gives the `std::experimental::resumable_traits`
+ * instance associated with it, and the variables representing the `handle` and `promise`
+ * for it.
+ */
+coroutine(
+ unique int function: @function ref,
+ int traits: @type ref
+);
+
+/*
+case @coroutine_placeholder_variable.kind of
+ 1 = @handle
+| 2 = @promise
+| 3 = @init_await_resume
+;
+*/
+
+coroutine_placeholder_variable(
+ unique int placeholder_variable: @variable ref,
+ int kind: int ref,
+ int function: @function ref
+)
+
+/** The `new` function used for allocating the coroutine state, if any. */
+coroutine_new(
+ unique int function: @function ref,
+ int new: @function ref
+);
+
+/** The `delete` function used for deallocating the coroutine state, if any. */
+coroutine_delete(
+ unique int function: @function ref,
+ int delete: @function ref
+);
+
+purefunctions(unique int id: @function ref);
+
+function_deleted(unique int id: @function ref);
+
+function_defaulted(unique int id: @function ref);
+
+function_prototyped(unique int id: @function ref)
+
+deduction_guide_for_class(
+ int id: @function ref,
+ int class_template: @usertype ref
+)
+
+member_function_this_type(
+ unique int id: @function ref,
+ int this_type: @type ref
+);
+
+#keyset[id, type_id]
+fun_decls(
+ int id: @fun_decl,
+ int function: @function ref,
+ int type_id: @type ref,
+ string name: string ref,
+ int location: @location_default ref
+);
+fun_def(unique int id: @fun_decl ref);
+fun_specialized(unique int id: @fun_decl ref);
+fun_implicit(unique int id: @fun_decl ref);
+fun_decl_specifiers(
+ int id: @fun_decl ref,
+ string name: string ref
+)
+#keyset[fun_decl, index]
+fun_decl_throws(
+ int fun_decl: @fun_decl ref,
+ int index: int ref,
+ int type_id: @type ref
+);
+/* an empty throw specification is different from none */
+fun_decl_empty_throws(unique int fun_decl: @fun_decl ref);
+fun_decl_noexcept(
+ int fun_decl: @fun_decl ref,
+ int constant: @expr ref
+);
+fun_decl_empty_noexcept(int fun_decl: @fun_decl ref);
+fun_decl_typedef_type(
+ unique int fun_decl: @fun_decl ref,
+ int typedeftype_id: @usertype ref
+);
+
+/*
+case @fun_requires.kind of
+ 1 = @template_attached
+| 2 = @function_attached
+;
+*/
+
+fun_requires(
+ int id: @fun_decl ref,
+ int kind: int ref,
+ int constraint: @expr ref
+);
+
+param_decl_bind(
+ unique int id: @var_decl ref,
+ int index: int ref,
+ int fun_decl: @fun_decl ref
+);
+
+#keyset[id, type_id]
+var_decls(
+ int id: @var_decl,
+ int variable: @variable ref,
+ int type_id: @type ref,
+ string name: string ref,
+ int location: @location_default ref
+);
+var_def(unique int id: @var_decl ref);
+var_specialized(int id: @var_decl ref);
+var_decl_specifiers(
+ int id: @var_decl ref,
+ string name: string ref
+)
+is_structured_binding(unique int id: @variable ref);
+var_requires(
+ int id: @var_decl ref,
+ int constraint: @expr ref
+);
+
+type_decls(
+ unique int id: @type_decl,
+ int type_id: @type ref,
+ int location: @location_default ref
+);
+type_def(unique int id: @type_decl ref);
+type_decl_top(
+ unique int type_decl: @type_decl ref
+);
+type_requires(
+ int id: @type_decl ref,
+ int constraint: @expr ref
+);
+
+namespace_decls(
+ unique int id: @namespace_decl,
+ int namespace_id: @namespace ref,
+ int location: @location_default ref,
+ int bodylocation: @location_default ref
+);
+
+case @using.kind of
+ 1 = @using_declaration
+| 2 = @using_directive
+| 3 = @using_enum_declaration
+;
+
+usings(
+ unique int id: @using,
+ int element_id: @element ref,
+ int location: @location_default ref,
+ int kind: int ref
+);
+
+/** The element which contains the `using` declaration. */
+using_container(
+ int parent: @element ref,
+ int child: @using ref
+);
+
+static_asserts(
+ unique int id: @static_assert,
+ int condition : @expr ref,
+ string message : string ref,
+ int location: @location_default ref,
+ int enclosing : @element ref
+);
+
+// each function has an ordered list of parameters
+#keyset[id, type_id]
+#keyset[function, index, type_id]
+params(
+ int id: @parameter,
+ int function: @parameterized_element ref,
+ int index: int ref,
+ int type_id: @type ref
+);
+
+overrides(
+ int new: @function ref,
+ int old: @function ref
+);
+
+#keyset[id, type_id]
+membervariables(
+ int id: @membervariable,
+ int type_id: @type ref,
+ string name: string ref
+);
+
+#keyset[id, type_id]
+globalvariables(
+ int id: @globalvariable,
+ int type_id: @type ref,
+ string name: string ref
+);
+
+#keyset[id, type_id]
+localvariables(
+ int id: @localvariable,
+ int type_id: @type ref,
+ string name: string ref
+);
+
+autoderivation(
+ unique int var: @variable ref,
+ int derivation_type: @type ref
+);
+
+orphaned_variables(
+ int var: @localvariable ref,
+ int function: @function ref
+)
+
+enumconstants(
+ unique int id: @enumconstant,
+ int parent: @usertype ref,
+ int index: int ref,
+ int type_id: @type ref,
+ string name: string ref,
+ int location: @location_default ref
+);
+
+@variable = @localscopevariable | @globalvariable | @membervariable;
+
+@localscopevariable = @localvariable | @parameter;
+
+/**
+ * Built-in types are the fundamental types, e.g., integral, floating, and void.
+ */
+case @builtintype.kind of
+ 1 = @errortype
+| 2 = @unknowntype
+| 3 = @void
+| 4 = @boolean
+| 5 = @char
+| 6 = @unsigned_char
+| 7 = @signed_char
+| 8 = @short
+| 9 = @unsigned_short
+| 10 = @signed_short
+| 11 = @int
+| 12 = @unsigned_int
+| 13 = @signed_int
+| 14 = @long
+| 15 = @unsigned_long
+| 16 = @signed_long
+| 17 = @long_long
+| 18 = @unsigned_long_long
+| 19 = @signed_long_long
+// ... 20 Microsoft-specific __int8
+// ... 21 Microsoft-specific __int16
+// ... 22 Microsoft-specific __int32
+// ... 23 Microsoft-specific __int64
+| 24 = @float
+| 25 = @double
+| 26 = @long_double
+| 27 = @complex_float // C99-specific _Complex float
+| 28 = @complex_double // C99-specific _Complex double
+| 29 = @complex_long_double // C99-specific _Complex long double
+| 30 = @imaginary_float // C99-specific _Imaginary float
+| 31 = @imaginary_double // C99-specific _Imaginary double
+| 32 = @imaginary_long_double // C99-specific _Imaginary long double
+| 33 = @wchar_t // Microsoft-specific
+| 34 = @decltype_nullptr // C++11
+| 35 = @int128 // __int128
+| 36 = @unsigned_int128 // unsigned __int128
+| 37 = @signed_int128 // signed __int128
+| 38 = @float128 // __float128
+| 39 = @complex_float128 // _Complex __float128
+| 40 = @decimal32 // _Decimal32
+| 41 = @decimal64 // _Decimal64
+| 42 = @decimal128 // _Decimal128
+| 43 = @char16_t
+| 44 = @char32_t
+| 45 = @std_float32 // _Float32
+| 46 = @float32x // _Float32x
+| 47 = @std_float64 // _Float64
+| 48 = @float64x // _Float64x
+| 49 = @std_float128 // _Float128
+// ... 50 _Float128x
+| 51 = @char8_t
+| 52 = @float16 // _Float16
+| 53 = @complex_float16 // _Complex _Float16
+| 54 = @fp16 // __fp16
+| 55 = @std_bfloat16 // __bf16
+| 56 = @std_float16 // std::float16_t
+| 57 = @complex_std_float32 // _Complex _Float32
+| 58 = @complex_float32x // _Complex _Float32x
+| 59 = @complex_std_float64 // _Complex _Float64
+| 60 = @complex_float64x // _Complex _Float64x
+| 61 = @complex_std_float128 // _Complex _Float128
+| 62 = @mfp8 // __mfp8
+| 63 = @scalable_vector_count // __SVCount_t
+| 64 = @complex_fp16 // _Complex __fp16
+| 65 = @complex_std_bfloat16 // _Complex __bf16
+| 66 = @complex_std_float16 // _Complex std::float16_t
+;
+
+builtintypes(
+ unique int id: @builtintype,
+ string name: string ref,
+ int kind: int ref,
+ int size: int ref,
+ int sign: int ref,
+ int alignment: int ref
+);
+
+/**
+ * Derived types are types that are directly derived from existing types and
+ * point to, refer to, transform type data to return a new type.
+ */
+case @derivedtype.kind of
+ 1 = @pointer
+| 2 = @reference
+| 3 = @type_with_specifiers
+| 4 = @array
+| 5 = @gnu_vector
+| 6 = @routineptr
+| 7 = @routinereference
+| 8 = @rvalue_reference // C++11
+// ... 9 type_conforming_to_protocols deprecated
+| 10 = @block
+| 11 = @scalable_vector // Arm SVE
+;
+
+derivedtypes(
+ unique int id: @derivedtype,
+ string name: string ref,
+ int kind: int ref,
+ int type_id: @type ref
+);
+
+pointerishsize(unique int id: @derivedtype ref,
+ int size: int ref,
+ int alignment: int ref);
+
+arraysizes(
+ unique int id: @derivedtype ref,
+ int num_elements: int ref,
+ int bytesize: int ref,
+ int alignment: int ref
+);
+
+tupleelements(
+ unique int id: @derivedtype ref,
+ int num_elements: int ref
+);
+
+typedefbase(
+ unique int id: @usertype ref,
+ int type_id: @type ref
+);
+
+/**
+ * An instance of the C++11 `decltype` operator or C23 `typeof`/`typeof_unqual`
+ * operator taking an expression as its argument. For example:
+ * ```
+ * int a;
+ * decltype(1+a) b;
+ * typeof(1+a) c;
+ * ```
+ * Here `expr` is `1+a`.
+ *
+ * Sometimes an additional pair of parentheses around the expression
+ * changes the semantics of the decltype, e.g.
+ * ```
+ * struct A { double x; };
+ * const A* a = new A();
+ * decltype( a->x ); // type is double
+ * decltype((a->x)); // type is const double&
+ * ```
+ * (Please consult the C++11 standard for more details).
+ * `parentheses_would_change_meaning` is `true` iff that is the case.
+ */
+
+/*
+case @decltype.kind of
+| 0 = @decltype
+| 1 = @typeof // The frontend does not differentiate between typeof and typeof_unqual
+;
+*/
+
+#keyset[id, expr]
+decltypes(
+ int id: @decltype,
+ int expr: @expr ref,
+ int kind: int ref,
+ int base_type: @type ref,
+ boolean parentheses_would_change_meaning: boolean ref
+);
+
+case @type_operator.kind of
+ 0 = @typeof // The frontend does not differentiate between typeof and typeof_unqual
+| 1 = @underlying_type
+| 2 = @bases
+| 3 = @direct_bases
+| 4 = @add_lvalue_reference
+| 5 = @add_pointer
+| 6 = @add_rvalue_reference
+| 7 = @decay
+| 8 = @make_signed
+| 9 = @make_unsigned
+| 10 = @remove_all_extents
+| 11 = @remove_const
+| 12 = @remove_cv
+| 13 = @remove_cvref
+| 14 = @remove_extent
+| 15 = @remove_pointer
+| 16 = @remove_reference_t
+| 17 = @remove_restrict
+| 18 = @remove_volatile
+| 19 = @remove_reference
+;
+
+type_operators(
+ unique int id: @type_operator,
+ int arg_type: @type ref,
+ int kind: int ref,
+ int base_type: @type ref
+)
+
+case @usertype.kind of
+ 0 = @unknown_usertype
+| 1 = @struct
+| 2 = @class
+| 3 = @union
+| 4 = @enum
+// ... 5 = @typedef deprecated // classic C: typedef typedef type name
+// ... 6 = @template deprecated
+| 7 = @template_parameter
+| 8 = @template_template_parameter
+| 9 = @proxy_class // a proxy class associated with a template parameter
+// ... 10 objc_class deprecated
+// ... 11 objc_protocol deprecated
+// ... 12 objc_category deprecated
+| 13 = @scoped_enum
+// ... 14 = @using_alias deprecated // a using name = type style typedef
+| 15 = @template_struct
+| 16 = @template_class
+| 17 = @template_union
+| 18 = @alias
+;
+
+usertypes(
+ unique int id: @usertype,
+ string name: string ref,
+ int kind: int ref
+);
+
+usertypesize(
+ unique int id: @usertype ref,
+ int size: int ref,
+ int alignment: int ref
+);
+
+usertype_final(unique int id: @usertype ref);
+
+usertype_uuid(
+ unique int id: @usertype ref,
+ string uuid: string ref
+);
+
+/*
+case @usertype.alias_kind of
+| 0 = @typedef
+| 1 = @alias
+*/
+
+usertype_alias_kind(
+ int id: @usertype ref,
+ int alias_kind: int ref
+)
+
+nontype_template_parameters(
+ int id: @expr ref
+);
+
+type_template_type_constraint(
+ int id: @usertype ref,
+ int constraint: @expr ref
+);
+
+mangled_name(
+ unique int id: @declaration ref,
+ int mangled_name : @mangledname,
+ boolean is_complete: boolean ref
+);
+
+is_pod_class(unique int id: @usertype ref);
+is_standard_layout_class(unique int id: @usertype ref);
+
+is_complete(unique int id: @usertype ref);
+
+is_class_template(unique int id: @usertype ref);
+class_instantiation(
+ int to: @usertype ref,
+ int from: @usertype ref
+);
+class_template_argument(
+ int type_id: @usertype ref,
+ int index: int ref,
+ int arg_type: @type ref
+);
+class_template_argument_value(
+ int type_id: @usertype ref,
+ int index: int ref,
+ int arg_value: @expr ref
+);
+
+@user_or_decltype = @usertype | @decltype;
+
+is_proxy_class_for(
+ unique int id: @usertype ref,
+ int templ_param_id: @user_or_decltype ref
+);
+
+type_mentions(
+ unique int id: @type_mention,
+ int type_id: @type ref,
+ int location: @location_default ref,
+ // a_symbol_reference_kind from the frontend.
+ int kind: int ref
+);
+
+is_function_template(unique int id: @function ref);
+function_instantiation(
+ unique int to: @function ref,
+ int from: @function ref
+);
+function_template_argument(
+ int function_id: @function ref,
+ int index: int ref,
+ int arg_type: @type ref
+);
+function_template_argument_value(
+ int function_id: @function ref,
+ int index: int ref,
+ int arg_value: @expr ref
+);
+
+is_variable_template(unique int id: @variable ref);
+variable_instantiation(
+ unique int to: @variable ref,
+ int from: @variable ref
+);
+variable_template_argument(
+ int variable_id: @variable ref,
+ int index: int ref,
+ int arg_type: @type ref
+);
+variable_template_argument_value(
+ int variable_id: @variable ref,
+ int index: int ref,
+ int arg_value: @expr ref
+);
+
+template_template_instantiation(
+ int to: @usertype ref,
+ int from: @usertype ref
+);
+template_template_argument(
+ int type_id: @usertype ref,
+ int index: int ref,
+ int arg_type: @type ref
+);
+template_template_argument_value(
+ int type_id: @usertype ref,
+ int index: int ref,
+ int arg_value: @expr ref
+);
+
+@concept = @concept_template | @concept_id;
+
+concept_templates(
+ unique int concept_id: @concept_template,
+ string name: string ref,
+ int location: @location_default ref
+);
+concept_instantiation(
+ unique int to: @concept_id ref,
+ int from: @concept_template ref
+);
+is_type_constraint(int concept_id: @concept_id ref);
+concept_template_argument(
+ int concept_id: @concept ref,
+ int index: int ref,
+ int arg_type: @type ref
+);
+concept_template_argument_value(
+ int concept_id: @concept ref,
+ int index: int ref,
+ int arg_value: @expr ref
+);
+
+routinetypes(
+ unique int id: @routinetype,
+ int return_type: @type ref
+);
+
+routinetypeargs(
+ int routine: @routinetype ref,
+ int index: int ref,
+ int type_id: @type ref
+);
+
+ptrtomembers(
+ unique int id: @ptrtomember,
+ int type_id: @type ref,
+ int class_id: @type ref
+);
+
+/*
+ specifiers for types, functions, and variables
+
+ "public",
+ "protected",
+ "private",
+
+ "const",
+ "volatile",
+ "static",
+
+ "pure",
+ "virtual",
+ "sealed", // Microsoft
+ "__interface", // Microsoft
+ "inline",
+ "explicit",
+
+ "near", // near far extension
+ "far", // near far extension
+ "__ptr32", // Microsoft
+ "__ptr64", // Microsoft
+ "__sptr", // Microsoft
+ "__uptr", // Microsoft
+ "dllimport", // Microsoft
+ "dllexport", // Microsoft
+ "thread", // Microsoft
+ "naked", // Microsoft
+ "microsoft_inline", // Microsoft
+ "forceinline", // Microsoft
+ "selectany", // Microsoft
+ "nothrow", // Microsoft
+ "novtable", // Microsoft
+ "noreturn", // Microsoft
+ "noinline", // Microsoft
+ "noalias", // Microsoft
+ "restrict", // Microsoft
+*/
+
+specifiers(
+ unique int id: @specifier,
+ unique string str: string ref
+);
+
+typespecifiers(
+ int type_id: @type ref,
+ int spec_id: @specifier ref
+);
+
+funspecifiers(
+ int func_id: @function ref,
+ int spec_id: @specifier ref
+);
+
+varspecifiers(
+ int var_id: @accessible ref,
+ int spec_id: @specifier ref
+);
+
+explicit_specifier_exprs(
+ unique int func_id: @function ref,
+ int constant: @expr ref
+)
+
+attributes(
+ unique int id: @attribute,
+ int kind: int ref,
+ string name: string ref,
+ string name_space: string ref,
+ int location: @location_default ref
+);
+
+case @attribute.kind of
+ 0 = @gnuattribute
+| 1 = @stdattribute
+| 2 = @declspec
+| 3 = @msattribute
+| 4 = @alignas
+// ... 5 @objc_propertyattribute deprecated
+;
+
+attribute_args(
+ unique int id: @attribute_arg,
+ int kind: int ref,
+ int attribute: @attribute ref,
+ int index: int ref,
+ int location: @location_default ref
+);
+
+case @attribute_arg.kind of
+ 0 = @attribute_arg_empty
+| 1 = @attribute_arg_token
+| 2 = @attribute_arg_constant
+| 3 = @attribute_arg_type
+| 4 = @attribute_arg_constant_expr
+| 5 = @attribute_arg_expr
+;
+
+attribute_arg_value(
+ unique int arg: @attribute_arg ref,
+ string value: string ref
+);
+attribute_arg_type(
+ unique int arg: @attribute_arg ref,
+ int type_id: @type ref
+);
+attribute_arg_constant(
+ unique int arg: @attribute_arg ref,
+ int constant: @expr ref
+)
+attribute_arg_expr(
+ unique int arg: @attribute_arg ref,
+ int expr: @expr ref
+)
+attribute_arg_name(
+ unique int arg: @attribute_arg ref,
+ string name: string ref
+);
+
+typeattributes(
+ int type_id: @type ref,
+ int spec_id: @attribute ref
+);
+
+funcattributes(
+ int func_id: @function ref,
+ int spec_id: @attribute ref
+);
+
+varattributes(
+ int var_id: @accessible ref,
+ int spec_id: @attribute ref
+);
+
+namespaceattributes(
+ int namespace_id: @namespace ref,
+ int spec_id: @attribute ref
+);
+
+stmtattributes(
+ int stmt_id: @stmt ref,
+ int spec_id: @attribute ref
+);
+
+@type = @builtintype
+ | @derivedtype
+ | @usertype
+ | @routinetype
+ | @ptrtomember
+ | @decltype
+ | @type_operator;
+
+unspecifiedtype(
+ unique int type_id: @type ref,
+ int unspecified_type_id: @type ref
+);
+
+member(
+ int parent: @type ref,
+ int index: int ref,
+ int child: @member ref
+);
+
+@enclosingfunction_child = @usertype | @variable | @namespace
+
+enclosingfunction(
+ unique int child: @enclosingfunction_child ref,
+ int parent: @function ref
+);
+
+derivations(
+ unique int derivation: @derivation,
+ int sub: @type ref,
+ int index: int ref,
+ int super: @type ref,
+ int location: @location_default ref
+);
+
+derspecifiers(
+ int der_id: @derivation ref,
+ int spec_id: @specifier ref
+);
+
+/**
+ * Contains the byte offset of the base class subobject within the derived
+ * class. Only holds for non-virtual base classes, but see table
+ * `virtual_base_offsets` for offsets of virtual base class subobjects.
+ */
+direct_base_offsets(
+ unique int der_id: @derivation ref,
+ int offset: int ref
+);
+
+/**
+ * Contains the byte offset of the virtual base class subobject for class
+ * `super` within a most-derived object of class `sub`. `super` can be either a
+ * direct or indirect base class.
+ */
+#keyset[sub, super]
+virtual_base_offsets(
+ int sub: @usertype ref,
+ int super: @usertype ref,
+ int offset: int ref
+);
+
+frienddecls(
+ unique int id: @frienddecl,
+ int type_id: @type ref,
+ int decl_id: @declaration ref,
+ int location: @location_default ref
+);
+
+@declaredtype = @usertype ;
+
+@declaration = @function
+ | @declaredtype
+ | @variable
+ | @enumconstant
+ | @frienddecl
+ | @concept_template;
+
+@member = @membervariable
+ | @function
+ | @declaredtype
+ | @enumconstant;
+
+@locatable = @diagnostic
+ | @declaration
+ | @ppd_include
+ | @ppd_define
+ | @macroinvocation
+ /*| @funcall*/
+ | @xmllocatable
+ | @attribute
+ | @attribute_arg;
+
+@namedscope = @namespace | @usertype;
+
+@element = @locatable
+ | @file
+ | @folder
+ | @specifier
+ | @type
+ | @expr
+ | @namespace
+ | @initialiser
+ | @stmt
+ | @derivation
+ | @comment
+ | @preprocdirect
+ | @fun_decl
+ | @var_decl
+ | @type_decl
+ | @namespace_decl
+ | @using
+ | @namequalifier
+ | @specialnamequalifyingelement
+ | @static_assert
+ | @type_mention
+ | @lambdacapture;
+
+@exprparent = @element;
+
+comments(
+ unique int id: @comment,
+ string contents: string ref,
+ int location: @location_default ref
+);
+
+commentbinding(
+ int id: @comment ref,
+ int element: @element ref
+);
+
+exprconv(
+ int converted: @expr ref,
+ unique int conversion: @expr ref
+);
+
+compgenerated(unique int id: @element ref);
+
+/**
+ * `destructor_call` destructs the `i`'th entity that should be
+ * destructed following `element`. Note that entities should be
+ * destructed in reverse construction order, so for a given `element`
+ * these should be called from highest to lowest `i`.
+ */
+#keyset[element, destructor_call]
+#keyset[element, i]
+synthetic_destructor_call(
+ int element: @element ref,
+ int i: int ref,
+ int destructor_call: @routineexpr ref
+);
+
+namespaces(
+ unique int id: @namespace,
+ string name: string ref
+);
+
+namespace_inline(
+ unique int id: @namespace ref
+);
+
+namespacembrs(
+ int parentid: @namespace ref,
+ unique int memberid: @namespacembr ref
+);
+
+@namespacembr = @declaration | @namespace;
+
+exprparents(
+ int expr_id: @expr ref,
+ int child_index: int ref,
+ int parent_id: @exprparent ref
+);
+
+expr_isload(unique int expr_id: @expr ref);
+
+@cast = @c_style_cast
+ | @const_cast
+ | @dynamic_cast
+ | @reinterpret_cast
+ | @static_cast
+ ;
+
+/*
+case @conversion.kind of
+ 0 = @simple_conversion // a numeric conversion, qualification conversion, or a reinterpret_cast
+| 1 = @bool_conversion // conversion to 'bool'
+| 2 = @base_class_conversion // a derived-to-base conversion
+| 3 = @derived_class_conversion // a base-to-derived conversion
+| 4 = @pm_base_class_conversion // a derived-to-base conversion of a pointer to member
+| 5 = @pm_derived_class_conversion // a base-to-derived conversion of a pointer to member
+| 6 = @glvalue_adjust // an adjustment of the type of a glvalue
+| 7 = @prvalue_adjust // an adjustment of the type of a prvalue
+;
+*/
+/**
+ * Describes the semantics represented by a cast expression. This is largely
+ * independent of the source syntax of the cast, so it is separate from the
+ * regular expression kind.
+ */
+conversionkinds(
+ unique int expr_id: @cast ref,
+ int kind: int ref
+);
+
+@conversion = @cast
+ | @array_to_pointer
+ | @parexpr
+ | @reference_to
+ | @ref_indirect
+ | @temp_init
+ | @c11_generic
+ ;
+
+/*
+case @funbindexpr.kind of
+ 0 = @normal_call // a normal call
+| 1 = @virtual_call // a virtual call
+| 2 = @adl_call // a call whose target is only found by ADL
+;
+*/
+iscall(
+ unique int caller: @funbindexpr ref,
+ int kind: int ref
+);
+
+numtemplatearguments(
+ unique int expr_id: @expr ref,
+ int num: int ref
+);
+
+specialnamequalifyingelements(
+ unique int id: @specialnamequalifyingelement,
+ unique string name: string ref
+);
+
+@namequalifiableelement = @expr | @namequalifier;
+@namequalifyingelement = @namespace
+ | @specialnamequalifyingelement
+ | @usertype;
+
+namequalifiers(
+ unique int id: @namequalifier,
+ unique int qualifiableelement: @namequalifiableelement ref,
+ int qualifyingelement: @namequalifyingelement ref,
+ int location: @location_default ref
+);
+
+varbind(
+ int expr: @varbindexpr ref,
+ int var: @accessible ref
+);
+
+funbind(
+ int expr: @funbindexpr ref,
+ int fun: @function ref
+);
+
+@any_new_expr = @new_expr
+ | @new_array_expr;
+
+@new_or_delete_expr = @any_new_expr
+ | @delete_expr
+ | @delete_array_expr;
+
+@prefix_crement_expr = @preincrexpr | @predecrexpr;
+
+@postfix_crement_expr = @postincrexpr | @postdecrexpr;
+
+@increment_expr = @preincrexpr | @postincrexpr;
+
+@decrement_expr = @predecrexpr | @postdecrexpr;
+
+@crement_expr = @increment_expr | @decrement_expr;
+
+@un_arith_op_expr = @arithnegexpr
+ | @unaryplusexpr
+ | @conjugation
+ | @realpartexpr
+ | @imagpartexpr
+ | @crement_expr
+ ;
+
+@un_bitwise_op_expr = @complementexpr;
+
+@un_log_op_expr = @notexpr;
+
+@un_op_expr = @address_of
+ | @indirect
+ | @un_arith_op_expr
+ | @un_bitwise_op_expr
+ | @builtinaddressof
+ | @vec_fill
+ | @un_log_op_expr
+ | @co_await
+ | @co_yield
+ ;
+
+@bin_log_op_expr = @andlogicalexpr | @orlogicalexpr;
+
+@cmp_op_expr = @eq_op_expr | @rel_op_expr;
+
+@eq_op_expr = @eqexpr | @neexpr;
+
+@rel_op_expr = @gtexpr
+ | @ltexpr
+ | @geexpr
+ | @leexpr
+ | @spaceshipexpr
+ ;
+
+@bin_bitwise_op_expr = @lshiftexpr
+ | @rshiftexpr
+ | @andexpr
+ | @orexpr
+ | @xorexpr
+ ;
+
+@p_arith_op_expr = @paddexpr
+ | @psubexpr
+ | @pdiffexpr
+ ;
+
+@bin_arith_op_expr = @addexpr
+ | @subexpr
+ | @mulexpr
+ | @divexpr
+ | @remexpr
+ | @jmulexpr
+ | @jdivexpr
+ | @fjaddexpr
+ | @jfaddexpr
+ | @fjsubexpr
+ | @jfsubexpr
+ | @minexpr
+ | @maxexpr
+ | @p_arith_op_expr
+ ;
+
+@bin_op_expr = @bin_arith_op_expr
+ | @bin_bitwise_op_expr
+ | @cmp_op_expr
+ | @bin_log_op_expr
+ ;
+
+@op_expr = @un_op_expr
+ | @bin_op_expr
+ | @assign_expr
+ | @conditionalexpr
+ ;
+
+@assign_arith_expr = @assignaddexpr
+ | @assignsubexpr
+ | @assignmulexpr
+ | @assigndivexpr
+ | @assignremexpr
+ ;
+
+@assign_bitwise_expr = @assignandexpr
+ | @assignorexpr
+ | @assignxorexpr
+ | @assignlshiftexpr
+ | @assignrshiftexpr
+ ;
+
+@assign_pointer_expr = @assignpaddexpr
+ | @assignpsubexpr
+ ;
+
+@assign_op_expr = @assign_arith_expr
+ | @assign_bitwise_expr
+ | @assign_pointer_expr
+ ;
+
+@assign_expr = @assignexpr | @assign_op_expr | @blockassignexpr
+
+/*
+ Binary encoding of the allocator form.
+
+ case @allocator.form of
+ 0 = plain
+ | 1 = alignment
+ ;
+*/
+
+/**
+ * The allocator function associated with a `new` or `new[]` expression.
+ * The `form` column specified whether the allocation call contains an alignment
+ * argument.
+ */
+expr_allocator(
+ unique int expr: @any_new_expr ref,
+ int func: @function ref,
+ int form: int ref
+);
+
+/*
+ Binary encoding of the deallocator form.
+
+ case @deallocator.form of
+ 0 = plain
+ | 1 = size
+ | 2 = alignment
+ | 4 = destroying_delete
+ ;
+*/
+
+/**
+ * The deallocator function associated with a `delete`, `delete[]`, `new`, or
+ * `new[]` expression. For a `new` or `new[]` expression, the deallocator is the
+ * one used to free memory if the initialization throws an exception.
+ * The `form` column specifies whether the deallocation call contains a size
+ * argument, and alignment argument, or both.
+ */
+expr_deallocator(
+ unique int expr: @new_or_delete_expr ref,
+ int func: @function ref,
+ int form: int ref
+);
+
+/**
+ * Holds if the `@conditionalexpr` is of the two operand form
+ * `guard ? : false`.
+ */
+expr_cond_two_operand(
+ unique int cond: @conditionalexpr ref
+);
+
+/**
+ * The guard of `@conditionalexpr` `guard ? true : false`
+ */
+expr_cond_guard(
+ unique int cond: @conditionalexpr ref,
+ int guard: @expr ref
+);
+
+/**
+ * The expression used when the guard of `@conditionalexpr`
+ * `guard ? true : false` holds. For the two operand form
+ * `guard ?: false` consider using `expr_cond_guard` instead.
+ */
+expr_cond_true(
+ unique int cond: @conditionalexpr ref,
+ int true: @expr ref
+);
+
+/**
+ * The expression used when the guard of `@conditionalexpr`
+ * `guard ? true : false` does not hold.
+ */
+expr_cond_false(
+ unique int cond: @conditionalexpr ref,
+ int false: @expr ref
+);
+
+/** A string representation of the value. */
+values(
+ unique int id: @value,
+ string str: string ref
+);
+
+/** The actual text in the source code for the value, if any. */
+valuetext(
+ unique int id: @value ref,
+ string text: string ref
+);
+
+valuebind(
+ int val: @value ref,
+ unique int expr: @expr ref
+);
+
+fieldoffsets(
+ unique int id: @variable ref,
+ int byteoffset: int ref,
+ int bitoffset: int ref
+);
+
+bitfield(
+ unique int id: @variable ref,
+ int bits: int ref,
+ int declared_bits: int ref
+);
+
+/* TODO
+memberprefix(
+ int member: @expr ref,
+ int prefix: @expr ref
+);
+*/
+
+/*
+ kind(1) = mbrcallexpr
+ kind(2) = mbrptrcallexpr
+ kind(3) = mbrptrmbrcallexpr
+ kind(4) = ptrmbrptrmbrcallexpr
+ kind(5) = mbrreadexpr // x.y
+ kind(6) = mbrptrreadexpr // p->y
+ kind(7) = mbrptrmbrreadexpr // x.*pm
+ kind(8) = mbrptrmbrptrreadexpr // x->*pm
+ kind(9) = staticmbrreadexpr // static x.y
+ kind(10) = staticmbrptrreadexpr // static p->y
+*/
+/* TODO
+memberaccess(
+ int member: @expr ref,
+ int kind: int ref
+);
+*/
+
+initialisers(
+ unique int init: @initialiser,
+ int var: @accessible ref,
+ unique int expr: @expr ref,
+ int location: @location_default ref
+);
+
+braced_initialisers(
+ int init: @initialiser ref
+);
+
+/**
+ * An ancestor for the expression, for cases in which we cannot
+ * otherwise find the expression's parent.
+ */
+expr_ancestor(
+ int exp: @expr ref,
+ int ancestor: @element ref
+);
+
+exprs(
+ unique int id: @expr,
+ int kind: int ref,
+ int location: @location_default ref
+);
+
+expr_reuse(
+ int reuse: @expr ref,
+ int original: @expr ref,
+ int value_category: int ref
+)
+
+/*
+ case @value.category of
+ 1 = prval
+ | 2 = xval
+ | 3 = lval
+ ;
+*/
+expr_types(
+ int id: @expr ref,
+ int typeid: @type ref,
+ int value_category: int ref
+);
+
+case @expr.kind of
+ 1 = @errorexpr
+| 2 = @address_of // & AddressOfExpr
+| 3 = @reference_to // ReferenceToExpr (implicit?)
+| 4 = @indirect // * PointerDereferenceExpr
+| 5 = @ref_indirect // ReferenceDereferenceExpr (implicit?)
+// ...
+| 8 = @array_to_pointer // (???)
+| 9 = @vacuous_destructor_call // VacuousDestructorCall
+// ...
+| 11 = @assume // Microsoft
+| 12 = @parexpr
+| 13 = @arithnegexpr
+| 14 = @unaryplusexpr
+| 15 = @complementexpr
+| 16 = @notexpr
+| 17 = @conjugation // GNU ~ operator
+| 18 = @realpartexpr // GNU __real
+| 19 = @imagpartexpr // GNU __imag
+| 20 = @postincrexpr
+| 21 = @postdecrexpr
+| 22 = @preincrexpr
+| 23 = @predecrexpr
+| 24 = @conditionalexpr
+| 25 = @addexpr
+| 26 = @subexpr
+| 27 = @mulexpr
+| 28 = @divexpr
+| 29 = @remexpr
+| 30 = @jmulexpr // C99 mul imaginary
+| 31 = @jdivexpr // C99 div imaginary
+| 32 = @fjaddexpr // C99 add real + imaginary
+| 33 = @jfaddexpr // C99 add imaginary + real
+| 34 = @fjsubexpr // C99 sub real - imaginary
+| 35 = @jfsubexpr // C99 sub imaginary - real
+| 36 = @paddexpr // pointer add (pointer + int or int + pointer)
+| 37 = @psubexpr // pointer sub (pointer - integer)
+| 38 = @pdiffexpr // difference between two pointers
+| 39 = @lshiftexpr
+| 40 = @rshiftexpr
+| 41 = @andexpr
+| 42 = @orexpr
+| 43 = @xorexpr
+| 44 = @eqexpr
+| 45 = @neexpr
+| 46 = @gtexpr
+| 47 = @ltexpr
+| 48 = @geexpr
+| 49 = @leexpr
+| 50 = @minexpr // GNU minimum
+| 51 = @maxexpr // GNU maximum
+| 52 = @assignexpr
+| 53 = @assignaddexpr
+| 54 = @assignsubexpr
+| 55 = @assignmulexpr
+| 56 = @assigndivexpr
+| 57 = @assignremexpr
+| 58 = @assignlshiftexpr
+| 59 = @assignrshiftexpr
+| 60 = @assignandexpr
+| 61 = @assignorexpr
+| 62 = @assignxorexpr
+| 63 = @assignpaddexpr // assign pointer add
+| 64 = @assignpsubexpr // assign pointer sub
+| 65 = @andlogicalexpr
+| 66 = @orlogicalexpr
+| 67 = @commaexpr
+| 68 = @subscriptexpr // access to member of an array, e.g., a[5]
+// ... 69 @objc_subscriptexpr deprecated
+// ... 70 @cmdaccess deprecated
+// ...
+| 73 = @virtfunptrexpr
+| 74 = @callexpr
+// ... 75 @msgexpr_normal deprecated
+// ... 76 @msgexpr_super deprecated
+// ... 77 @atselectorexpr deprecated
+// ... 78 @atprotocolexpr deprecated
+| 79 = @vastartexpr
+| 80 = @vaargexpr
+| 81 = @vaendexpr
+| 82 = @vacopyexpr
+// ... 83 @atencodeexpr deprecated
+| 84 = @varaccess
+| 85 = @thisaccess
+// ... 86 @objc_box_expr deprecated
+| 87 = @new_expr
+| 88 = @delete_expr
+| 89 = @throw_expr
+| 90 = @condition_decl // a variable declared in a condition, e.g., if(int x = y > 2)
+| 91 = @braced_init_list
+| 92 = @type_id
+| 93 = @runtime_sizeof
+| 94 = @runtime_alignof
+| 95 = @sizeof_pack
+| 96 = @expr_stmt // GNU extension
+| 97 = @routineexpr
+| 98 = @type_operand // used to access a type in certain contexts (haven't found any examples yet....)
+| 99 = @offsetofexpr // offsetof ::= type and field
+| 100 = @hasassignexpr // __has_assign ::= type
+| 101 = @hascopyexpr // __has_copy ::= type
+| 102 = @hasnothrowassign // __has_nothrow_assign ::= type
+| 103 = @hasnothrowconstr // __has_nothrow_constructor ::= type
+| 104 = @hasnothrowcopy // __has_nothrow_copy ::= type
+| 105 = @hastrivialassign // __has_trivial_assign ::= type
+| 106 = @hastrivialconstr // __has_trivial_constructor ::= type
+| 107 = @hastrivialcopy // __has_trivial_copy ::= type
+| 108 = @hasuserdestr // __has_user_destructor ::= type
+| 109 = @hasvirtualdestr // __has_virtual_destructor ::= type
+| 110 = @isabstractexpr // __is_abstract ::= type
+| 111 = @isbaseofexpr // __is_base_of ::= type type
+| 112 = @isclassexpr // __is_class ::= type
+| 113 = @isconvtoexpr // __is_convertible_to ::= type type
+| 114 = @isemptyexpr // __is_empty ::= type
+| 115 = @isenumexpr // __is_enum ::= type
+| 116 = @ispodexpr // __is_pod ::= type
+| 117 = @ispolyexpr // __is_polymorphic ::= type
+| 118 = @isunionexpr // __is_union ::= type
+| 119 = @typescompexpr // GNU __builtin_types_compatible ::= type type
+| 120 = @intaddrexpr // frontend internal builtin, used to implement offsetof
+// ...
+| 122 = @hastrivialdestructor // __has_trivial_destructor ::= type
+| 123 = @literal
+| 124 = @uuidof
+| 127 = @aggregateliteral
+| 128 = @delete_array_expr
+| 129 = @new_array_expr
+// ... 130 @objc_array_literal deprecated
+// ... 131 @objc_dictionary_literal deprecated
+| 132 = @foldexpr
+// ...
+| 200 = @ctordirectinit
+| 201 = @ctorvirtualinit
+| 202 = @ctorfieldinit
+| 203 = @ctordelegatinginit
+| 204 = @dtordirectdestruct
+| 205 = @dtorvirtualdestruct
+| 206 = @dtorfielddestruct
+// ...
+| 210 = @static_cast
+| 211 = @reinterpret_cast
+| 212 = @const_cast
+| 213 = @dynamic_cast
+| 214 = @c_style_cast
+| 215 = @lambdaexpr
+| 216 = @param_ref
+| 217 = @noopexpr
+// ...
+| 294 = @istriviallyconstructibleexpr
+| 295 = @isdestructibleexpr
+| 296 = @isnothrowdestructibleexpr
+| 297 = @istriviallydestructibleexpr
+| 298 = @istriviallyassignableexpr
+| 299 = @isnothrowassignableexpr
+| 300 = @istrivialexpr
+| 301 = @isstandardlayoutexpr
+| 302 = @istriviallycopyableexpr
+| 303 = @isliteraltypeexpr
+| 304 = @hastrivialmoveconstructorexpr
+| 305 = @hastrivialmoveassignexpr
+| 306 = @hasnothrowmoveassignexpr
+| 307 = @isconstructibleexpr
+| 308 = @isnothrowconstructibleexpr
+| 309 = @hasfinalizerexpr
+| 310 = @isdelegateexpr
+| 311 = @isinterfaceclassexpr
+| 312 = @isrefarrayexpr
+| 313 = @isrefclassexpr
+| 314 = @issealedexpr
+| 315 = @issimplevalueclassexpr
+| 316 = @isvalueclassexpr
+| 317 = @isfinalexpr
+| 319 = @noexceptexpr
+| 320 = @builtinshufflevector
+| 321 = @builtinchooseexpr
+| 322 = @builtinaddressof
+| 323 = @vec_fill
+| 324 = @builtinconvertvector
+| 325 = @builtincomplex
+| 326 = @spaceshipexpr
+| 327 = @co_await
+| 328 = @co_yield
+| 329 = @temp_init
+| 330 = @isassignable
+| 331 = @isaggregate
+| 332 = @hasuniqueobjectrepresentations
+| 333 = @builtinbitcast
+| 334 = @builtinshuffle
+| 335 = @blockassignexpr
+| 336 = @issame
+| 337 = @isfunction
+| 338 = @islayoutcompatible
+| 339 = @ispointerinterconvertiblebaseof
+| 340 = @isarray
+| 341 = @arrayrank
+| 342 = @arrayextent
+| 343 = @isarithmetic
+| 344 = @iscompletetype
+| 345 = @iscompound
+| 346 = @isconst
+| 347 = @isfloatingpoint
+| 348 = @isfundamental
+| 349 = @isintegral
+| 350 = @islvaluereference
+| 351 = @ismemberfunctionpointer
+| 352 = @ismemberobjectpointer
+| 353 = @ismemberpointer
+| 354 = @isobject
+| 355 = @ispointer
+| 356 = @isreference
+| 357 = @isrvaluereference
+| 358 = @isscalar
+| 359 = @issigned
+| 360 = @isunsigned
+| 361 = @isvoid
+| 362 = @isvolatile
+| 363 = @reuseexpr
+| 364 = @istriviallycopyassignable
+| 365 = @isassignablenopreconditioncheck
+| 366 = @referencebindstotemporary
+| 367 = @issameas
+| 368 = @builtinhasattribute
+| 369 = @ispointerinterconvertiblewithclass
+| 370 = @builtinispointerinterconvertiblewithclass
+| 371 = @iscorrespondingmember
+| 372 = @builtiniscorrespondingmember
+| 373 = @isboundedarray
+| 374 = @isunboundedarray
+| 375 = @isreferenceable
+| 378 = @isnothrowconvertible
+| 379 = @referenceconstructsfromtemporary
+| 380 = @referenceconvertsfromtemporary
+| 381 = @isconvertible
+| 382 = @isvalidwinrttype
+| 383 = @iswinclass
+| 384 = @iswininterface
+| 385 = @istriviallyequalitycomparable
+| 386 = @isscopedenum
+| 387 = @istriviallyrelocatable
+| 388 = @datasizeof
+| 389 = @c11_generic
+| 390 = @requires_expr
+| 391 = @nested_requirement
+| 392 = @compound_requirement
+| 393 = @concept_id
+;
+
+@var_args_expr = @vastartexpr
+ | @vaendexpr
+ | @vaargexpr
+ | @vacopyexpr
+ ;
+
+@builtin_op = @var_args_expr
+ | @noopexpr
+ | @offsetofexpr
+ | @intaddrexpr
+ | @hasassignexpr
+ | @hascopyexpr
+ | @hasnothrowassign
+ | @hasnothrowconstr
+ | @hasnothrowcopy
+ | @hastrivialassign
+ | @hastrivialconstr
+ | @hastrivialcopy
+ | @hastrivialdestructor
+ | @hasuserdestr
+ | @hasvirtualdestr
+ | @isabstractexpr
+ | @isbaseofexpr
+ | @isclassexpr
+ | @isconvtoexpr
+ | @isemptyexpr
+ | @isenumexpr
+ | @ispodexpr
+ | @ispolyexpr
+ | @isunionexpr
+ | @typescompexpr
+ | @builtinshufflevector
+ | @builtinconvertvector
+ | @builtinaddressof
+ | @istriviallyconstructibleexpr
+ | @isdestructibleexpr
+ | @isnothrowdestructibleexpr
+ | @istriviallydestructibleexpr
+ | @istriviallyassignableexpr
+ | @isnothrowassignableexpr
+ | @istrivialexpr
+ | @isstandardlayoutexpr
+ | @istriviallycopyableexpr
+ | @isliteraltypeexpr
+ | @hastrivialmoveconstructorexpr
+ | @hastrivialmoveassignexpr
+ | @hasnothrowmoveassignexpr
+ | @isconstructibleexpr
+ | @isnothrowconstructibleexpr
+ | @hasfinalizerexpr
+ | @isdelegateexpr
+ | @isinterfaceclassexpr
+ | @isrefarrayexpr
+ | @isrefclassexpr
+ | @issealedexpr
+ | @issimplevalueclassexpr
+ | @isvalueclassexpr
+ | @isfinalexpr
+ | @builtinchooseexpr
+ | @builtincomplex
+ | @isassignable
+ | @isaggregate
+ | @hasuniqueobjectrepresentations
+ | @builtinbitcast
+ | @builtinshuffle
+ | @issame
+ | @isfunction
+ | @islayoutcompatible
+ | @ispointerinterconvertiblebaseof
+ | @isarray
+ | @arrayrank
+ | @arrayextent
+ | @isarithmetic
+ | @iscompletetype
+ | @iscompound
+ | @isconst
+ | @isfloatingpoint
+ | @isfundamental
+ | @isintegral
+ | @islvaluereference
+ | @ismemberfunctionpointer
+ | @ismemberobjectpointer
+ | @ismemberpointer
+ | @isobject
+ | @ispointer
+ | @isreference
+ | @isrvaluereference
+ | @isscalar
+ | @issigned
+ | @isunsigned
+ | @isvoid
+ | @isvolatile
+ | @istriviallycopyassignable
+ | @isassignablenopreconditioncheck
+ | @referencebindstotemporary
+ | @issameas
+ | @builtinhasattribute
+ | @ispointerinterconvertiblewithclass
+ | @builtinispointerinterconvertiblewithclass
+ | @iscorrespondingmember
+ | @builtiniscorrespondingmember
+ | @isboundedarray
+ | @isunboundedarray
+ | @isreferenceable
+ | @isnothrowconvertible
+ | @referenceconstructsfromtemporary
+ | @referenceconvertsfromtemporary
+ | @isconvertible
+ | @isvalidwinrttype
+ | @iswinclass
+ | @iswininterface
+ | @istriviallyequalitycomparable
+ | @isscopedenum
+ | @istriviallyrelocatable
+ ;
+
+compound_requirement_is_noexcept(
+ int expr: @compound_requirement ref
+);
+
+new_allocated_type(
+ unique int expr: @new_expr ref,
+ int type_id: @type ref
+);
+
+new_array_allocated_type(
+ unique int expr: @new_array_expr ref,
+ int type_id: @type ref
+);
+
+/**
+ * The field being initialized by an initializer expression within an aggregate
+ * initializer for a class/struct/union. Position is used to sort repeated initializers.
+ */
+#keyset[aggregate, position]
+aggregate_field_init(
+ int aggregate: @aggregateliteral ref,
+ int initializer: @expr ref,
+ int field: @membervariable ref,
+ int position: int ref,
+ boolean is_designated: boolean ref
+);
+
+/**
+ * The index of the element being initialized by an initializer expression
+ * within an aggregate initializer for an array. Position is used to sort repeated initializers.
+ */
+#keyset[aggregate, position]
+aggregate_array_init(
+ int aggregate: @aggregateliteral ref,
+ int initializer: @expr ref,
+ int element_index: int ref,
+ int position: int ref,
+ boolean is_designated: boolean ref
+);
+
+@ctorinit = @ctordirectinit
+ | @ctorvirtualinit
+ | @ctorfieldinit
+ | @ctordelegatinginit;
+@dtordestruct = @dtordirectdestruct
+ | @dtorvirtualdestruct
+ | @dtorfielddestruct;
+
+
+condition_decl_bind(
+ unique int expr: @condition_decl ref,
+ unique int decl: @declaration ref
+);
+
+typeid_bind(
+ unique int expr: @type_id ref,
+ int type_id: @type ref
+);
+
+uuidof_bind(
+ unique int expr: @uuidof ref,
+ int type_id: @type ref
+);
+
+@sizeof_or_alignof = @runtime_sizeof | @runtime_alignof | @datasizeof | @sizeof_pack;
+
+sizeof_bind(
+ unique int expr: @sizeof_or_alignof ref,
+ int type_id: @type ref
+);
+
+code_block(
+ unique int block: @literal ref,
+ unique int routine: @function ref
+);
+
+lambdas(
+ unique int expr: @lambdaexpr ref,
+ string default_capture: string ref,
+ boolean has_explicit_return_type: boolean ref,
+ boolean has_explicit_parameter_list: boolean ref
+);
+
+lambda_capture(
+ unique int id: @lambdacapture,
+ int lambda: @lambdaexpr ref,
+ int index: int ref,
+ int field: @membervariable ref,
+ boolean captured_by_reference: boolean ref,
+ boolean is_implicit: boolean ref,
+ int location: @location_default ref
+);
+
+@funbindexpr = @routineexpr
+ | @new_expr
+ | @delete_expr
+ | @delete_array_expr
+ | @ctordirectinit
+ | @ctorvirtualinit
+ | @ctordelegatinginit
+ | @dtordirectdestruct
+ | @dtorvirtualdestruct;
+
+@varbindexpr = @varaccess | @ctorfieldinit | @dtorfielddestruct;
+@addressable = @function | @variable ;
+@accessible = @addressable | @enumconstant ;
+
+@access = @varaccess | @routineexpr ;
+
+fold(
+ int expr: @foldexpr ref,
+ string operator: string ref,
+ boolean is_left_fold: boolean ref
+);
+
+stmts(
+ unique int id: @stmt,
+ int kind: int ref,
+ int location: @location_default ref
+);
+
+case @stmt.kind of
+ 1 = @stmt_expr
+| 2 = @stmt_if
+| 3 = @stmt_while
+| 4 = @stmt_goto
+| 5 = @stmt_label
+| 6 = @stmt_return
+| 7 = @stmt_block
+| 8 = @stmt_end_test_while // do { ... } while ( ... )
+| 9 = @stmt_for
+| 10 = @stmt_switch_case
+| 11 = @stmt_switch
+| 13 = @stmt_asm // "asm" statement or the body of an asm function
+| 15 = @stmt_try_block
+| 16 = @stmt_microsoft_try // Microsoft
+| 17 = @stmt_decl
+| 18 = @stmt_set_vla_size // C99
+| 19 = @stmt_vla_decl // C99
+| 25 = @stmt_assigned_goto // GNU
+| 26 = @stmt_empty
+| 27 = @stmt_continue
+| 28 = @stmt_break
+| 29 = @stmt_range_based_for // C++11
+// ... 30 @stmt_at_autoreleasepool_block deprecated
+// ... 31 @stmt_objc_for_in deprecated
+// ... 32 @stmt_at_synchronized deprecated
+| 33 = @stmt_handler
+// ... 34 @stmt_finally_end deprecated
+| 35 = @stmt_constexpr_if
+| 37 = @stmt_co_return
+| 38 = @stmt_consteval_if
+| 39 = @stmt_not_consteval_if
+| 40 = @stmt_leave
+;
+
+type_vla(
+ int type_id: @type ref,
+ int decl: @stmt_vla_decl ref
+);
+
+variable_vla(
+ int var: @variable ref,
+ int decl: @stmt_vla_decl ref
+);
+
+type_is_vla(unique int type_id: @derivedtype ref)
+
+if_initialization(
+ unique int if_stmt: @stmt_if ref,
+ int init_id: @stmt ref
+);
+
+if_then(
+ unique int if_stmt: @stmt_if ref,
+ int then_id: @stmt ref
+);
+
+if_else(
+ unique int if_stmt: @stmt_if ref,
+ int else_id: @stmt ref
+);
+
+constexpr_if_initialization(
+ unique int constexpr_if_stmt: @stmt_constexpr_if ref,
+ int init_id: @stmt ref
+);
+
+constexpr_if_then(
+ unique int constexpr_if_stmt: @stmt_constexpr_if ref,
+ int then_id: @stmt ref
+);
+
+constexpr_if_else(
+ unique int constexpr_if_stmt: @stmt_constexpr_if ref,
+ int else_id: @stmt ref
+);
+
+@stmt_consteval_or_not_consteval_if = @stmt_consteval_if | @stmt_not_consteval_if;
+
+consteval_if_then(
+ unique int constexpr_if_stmt: @stmt_consteval_or_not_consteval_if ref,
+ int then_id: @stmt ref
+);
+
+consteval_if_else(
+ unique int constexpr_if_stmt: @stmt_consteval_or_not_consteval_if ref,
+ int else_id: @stmt ref
+);
+
+while_body(
+ unique int while_stmt: @stmt_while ref,
+ int body_id: @stmt ref
+);
+
+do_body(
+ unique int do_stmt: @stmt_end_test_while ref,
+ int body_id: @stmt ref
+);
+
+switch_initialization(
+ unique int switch_stmt: @stmt_switch ref,
+ int init_id: @stmt ref
+);
+
+#keyset[switch_stmt, index]
+switch_case(
+ int switch_stmt: @stmt_switch ref,
+ int index: int ref,
+ int case_id: @stmt_switch_case ref
+);
+
+switch_body(
+ unique int switch_stmt: @stmt_switch ref,
+ int body_id: @stmt ref
+);
+
+@stmt_for_or_range_based_for = @stmt_for
+ | @stmt_range_based_for;
+
+for_initialization(
+ unique int for_stmt: @stmt_for_or_range_based_for ref,
+ int init_id: @stmt ref
+);
+
+for_condition(
+ unique int for_stmt: @stmt_for ref,
+ int condition_id: @expr ref
+);
+
+for_update(
+ unique int for_stmt: @stmt_for ref,
+ int update_id: @expr ref
+);
+
+for_body(
+ unique int for_stmt: @stmt_for ref,
+ int body_id: @stmt ref
+);
+
+@stmtparent = @stmt | @expr_stmt ;
+stmtparents(
+ unique int id: @stmt ref,
+ int index: int ref,
+ int parent: @stmtparent ref
+);
+
+ishandler(unique int block: @stmt_block ref);
+
+@cfgnode = @stmt | @expr | @function | @initialiser ;
+
+stmt_decl_bind(
+ int stmt: @stmt_decl ref,
+ int num: int ref,
+ int decl: @declaration ref
+);
+
+stmt_decl_entry_bind(
+ int stmt: @stmt_decl ref,
+ int num: int ref,
+ int decl_entry: @element ref
+);
+
+@parameterized_element = @function | @stmt_block | @requires_expr;
+
+blockscope(
+ unique int block: @stmt_block ref,
+ int enclosing: @parameterized_element ref
+);
+
+@jump = @stmt_goto | @stmt_break | @stmt_continue | @stmt_leave;
+
+@jumporlabel = @jump | @stmt_label | @literal;
+
+jumpinfo(
+ unique int id: @jumporlabel ref,
+ string str: string ref,
+ int target: @stmt ref
+);
+
+preprocdirects(
+ unique int id: @preprocdirect,
+ int kind: int ref,
+ int location: @location_default ref
+);
+case @preprocdirect.kind of
+ 0 = @ppd_if
+| 1 = @ppd_ifdef
+| 2 = @ppd_ifndef
+| 3 = @ppd_elif
+| 4 = @ppd_else
+| 5 = @ppd_endif
+| 6 = @ppd_plain_include
+| 7 = @ppd_define
+| 8 = @ppd_undef
+| 9 = @ppd_line
+| 10 = @ppd_error
+| 11 = @ppd_pragma
+| 12 = @ppd_objc_import
+| 13 = @ppd_include_next
+| 14 = @ppd_ms_import
+| 15 = @ppd_elifdef
+| 16 = @ppd_elifndef
+| 18 = @ppd_warning
+;
+
+@ppd_include = @ppd_plain_include | @ppd_objc_import | @ppd_include_next | @ppd_ms_import;
+
+@ppd_branch = @ppd_if | @ppd_ifdef | @ppd_ifndef | @ppd_elif | @ppd_elifdef | @ppd_elifndef;
+
+preprocpair(
+ int begin : @ppd_branch ref,
+ int elseelifend : @preprocdirect ref
+);
+
+preproctrue(int branch : @ppd_branch ref);
+preprocfalse(int branch : @ppd_branch ref);
+
+preproctext(
+ unique int id: @preprocdirect ref,
+ string head: string ref,
+ string body: string ref
+);
+
+includes(
+ unique int id: @ppd_include ref,
+ int included: @file ref
+);
+
+link_targets(
+ int id: @link_target,
+ int binary: @file ref
+);
+
+link_parent(
+ int element : @element ref,
+ int link_target : @link_target ref
+);
+
+/*- XML Files -*/
+
+xmlEncoding(
+ unique int id: @file ref,
+ string encoding: string ref
+);
+
+xmlDTDs(
+ unique int id: @xmldtd,
+ string root: string ref,
+ string publicId: string ref,
+ string systemId: string ref,
+ int fileid: @file ref
+);
+
+xmlElements(
+ unique int id: @xmlelement,
+ string name: string ref,
+ int parentid: @xmlparent ref,
+ int idx: int ref,
+ int fileid: @file ref
+);
+
+xmlAttrs(
+ unique int id: @xmlattribute,
+ int elementid: @xmlelement ref,
+ string name: string ref,
+ string value: string ref,
+ int idx: int ref,
+ int fileid: @file ref
+);
+
+xmlNs(
+ int id: @xmlnamespace,
+ string prefixName: string ref,
+ string URI: string ref,
+ int fileid: @file ref
+);
+
+xmlHasNs(
+ int elementId: @xmlnamespaceable ref,
+ int nsId: @xmlnamespace ref,
+ int fileid: @file ref
+);
+
+xmlComments(
+ unique int id: @xmlcomment,
+ string text: string ref,
+ int parentid: @xmlparent ref,
+ int fileid: @file ref
+);
+
+xmlChars(
+ unique int id: @xmlcharacters,
+ string text: string ref,
+ int parentid: @xmlparent ref,
+ int idx: int ref,
+ int isCDATA: int ref,
+ int fileid: @file ref
+);
+
+@xmlparent = @file | @xmlelement;
+@xmlnamespaceable = @xmlelement | @xmlattribute;
+
+xmllocations(
+ int xmlElement: @xmllocatable ref,
+ int location: @location_default ref
+);
+
+@xmllocatable = @xmlcharacters | @xmlelement | @xmlcomment | @xmlattribute | @xmldtd | @file | @xmlnamespace;
diff --git a/cpp/downgrades/c16b29b27f71247023321cc0d0360998b318837c/semmlecode.cpp.dbscheme b/cpp/downgrades/c16b29b27f71247023321cc0d0360998b318837c/semmlecode.cpp.dbscheme
new file mode 100644
index 000000000000..5340d6d5f428
--- /dev/null
+++ b/cpp/downgrades/c16b29b27f71247023321cc0d0360998b318837c/semmlecode.cpp.dbscheme
@@ -0,0 +1,2423 @@
+/*- Compilations -*/
+
+/**
+ * An invocation of the compiler. Note that more than one file may be
+ * compiled per invocation. For example, this command compiles three
+ * source files:
+ *
+ * gcc -c f1.c f2.c f3.c
+ *
+ * The `id` simply identifies the invocation, while `cwd` is the working
+ * directory from which the compiler was invoked.
+ */
+compilations(
+ /**
+ * An invocation of the compiler. Note that more than one file may
+ * be compiled per invocation. For example, this command compiles
+ * three source files:
+ *
+ * gcc -c f1.c f2.c f3.c
+ */
+ unique int id : @compilation,
+ string cwd : string ref
+);
+
+/**
+ * The arguments that were passed to the extractor for a compiler
+ * invocation. If `id` is for the compiler invocation
+ *
+ * gcc -c f1.c f2.c f3.c
+ *
+ * then typically there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0 | *path to extractor*
+ * 1 | `--mimic`
+ * 2 | `/usr/bin/gcc`
+ * 3 | `-c`
+ * 4 | f1.c
+ * 5 | f2.c
+ * 6 | f3.c
+ */
+#keyset[id, num]
+compilation_args(
+ int id : @compilation ref,
+ int num : int ref,
+ string arg : string ref
+);
+
+/**
+ * Optionally, record the build mode for each compilation.
+ */
+compilation_build_mode(
+ unique int id : @compilation ref,
+ int mode : int ref
+);
+
+/*
+case @compilation_build_mode.mode of
+ 0 = @build_mode_none
+| 1 = @build_mode_manual
+| 2 = @build_mode_auto
+;
+*/
+
+/**
+ * The source files that are compiled by a compiler invocation.
+ * If `id` is for the compiler invocation
+ *
+ * gcc -c f1.c f2.c f3.c
+ *
+ * then there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0 | f1.c
+ * 1 | f2.c
+ * 2 | f3.c
+ *
+ * Note that even if those files `#include` headers, those headers
+ * do not appear as rows.
+ */
+#keyset[id, num]
+compilation_compiling_files(
+ int id : @compilation ref,
+ int num : int ref,
+ int file : @file ref
+);
+
+/**
+ * The time taken by the extractor for a compiler invocation.
+ *
+ * For each file `num`, there will be rows for
+ *
+ * kind | seconds
+ * ---- | ---
+ * 1 | CPU seconds used by the extractor frontend
+ * 2 | Elapsed seconds during the extractor frontend
+ * 3 | CPU seconds used by the extractor backend
+ * 4 | Elapsed seconds during the extractor backend
+ */
+#keyset[id, num, kind]
+compilation_time(
+ int id : @compilation ref,
+ int num : int ref,
+ /* kind:
+ 1 = frontend_cpu_seconds
+ 2 = frontend_elapsed_seconds
+ 3 = extractor_cpu_seconds
+ 4 = extractor_elapsed_seconds
+ */
+ int kind : int ref,
+ float seconds : float ref
+);
+
+/**
+ * An error or warning generated by the extractor.
+ * The diagnostic message `diagnostic` was generated during compiler
+ * invocation `compilation`, and is the `file_number_diagnostic_number`th
+ * message generated while extracting the `file_number`th file of that
+ * invocation.
+ */
+#keyset[compilation, file_number, file_number_diagnostic_number]
+diagnostic_for(
+ int diagnostic : @diagnostic ref,
+ int compilation : @compilation ref,
+ int file_number : int ref,
+ int file_number_diagnostic_number : int ref
+);
+
+/**
+ * If extraction was successful, then `cpu_seconds` and
+ * `elapsed_seconds` are the CPU time and elapsed time (respectively)
+ * that extraction took for compiler invocation `id`.
+ */
+compilation_finished(
+ unique int id : @compilation ref,
+ float cpu_seconds : float ref,
+ float elapsed_seconds : float ref
+);
+
+/*- External data -*/
+
+/**
+ * External data, loaded from CSV files during snapshot creation. See
+ * [Tutorial: Incorporating external data](https://help.semmle.com/wiki/display/SD/Tutorial%3A+Incorporating+external+data)
+ * for more information.
+ */
+externalData(
+ int id : @externalDataElement,
+ string path : string ref,
+ int column: int ref,
+ string value : string ref
+);
+
+/*- Source location prefix -*/
+
+/**
+ * The source location of the snapshot.
+ */
+sourceLocationPrefix(string prefix : string ref);
+
+/*- Files and folders -*/
+
+/**
+ * The location of an element.
+ * The location spans column `startcolumn` of line `startline` to
+ * column `endcolumn` of line `endline` in file `file`.
+ * For more information, see
+ * [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
+ */
+locations_default(
+ unique int id: @location_default,
+ int file: @file ref,
+ int beginLine: int ref,
+ int beginColumn: int ref,
+ int endLine: int ref,
+ int endColumn: int ref
+);
+
+files(
+ unique int id: @file,
+ string name: string ref
+);
+
+folders(
+ unique int id: @folder,
+ string name: string ref
+);
+
+@container = @file | @folder
+
+containerparent(
+ int parent: @container ref,
+ unique int child: @container ref
+);
+
+/*- Lines of code -*/
+
+numlines(
+ int element_id: @sourceline ref,
+ int num_lines: int ref,
+ int num_code: int ref,
+ int num_comment: int ref
+);
+
+/*- Diagnostic messages -*/
+
+diagnostics(
+ unique int id: @diagnostic,
+ int severity: int ref,
+ string error_tag: string ref,
+ string error_message: string ref,
+ string full_error_message: string ref,
+ int location: @location_default ref
+);
+
+/*- C++ dbscheme -*/
+
+extractor_version(
+ string codeql_version: string ref,
+ string frontend_version: string ref
+)
+
+/** An element for which line-count information is available. */
+@sourceline = @file | @function | @variable | @enumconstant | @xmllocatable;
+
+fileannotations(
+ int id: @file ref,
+ int kind: int ref,
+ string name: string ref,
+ string value: string ref
+);
+
+inmacroexpansion(
+ int id: @element ref,
+ int inv: @macroinvocation ref
+);
+
+affectedbymacroexpansion(
+ int id: @element ref,
+ int inv: @macroinvocation ref
+);
+
+case @macroinvocation.kind of
+ 1 = @macro_expansion
+| 2 = @other_macro_reference
+;
+
+macroinvocations(
+ unique int id: @macroinvocation,
+ int macro_id: @ppd_define ref,
+ int location: @location_default ref,
+ int kind: int ref
+);
+
+macroparent(
+ unique int id: @macroinvocation ref,
+ int parent_id: @macroinvocation ref
+);
+
+// a macroinvocation may be part of another location
+// the way to find a constant expression that uses a macro
+// is thus to find a constant expression that has a location
+// to which a macro invocation is bound
+macrolocationbind(
+ int id: @macroinvocation ref,
+ int location: @location_default ref
+);
+
+#keyset[invocation, argument_index]
+macro_argument_unexpanded(
+ int invocation: @macroinvocation ref,
+ int argument_index: int ref,
+ string text: string ref
+);
+
+#keyset[invocation, argument_index]
+macro_argument_expanded(
+ int invocation: @macroinvocation ref,
+ int argument_index: int ref,
+ string text: string ref
+);
+
+case @function.kind of
+ 0 = @unknown_function
+| 1 = @normal_function
+| 2 = @constructor
+| 3 = @destructor
+| 4 = @conversion_function
+| 5 = @operator
+// ... 6 = @builtin_function deprecated // GCC built-in functions, e.g. __builtin___memcpy_chk
+| 7 = @user_defined_literal
+| 8 = @deduction_guide
+;
+
+functions(
+ unique int id: @function,
+ string name: string ref,
+ int kind: int ref
+);
+
+builtin_functions(
+ int id: @function ref
+)
+
+function_entry_point(
+ int id: @function ref,
+ unique int entry_point: @stmt ref
+);
+
+function_return_type(
+ int id: @function ref,
+ int return_type: @type ref
+);
+
+/**
+ * If `function` is a coroutine, then this gives the `std::experimental::resumable_traits`
+ * instance associated with it, and the variables representing the `handle` and `promise`
+ * for it.
+ */
+coroutine(
+ unique int function: @function ref,
+ int traits: @type ref
+);
+
+/*
+case @coroutine_placeholder_variable.kind of
+ 1 = @handle
+| 2 = @promise
+| 3 = @init_await_resume
+;
+*/
+
+coroutine_placeholder_variable(
+ unique int placeholder_variable: @variable ref,
+ int kind: int ref,
+ int function: @function ref
+)
+
+/** The `new` function used for allocating the coroutine state, if any. */
+coroutine_new(
+ unique int function: @function ref,
+ int new: @function ref
+);
+
+/** The `delete` function used for deallocating the coroutine state, if any. */
+coroutine_delete(
+ unique int function: @function ref,
+ int delete: @function ref
+);
+
+purefunctions(unique int id: @function ref);
+
+function_deleted(unique int id: @function ref);
+
+function_defaulted(unique int id: @function ref);
+
+function_prototyped(unique int id: @function ref)
+
+deduction_guide_for_class(
+ int id: @function ref,
+ int class_template: @usertype ref
+)
+
+member_function_this_type(
+ unique int id: @function ref,
+ int this_type: @type ref
+);
+
+#keyset[id, type_id]
+fun_decls(
+ int id: @fun_decl,
+ int function: @function ref,
+ int type_id: @type ref,
+ string name: string ref,
+ int location: @location_default ref
+);
+fun_def(unique int id: @fun_decl ref);
+fun_specialized(unique int id: @fun_decl ref);
+fun_implicit(unique int id: @fun_decl ref);
+fun_decl_specifiers(
+ int id: @fun_decl ref,
+ string name: string ref
+)
+#keyset[fun_decl, index]
+fun_decl_throws(
+ int fun_decl: @fun_decl ref,
+ int index: int ref,
+ int type_id: @type ref
+);
+/* an empty throw specification is different from none */
+fun_decl_empty_throws(unique int fun_decl: @fun_decl ref);
+fun_decl_noexcept(
+ int fun_decl: @fun_decl ref,
+ int constant: @expr ref
+);
+fun_decl_empty_noexcept(int fun_decl: @fun_decl ref);
+fun_decl_typedef_type(
+ unique int fun_decl: @fun_decl ref,
+ int typedeftype_id: @usertype ref
+);
+
+/*
+case @fun_requires.kind of
+ 1 = @template_attached
+| 2 = @function_attached
+;
+*/
+
+fun_requires(
+ int id: @fun_decl ref,
+ int kind: int ref,
+ int constraint: @expr ref
+);
+
+param_decl_bind(
+ unique int id: @var_decl ref,
+ int index: int ref,
+ int fun_decl: @fun_decl ref
+);
+
+#keyset[id, type_id]
+var_decls(
+ int id: @var_decl,
+ int variable: @variable ref,
+ int type_id: @type ref,
+ string name: string ref,
+ int location: @location_default ref
+);
+var_def(unique int id: @var_decl ref);
+var_specialized(int id: @var_decl ref);
+var_decl_specifiers(
+ int id: @var_decl ref,
+ string name: string ref
+)
+is_structured_binding(unique int id: @variable ref);
+var_requires(
+ int id: @var_decl ref,
+ int constraint: @expr ref
+);
+
+type_decls(
+ unique int id: @type_decl,
+ int type_id: @type ref,
+ int location: @location_default ref
+);
+type_def(unique int id: @type_decl ref);
+type_decl_top(
+ unique int type_decl: @type_decl ref
+);
+type_requires(
+ int id: @type_decl ref,
+ int constraint: @expr ref
+);
+
+namespace_decls(
+ unique int id: @namespace_decl,
+ int namespace_id: @namespace ref,
+ int location: @location_default ref,
+ int bodylocation: @location_default ref
+);
+
+case @using.kind of
+ 1 = @using_declaration
+| 2 = @using_directive
+| 3 = @using_enum_declaration
+;
+
+usings(
+ unique int id: @using,
+ int element_id: @element ref,
+ int location: @location_default ref,
+ int kind: int ref
+);
+
+/** The element which contains the `using` declaration. */
+using_container(
+ int parent: @element ref,
+ int child: @using ref
+);
+
+static_asserts(
+ unique int id: @static_assert,
+ int condition : @expr ref,
+ string message : string ref,
+ int location: @location_default ref,
+ int enclosing : @element ref
+);
+
+// each function has an ordered list of parameters
+#keyset[id, type_id]
+#keyset[function, index, type_id]
+params(
+ int id: @parameter,
+ int function: @parameterized_element ref,
+ int index: int ref,
+ int type_id: @type ref
+);
+
+overrides(
+ int new: @function ref,
+ int old: @function ref
+);
+
+#keyset[id, type_id]
+membervariables(
+ int id: @membervariable,
+ int type_id: @type ref,
+ string name: string ref
+);
+
+#keyset[id, type_id]
+globalvariables(
+ int id: @globalvariable,
+ int type_id: @type ref,
+ string name: string ref
+);
+
+#keyset[id, type_id]
+localvariables(
+ int id: @localvariable,
+ int type_id: @type ref,
+ string name: string ref
+);
+
+autoderivation(
+ unique int var: @variable ref,
+ int derivation_type: @type ref
+);
+
+orphaned_variables(
+ int var: @localvariable ref,
+ int function: @function ref
+)
+
+enumconstants(
+ unique int id: @enumconstant,
+ int parent: @usertype ref,
+ int index: int ref,
+ int type_id: @type ref,
+ string name: string ref,
+ int location: @location_default ref
+);
+
+@variable = @localscopevariable | @globalvariable | @membervariable;
+
+@localscopevariable = @localvariable | @parameter;
+
+/**
+ * Built-in types are the fundamental types, e.g., integral, floating, and void.
+ */
+case @builtintype.kind of
+ 1 = @errortype
+| 2 = @unknowntype
+| 3 = @void
+| 4 = @boolean
+| 5 = @char
+| 6 = @unsigned_char
+| 7 = @signed_char
+| 8 = @short
+| 9 = @unsigned_short
+| 10 = @signed_short
+| 11 = @int
+| 12 = @unsigned_int
+| 13 = @signed_int
+| 14 = @long
+| 15 = @unsigned_long
+| 16 = @signed_long
+| 17 = @long_long
+| 18 = @unsigned_long_long
+| 19 = @signed_long_long
+// ... 20 Microsoft-specific __int8
+// ... 21 Microsoft-specific __int16
+// ... 22 Microsoft-specific __int32
+// ... 23 Microsoft-specific __int64
+| 24 = @float
+| 25 = @double
+| 26 = @long_double
+| 27 = @complex_float // C99-specific _Complex float
+| 28 = @complex_double // C99-specific _Complex double
+| 29 = @complex_long_double // C99-specific _Complex long double
+| 30 = @imaginary_float // C99-specific _Imaginary float
+| 31 = @imaginary_double // C99-specific _Imaginary double
+| 32 = @imaginary_long_double // C99-specific _Imaginary long double
+| 33 = @wchar_t // Microsoft-specific
+| 34 = @decltype_nullptr // C++11
+| 35 = @int128 // __int128
+| 36 = @unsigned_int128 // unsigned __int128
+| 37 = @signed_int128 // signed __int128
+| 38 = @float128 // __float128
+| 39 = @complex_float128 // _Complex __float128
+| 40 = @decimal32 // _Decimal32
+| 41 = @decimal64 // _Decimal64
+| 42 = @decimal128 // _Decimal128
+| 43 = @char16_t
+| 44 = @char32_t
+| 45 = @std_float32 // _Float32
+| 46 = @float32x // _Float32x
+| 47 = @std_float64 // _Float64
+| 48 = @float64x // _Float64x
+| 49 = @std_float128 // _Float128
+// ... 50 _Float128x
+| 51 = @char8_t
+| 52 = @float16 // _Float16
+| 53 = @complex_float16 // _Complex _Float16
+| 54 = @fp16 // __fp16
+| 55 = @std_bfloat16 // __bf16
+| 56 = @std_float16 // std::float16_t
+| 57 = @complex_std_float32 // _Complex _Float32
+| 58 = @complex_float32x // _Complex _Float32x
+| 59 = @complex_std_float64 // _Complex _Float64
+| 60 = @complex_float64x // _Complex _Float64x
+| 61 = @complex_std_float128 // _Complex _Float128
+| 62 = @mfp8 // __mfp8
+| 63 = @scalable_vector_count // __SVCount_t
+| 64 = @complex_fp16 // _Complex __fp16
+| 65 = @complex_std_bfloat16 // _Complex __bf16
+| 66 = @complex_std_float16 // _Complex std::float16_t
+;
+
+builtintypes(
+ unique int id: @builtintype,
+ string name: string ref,
+ int kind: int ref,
+ int size: int ref,
+ int sign: int ref,
+ int alignment: int ref
+);
+
+/**
+ * Derived types are types that are directly derived from existing types and
+ * point to, refer to, transform type data to return a new type.
+ */
+case @derivedtype.kind of
+ 1 = @pointer
+| 2 = @reference
+| 3 = @type_with_specifiers
+| 4 = @array
+| 5 = @gnu_vector
+| 6 = @routineptr
+| 7 = @routinereference
+| 8 = @rvalue_reference // C++11
+// ... 9 type_conforming_to_protocols deprecated
+| 10 = @block
+| 11 = @scalable_vector // Arm SVE
+;
+
+derivedtypes(
+ unique int id: @derivedtype,
+ string name: string ref,
+ int kind: int ref,
+ int type_id: @type ref
+);
+
+pointerishsize(unique int id: @derivedtype ref,
+ int size: int ref,
+ int alignment: int ref);
+
+arraysizes(
+ unique int id: @derivedtype ref,
+ int num_elements: int ref,
+ int bytesize: int ref,
+ int alignment: int ref
+);
+
+tupleelements(
+ unique int id: @derivedtype ref,
+ int num_elements: int ref
+);
+
+typedefbase(
+ unique int id: @usertype ref,
+ int type_id: @type ref
+);
+
+/**
+ * An instance of the C++11 `decltype` operator or C23 `typeof`/`typeof_unqual`
+ * operator taking an expression as its argument. For example:
+ * ```
+ * int a;
+ * decltype(1+a) b;
+ * typeof(1+a) c;
+ * ```
+ * Here `expr` is `1+a`.
+ *
+ * Sometimes an additional pair of parentheses around the expression
+ * changes the semantics of the decltype, e.g.
+ * ```
+ * struct A { double x; };
+ * const A* a = new A();
+ * decltype( a->x ); // type is double
+ * decltype((a->x)); // type is const double&
+ * ```
+ * (Please consult the C++11 standard for more details).
+ * `parentheses_would_change_meaning` is `true` iff that is the case.
+ */
+
+/*
+case @decltype.kind of
+| 0 = @decltype
+| 1 = @typeof // The frontend does not differentiate between typeof and typeof_unqual
+;
+*/
+
+#keyset[id, expr]
+decltypes(
+ int id: @decltype,
+ int expr: @expr ref,
+ int kind: int ref,
+ int base_type: @type ref,
+ boolean parentheses_would_change_meaning: boolean ref
+);
+
+case @type_operator.kind of
+ 0 = @typeof // The frontend does not differentiate between typeof and typeof_unqual
+| 1 = @underlying_type
+| 2 = @bases
+| 3 = @direct_bases
+| 4 = @add_lvalue_reference
+| 5 = @add_pointer
+| 6 = @add_rvalue_reference
+| 7 = @decay
+| 8 = @make_signed
+| 9 = @make_unsigned
+| 10 = @remove_all_extents
+| 11 = @remove_const
+| 12 = @remove_cv
+| 13 = @remove_cvref
+| 14 = @remove_extent
+| 15 = @remove_pointer
+| 16 = @remove_reference_t
+| 17 = @remove_restrict
+| 18 = @remove_volatile
+| 19 = @remove_reference
+;
+
+type_operators(
+ unique int id: @type_operator,
+ int arg_type: @type ref,
+ int kind: int ref,
+ int base_type: @type ref
+)
+
+case @usertype.kind of
+ 0 = @unknown_usertype
+| 1 = @struct
+| 2 = @class
+| 3 = @union
+| 4 = @enum
+// ... 5 = @typedef deprecated // classic C: typedef typedef type name
+// ... 6 = @template deprecated
+| 7 = @template_parameter
+| 8 = @template_template_parameter
+| 9 = @proxy_class // a proxy class associated with a template parameter
+// ... 10 objc_class deprecated
+// ... 11 objc_protocol deprecated
+// ... 12 objc_category deprecated
+| 13 = @scoped_enum
+// ... 14 = @using_alias deprecated // a using name = type style typedef
+| 15 = @template_struct
+| 16 = @template_class
+| 17 = @template_union
+| 18 = @alias
+;
+
+usertypes(
+ unique int id: @usertype,
+ string name: string ref,
+ int kind: int ref
+);
+
+usertypesize(
+ unique int id: @usertype ref,
+ int size: int ref,
+ int alignment: int ref
+);
+
+usertype_final(unique int id: @usertype ref);
+
+usertype_uuid(
+ unique int id: @usertype ref,
+ string uuid: string ref
+);
+
+/*
+case @usertype.alias_kind of
+| 0 = @typedef
+| 1 = @alias
+*/
+
+usertype_alias_kind(
+ int id: @usertype ref,
+ int alias_kind: int ref
+)
+
+nontype_template_parameters(
+ int id: @expr ref
+);
+
+type_template_type_constraint(
+ int id: @usertype ref,
+ int constraint: @expr ref
+);
+
+mangled_name(
+ unique int id: @declaration ref,
+ int mangled_name : @mangledname,
+ boolean is_complete: boolean ref
+);
+
+is_pod_class(unique int id: @usertype ref);
+is_standard_layout_class(unique int id: @usertype ref);
+
+is_complete(unique int id: @usertype ref);
+
+is_class_template(unique int id: @usertype ref);
+class_instantiation(
+ int to: @usertype ref,
+ int from: @usertype ref
+);
+class_template_argument(
+ int type_id: @usertype ref,
+ int index: int ref,
+ int arg_type: @type ref
+);
+class_template_argument_value(
+ int type_id: @usertype ref,
+ int index: int ref,
+ int arg_value: @expr ref
+);
+
+@user_or_decltype = @usertype | @decltype;
+
+is_proxy_class_for(
+ unique int id: @usertype ref,
+ int templ_param_id: @user_or_decltype ref
+);
+
+type_mentions(
+ unique int id: @type_mention,
+ int type_id: @type ref,
+ int location: @location_default ref,
+ // a_symbol_reference_kind from the frontend.
+ int kind: int ref
+);
+
+is_function_template(unique int id: @function ref);
+function_instantiation(
+ unique int to: @function ref,
+ int from: @function ref
+);
+function_template_argument(
+ int function_id: @function ref,
+ int index: int ref,
+ int arg_type: @type ref
+);
+function_template_argument_value(
+ int function_id: @function ref,
+ int index: int ref,
+ int arg_value: @expr ref
+);
+
+is_variable_template(unique int id: @variable ref);
+variable_instantiation(
+ unique int to: @variable ref,
+ int from: @variable ref
+);
+variable_template_argument(
+ int variable_id: @variable ref,
+ int index: int ref,
+ int arg_type: @type ref
+);
+variable_template_argument_value(
+ int variable_id: @variable ref,
+ int index: int ref,
+ int arg_value: @expr ref
+);
+
+template_template_instantiation(
+ int to: @usertype ref,
+ int from: @usertype ref
+);
+template_template_argument(
+ int type_id: @usertype ref,
+ int index: int ref,
+ int arg_type: @type ref
+);
+template_template_argument_value(
+ int type_id: @usertype ref,
+ int index: int ref,
+ int arg_value: @expr ref
+);
+
+@concept = @concept_template | @concept_id;
+
+concept_templates(
+ unique int concept_id: @concept_template,
+ string name: string ref,
+ int location: @location_default ref
+);
+concept_instantiation(
+ unique int to: @concept_id ref,
+ int from: @concept_template ref
+);
+is_type_constraint(int concept_id: @concept_id ref);
+concept_template_argument(
+ int concept_id: @concept ref,
+ int index: int ref,
+ int arg_type: @type ref
+);
+concept_template_argument_value(
+ int concept_id: @concept ref,
+ int index: int ref,
+ int arg_value: @expr ref
+);
+
+routinetypes(
+ unique int id: @routinetype,
+ int return_type: @type ref
+);
+
+routinetypeargs(
+ int routine: @routinetype ref,
+ int index: int ref,
+ int type_id: @type ref
+);
+
+ptrtomembers(
+ unique int id: @ptrtomember,
+ int type_id: @type ref,
+ int class_id: @type ref
+);
+
+/*
+ specifiers for types, functions, and variables
+
+ "public",
+ "protected",
+ "private",
+
+ "const",
+ "volatile",
+ "static",
+
+ "pure",
+ "virtual",
+ "sealed", // Microsoft
+ "__interface", // Microsoft
+ "inline",
+ "explicit",
+
+ "near", // near far extension
+ "far", // near far extension
+ "__ptr32", // Microsoft
+ "__ptr64", // Microsoft
+ "__sptr", // Microsoft
+ "__uptr", // Microsoft
+ "dllimport", // Microsoft
+ "dllexport", // Microsoft
+ "thread", // Microsoft
+ "naked", // Microsoft
+ "microsoft_inline", // Microsoft
+ "forceinline", // Microsoft
+ "selectany", // Microsoft
+ "nothrow", // Microsoft
+ "novtable", // Microsoft
+ "noreturn", // Microsoft
+ "noinline", // Microsoft
+ "noalias", // Microsoft
+ "restrict", // Microsoft
+*/
+
+specifiers(
+ unique int id: @specifier,
+ unique string str: string ref
+);
+
+typespecifiers(
+ int type_id: @type ref,
+ int spec_id: @specifier ref
+);
+
+funspecifiers(
+ int func_id: @function ref,
+ int spec_id: @specifier ref
+);
+
+varspecifiers(
+ int var_id: @accessible ref,
+ int spec_id: @specifier ref
+);
+
+explicit_specifier_exprs(
+ unique int func_id: @function ref,
+ int constant: @expr ref
+)
+
+attributes(
+ unique int id: @attribute,
+ int kind: int ref,
+ string name: string ref,
+ string name_space: string ref,
+ int location: @location_default ref
+);
+
+case @attribute.kind of
+ 0 = @gnuattribute
+| 1 = @stdattribute
+| 2 = @declspec
+| 3 = @msattribute
+| 4 = @alignas
+// ... 5 @objc_propertyattribute deprecated
+;
+
+attribute_args(
+ unique int id: @attribute_arg,
+ int kind: int ref,
+ int attribute: @attribute ref,
+ int index: int ref,
+ int location: @location_default ref
+);
+
+case @attribute_arg.kind of
+ 0 = @attribute_arg_empty
+| 1 = @attribute_arg_token
+| 2 = @attribute_arg_constant
+| 3 = @attribute_arg_type
+| 4 = @attribute_arg_constant_expr
+| 5 = @attribute_arg_expr
+;
+
+attribute_arg_value(
+ unique int arg: @attribute_arg ref,
+ string value: string ref
+);
+attribute_arg_type(
+ unique int arg: @attribute_arg ref,
+ int type_id: @type ref
+);
+attribute_arg_constant(
+ unique int arg: @attribute_arg ref,
+ int constant: @expr ref
+)
+attribute_arg_expr(
+ unique int arg: @attribute_arg ref,
+ int expr: @expr ref
+)
+attribute_arg_name(
+ unique int arg: @attribute_arg ref,
+ string name: string ref
+);
+
+typeattributes(
+ int type_id: @type ref,
+ int spec_id: @attribute ref
+);
+
+funcattributes(
+ int func_id: @function ref,
+ int spec_id: @attribute ref
+);
+
+varattributes(
+ int var_id: @accessible ref,
+ int spec_id: @attribute ref
+);
+
+namespaceattributes(
+ int namespace_id: @namespace ref,
+ int spec_id: @attribute ref
+);
+
+stmtattributes(
+ int stmt_id: @stmt ref,
+ int spec_id: @attribute ref
+);
+
+@type = @builtintype
+ | @derivedtype
+ | @usertype
+ | @routinetype
+ | @ptrtomember
+ | @decltype
+ | @type_operator;
+
+unspecifiedtype(
+ unique int type_id: @type ref,
+ int unspecified_type_id: @type ref
+);
+
+member(
+ int parent: @type ref,
+ int index: int ref,
+ int child: @member ref
+);
+
+@enclosingfunction_child = @usertype | @variable | @namespace
+
+enclosingfunction(
+ unique int child: @enclosingfunction_child ref,
+ int parent: @function ref
+);
+
+derivations(
+ unique int derivation: @derivation,
+ int sub: @type ref,
+ int index: int ref,
+ int super: @type ref,
+ int location: @location_default ref
+);
+
+derspecifiers(
+ int der_id: @derivation ref,
+ int spec_id: @specifier ref
+);
+
+/**
+ * Contains the byte offset of the base class subobject within the derived
+ * class. Only holds for non-virtual base classes, but see table
+ * `virtual_base_offsets` for offsets of virtual base class subobjects.
+ */
+direct_base_offsets(
+ unique int der_id: @derivation ref,
+ int offset: int ref
+);
+
+/**
+ * Contains the byte offset of the virtual base class subobject for class
+ * `super` within a most-derived object of class `sub`. `super` can be either a
+ * direct or indirect base class.
+ */
+#keyset[sub, super]
+virtual_base_offsets(
+ int sub: @usertype ref,
+ int super: @usertype ref,
+ int offset: int ref
+);
+
+frienddecls(
+ unique int id: @frienddecl,
+ int type_id: @type ref,
+ int decl_id: @declaration ref,
+ int location: @location_default ref
+);
+
+@declaredtype = @usertype ;
+
+@declaration = @function
+ | @declaredtype
+ | @variable
+ | @enumconstant
+ | @frienddecl
+ | @concept_template;
+
+@member = @membervariable
+ | @function
+ | @declaredtype
+ | @enumconstant;
+
+@locatable = @diagnostic
+ | @declaration
+ | @ppd_include
+ | @ppd_define
+ | @macroinvocation
+ /*| @funcall*/
+ | @xmllocatable
+ | @attribute
+ | @attribute_arg;
+
+@namedscope = @namespace | @usertype;
+
+@element = @locatable
+ | @file
+ | @folder
+ | @specifier
+ | @type
+ | @expr
+ | @namespace
+ | @initialiser
+ | @stmt
+ | @derivation
+ | @comment
+ | @preprocdirect
+ | @fun_decl
+ | @var_decl
+ | @type_decl
+ | @namespace_decl
+ | @using
+ | @namequalifier
+ | @specialnamequalifyingelement
+ | @static_assert
+ | @type_mention
+ | @lambdacapture;
+
+@exprparent = @element;
+
+comments(
+ unique int id: @comment,
+ string contents: string ref,
+ int location: @location_default ref
+);
+
+commentbinding(
+ int id: @comment ref,
+ int element: @element ref
+);
+
+exprconv(
+ int converted: @expr ref,
+ unique int conversion: @expr ref
+);
+
+compgenerated(unique int id: @element ref);
+
+/**
+ * `destructor_call` destructs the `i`'th entity that should be
+ * destructed following `element`. Note that entities should be
+ * destructed in reverse construction order, so for a given `element`
+ * these should be called from highest to lowest `i`.
+ */
+#keyset[element, destructor_call]
+#keyset[element, i]
+synthetic_destructor_call(
+ int element: @element ref,
+ int i: int ref,
+ int destructor_call: @routineexpr ref
+);
+
+namespaces(
+ unique int id: @namespace,
+ string name: string ref
+);
+
+namespace_inline(
+ unique int id: @namespace ref
+);
+
+namespacembrs(
+ int parentid: @namespace ref,
+ unique int memberid: @namespacembr ref
+);
+
+@namespacembr = @declaration | @namespace;
+
+exprparents(
+ int expr_id: @expr ref,
+ int child_index: int ref,
+ int parent_id: @exprparent ref
+);
+
+expr_isload(unique int expr_id: @expr ref);
+
+@cast = @c_style_cast
+ | @const_cast
+ | @dynamic_cast
+ | @reinterpret_cast
+ | @static_cast
+ ;
+
+/*
+case @conversion.kind of
+ 0 = @simple_conversion // a numeric conversion, qualification conversion, or a reinterpret_cast
+| 1 = @bool_conversion // conversion to 'bool'
+| 2 = @base_class_conversion // a derived-to-base conversion
+| 3 = @derived_class_conversion // a base-to-derived conversion
+| 4 = @pm_base_class_conversion // a derived-to-base conversion of a pointer to member
+| 5 = @pm_derived_class_conversion // a base-to-derived conversion of a pointer to member
+| 6 = @glvalue_adjust // an adjustment of the type of a glvalue
+| 7 = @prvalue_adjust // an adjustment of the type of a prvalue
+;
+*/
+/**
+ * Describes the semantics represented by a cast expression. This is largely
+ * independent of the source syntax of the cast, so it is separate from the
+ * regular expression kind.
+ */
+conversionkinds(
+ unique int expr_id: @cast ref,
+ int kind: int ref
+);
+
+@conversion = @cast
+ | @array_to_pointer
+ | @parexpr
+ | @reference_to
+ | @ref_indirect
+ | @temp_init
+ | @c11_generic
+ ;
+
+/*
+case @funbindexpr.kind of
+ 0 = @normal_call // a normal call
+| 1 = @virtual_call // a virtual call
+| 2 = @adl_call // a call whose target is only found by ADL
+;
+*/
+iscall(
+ unique int caller: @funbindexpr ref,
+ int kind: int ref
+);
+
+numtemplatearguments(
+ unique int expr_id: @expr ref,
+ int num: int ref
+);
+
+specialnamequalifyingelements(
+ unique int id: @specialnamequalifyingelement,
+ unique string name: string ref
+);
+
+@namequalifiableelement = @expr | @namequalifier;
+@namequalifyingelement = @namespace
+ | @specialnamequalifyingelement
+ | @usertype;
+
+namequalifiers(
+ unique int id: @namequalifier,
+ unique int qualifiableelement: @namequalifiableelement ref,
+ int qualifyingelement: @namequalifyingelement ref,
+ int location: @location_default ref
+);
+
+varbind(
+ int expr: @varbindexpr ref,
+ int var: @accessible ref
+);
+
+funbind(
+ int expr: @funbindexpr ref,
+ int fun: @function ref
+);
+
+@any_new_expr = @new_expr
+ | @new_array_expr;
+
+@new_or_delete_expr = @any_new_expr
+ | @delete_expr
+ | @delete_array_expr;
+
+@prefix_crement_expr = @preincrexpr | @predecrexpr;
+
+@postfix_crement_expr = @postincrexpr | @postdecrexpr;
+
+@increment_expr = @preincrexpr | @postincrexpr;
+
+@decrement_expr = @predecrexpr | @postdecrexpr;
+
+@crement_expr = @increment_expr | @decrement_expr;
+
+@un_arith_op_expr = @arithnegexpr
+ | @unaryplusexpr
+ | @conjugation
+ | @realpartexpr
+ | @imagpartexpr
+ | @crement_expr
+ ;
+
+@un_bitwise_op_expr = @complementexpr;
+
+@un_log_op_expr = @notexpr;
+
+@un_op_expr = @address_of
+ | @indirect
+ | @un_arith_op_expr
+ | @un_bitwise_op_expr
+ | @builtinaddressof
+ | @vec_fill
+ | @un_log_op_expr
+ | @co_await
+ | @co_yield
+ ;
+
+@bin_log_op_expr = @andlogicalexpr | @orlogicalexpr;
+
+@cmp_op_expr = @eq_op_expr | @rel_op_expr;
+
+@eq_op_expr = @eqexpr | @neexpr;
+
+@rel_op_expr = @gtexpr
+ | @ltexpr
+ | @geexpr
+ | @leexpr
+ | @spaceshipexpr
+ ;
+
+@bin_bitwise_op_expr = @lshiftexpr
+ | @rshiftexpr
+ | @andexpr
+ | @orexpr
+ | @xorexpr
+ ;
+
+@p_arith_op_expr = @paddexpr
+ | @psubexpr
+ | @pdiffexpr
+ ;
+
+@bin_arith_op_expr = @addexpr
+ | @subexpr
+ | @mulexpr
+ | @divexpr
+ | @remexpr
+ | @jmulexpr
+ | @jdivexpr
+ | @fjaddexpr
+ | @jfaddexpr
+ | @fjsubexpr
+ | @jfsubexpr
+ | @minexpr
+ | @maxexpr
+ | @p_arith_op_expr
+ ;
+
+@bin_op_expr = @bin_arith_op_expr
+ | @bin_bitwise_op_expr
+ | @cmp_op_expr
+ | @bin_log_op_expr
+ ;
+
+@op_expr = @un_op_expr
+ | @bin_op_expr
+ | @assign_expr
+ | @conditionalexpr
+ ;
+
+@assign_arith_expr = @assignaddexpr
+ | @assignsubexpr
+ | @assignmulexpr
+ | @assigndivexpr
+ | @assignremexpr
+ ;
+
+@assign_bitwise_expr = @assignandexpr
+ | @assignorexpr
+ | @assignxorexpr
+ | @assignlshiftexpr
+ | @assignrshiftexpr
+ ;
+
+@assign_pointer_expr = @assignpaddexpr
+ | @assignpsubexpr
+ ;
+
+@assign_op_expr = @assign_arith_expr
+ | @assign_bitwise_expr
+ | @assign_pointer_expr
+ ;
+
+@assign_expr = @assignexpr | @assign_op_expr | @blockassignexpr
+
+/*
+ Binary encoding of the allocator form.
+
+ case @allocator.form of
+ 0 = plain
+ | 1 = alignment
+ ;
+*/
+
+/**
+ * The allocator function associated with a `new` or `new[]` expression.
+ * The `form` column specified whether the allocation call contains an alignment
+ * argument.
+ */
+expr_allocator(
+ unique int expr: @any_new_expr ref,
+ int func: @function ref,
+ int form: int ref
+);
+
+/*
+ Binary encoding of the deallocator form.
+
+ case @deallocator.form of
+ 0 = plain
+ | 1 = size
+ | 2 = alignment
+ | 4 = destroying_delete
+ ;
+*/
+
+/**
+ * The deallocator function associated with a `delete`, `delete[]`, `new`, or
+ * `new[]` expression. For a `new` or `new[]` expression, the deallocator is the
+ * one used to free memory if the initialization throws an exception.
+ * The `form` column specifies whether the deallocation call contains a size
+ * argument, and alignment argument, or both.
+ */
+expr_deallocator(
+ unique int expr: @new_or_delete_expr ref,
+ int func: @function ref,
+ int form: int ref
+);
+
+/**
+ * Holds if the `@conditionalexpr` is of the two operand form
+ * `guard ? : false`.
+ */
+expr_cond_two_operand(
+ unique int cond: @conditionalexpr ref
+);
+
+/**
+ * The guard of `@conditionalexpr` `guard ? true : false`
+ */
+expr_cond_guard(
+ unique int cond: @conditionalexpr ref,
+ int guard: @expr ref
+);
+
+/**
+ * The expression used when the guard of `@conditionalexpr`
+ * `guard ? true : false` holds. For the two operand form
+ * `guard ?: false` consider using `expr_cond_guard` instead.
+ */
+expr_cond_true(
+ unique int cond: @conditionalexpr ref,
+ int true: @expr ref
+);
+
+/**
+ * The expression used when the guard of `@conditionalexpr`
+ * `guard ? true : false` does not hold.
+ */
+expr_cond_false(
+ unique int cond: @conditionalexpr ref,
+ int false: @expr ref
+);
+
+/** A string representation of the value. */
+values(
+ unique int id: @value,
+ string str: string ref
+);
+
+/** The actual text in the source code for the value, if any. */
+valuetext(
+ unique int id: @value ref,
+ string text: string ref
+);
+
+valuebind(
+ int val: @value ref,
+ unique int expr: @expr ref
+);
+
+fieldoffsets(
+ unique int id: @variable ref,
+ int byteoffset: int ref,
+ int bitoffset: int ref
+);
+
+bitfield(
+ unique int id: @variable ref,
+ int bits: int ref,
+ int declared_bits: int ref
+);
+
+/* TODO
+memberprefix(
+ int member: @expr ref,
+ int prefix: @expr ref
+);
+*/
+
+/*
+ kind(1) = mbrcallexpr
+ kind(2) = mbrptrcallexpr
+ kind(3) = mbrptrmbrcallexpr
+ kind(4) = ptrmbrptrmbrcallexpr
+ kind(5) = mbrreadexpr // x.y
+ kind(6) = mbrptrreadexpr // p->y
+ kind(7) = mbrptrmbrreadexpr // x.*pm
+ kind(8) = mbrptrmbrptrreadexpr // x->*pm
+ kind(9) = staticmbrreadexpr // static x.y
+ kind(10) = staticmbrptrreadexpr // static p->y
+*/
+/* TODO
+memberaccess(
+ int member: @expr ref,
+ int kind: int ref
+);
+*/
+
+initialisers(
+ unique int init: @initialiser,
+ int var: @accessible ref,
+ unique int expr: @expr ref,
+ int location: @location_default ref
+);
+
+braced_initialisers(
+ int init: @initialiser ref
+);
+
+/**
+ * An ancestor for the expression, for cases in which we cannot
+ * otherwise find the expression's parent.
+ */
+expr_ancestor(
+ int exp: @expr ref,
+ int ancestor: @element ref
+);
+
+exprs(
+ unique int id: @expr,
+ int kind: int ref,
+ int location: @location_default ref
+);
+
+expr_reuse(
+ int reuse: @expr ref,
+ int original: @expr ref,
+ int value_category: int ref
+)
+
+/*
+ case @value.category of
+ 1 = prval
+ | 2 = xval
+ | 3 = lval
+ ;
+*/
+expr_types(
+ int id: @expr ref,
+ int typeid: @type ref,
+ int value_category: int ref
+);
+
+case @expr.kind of
+ 1 = @errorexpr
+| 2 = @address_of // & AddressOfExpr
+| 3 = @reference_to // ReferenceToExpr (implicit?)
+| 4 = @indirect // * PointerDereferenceExpr
+| 5 = @ref_indirect // ReferenceDereferenceExpr (implicit?)
+// ...
+| 8 = @array_to_pointer // (???)
+| 9 = @vacuous_destructor_call // VacuousDestructorCall
+// ...
+| 11 = @assume // Microsoft
+| 12 = @parexpr
+| 13 = @arithnegexpr
+| 14 = @unaryplusexpr
+| 15 = @complementexpr
+| 16 = @notexpr
+| 17 = @conjugation // GNU ~ operator
+| 18 = @realpartexpr // GNU __real
+| 19 = @imagpartexpr // GNU __imag
+| 20 = @postincrexpr
+| 21 = @postdecrexpr
+| 22 = @preincrexpr
+| 23 = @predecrexpr
+| 24 = @conditionalexpr
+| 25 = @addexpr
+| 26 = @subexpr
+| 27 = @mulexpr
+| 28 = @divexpr
+| 29 = @remexpr
+| 30 = @jmulexpr // C99 mul imaginary
+| 31 = @jdivexpr // C99 div imaginary
+| 32 = @fjaddexpr // C99 add real + imaginary
+| 33 = @jfaddexpr // C99 add imaginary + real
+| 34 = @fjsubexpr // C99 sub real - imaginary
+| 35 = @jfsubexpr // C99 sub imaginary - real
+| 36 = @paddexpr // pointer add (pointer + int or int + pointer)
+| 37 = @psubexpr // pointer sub (pointer - integer)
+| 38 = @pdiffexpr // difference between two pointers
+| 39 = @lshiftexpr
+| 40 = @rshiftexpr
+| 41 = @andexpr
+| 42 = @orexpr
+| 43 = @xorexpr
+| 44 = @eqexpr
+| 45 = @neexpr
+| 46 = @gtexpr
+| 47 = @ltexpr
+| 48 = @geexpr
+| 49 = @leexpr
+| 50 = @minexpr // GNU minimum
+| 51 = @maxexpr // GNU maximum
+| 52 = @assignexpr
+| 53 = @assignaddexpr
+| 54 = @assignsubexpr
+| 55 = @assignmulexpr
+| 56 = @assigndivexpr
+| 57 = @assignremexpr
+| 58 = @assignlshiftexpr
+| 59 = @assignrshiftexpr
+| 60 = @assignandexpr
+| 61 = @assignorexpr
+| 62 = @assignxorexpr
+| 63 = @assignpaddexpr // assign pointer add
+| 64 = @assignpsubexpr // assign pointer sub
+| 65 = @andlogicalexpr
+| 66 = @orlogicalexpr
+| 67 = @commaexpr
+| 68 = @subscriptexpr // access to member of an array, e.g., a[5]
+// ... 69 @objc_subscriptexpr deprecated
+// ... 70 @cmdaccess deprecated
+// ...
+| 73 = @virtfunptrexpr
+| 74 = @callexpr
+// ... 75 @msgexpr_normal deprecated
+// ... 76 @msgexpr_super deprecated
+// ... 77 @atselectorexpr deprecated
+// ... 78 @atprotocolexpr deprecated
+| 79 = @vastartexpr
+| 80 = @vaargexpr
+| 81 = @vaendexpr
+| 82 = @vacopyexpr
+// ... 83 @atencodeexpr deprecated
+| 84 = @varaccess
+| 85 = @thisaccess
+// ... 86 @objc_box_expr deprecated
+| 87 = @new_expr
+| 88 = @delete_expr
+| 89 = @throw_expr
+| 90 = @condition_decl // a variable declared in a condition, e.g., if(int x = y > 2)
+| 91 = @braced_init_list
+| 92 = @type_id
+| 93 = @runtime_sizeof
+| 94 = @runtime_alignof
+| 95 = @sizeof_pack
+| 96 = @expr_stmt // GNU extension
+| 97 = @routineexpr
+| 98 = @type_operand // used to access a type in certain contexts (haven't found any examples yet....)
+| 99 = @offsetofexpr // offsetof ::= type and field
+| 100 = @hasassignexpr // __has_assign ::= type
+| 101 = @hascopyexpr // __has_copy ::= type
+| 102 = @hasnothrowassign // __has_nothrow_assign ::= type
+| 103 = @hasnothrowconstr // __has_nothrow_constructor ::= type
+| 104 = @hasnothrowcopy // __has_nothrow_copy ::= type
+| 105 = @hastrivialassign // __has_trivial_assign ::= type
+| 106 = @hastrivialconstr // __has_trivial_constructor ::= type
+| 107 = @hastrivialcopy // __has_trivial_copy ::= type
+| 108 = @hasuserdestr // __has_user_destructor ::= type
+| 109 = @hasvirtualdestr // __has_virtual_destructor ::= type
+| 110 = @isabstractexpr // __is_abstract ::= type
+| 111 = @isbaseofexpr // __is_base_of ::= type type
+| 112 = @isclassexpr // __is_class ::= type
+| 113 = @isconvtoexpr // __is_convertible_to ::= type type
+| 114 = @isemptyexpr // __is_empty ::= type
+| 115 = @isenumexpr // __is_enum ::= type
+| 116 = @ispodexpr // __is_pod ::= type
+| 117 = @ispolyexpr // __is_polymorphic ::= type
+| 118 = @isunionexpr // __is_union ::= type
+| 119 = @typescompexpr // GNU __builtin_types_compatible ::= type type
+| 120 = @intaddrexpr // frontend internal builtin, used to implement offsetof
+// ...
+| 122 = @hastrivialdestructor // __has_trivial_destructor ::= type
+| 123 = @literal
+| 124 = @uuidof
+| 127 = @aggregateliteral
+| 128 = @delete_array_expr
+| 129 = @new_array_expr
+// ... 130 @objc_array_literal deprecated
+// ... 131 @objc_dictionary_literal deprecated
+| 132 = @foldexpr
+// ...
+| 200 = @ctordirectinit
+| 201 = @ctorvirtualinit
+| 202 = @ctorfieldinit
+| 203 = @ctordelegatinginit
+| 204 = @dtordirectdestruct
+| 205 = @dtorvirtualdestruct
+| 206 = @dtorfielddestruct
+// ...
+| 210 = @static_cast
+| 211 = @reinterpret_cast
+| 212 = @const_cast
+| 213 = @dynamic_cast
+| 214 = @c_style_cast
+| 215 = @lambdaexpr
+| 216 = @param_ref
+| 217 = @noopexpr
+// ...
+| 294 = @istriviallyconstructibleexpr
+| 295 = @isdestructibleexpr
+| 296 = @isnothrowdestructibleexpr
+| 297 = @istriviallydestructibleexpr
+| 298 = @istriviallyassignableexpr
+| 299 = @isnothrowassignableexpr
+| 300 = @istrivialexpr
+| 301 = @isstandardlayoutexpr
+| 302 = @istriviallycopyableexpr
+| 303 = @isliteraltypeexpr
+| 304 = @hastrivialmoveconstructorexpr
+| 305 = @hastrivialmoveassignexpr
+| 306 = @hasnothrowmoveassignexpr
+| 307 = @isconstructibleexpr
+| 308 = @isnothrowconstructibleexpr
+| 309 = @hasfinalizerexpr
+| 310 = @isdelegateexpr
+| 311 = @isinterfaceclassexpr
+| 312 = @isrefarrayexpr
+| 313 = @isrefclassexpr
+| 314 = @issealedexpr
+| 315 = @issimplevalueclassexpr
+| 316 = @isvalueclassexpr
+| 317 = @isfinalexpr
+| 319 = @noexceptexpr
+| 320 = @builtinshufflevector
+| 321 = @builtinchooseexpr
+| 322 = @builtinaddressof
+| 323 = @vec_fill
+| 324 = @builtinconvertvector
+| 325 = @builtincomplex
+| 326 = @spaceshipexpr
+| 327 = @co_await
+| 328 = @co_yield
+| 329 = @temp_init
+| 330 = @isassignable
+| 331 = @isaggregate
+| 332 = @hasuniqueobjectrepresentations
+| 333 = @builtinbitcast
+| 334 = @builtinshuffle
+| 335 = @blockassignexpr
+| 336 = @issame
+| 337 = @isfunction
+| 338 = @islayoutcompatible
+| 339 = @ispointerinterconvertiblebaseof
+| 340 = @isarray
+| 341 = @arrayrank
+| 342 = @arrayextent
+| 343 = @isarithmetic
+| 344 = @iscompletetype
+| 345 = @iscompound
+| 346 = @isconst
+| 347 = @isfloatingpoint
+| 348 = @isfundamental
+| 349 = @isintegral
+| 350 = @islvaluereference
+| 351 = @ismemberfunctionpointer
+| 352 = @ismemberobjectpointer
+| 353 = @ismemberpointer
+| 354 = @isobject
+| 355 = @ispointer
+| 356 = @isreference
+| 357 = @isrvaluereference
+| 358 = @isscalar
+| 359 = @issigned
+| 360 = @isunsigned
+| 361 = @isvoid
+| 362 = @isvolatile
+| 363 = @reuseexpr
+| 364 = @istriviallycopyassignable
+| 365 = @isassignablenopreconditioncheck
+| 366 = @referencebindstotemporary
+| 367 = @issameas
+| 368 = @builtinhasattribute
+| 369 = @ispointerinterconvertiblewithclass
+| 370 = @builtinispointerinterconvertiblewithclass
+| 371 = @iscorrespondingmember
+| 372 = @builtiniscorrespondingmember
+| 373 = @isboundedarray
+| 374 = @isunboundedarray
+| 375 = @isreferenceable
+| 378 = @isnothrowconvertible
+| 379 = @referenceconstructsfromtemporary
+| 380 = @referenceconvertsfromtemporary
+| 381 = @isconvertible
+| 382 = @isvalidwinrttype
+| 383 = @iswinclass
+| 384 = @iswininterface
+| 385 = @istriviallyequalitycomparable
+| 386 = @isscopedenum
+| 387 = @istriviallyrelocatable
+| 388 = @datasizeof
+| 389 = @c11_generic
+| 390 = @requires_expr
+| 391 = @nested_requirement
+| 392 = @compound_requirement
+| 393 = @concept_id
+;
+
+@var_args_expr = @vastartexpr
+ | @vaendexpr
+ | @vaargexpr
+ | @vacopyexpr
+ ;
+
+@builtin_op = @var_args_expr
+ | @noopexpr
+ | @offsetofexpr
+ | @intaddrexpr
+ | @hasassignexpr
+ | @hascopyexpr
+ | @hasnothrowassign
+ | @hasnothrowconstr
+ | @hasnothrowcopy
+ | @hastrivialassign
+ | @hastrivialconstr
+ | @hastrivialcopy
+ | @hastrivialdestructor
+ | @hasuserdestr
+ | @hasvirtualdestr
+ | @isabstractexpr
+ | @isbaseofexpr
+ | @isclassexpr
+ | @isconvtoexpr
+ | @isemptyexpr
+ | @isenumexpr
+ | @ispodexpr
+ | @ispolyexpr
+ | @isunionexpr
+ | @typescompexpr
+ | @builtinshufflevector
+ | @builtinconvertvector
+ | @builtinaddressof
+ | @istriviallyconstructibleexpr
+ | @isdestructibleexpr
+ | @isnothrowdestructibleexpr
+ | @istriviallydestructibleexpr
+ | @istriviallyassignableexpr
+ | @isnothrowassignableexpr
+ | @istrivialexpr
+ | @isstandardlayoutexpr
+ | @istriviallycopyableexpr
+ | @isliteraltypeexpr
+ | @hastrivialmoveconstructorexpr
+ | @hastrivialmoveassignexpr
+ | @hasnothrowmoveassignexpr
+ | @isconstructibleexpr
+ | @isnothrowconstructibleexpr
+ | @hasfinalizerexpr
+ | @isdelegateexpr
+ | @isinterfaceclassexpr
+ | @isrefarrayexpr
+ | @isrefclassexpr
+ | @issealedexpr
+ | @issimplevalueclassexpr
+ | @isvalueclassexpr
+ | @isfinalexpr
+ | @builtinchooseexpr
+ | @builtincomplex
+ | @isassignable
+ | @isaggregate
+ | @hasuniqueobjectrepresentations
+ | @builtinbitcast
+ | @builtinshuffle
+ | @issame
+ | @isfunction
+ | @islayoutcompatible
+ | @ispointerinterconvertiblebaseof
+ | @isarray
+ | @arrayrank
+ | @arrayextent
+ | @isarithmetic
+ | @iscompletetype
+ | @iscompound
+ | @isconst
+ | @isfloatingpoint
+ | @isfundamental
+ | @isintegral
+ | @islvaluereference
+ | @ismemberfunctionpointer
+ | @ismemberobjectpointer
+ | @ismemberpointer
+ | @isobject
+ | @ispointer
+ | @isreference
+ | @isrvaluereference
+ | @isscalar
+ | @issigned
+ | @isunsigned
+ | @isvoid
+ | @isvolatile
+ | @istriviallycopyassignable
+ | @isassignablenopreconditioncheck
+ | @referencebindstotemporary
+ | @issameas
+ | @builtinhasattribute
+ | @ispointerinterconvertiblewithclass
+ | @builtinispointerinterconvertiblewithclass
+ | @iscorrespondingmember
+ | @builtiniscorrespondingmember
+ | @isboundedarray
+ | @isunboundedarray
+ | @isreferenceable
+ | @isnothrowconvertible
+ | @referenceconstructsfromtemporary
+ | @referenceconvertsfromtemporary
+ | @isconvertible
+ | @isvalidwinrttype
+ | @iswinclass
+ | @iswininterface
+ | @istriviallyequalitycomparable
+ | @isscopedenum
+ | @istriviallyrelocatable
+ ;
+
+compound_requirement_is_noexcept(
+ int expr: @compound_requirement ref
+);
+
+new_allocated_type(
+ unique int expr: @new_expr ref,
+ int type_id: @type ref
+);
+
+new_array_allocated_type(
+ unique int expr: @new_array_expr ref,
+ int type_id: @type ref
+);
+
+/**
+ * The field being initialized by an initializer expression within an aggregate
+ * initializer for a class/struct/union. Position is used to sort repeated initializers.
+ */
+#keyset[aggregate, position]
+aggregate_field_init(
+ int aggregate: @aggregateliteral ref,
+ int initializer: @expr ref,
+ int field: @membervariable ref,
+ int position: int ref,
+ boolean is_designated: boolean ref
+);
+
+/**
+ * The index of the element being initialized by an initializer expression
+ * within an aggregate initializer for an array. Position is used to sort repeated initializers.
+ */
+#keyset[aggregate, position]
+aggregate_array_init(
+ int aggregate: @aggregateliteral ref,
+ int initializer: @expr ref,
+ int element_index: int ref,
+ int position: int ref,
+ boolean is_designated: boolean ref
+);
+
+@ctorinit = @ctordirectinit
+ | @ctorvirtualinit
+ | @ctorfieldinit
+ | @ctordelegatinginit;
+@dtordestruct = @dtordirectdestruct
+ | @dtorvirtualdestruct
+ | @dtorfielddestruct;
+
+
+condition_decl_bind(
+ unique int expr: @condition_decl ref,
+ unique int decl: @declaration ref
+);
+
+typeid_bind(
+ unique int expr: @type_id ref,
+ int type_id: @type ref
+);
+
+uuidof_bind(
+ unique int expr: @uuidof ref,
+ int type_id: @type ref
+);
+
+@sizeof_or_alignof = @runtime_sizeof | @runtime_alignof | @datasizeof | @sizeof_pack;
+
+sizeof_bind(
+ unique int expr: @sizeof_or_alignof ref,
+ int type_id: @type ref
+);
+
+code_block(
+ unique int block: @literal ref,
+ unique int routine: @function ref
+);
+
+lambdas(
+ unique int expr: @lambdaexpr ref,
+ string default_capture: string ref,
+ boolean has_explicit_return_type: boolean ref,
+ boolean has_explicit_parameter_list: boolean ref
+);
+
+lambda_capture(
+ unique int id: @lambdacapture,
+ int lambda: @lambdaexpr ref,
+ int index: int ref,
+ int field: @membervariable ref,
+ boolean captured_by_reference: boolean ref,
+ boolean is_implicit: boolean ref,
+ int location: @location_default ref
+);
+
+@funbindexpr = @routineexpr
+ | @new_expr
+ | @delete_expr
+ | @delete_array_expr
+ | @ctordirectinit
+ | @ctorvirtualinit
+ | @ctordelegatinginit
+ | @dtordirectdestruct
+ | @dtorvirtualdestruct;
+
+@varbindexpr = @varaccess | @ctorfieldinit | @dtorfielddestruct;
+@addressable = @function | @variable ;
+@accessible = @addressable | @enumconstant ;
+
+@access = @varaccess | @routineexpr ;
+
+fold(
+ int expr: @foldexpr ref,
+ string operator: string ref,
+ boolean is_left_fold: boolean ref
+);
+
+stmts(
+ unique int id: @stmt,
+ int kind: int ref,
+ int location: @location_default ref
+);
+
+case @stmt.kind of
+ 1 = @stmt_expr
+| 2 = @stmt_if
+| 3 = @stmt_while
+| 4 = @stmt_goto
+| 5 = @stmt_label
+| 6 = @stmt_return
+| 7 = @stmt_block
+| 8 = @stmt_end_test_while // do { ... } while ( ... )
+| 9 = @stmt_for
+| 10 = @stmt_switch_case
+| 11 = @stmt_switch
+| 13 = @stmt_asm // "asm" statement or the body of an asm function
+| 15 = @stmt_try_block
+| 16 = @stmt_microsoft_try // Microsoft
+| 17 = @stmt_decl
+| 18 = @stmt_set_vla_size // C99
+| 19 = @stmt_vla_decl // C99
+| 25 = @stmt_assigned_goto // GNU
+| 26 = @stmt_empty
+| 27 = @stmt_continue
+| 28 = @stmt_break
+| 29 = @stmt_range_based_for // C++11
+// ... 30 @stmt_at_autoreleasepool_block deprecated
+// ... 31 @stmt_objc_for_in deprecated
+// ... 32 @stmt_at_synchronized deprecated
+| 33 = @stmt_handler
+// ... 34 @stmt_finally_end deprecated
+| 35 = @stmt_constexpr_if
+| 37 = @stmt_co_return
+| 38 = @stmt_consteval_if
+| 39 = @stmt_not_consteval_if
+| 40 = @stmt_leave
+;
+
+type_vla(
+ int type_id: @type ref,
+ int decl: @stmt_vla_decl ref
+);
+
+variable_vla(
+ int var: @variable ref,
+ int decl: @stmt_vla_decl ref
+);
+
+type_is_vla(unique int type_id: @derivedtype ref)
+
+if_initialization(
+ unique int if_stmt: @stmt_if ref,
+ int init_id: @stmt ref
+);
+
+if_then(
+ unique int if_stmt: @stmt_if ref,
+ int then_id: @stmt ref
+);
+
+if_else(
+ unique int if_stmt: @stmt_if ref,
+ int else_id: @stmt ref
+);
+
+constexpr_if_initialization(
+ unique int constexpr_if_stmt: @stmt_constexpr_if ref,
+ int init_id: @stmt ref
+);
+
+constexpr_if_then(
+ unique int constexpr_if_stmt: @stmt_constexpr_if ref,
+ int then_id: @stmt ref
+);
+
+constexpr_if_else(
+ unique int constexpr_if_stmt: @stmt_constexpr_if ref,
+ int else_id: @stmt ref
+);
+
+@stmt_consteval_or_not_consteval_if = @stmt_consteval_if | @stmt_not_consteval_if;
+
+consteval_if_then(
+ unique int constexpr_if_stmt: @stmt_consteval_or_not_consteval_if ref,
+ int then_id: @stmt ref
+);
+
+consteval_if_else(
+ unique int constexpr_if_stmt: @stmt_consteval_or_not_consteval_if ref,
+ int else_id: @stmt ref
+);
+
+while_body(
+ unique int while_stmt: @stmt_while ref,
+ int body_id: @stmt ref
+);
+
+do_body(
+ unique int do_stmt: @stmt_end_test_while ref,
+ int body_id: @stmt ref
+);
+
+switch_initialization(
+ unique int switch_stmt: @stmt_switch ref,
+ int init_id: @stmt ref
+);
+
+#keyset[switch_stmt, index]
+switch_case(
+ int switch_stmt: @stmt_switch ref,
+ int index: int ref,
+ int case_id: @stmt_switch_case ref
+);
+
+switch_body(
+ unique int switch_stmt: @stmt_switch ref,
+ int body_id: @stmt ref
+);
+
+@stmt_for_or_range_based_for = @stmt_for
+ | @stmt_range_based_for;
+
+for_initialization(
+ unique int for_stmt: @stmt_for_or_range_based_for ref,
+ int init_id: @stmt ref
+);
+
+for_condition(
+ unique int for_stmt: @stmt_for ref,
+ int condition_id: @expr ref
+);
+
+for_update(
+ unique int for_stmt: @stmt_for ref,
+ int update_id: @expr ref
+);
+
+for_body(
+ unique int for_stmt: @stmt_for ref,
+ int body_id: @stmt ref
+);
+
+@stmtparent = @stmt | @expr_stmt ;
+stmtparents(
+ unique int id: @stmt ref,
+ int index: int ref,
+ int parent: @stmtparent ref
+);
+
+ishandler(unique int block: @stmt_block ref);
+
+@cfgnode = @stmt | @expr | @function | @initialiser ;
+
+stmt_decl_bind(
+ int stmt: @stmt_decl ref,
+ int num: int ref,
+ int decl: @declaration ref
+);
+
+stmt_decl_entry_bind(
+ int stmt: @stmt_decl ref,
+ int num: int ref,
+ int decl_entry: @element ref
+);
+
+@parameterized_element = @function | @stmt_block | @requires_expr;
+
+blockscope(
+ unique int block: @stmt_block ref,
+ int enclosing: @parameterized_element ref
+);
+
+@jump = @stmt_goto | @stmt_break | @stmt_continue | @stmt_leave;
+
+@jumporlabel = @jump | @stmt_label | @literal;
+
+jumpinfo(
+ unique int id: @jumporlabel ref,
+ string str: string ref,
+ int target: @stmt ref
+);
+
+preprocdirects(
+ unique int id: @preprocdirect,
+ int kind: int ref,
+ int location: @location_default ref
+);
+case @preprocdirect.kind of
+ 0 = @ppd_if
+| 1 = @ppd_ifdef
+| 2 = @ppd_ifndef
+| 3 = @ppd_elif
+| 4 = @ppd_else
+| 5 = @ppd_endif
+| 6 = @ppd_plain_include
+| 7 = @ppd_define
+| 8 = @ppd_undef
+| 9 = @ppd_line
+| 10 = @ppd_error
+| 11 = @ppd_pragma
+| 12 = @ppd_objc_import
+| 13 = @ppd_include_next
+| 14 = @ppd_ms_import
+| 15 = @ppd_elifdef
+| 16 = @ppd_elifndef
+| 18 = @ppd_warning
+;
+
+@ppd_include = @ppd_plain_include | @ppd_objc_import | @ppd_include_next | @ppd_ms_import;
+
+@ppd_branch = @ppd_if | @ppd_ifdef | @ppd_ifndef | @ppd_elif | @ppd_elifdef | @ppd_elifndef;
+
+preprocpair(
+ int begin : @ppd_branch ref,
+ int elseelifend : @preprocdirect ref
+);
+
+preproctrue(int branch : @ppd_branch ref);
+preprocfalse(int branch : @ppd_branch ref);
+
+preproctext(
+ unique int id: @preprocdirect ref,
+ string head: string ref,
+ string body: string ref
+);
+
+includes(
+ unique int id: @ppd_include ref,
+ int included: @file ref
+);
+
+link_targets(
+ int id: @link_target,
+ int binary: @file ref
+);
+
+link_parent(
+ int element : @element ref,
+ int link_target : @link_target ref
+);
+
+/*- XML Files -*/
+
+xmlEncoding(
+ unique int id: @file ref,
+ string encoding: string ref
+);
+
+xmlDTDs(
+ unique int id: @xmldtd,
+ string root: string ref,
+ string publicId: string ref,
+ string systemId: string ref,
+ int fileid: @file ref
+);
+
+xmlElements(
+ unique int id: @xmlelement,
+ string name: string ref,
+ int parentid: @xmlparent ref,
+ int idx: int ref,
+ int fileid: @file ref
+);
+
+xmlAttrs(
+ unique int id: @xmlattribute,
+ int elementid: @xmlelement ref,
+ string name: string ref,
+ string value: string ref,
+ int idx: int ref,
+ int fileid: @file ref
+);
+
+xmlNs(
+ int id: @xmlnamespace,
+ string prefixName: string ref,
+ string URI: string ref,
+ int fileid: @file ref
+);
+
+xmlHasNs(
+ int elementId: @xmlnamespaceable ref,
+ int nsId: @xmlnamespace ref,
+ int fileid: @file ref
+);
+
+xmlComments(
+ unique int id: @xmlcomment,
+ string text: string ref,
+ int parentid: @xmlparent ref,
+ int fileid: @file ref
+);
+
+xmlChars(
+ unique int id: @xmlcharacters,
+ string text: string ref,
+ int parentid: @xmlparent ref,
+ int idx: int ref,
+ int isCDATA: int ref,
+ int fileid: @file ref
+);
+
+@xmlparent = @file | @xmlelement;
+@xmlnamespaceable = @xmlelement | @xmlattribute;
+
+xmllocations(
+ int xmlElement: @xmllocatable ref,
+ int location: @location_default ref
+);
+
+@xmllocatable = @xmlcharacters | @xmlelement | @xmlcomment | @xmlattribute | @xmldtd | @file | @xmlnamespace;
diff --git a/cpp/downgrades/c16b29b27f71247023321cc0d0360998b318837c/upgrade.properties b/cpp/downgrades/c16b29b27f71247023321cc0d0360998b318837c/upgrade.properties
new file mode 100644
index 000000000000..c0351e51e293
--- /dev/null
+++ b/cpp/downgrades/c16b29b27f71247023321cc0d0360998b318837c/upgrade.properties
@@ -0,0 +1,4 @@
+description: Link PCH creations and uses
+compatibility: full
+pch_uses.rel: delete
+pch_creations.rel: delete
diff --git a/cpp/ql/lib/Customizations.qll b/cpp/ql/lib/Customizations.qll
new file mode 100644
index 000000000000..c9d899e07e01
--- /dev/null
+++ b/cpp/ql/lib/Customizations.qll
@@ -0,0 +1,11 @@
+/**
+ * Contains customizations to the standard library.
+ *
+ * This module is imported by `cpp.qll`, so any customizations defined here automatically
+ * apply to all queries.
+ *
+ * Typical examples of customizations include adding new subclasses of abstract classes such as
+ * the `RemoteFlowSource` class to model frameworks that are not covered by the standard library.
+ */
+
+import cpp
diff --git a/cpp/ql/lib/change-notes/2025-08-19-virtual-dispatch.md b/cpp/ql/lib/change-notes/2025-08-19-virtual-dispatch.md
new file mode 100644
index 000000000000..4342bb7f62dc
--- /dev/null
+++ b/cpp/ql/lib/change-notes/2025-08-19-virtual-dispatch.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The new dataflow/taint-tracking library (`semmle.code.cpp.dataflow.new.DataFlow` and `semmle.code.cpp.dataflow.new.TaintTracking`) now resolves virtual function calls more precisely. This results in fewer false positives when running dataflow/taint-tracking queries on C++ projects.
\ No newline at end of file
diff --git a/cpp/ql/lib/change-notes/2025-08-27-pch.md b/cpp/ql/lib/change-notes/2025-08-27-pch.md
new file mode 100644
index 000000000000..c4a59f112c56
--- /dev/null
+++ b/cpp/ql/lib/change-notes/2025-08-27-pch.md
@@ -0,0 +1,5 @@
+---
+category: feature
+---
+* Added a new class `PchFile` representing precompiled header (PCH) files used during project compilation.
+
diff --git a/cpp/ql/lib/change-notes/2025-08-28-comptr.md b/cpp/ql/lib/change-notes/2025-08-28-comptr.md
new file mode 100644
index 000000000000..9ce6fde50cb9
--- /dev/null
+++ b/cpp/ql/lib/change-notes/2025-08-28-comptr.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Added flow summaries for the `Microsoft::WRL::ComPtr` member functions.
\ No newline at end of file
diff --git a/cpp/ql/lib/cpp.qll b/cpp/ql/lib/cpp.qll
index ccd32c368e4b..46c651daf579 100644
--- a/cpp/ql/lib/cpp.qll
+++ b/cpp/ql/lib/cpp.qll
@@ -13,7 +13,9 @@
* https://github.com/cplusplus/draft/raw/master/papers/n4140.pdf
*/
+import Customizations
import semmle.code.cpp.File
+import semmle.code.cpp.PchFile
import semmle.code.cpp.Linkage
import semmle.code.cpp.Location
import semmle.code.cpp.Compilation
diff --git a/cpp/ql/lib/ext/ComPtr.model.yml b/cpp/ql/lib/ext/ComPtr.model.yml
new file mode 100644
index 000000000000..49be2c49a4bf
--- /dev/null
+++ b/cpp/ql/lib/ext/ComPtr.model.yml
@@ -0,0 +1,31 @@
+extensions:
+ - addsTo:
+ pack: codeql/cpp-all
+ extensible: summaryModel
+ data: # namespace, type, subtypes, name, signature, ext, input, output, kind, provenance
+ - ["Microsoft::WRL", "ComPtr", True, "ComPtr", "(T *)", "", "Argument[*@0]", "Argument[-1].Element[@]", "value", "manual"]
+ - ["Microsoft::WRL", "ComPtr", True, "ComPtr", "(const ComPtr &)", "", "Argument[*0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
+ - ["Microsoft::WRL", "ComPtr", True, "ComPtr", "(ComPtr &&)", "", "Argument[*0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
+ - ["Microsoft::WRL", "ComPtr", True, "As", "", "", "Argument[-1]", "Argument[*0]", "value", "manual"]
+ - ["Microsoft::WRL", "ComPtr", True, "AsIID", "", "", "Argument[-1]", "Argument[*1]", "value", "manual"]
+ - ["Microsoft::WRL", "ComPtr", True, "AsWeak", "", "", "Argument[-1]", "Argument[*0]", "value", "manual"]
+ - ["Microsoft::WRL", "ComPtr", True, "Attach", "", "", "Argument[*@0]", "Argument[-1].Element[@]", "value", "manual"]
+ - ["Microsoft::WRL", "ComPtr", True, "CopyTo", "(T **)", "", "Argument[-1].Element[@]", "Argument[**@0]", "value", "manual"]
+ - ["Microsoft::WRL", "ComPtr", True, "CopyTo", "(T **)", "", "Argument[-1].Element[@]", "Argument[**@0]", "value", "manual"]
+ - ["Microsoft::WRL", "ComPtr", True, "CopyTo", "(REFIID,void **)", "", "Argument[-1].Element[@]", "Argument[**@1]", "value", "manual"]
+ - ["Microsoft::WRL", "ComPtr", True, "Detach", "", "", "Argument[-1].Element[@]", "ReturnValue[*@]", "value", "manual"]
+ - ["Microsoft::WRL", "ComPtr", True, "Get", "", "", "Argument[-1].Element[@]", "ReturnValue[*@]", "value", "manual"]
+ - ["Microsoft::WRL", "ComPtr", True, "GetAddressOf", "", "", "Argument[-1].Element[@]", "ReturnValue[**@]", "value", "manual"]
+ - ["Microsoft::WRL", "ComPtr", True, "ReleaseAndGetAddressOf", "", "", "Argument[-1].Element[@]", "ReturnValue[**@]", "value", "manual"]
+ - ["Microsoft::WRL", "ComPtr", True, "Swap", "", "", "Argument[-1]", "Argument[*0]", "value", "manual"]
+ - ["Microsoft::WRL", "ComPtr", True, "Swap", "", "", "Argument[*0]", "Argument[-1]", "value", "manual"]
+ - ["Microsoft::WRL", "ComPtr", True, "operator&", "", "", "Argument[-1]", "ReturnValue.Element", "value", "manual"]
+ - ["Microsoft::WRL", "ComPtr", True, "operator->", "", "", "Argument[-1].Element[@]", "ReturnValue[*@]", "value", "manual"]
+ - ["Microsoft::WRL", "ComPtr", True, "operator=", "(T *)", "", "Argument[*@0]", "Argument[-1].Element[@]", "value", "manual"]
+ - ["Microsoft::WRL", "ComPtr", True, "operator=", "(T *)", "", "Argument[*@0]", "ReturnValue[*].Element[@]", "value", "manual"]
+ - ["Microsoft::WRL", "ComPtr", True, "operator=", "(U *)", "", "Argument[*@0]", "Argument[-1].Element[@]", "value", "manual"]
+ - ["Microsoft::WRL", "ComPtr", True, "operator=", "(U *)", "", "Argument[*@0]", "ReturnValue[*].Element[@]", "value", "manual"]
+ - ["Microsoft::WRL", "ComPtr", True, "operator=", "(const ComPtr &)", "", "Argument[*0]", "Argument[-1]", "value", "manual"]
+ - ["Microsoft::WRL", "ComPtr", True, "operator=", "(const ComPtr &)", "", "Argument[*0]", "ReturnValue[*]", "value", "manual"]
+ - ["Microsoft::WRL", "ComPtr", True, "operator=", "(ComPtr &&)", "", "Argument[*0]", "Argument[-1]", "value", "manual"]
+ - ["Microsoft::WRL", "ComPtr", True, "operator=", "(ComPtr &&)", "", "Argument[*0]", "ReturnValue[*]", "value", "manual"]
diff --git a/cpp/ql/lib/ext/ComPtrRef.model.yml b/cpp/ql/lib/ext/ComPtrRef.model.yml
new file mode 100644
index 000000000000..710d9e6def35
--- /dev/null
+++ b/cpp/ql/lib/ext/ComPtrRef.model.yml
@@ -0,0 +1,12 @@
+extensions:
+ - addsTo:
+ pack: codeql/cpp-all
+ extensible: summaryModel
+ data: # namespace, type, subtypes, name, signature, ext, input, output, kind, provenance
+ - ["Microsoft::WRL::Details", "ComPtrRef", True, "ComPtrRef", "", "", "Argument[*0]", "Argument[-1].Element[@]", "value", "manual"]
+ - ["Microsoft::WRL::Details", "ComPtrRef", True, "GetAddressOf", "", "", "Argument[-1].Element[@]", "ReturnValue[*@]", "value", "manual"]
+ # TODO: We cannot yet model https://learn.microsoft.com/en-us/cpp/cppcx/wrl/comptrref-class?view=msvc-170#operator-interfacetype-star-star
+ - ["Microsoft::WRL::Details", "ComPtrRef", True, "operator*", "", "", "Argument[-1].Element[@]", "ReturnValue[*@]", "value", "manual"]
+ # TODO: We cannot yet model https://learn.microsoft.com/en-us/cpp/cppcx/wrl/comptrref-class?view=msvc-170#operator-t-star
+ - ["Microsoft::WRL::Details", "ComPtrRef", True, "operator void**", "", "", "Argument[-1].Element[@]", "ReturnValue[**@]", "value", "manual"]
+ - ["Microsoft::WRL::Details", "ComPtrRef", True, "ReleaseAndGetAddressOf", "", "", "Argument[-1].Element[@]", "ReturnValue[**@]", "value", "manual"]
\ No newline at end of file
diff --git a/cpp/ql/lib/qlpack.yml b/cpp/ql/lib/qlpack.yml
index 9698c86d3f24..68f412126f48 100644
--- a/cpp/ql/lib/qlpack.yml
+++ b/cpp/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/cpp-all
-version: 5.4.1
+version: 5.4.2-dev
groups: cpp
dbscheme: semmlecode.cpp.dbscheme
extractor: cpp
diff --git a/cpp/ql/lib/semmle/code/cpp/PchFile.qll b/cpp/ql/lib/semmle/code/cpp/PchFile.qll
new file mode 100644
index 000000000000..6522edf6593c
--- /dev/null
+++ b/cpp/ql/lib/semmle/code/cpp/PchFile.qll
@@ -0,0 +1,26 @@
+/**
+ * Provides the `PchFile` class representing precompiled header (PCH) files created and
+ * used during the build process.
+ */
+
+import semmle.code.cpp.File
+
+/**
+ * A precompiled header (PCH) file created during the build process.
+ */
+class PchFile extends @pch {
+ /**
+ * Gets a textual representation of this element.
+ */
+ string toString() { result = "PCH for " + this.getHeaderFile() }
+
+ /**
+ * Gets the header file from which the PCH file was created.
+ */
+ File getHeaderFile() { pch_creations(this, _, result) }
+
+ /**
+ * Gets a source file that includes the PCH.
+ */
+ File getAUse() { pch_uses(this, _, result) }
+}
diff --git a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowDispatch.qll b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowDispatch.qll
index b5e899bf0aac..0d63558c956e 100644
--- a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowDispatch.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowDispatch.qll
@@ -1,8 +1,44 @@
private import cpp
private import semmle.code.cpp.ir.IR
-private import DataFlowPrivate
+private import semmle.code.cpp.ir.dataflow.DataFlow
+private import DataFlowPrivate as DataFlowPrivate
private import DataFlowUtil
private import DataFlowImplCommon as DataFlowImplCommon
+private import codeql.typetracking.TypeTracking
+private import SsaImpl as SsaImpl
+
+/**
+ * Holds if `f` has name `qualifiedName` and `nparams` parameter count. This is
+ * an approximation of its signature for the purpose of matching functions that
+ * might be the same across link targets.
+ */
+private predicate functionSignature(Function f, string qualifiedName, int nparams) {
+ qualifiedName = f.getQualifiedName() and
+ nparams = f.getNumberOfParameters() and
+ not f.isStatic()
+}
+
+/**
+ * Holds if `f` is a function with a body that has name `qualifiedName` and
+ * `nparams` parameter count. See `functionSignature`.
+ */
+private predicate functionSignatureWithBody(string qualifiedName, int nparams, Function f) {
+ functionSignature(f, qualifiedName, nparams) and
+ exists(f.getBlock())
+}
+
+/**
+ * Holds if the target of `call` is a function _with no definition_ that has
+ * name `qualifiedName` and `nparams` parameter count. See `functionSignature`.
+ */
+pragma[noinline]
+private predicate callSignatureWithoutBody(string qualifiedName, int nparams, CallInstruction call) {
+ exists(Function target |
+ target = call.getStaticCallTarget() and
+ not exists(target.getBlock()) and
+ functionSignature(target, qualifiedName, nparams)
+ )
+}
/**
* Gets a function that might be called by `call`.
@@ -11,7 +47,15 @@ private import DataFlowImplCommon as DataFlowImplCommon
* from `AdditionalCallTarget` into account.
*/
cached
-DataFlowCallable defaultViableCallable(DataFlowCall call) {
+DataFlowPrivate::DataFlowCallable defaultViableCallable(DataFlowPrivate::DataFlowCall call) {
+ result = defaultViableCallableWithoutLambda(call)
+ or
+ result = DataFlowImplCommon::viableCallableLambda(call, _)
+}
+
+private DataFlowPrivate::DataFlowCallable defaultViableCallableWithoutLambda(
+ DataFlowPrivate::DataFlowCall call
+) {
DataFlowImplCommon::forceCachingInSameStage() and
result = call.getStaticCallTarget()
or
@@ -26,17 +70,13 @@ DataFlowCallable defaultViableCallable(DataFlowCall call) {
functionSignatureWithBody(qualifiedName, nparams, result.getUnderlyingCallable()) and
strictcount(Function other | functionSignatureWithBody(qualifiedName, nparams, other)) = 1
)
- or
- // Virtual dispatch
- result.asSourceCallable() = call.(VirtualDispatch::DataSensitiveCall).resolve()
}
/**
* Gets a function that might be called by `call`.
*/
-cached
-DataFlowCallable viableCallable(DataFlowCall call) {
- result = defaultViableCallable(call)
+private DataFlowPrivate::DataFlowCallable nonVirtualDispatch(DataFlowPrivate::DataFlowCall call) {
+ result = defaultViableCallableWithoutLambda(call)
or
// Additional call targets
result.getUnderlyingCallable() =
@@ -44,228 +84,276 @@ DataFlowCallable viableCallable(DataFlowCall call) {
.viableTarget(call.asCallInstruction().getUnconvertedResultExpression())
}
+private class RelevantNode extends Node {
+ RelevantNode() { this.getType().stripType() instanceof Class }
+}
+
+private signature DataFlowPrivate::DataFlowCallable methodDispatchSig(
+ DataFlowPrivate::DataFlowCall c
+);
+
+private predicate ignoreConstructor(Expr e) {
+ e instanceof ConstructorDirectInit or
+ e instanceof ConstructorVirtualInit or
+ e instanceof ConstructorDelegationInit or
+ exists(ConstructorFieldInit init | init.getExpr() = e)
+}
+
/**
- * Provides virtual dispatch support compatible with the original
- * implementation of `semmle.code.cpp.security.TaintTracking`.
+ * Holds if `n` is either:
+ * - the post-update node of a qualifier after a call to a constructor which
+ * constructs an object containing at least one virtual function.
+ * - a node which represents a derived-to-base instruction that converts from `c`.
*/
-private module VirtualDispatch {
- /** A call that may dispatch differently depending on the qualifier value. */
- abstract class DataSensitiveCall extends DataFlowCall {
- /**
- * Gets the node whose value determines the target of this call. This node
- * could be the qualifier of a virtual dispatch or the function-pointer
- * expression in a call to a function pointer. What they have in common is
- * that we need to find out which data flows there, and then it's up to the
- * `resolve` predicate to stitch that information together and resolve the
- * call.
- */
- abstract Node getDispatchValue();
-
- /** Gets a candidate target for this call. */
- abstract Function resolve();
-
- /**
- * Whether `src` can flow to this call.
- *
- * Searches backwards from `getDispatchValue()` to `src`. The `allowFromArg`
- * parameter is true when the search is allowed to continue backwards into
- * a parameter; non-recursive callers should pass `_` for `allowFromArg`.
- */
- predicate flowsFrom(Node src, boolean allowFromArg) {
- src = this.getDispatchValue() and allowFromArg = true
- or
- exists(Node other, boolean allowOtherFromArg | this.flowsFrom(other, allowOtherFromArg) |
- // Call argument
- exists(DataFlowCall call, Position i |
- other.(ParameterNode).isParameterOf(pragma[only_bind_into](call).getStaticCallTarget(), i) and
- src.(ArgumentNode).argumentOf(call, pragma[only_bind_into](pragma[only_bind_out](i)))
- ) and
- allowOtherFromArg = true and
- allowFromArg = true
+private predicate qualifierSourceImpl(RelevantNode n, Class c) {
+ // Object construction
+ exists(CallInstruction call, ThisArgumentOperand qualifier, Call e |
+ qualifier = call.getThisArgumentOperand() and
+ n.(PostUpdateNode).getPreUpdateNode().asOperand() = qualifier and
+ call.getStaticCallTarget() instanceof Constructor and
+ qualifier.getType().stripType() = c and
+ c.getABaseClass*().getAMemberFunction().isVirtual() and
+ e = call.getUnconvertedResultExpression() and
+ not ignoreConstructor(e)
+ |
+ exists(c.getABaseClass())
+ or
+ exists(c.getADerivedClass())
+ )
+ or
+ // Conversion to a base class
+ exists(ConvertToBaseInstruction convert |
+ // Only keep the most specific cast
+ not convert.getUnary() instanceof ConvertToBaseInstruction and
+ n.asInstruction() = convert and
+ convert.getDerivedClass() = c and
+ c.getABaseClass*().getAMemberFunction().isVirtual()
+ )
+}
+
+private module TrackVirtualDispatch {
+ /**
+ * Gets a possible runtime target of `c` using both static call-target
+ * information, and call-target resolution from `virtualDispatch0`.
+ */
+ private DataFlowPrivate::DataFlowCallable dispatch(DataFlowPrivate::DataFlowCall c) {
+ result = nonVirtualDispatch(c) or
+ result = virtualDispatch0(c)
+ }
+
+ private module TtInput implements TypeTrackingInput {
+ final class Node = RelevantNode;
+
+ class LocalSourceNode extends Node {
+ LocalSourceNode() {
+ this instanceof ParameterNode
or
- // Call return
- exists(DataFlowCall call, ReturnKind returnKind |
- other = getAnOutNode(call, returnKind) and
- returnNodeWithKindAndEnclosingCallable(src, returnKind, call.getStaticCallTarget())
- ) and
- allowFromArg = false
+ this instanceof DataFlowPrivate::OutNode
or
- // Local flow
- localFlowStep(src, other) and
- allowFromArg = allowOtherFromArg
+ DataFlowPrivate::readStep(_, _, this)
or
- // Flow from global variable to load.
- exists(LoadInstruction load, GlobalOrNamespaceVariable var |
- var = src.asVariable() and
- other.asInstruction() = load and
- addressOfGlobal(load.getSourceAddress(), var) and
- // The `allowFromArg` concept doesn't play a role when `src` is a
- // global variable, so we just set it to a single arbitrary value for
- // performance.
- allowFromArg = true
- )
+ DataFlowPrivate::storeStep(_, _, this)
+ or
+ DataFlowPrivate::jumpStep(_, this)
or
- // Flow from store to global variable.
- exists(StoreInstruction store, GlobalOrNamespaceVariable var |
- var = other.asVariable() and
- store = src.asInstruction() and
- storeIntoGlobal(store, var) and
- // Setting `allowFromArg` to `true` like in the base case means we
- // treat a store to a global variable like the dispatch itself: flow
- // may come from anywhere.
- allowFromArg = true
+ qualifierSourceImpl(this, _)
+ }
+ }
+
+ final private class ContentSetFinal = ContentSet;
+
+ class Content extends ContentSetFinal {
+ Content() {
+ exists(DataFlow::Content c |
+ this.isSingleton(c) and
+ c.getIndirectionIndex() = 1
)
+ }
+ }
+
+ class ContentFilter extends Content {
+ Content getAMatchingContent() { result = this }
+ }
+
+ predicate compatibleContents(Content storeContents, Content loadContents) {
+ storeContents = loadContents
+ }
+
+ predicate simpleLocalSmallStep(Node nodeFrom, Node nodeTo) {
+ nodeFrom.getFunction() instanceof Function and
+ simpleLocalFlowStep(nodeFrom, nodeTo, _)
+ }
+
+ predicate levelStepNoCall(Node n1, LocalSourceNode n2) { none() }
+
+ predicate levelStepCall(Node n1, LocalSourceNode n2) { none() }
+
+ predicate storeStep(Node n1, Node n2, Content f) { DataFlowPrivate::storeStep(n1, f, n2) }
+
+ predicate callStep(Node n1, LocalSourceNode n2) {
+ exists(DataFlowPrivate::DataFlowCall call, DataFlowPrivate::Position pos |
+ n1.(DataFlowPrivate::ArgumentNode).argumentOf(call, pos) and
+ n2.(ParameterNode).isParameterOf(dispatch(call), pos)
+ )
+ }
+
+ predicate returnStep(Node n1, LocalSourceNode n2) {
+ exists(DataFlowPrivate::DataFlowCallable callable, DataFlowPrivate::DataFlowCall call |
+ n1.(DataFlowPrivate::ReturnNode).getEnclosingCallable() = callable and
+ callable = dispatch(call) and
+ n2 = DataFlowPrivate::getAnOutNode(call, n1.(DataFlowPrivate::ReturnNode).getKind())
)
}
+
+ predicate loadStep(Node n1, LocalSourceNode n2, Content f) {
+ DataFlowPrivate::readStep(n1, f, n2)
+ }
+
+ predicate loadStoreStep(Node nodeFrom, Node nodeTo, Content f1, Content f2) { none() }
+
+ predicate withContentStep(Node nodeFrom, LocalSourceNode nodeTo, ContentFilter f) { none() }
+
+ predicate withoutContentStep(Node nodeFrom, LocalSourceNode nodeTo, ContentFilter f) { none() }
+
+ predicate jumpStep(Node n1, LocalSourceNode n2) { DataFlowPrivate::jumpStep(n1, n2) }
+
+ predicate hasFeatureBacktrackStoreTarget() { none() }
}
- pragma[noinline]
- private predicate storeIntoGlobal(StoreInstruction store, GlobalOrNamespaceVariable var) {
- addressOfGlobal(store.getDestinationAddress(), var)
+ private predicate qualifierSource(RelevantNode n) { qualifierSourceImpl(n, _) }
+
+ /**
+ * Holds if `n` is the qualifier of `call` which targets the virtual member
+ * function `mf`.
+ */
+ private predicate qualifierOfVirtualCallImpl(
+ RelevantNode n, CallInstruction call, MemberFunction mf
+ ) {
+ n.asOperand() = call.getThisArgumentOperand() and
+ call.getStaticCallTarget() = mf and
+ mf.isVirtual()
}
- /** Holds if `addressInstr` is an instruction that produces the address of `var`. */
- private predicate addressOfGlobal(Instruction addressInstr, GlobalOrNamespaceVariable var) {
- // Access directly to the global variable
- addressInstr.(VariableAddressInstruction).getAstVariable() = var
- or
- // Access to a field on a global union
- exists(FieldAddressInstruction fa |
- fa = addressInstr and
- fa.getObjectAddress().(VariableAddressInstruction).getAstVariable() = var and
- fa.getField().getDeclaringType() instanceof Union
+ private predicate qualifierOfVirtualCall(RelevantNode n) { qualifierOfVirtualCallImpl(n, _, _) }
+
+ private import TypeTracking::TypeTrack::Graph
+
+ private predicate edgePlus(PathNode n1, PathNode n2) = fastTC(edges/2)(n1, n2)
+
+ /**
+ * Gets the most specific implementation of `mf` that may be called when the
+ * qualifier has runtime type `c`.
+ */
+ private MemberFunction mostSpecific(MemberFunction mf, Class c) {
+ qualifierOfVirtualCallImpl(_, _, mf) and
+ mf.getAnOverridingFunction*() = result and
+ (
+ result.getDeclaringType() = c
+ or
+ not c.getAMemberFunction().getAnOverriddenFunction*() = mf and
+ result = mostSpecific(mf, c.getABaseClass())
)
}
/**
- * A ReturnNode with its ReturnKind and its enclosing callable.
- *
- * Used to fix a join ordering issue in flowsFrom.
+ * Gets a possible pair of end-points `(p1, p2)` where:
+ * - `p1` is a derived-to-base conversion that converts from some
+ * class `derived`, and
+ * - `p2` is the qualifier of a call to a virtual function that may
+ * target `callable`, and
+ * - `callable` is the most specific implementation that may be called when
+ * the qualifier has type `derived`.
*/
- pragma[noinline]
- private predicate returnNodeWithKindAndEnclosingCallable(
- ReturnNode node, ReturnKind kind, DataFlowCallable callable
+ private predicate pairCand(
+ PathNode p1, PathNode p2, DataFlowPrivate::DataFlowCallable callable,
+ DataFlowPrivate::DataFlowCall call
) {
- node.getKind() = kind and
- node.getFunction() = callable.getUnderlyingCallable()
+ exists(Class derived, MemberFunction mf |
+ qualifierSourceImpl(p1.getNode(), derived) and
+ qualifierOfVirtualCallImpl(p2.getNode(), call.asCallInstruction(), mf) and
+ p1.isSource() and
+ p2.isSink() and
+ callable.asSourceCallable() = mostSpecific(mf, derived)
+ )
}
- /** Call through a function pointer. */
- private class DataSensitiveExprCall extends DataSensitiveCall {
- DataSensitiveExprCall() { not exists(this.getStaticCallTarget()) }
-
- override Node getDispatchValue() { result.asOperand() = this.getCallTargetOperand() }
-
- override Function resolve() {
- exists(FunctionInstruction fi |
- this.flowsFrom(instructionNode(fi), _) and
- result = fi.getFunctionSymbol()
- ) and
- (
- this.getNumberOfArguments() <= result.getEffectiveNumberOfParameters() and
- this.getNumberOfArguments() >= result.getEffectiveNumberOfParameters()
- or
- result.isVarargs()
- )
- }
+ /** Gets a possible run-time target of `call`. */
+ DataFlowPrivate::DataFlowCallable virtualDispatch(DataFlowPrivate::DataFlowCall call) {
+ exists(PathNode p1, PathNode p2 | p1 = p2 or edgePlus(p1, p2) | pairCand(p1, p2, result, call))
}
+}
- /** Call to a virtual function. */
- private class DataSensitiveOverriddenFunctionCall extends DataSensitiveCall {
- DataSensitiveOverriddenFunctionCall() {
- exists(
- this.getStaticCallTarget()
- .getUnderlyingCallable()
- .(VirtualFunction)
- .getAnOverridingFunction()
- )
- }
+private DataFlowPrivate::DataFlowCallable noDisp(DataFlowPrivate::DataFlowCall call) { none() }
- override Node getDispatchValue() { result.asInstruction() = this.getArgument(-1) }
+pragma[nomagic]
+private DataFlowPrivate::DataFlowCallable d1(DataFlowPrivate::DataFlowCall call) {
+ result = TrackVirtualDispatch::virtualDispatch(call)
+}
- override MemberFunction resolve() {
- exists(Class overridingClass |
- this.overrideMayAffectCall(overridingClass, result) and
- this.hasFlowFromCastFrom(overridingClass)
- )
- }
+pragma[nomagic]
+private DataFlowPrivate::DataFlowCallable d2(DataFlowPrivate::DataFlowCall call) {
+ result = TrackVirtualDispatch::virtualDispatch(call)
+}
- /**
- * Holds if `this` is a virtual function call whose static target is
- * overridden by `overridingFunction` in `overridingClass`.
- */
- pragma[noinline]
- private predicate overrideMayAffectCall(Class overridingClass, MemberFunction overridingFunction) {
- overridingFunction.getAnOverriddenFunction+() =
- this.getStaticCallTarget().getUnderlyingCallable().(VirtualFunction) and
- overridingFunction.getDeclaringType() = overridingClass
- }
+pragma[nomagic]
+private DataFlowPrivate::DataFlowCallable d3(DataFlowPrivate::DataFlowCall call) {
+ result = TrackVirtualDispatch::virtualDispatch(call)
+}
- /**
- * Holds if the qualifier of `this` has flow from an upcast from
- * `derivedClass`.
- */
- pragma[noinline]
- private predicate hasFlowFromCastFrom(Class derivedClass) {
- exists(ConvertToBaseInstruction toBase |
- this.flowsFrom(instructionNode(toBase), _) and
- derivedClass = toBase.getDerivedClass()
- )
- }
- }
+pragma[nomagic]
+private DataFlowPrivate::DataFlowCallable d4(DataFlowPrivate::DataFlowCall call) {
+ result = TrackVirtualDispatch::virtualDispatch(call)
}
-/**
- * Holds if `f` is a function with a body that has name `qualifiedName` and
- * `nparams` parameter count. See `functionSignature`.
- */
-private predicate functionSignatureWithBody(string qualifiedName, int nparams, Function f) {
- functionSignature(f, qualifiedName, nparams) and
- exists(f.getBlock())
+pragma[nomagic]
+private DataFlowPrivate::DataFlowCallable d5(DataFlowPrivate::DataFlowCall call) {
+ result = TrackVirtualDispatch::virtualDispatch(call)
}
-/**
- * Holds if the target of `call` is a function _with no definition_ that has
- * name `qualifiedName` and `nparams` parameter count. See `functionSignature`.
- */
-pragma[noinline]
-private predicate callSignatureWithoutBody(string qualifiedName, int nparams, CallInstruction call) {
- exists(Function target |
- target = call.getStaticCallTarget() and
- not exists(target.getBlock()) and
- functionSignature(target, qualifiedName, nparams)
- )
+pragma[nomagic]
+private DataFlowPrivate::DataFlowCallable d6(DataFlowPrivate::DataFlowCall call) {
+ result = TrackVirtualDispatch::virtualDispatch(call)
}
-/**
- * Holds if `f` has name `qualifiedName` and `nparams` parameter count. This is
- * an approximation of its signature for the purpose of matching functions that
- * might be the same across link targets.
- */
-private predicate functionSignature(Function f, string qualifiedName, int nparams) {
- qualifiedName = f.getQualifiedName() and
- nparams = f.getNumberOfParameters() and
- not f.isStatic()
+/** Gets a function that might be called by `call`. */
+cached
+DataFlowPrivate::DataFlowCallable viableCallable(DataFlowPrivate::DataFlowCall call) {
+ not exists(d6(call)) and
+ result = nonVirtualDispatch(call)
+ or
+ result = d6(call)
}
/**
* Holds if the set of viable implementations that can be called by `call`
* might be improved by knowing the call context.
*/
-predicate mayBenefitFromCallContext(DataFlowCall call) { mayBenefitFromCallContext(call, _, _) }
+predicate mayBenefitFromCallContext(DataFlowPrivate::DataFlowCall call) {
+ mayBenefitFromCallContext(call, _, _)
+}
+
+private predicate localLambdaFlowStep(Node nodeFrom, Node nodeTo) {
+ localFlowStep(nodeFrom, nodeTo)
+ or
+ DataFlowPrivate::additionalLambdaFlowStep(nodeFrom, nodeTo, _)
+}
/**
* Holds if `call` is a call through a function pointer, and the pointer
* value is given as the `arg`'th argument to `f`.
*/
private predicate mayBenefitFromCallContext(
- VirtualDispatch::DataSensitiveCall call, DataFlowCallable f, int arg
+ DataFlowPrivate::DataFlowCall call, DataFlowPrivate::DataFlowCallable f, int arg
) {
f = pragma[only_bind_out](call).getEnclosingCallable() and
exists(InitializeParameterInstruction init |
- not exists(call.getStaticCallTarget()) and
+ not exists(call.getStaticCallTarget())
+ or
+ exists(call.getStaticCallSourceTarget().(VirtualFunction).getAnOverridingFunction())
+ |
init.getEnclosingFunction() = f.getUnderlyingCallable() and
- call.flowsFrom(instructionNode(init), _) and
+ localLambdaFlowStep+(instructionNode(init),
+ operandNode(call.asCallInstruction().getCallTargetOperand())) and
init.getParameter().getIndex() = arg
)
}
@@ -274,9 +362,11 @@ private predicate mayBenefitFromCallContext(
* Gets a viable dispatch target of `call` in the context `ctx`. This is
* restricted to those `call`s for which a context might make a difference.
*/
-DataFlowCallable viableImplInCallContext(DataFlowCall call, DataFlowCall ctx) {
+DataFlowPrivate::DataFlowCallable viableImplInCallContext(
+ DataFlowPrivate::DataFlowCall call, DataFlowPrivate::DataFlowCall ctx
+) {
result = viableCallable(call) and
- exists(int i, DataFlowCallable f |
+ exists(int i, DataFlowPrivate::DataFlowCallable f |
mayBenefitFromCallContext(pragma[only_bind_into](call), f, i) and
f = ctx.getStaticCallTarget() and
result.asSourceCallable() =
@@ -286,4 +376,8 @@ DataFlowCallable viableImplInCallContext(DataFlowCall call, DataFlowCall ctx) {
/** Holds if arguments at position `apos` match parameters at position `ppos`. */
pragma[inline]
-predicate parameterMatch(ParameterPosition ppos, ArgumentPosition apos) { ppos = apos }
+predicate parameterMatch(
+ DataFlowPrivate::ParameterPosition ppos, DataFlowPrivate::ArgumentPosition apos
+) {
+ ppos = apos
+}
diff --git a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll
index a03042a77ff0..3aa8994a4499 100644
--- a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll
@@ -1492,7 +1492,14 @@ predicate lambdaCall(DataFlowCall call, LambdaCallKind kind, Node receiver) {
}
/** Extra data-flow steps needed for lambda flow analysis. */
-predicate additionalLambdaFlowStep(Node nodeFrom, Node nodeTo, boolean preservesValue) { none() }
+predicate additionalLambdaFlowStep(Node nodeFrom, Node nodeTo, boolean preservesValue) {
+ preservesValue = false and
+ exists(ContentSet cs | cs.isSingleton(any(UnionContent uc)) |
+ storeStep(nodeFrom, cs, nodeTo)
+ or
+ readStep(nodeFrom, cs, nodeTo)
+ )
+}
predicate knownSourceModel(Node source, string model) { External::sourceNode(source, _, model) }
diff --git a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
index a0a99711552c..ef4051171afb 100644
--- a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
@@ -795,7 +795,7 @@ class FinalGlobalValue extends Node, TFinalGlobalValue {
override DataFlowType getType() {
exists(int indirectionIndex |
indirectionIndex = globalUse.getIndirectionIndex() and
- result = getTypeImpl(globalUse.getUnderlyingType(), indirectionIndex - 1)
+ result = getTypeImpl(globalUse.getUnderlyingType(), indirectionIndex)
)
}
diff --git a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaImpl.qll b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaImpl.qll
index b9f320e57b23..1cf45439d8b7 100644
--- a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaImpl.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaImpl.qll
@@ -756,9 +756,9 @@ private predicate modeledFlowBarrier(Node n) {
partialFlowFunc = call.getStaticCallTarget() and
not partialFlowFunc.isPartialWrite(output)
|
- call.getStaticCallTarget().(DataFlow::DataFlowFunction).hasDataFlow(_, output)
+ partialFlowFunc.(DataFlow::DataFlowFunction).hasDataFlow(_, output)
or
- call.getStaticCallTarget().(Taint::TaintFunction).hasTaintFlow(_, output)
+ partialFlowFunc.(Taint::TaintFunction).hasTaintFlow(_, output)
)
or
exists(Operand operand, Instruction instr, Node n0, int indirectionIndex |
diff --git a/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedExpr.qll b/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedExpr.qll
index f7786fcf290a..f749f8b7502c 100644
--- a/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedExpr.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedExpr.qll
@@ -3884,7 +3884,7 @@ class TranslatedNewExpr extends TranslatedNewOrNewArrayExpr {
final override Type getTargetType() { result = expr.getAllocatedType().getUnspecifiedType() }
final override TranslatedInitialization getInitialization() {
- result = getTranslatedInitialization(expr.getInitializer())
+ result = getTranslatedInitialization(expr.getInitializer().getFullyConverted())
}
}
diff --git a/cpp/ql/lib/semmle/code/cpp/models/interfaces/FormattingFunction.qll b/cpp/ql/lib/semmle/code/cpp/models/interfaces/FormattingFunction.qll
index ce65a65319a8..757db13fe8c3 100644
--- a/cpp/ql/lib/semmle/code/cpp/models/interfaces/FormattingFunction.qll
+++ b/cpp/ql/lib/semmle/code/cpp/models/interfaces/FormattingFunction.qll
@@ -170,6 +170,16 @@ abstract class FormattingFunction extends ArrayFunction, TaintFunction {
output.isParameterDeref(this.getOutputParameterIndex(_))
)
}
+
+ final override predicate isPartialWrite(FunctionOutput output) {
+ exists(int outputParameterIndex |
+ output.isParameterDeref(outputParameterIndex) and
+ // We require the output to be a stream since that definitely means that
+ // it's a partial write. If it's not a stream then it will most likely
+ // fill the whole buffer.
+ outputParameterIndex = this.getOutputParameterIndex(true)
+ )
+ }
}
/**
diff --git a/cpp/ql/lib/semmlecode.cpp.dbscheme b/cpp/ql/lib/semmlecode.cpp.dbscheme
index 5340d6d5f428..c16b29b27f71 100644
--- a/cpp/ql/lib/semmlecode.cpp.dbscheme
+++ b/cpp/ql/lib/semmlecode.cpp.dbscheme
@@ -222,6 +222,19 @@ extractor_version(
string frontend_version: string ref
)
+pch_uses(
+ int pch: @pch ref,
+ int compilation: @compilation ref,
+ int id: @file ref
+)
+
+#keyset[pch, compilation]
+pch_creations(
+ int pch: @pch,
+ int compilation: @compilation ref,
+ int from: @file ref
+)
+
/** An element for which line-count information is available. */
@sourceline = @file | @function | @variable | @enumconstant | @xmllocatable;
diff --git a/cpp/ql/lib/semmlecode.cpp.dbscheme.stats b/cpp/ql/lib/semmlecode.cpp.dbscheme.stats
index ef86a76e7edd..0943aadd6943 100644
--- a/cpp/ql/lib/semmlecode.cpp.dbscheme.stats
+++ b/cpp/ql/lib/semmlecode.cpp.dbscheme.stats
@@ -10,11 +10,11 @@
@file
- 65211
+ 65207
@folder
- 12389
+ 12388
@diagnostic
@@ -22,11 +22,15 @@
@location_default
- 46965929
+ 46945184
+
+
+ @pch
+ 249
@macro_expansion
- 40257319
+ 40256666
@other_macro_reference
@@ -34,7 +38,7 @@
@normal_function
- 2740505
+ 2738028
@unknown_function
@@ -42,19 +46,19 @@
@constructor
- 698724
+ 698700
@destructor
- 86280
+ 86202
@conversion_function
- 10363
+ 10354
@operator
- 653036
+ 652446
@user_defined_literal
@@ -62,31 +66,31 @@
@deduction_guide
- 5868
+ 5863
@fun_decl
- 4206778
+ 4202975
@var_decl
- 9391612
+ 9383123
@type_decl
- 1634963
+ 1633485
@namespace_decl
- 407321
+ 407776
@using_declaration
- 267931
+ 267925
@using_directive
- 6473
+ 6472
@using_enum_declaration
@@ -94,27 +98,27 @@
@static_assert
- 173266
+ 173263
@parameter
- 7026197
+ 7019846
@membervariable
- 1496815
+ 1497677
@globalvariable
- 488591
+ 488149
@localvariable
- 726232
+ 726313
@enumconstant
- 345733
+ 347817
@errortype
@@ -362,23 +366,23 @@
@pointer
- 452880
+ 452470
@type_with_specifiers
- 693866
+ 693239
@array
- 90401
+ 90319
@routineptr
- 684109
+ 684085
@reference
- 968192
+ 967316
@gnu_vector
@@ -390,7 +394,7 @@
@rvalue_reference
- 291306
+ 291043
@block
@@ -400,17 +404,13 @@
@scalable_vector
1
-
- @decltype
- 102349
-
@typeof
816
@underlying_type
- 624
+ 623
@bases
@@ -484,25 +484,29 @@
@remove_reference
5723
+
+ @decltype
+ 102349
+
@struct
- 979865
+ 979805
@union
- 20977
+ 20958
@enum
- 41337
+ 41550
@template_parameter
- 867072
+ 867019
@alias
- 1762239
+ 1762205
@unknown_usertype
@@ -510,7 +514,7 @@
@class
- 325269
+ 324975
@template_template_parameter
@@ -518,31 +522,31 @@
@proxy_class
- 48438
+ 48435
@scoped_enum
- 11612
+ 11601
@template_struct
- 212078
+ 212065
@template_class
- 29342
+ 29316
@template_union
- 1373
+ 1372
@mangledname
- 6370039
+ 6364281
@type_mention
- 5902897
+ 5903906
@concept_template
@@ -550,7 +554,7 @@
@routinetype
- 604319
+ 604298
@ptrtomember
@@ -558,7 +562,7 @@
@specifier
- 7741
+ 7734
@gnuattribute
@@ -566,11 +570,11 @@
@stdattribute
- 353114
+ 352794
@declspec
- 330047
+ 330282
@msattribute
@@ -578,7 +582,7 @@
@alignas
- 2166
+ 2165
@attribute_arg_token
@@ -586,7 +590,7 @@
@attribute_arg_constant_expr
- 71875
+ 71712
@attribute_arg_expr
@@ -606,19 +610,19 @@
@derivation
- 476900
+ 476883
@frienddecl
- 700462
+ 700403
@comment
- 11241965
+ 11233426
@namespace
- 8650
+ 8649
@specialnamequalifyingelement
@@ -626,15 +630,15 @@
@namequalifier
- 3041863
+ 3041831
@value
- 13474606
+ 13474629
@initialiser
- 2251035
+ 2251326
@address_of
@@ -642,35 +646,35 @@
@indirect
- 404153
+ 404154
@array_to_pointer
- 1953751
+ 1953754
@parexpr
- 4915208
+ 4915216
@arithnegexpr
- 586534
+ 586535
@unaryplusexpr
- 4073
+ 4069
@complementexpr
- 38199
+ 38200
@notexpr
- 355764
+ 355765
@postincrexpr
- 84581
+ 84571
@postdecrexpr
@@ -686,27 +690,27 @@
@conditionalexpr
- 897880
+ 897881
@addexpr
- 571553
+ 571554
@subexpr
- 466799
+ 466800
@mulexpr
- 435793
+ 435794
@divexpr
- 52393
+ 52387
@remexpr
- 16012
+ 16011
@paddexpr
@@ -714,39 +718,39 @@
@psubexpr
- 68024
+ 68016
@pdiffexpr
- 43951
+ 43912
@lshiftexpr
- 551696
+ 551697
@rshiftexpr
- 200554
+ 200555
@andexpr
- 481218
+ 481219
@orexpr
- 194055
+ 194056
@xorexpr
- 73961
+ 73952
@eqexpr
- 643372
+ 643373
@neexpr
- 411870
+ 411871
@gtexpr
@@ -758,7 +762,7 @@
@geexpr
- 81368
+ 81358
@leexpr
@@ -766,7 +770,7 @@
@assignexpr
- 1281144
+ 1281147
@assignaddexpr
@@ -778,7 +782,7 @@
@assignmulexpr
- 11185
+ 11184
@assigndivexpr
@@ -786,7 +790,7 @@
@assignremexpr
- 874
+ 873
@assignlshiftexpr
@@ -822,11 +826,11 @@
@orlogicalexpr
- 1103523
+ 1103525
@commaexpr
- 168440
+ 168288
@subscriptexpr
@@ -834,7 +838,7 @@
@callexpr
- 239778
+ 239770
@vastartexpr
@@ -846,7 +850,7 @@
@vaendexpr
- 2941
+ 2940
@vacopyexpr
@@ -854,15 +858,15 @@
@varaccess
- 8254632
+ 8254646
@runtime_sizeof
- 402047
+ 402048
@runtime_alignof
- 49877
+ 49875
@expr_stmt
@@ -870,11 +874,11 @@
@routineexpr
- 5732226
+ 5732184
@type_operand
- 1405363
+ 1405365
@offsetofexpr
@@ -882,11 +886,11 @@
@typescompexpr
- 701934
+ 701935
@literal
- 7967630
+ 7967037
@aggregateliteral
@@ -898,19 +902,19 @@
@temp_init
- 992324
+ 992080
@errorexpr
- 45686
+ 45685
@reference_to
- 1902638
+ 1903026
@ref_indirect
- 2107314
+ 2107241
@vacuous_destructor_call
@@ -970,23 +974,23 @@
@thisaccess
- 1558310
+ 1558281
@new_expr
- 46197
+ 46196
@delete_expr
- 11481
+ 11480
@throw_expr
- 24105
+ 24156
@condition_decl
- 408905
+ 408903
@braced_init_list
@@ -994,7 +998,7 @@
@type_id
- 47901
+ 47899
@sizeof_pack
@@ -1058,11 +1062,11 @@
@isemptyexpr
- 8865
+ 8857
@isenumexpr
- 2996
+ 2994
@ispodexpr
@@ -1086,7 +1090,7 @@
@uuidof
- 26588
+ 26677
@delete_array_expr
@@ -1102,7 +1106,7 @@
@ctordirectinit
- 112837
+ 112833
@ctorvirtualinit
@@ -1110,35 +1114,35 @@
@ctorfieldinit
- 206399
+ 206212
@ctordelegatinginit
- 3621
+ 3617
@dtordirectdestruct
- 39452
+ 39450
@dtorvirtualdestruct
- 3986
+ 3985
@dtorfielddestruct
- 39826
+ 39825
@static_cast
- 348369
+ 348054
@reinterpret_cast
- 40089
+ 40088
@const_cast
- 24461
+ 24460
@dynamic_cast
@@ -1150,7 +1154,7 @@
@param_ref
- 164014
+ 163949
@noopexpr
@@ -1158,7 +1162,7 @@
@istriviallyconstructibleexpr
- 3745
+ 3742
@isdestructibleexpr
@@ -1174,15 +1178,15 @@
@istriviallyassignableexpr
- 3745
+ 3742
@isnothrowassignableexpr
- 5119
+ 5114
@istrivialexpr
- 3368
+ 3367
@isstandardlayoutexpr
@@ -1190,7 +1194,7 @@
@istriviallycopyableexpr
- 1373
+ 1372
@isliteraltypeexpr
@@ -1210,11 +1214,11 @@
@isconstructibleexpr
- 3621
+ 3617
@isnothrowconstructibleexpr
- 20727
+ 20708
@hasfinalizerexpr
@@ -1250,11 +1254,11 @@
@isfinalexpr
- 9403
+ 9402
@noexceptexpr
- 28356
+ 28344
@builtinshufflevector
@@ -1266,7 +1270,7 @@
@builtinaddressof
- 15483
+ 15469
@vec_fill
@@ -1426,7 +1430,7 @@
@reuseexpr
- 847007
+ 847004
@istriviallycopyassignable
@@ -1542,35 +1546,35 @@
@lambdacapture
- 31966
+ 31965
@stmt_expr
- 2031614
+ 2031618
@stmt_if
- 990214
+ 990216
@stmt_while
- 39647
+ 39648
@stmt_goto
- 157904
+ 157895
@stmt_label
- 78022
+ 78018
@stmt_return
- 1241797
+ 1241679
@stmt_block
- 1729360
+ 1728670
@stmt_end_test_while
@@ -1582,11 +1586,11 @@
@stmt_switch_case
- 836120
+ 836117
@stmt_switch
- 411852
+ 411851
@stmt_asm
@@ -1594,11 +1598,11 @@
@stmt_decl
- 772441
+ 772426
@stmt_empty
- 429388
+ 429386
@stmt_continue
@@ -1606,11 +1610,11 @@
@stmt_break
- 137937
+ 137934
@stmt_try_block
- 26698
+ 26748
@stmt_microsoft_try
@@ -1630,15 +1634,15 @@
@stmt_range_based_for
- 6387
+ 6384
@stmt_handler
- 43746
+ 43790
@stmt_constexpr_if
- 106134
+ 106038
@stmt_co_return
@@ -1658,43 +1662,43 @@
@ppd_if
- 591478
+ 590944
@ppd_ifdef
- 214363
+ 214364
@ppd_ifndef
- 158651
+ 158633
@ppd_elif
- 21916
+ 21915
@ppd_else
- 235118
+ 234905
@ppd_endif
- 889777
+ 888973
@ppd_plain_include
- 318555
+ 318536
@ppd_define
- 2752617
+ 2750129
@ppd_undef
- 100515
+ 100424
@ppd_pragma
- 406555
+ 406188
@ppd_include_next
@@ -1702,7 +1706,7 @@
@ppd_line
- 18827
+ 18812
@ppd_error
@@ -1808,7 +1812,7 @@
compilation_args
- 1012186
+ 1012124
id
@@ -1820,7 +1824,7 @@
arg
- 29267
+ 29266
@@ -2148,12 +2152,12 @@
1
2
- 13403
+ 13402
2
3
- 12685
+ 12684
3
@@ -2179,12 +2183,12 @@
1
2
- 19381
+ 19380
2
3
- 8724
+ 8723
3
@@ -2247,19 +2251,19 @@
compilation_compiling_files
- 15739
+ 15738
id
- 2723
+ 2722
num
- 4520
+ 4519
file
- 13670
+ 13668
@@ -2447,7 +2451,7 @@
1
2
- 12308
+ 12307
2
@@ -2473,7 +2477,7 @@
1
2
- 12526
+ 12525
2
@@ -2493,15 +2497,15 @@
compilation_time
- 62959
+ 62952
id
- 2723
+ 2722
num
- 4520
+ 4519
kind
@@ -2509,7 +2513,7 @@
seconds
- 13343
+ 12634
@@ -2574,7 +2578,7 @@
4
5
- 2723
+ 2722
@@ -2587,54 +2591,49 @@
12
-
- 2
- 3
- 54
-
3
4
- 653
+ 980
4
5
- 653
+ 381
- 6
- 7
- 163
+ 5
+ 8
+ 217
8
- 9
+ 10
163
10
11
- 217
+ 108
11
- 14
+ 12
217
- 16
- 18
- 163
+ 14
+ 17
+ 217
- 18
+ 17
22
217
25
- 103
+ 93
217
@@ -2687,7 +2686,7 @@
4
5
- 4520
+ 4519
@@ -2713,17 +2712,17 @@
5
6
- 326
+ 272
6
7
- 381
+ 490
7
8
- 326
+ 217
8
@@ -2732,14 +2731,19 @@
9
- 22
+ 17
381
- 25
- 91
+ 23
+ 48
381
+
+ 83
+ 84
+ 54
+
@@ -2794,13 +2798,13 @@
54
- 148
- 149
+ 129
+ 130
54
- 154
- 155
+ 150
+ 151
54
@@ -2817,27 +2821,27 @@
1
2
- 6644
+ 6643
2
3
- 3267
+ 2069
3
4
- 1797
+ 2014
4
- 6
+ 5
1198
- 6
- 48
- 435
+ 5
+ 46
+ 707
@@ -2853,32 +2857,32 @@
1
2
- 5882
+ 6480
2
3
- 2941
+ 1797
3
4
- 1960
+ 1361
4
5
- 925
+ 1198
5
7
- 1198
+ 1143
7
- 73
- 435
+ 77
+ 653
@@ -2894,12 +2898,12 @@
1
2
- 9857
+ 9693
2
3
- 3485
+ 2940
@@ -3163,11 +3167,11 @@
cpu_seconds
- 9579
+ 9537
elapsed_seconds
- 232
+ 221
@@ -3213,17 +3217,17 @@
1
2
- 8080
+ 8026
2
3
- 1077
+ 1056
3
- 25
- 422
+ 28
+ 454
@@ -3239,12 +3243,12 @@
1
2
- 9051
+ 8945
2
3
- 528
+ 591
@@ -3260,47 +3264,82 @@
1
2
- 73
+ 42
2
- 5
+ 3
21
+
+ 3
+ 4
+ 10
+
+
+ 4
+ 5
+ 10
+
+
+ 5
+ 6
+ 10
+
6
- 8
- 21
+ 7
+ 10
- 11
- 12
+ 8
+ 9
10
- 13
- 14
- 21
+ 9
+ 10
+ 10
14
- 17
- 21
+ 15
+ 10
- 27
- 54
+ 15
+ 16
21
- 164
- 251
- 21
+ 34
+ 35
+ 10
- 289
- 322
- 21
+ 61
+ 62
+ 10
+
+
+ 172
+ 173
+ 10
+
+
+ 230
+ 231
+ 10
+
+
+ 300
+ 301
+ 10
+
+
+ 313
+ 314
+ 10
@@ -3316,47 +3355,82 @@
1
2
- 73
+ 42
2
- 5
+ 3
21
+
+ 3
+ 4
+ 10
+
+
+ 4
+ 5
+ 10
+
+
+ 5
+ 6
+ 10
+
6
- 8
- 21
+ 7
+ 10
- 11
- 12
+ 8
+ 9
10
- 13
- 14
- 21
+ 9
+ 10
+ 10
14
- 17
+ 15
21
- 26
- 53
- 21
+ 15
+ 16
+ 10
- 154
- 161
- 21
+ 33
+ 34
+ 10
- 227
- 246
- 21
+ 58
+ 59
+ 10
+
+
+ 156
+ 157
+ 10
+
+
+ 161
+ 162
+ 10
+
+
+ 218
+ 219
+ 10
+
+
+ 247
+ 248
+ 10
@@ -3593,31 +3667,31 @@
locations_default
- 46965929
+ 46945184
id
- 46965929
+ 46945184
file
- 40955
+ 40918
beginLine
- 7507421
+ 7500635
beginColumn
- 21975
+ 21956
endLine
- 7508545
+ 7501758
endColumn
- 53441
+ 53393
@@ -3631,7 +3705,7 @@
1
2
- 46965929
+ 46945184
@@ -3647,7 +3721,7 @@
1
2
- 46965929
+ 46945184
@@ -3663,7 +3737,7 @@
1
2
- 46965929
+ 46945184
@@ -3679,7 +3753,7 @@
1
2
- 46965929
+ 46945184
@@ -3695,7 +3769,7 @@
1
2
- 46965929
+ 46945184
@@ -3711,67 +3785,67 @@
1
15
- 3121
+ 3118
15
41
- 3121
+ 3118
42
72
- 3121
+ 3118
72
114
- 3371
+ 3368
114
142
- 3121
+ 3118
143
211
- 3121
+ 3118
213
307
- 3121
+ 3118
310
430
- 3121
+ 3118
437
596
- 3121
+ 3118
607
827
- 3121
+ 3118
839
1298
- 3121
+ 3118
1300
- 2722
- 3121
+ 2855
+ 3118
3114
30788
- 3121
+ 3118
57880
@@ -3792,67 +3866,67 @@
1
13
- 3371
+ 3368
13
31
- 3371
+ 3368
31
47
- 3121
+ 3118
47
64
- 3121
+ 3118
64
84
- 3121
+ 3118
85
115
- 3121
+ 3118
116
160
- 3246
+ 3243
160
206
- 3121
+ 3118
206
291
- 3121
+ 3118
298
388
- 3121
+ 3118
395
527
- 3121
+ 3118
561
1339
- 3121
+ 3118
1375
57764
- 2871
+ 2869
@@ -3868,67 +3942,67 @@
1
5
- 3745
+ 3742
5
9
- 3121
+ 3118
9
15
- 3246
+ 3243
15
20
- 3246
+ 3243
20
28
- 3246
+ 3243
28
36
- 3246
+ 3243
36
42
- 3121
+ 3118
42
53
- 3371
+ 3368
53
62
- 3246
+ 3243
62
81
- 3121
+ 3118
81
95
- 3121
+ 3118
95
111
- 3121
+ 3118
112
156
- 1997
+ 1996
@@ -3944,67 +4018,67 @@
1
13
- 3371
+ 3368
13
31
- 3371
+ 3368
31
46
- 3121
+ 3118
46
63
- 3121
+ 3118
63
84
- 3121
+ 3118
84
114
- 3121
+ 3118
118
160
- 3246
+ 3243
160
206
- 3121
+ 3118
207
291
- 3121
+ 3118
300
390
- 3121
+ 3118
395
562
- 3121
+ 3118
564
1350
- 3121
+ 3118
1420
57764
- 2871
+ 2869
@@ -4020,67 +4094,67 @@
1
12
- 3371
+ 3368
13
26
- 3496
+ 3493
26
34
- 3246
+ 3243
34
42
- 3246
+ 3243
42
50
- 3246
+ 3243
50
61
- 3121
+ 3118
61
67
- 3246
+ 3243
67
76
- 3496
+ 3493
76
88
- 3246
+ 3243
89
102
- 3121
+ 3118
102
116
- 3496
+ 3493
116
133
- 3121
+ 3118
136
363
- 1498
+ 1497
@@ -4096,32 +4170,32 @@
1
2
- 4961952
+ 4957467
2
3
- 779772
+ 779068
3
4
- 544405
+ 543913
4
12
- 570876
+ 570360
12
97
- 563134
+ 563374
97
637
- 87279
+ 86452
@@ -4137,27 +4211,27 @@
1
2
- 5024010
+ 5019469
2
3
- 1222414
+ 1221309
3
6
- 640550
+ 639971
6
57
- 563509
+ 563249
57
329
- 56937
+ 56636
@@ -4173,27 +4247,27 @@
1
2
- 5646455
+ 5641351
2
3
- 483596
+ 483159
3
7
- 582613
+ 582086
7
25
- 566256
+ 565245
25
94
- 228500
+ 228792
@@ -4209,12 +4283,12 @@
1
2
- 7041180
+ 7034567
2
85
- 466240
+ 466068
@@ -4230,32 +4304,32 @@
1
2
- 5031002
+ 5026455
2
3
- 740066
+ 739397
3
4
- 540284
+ 539796
4
12
- 587483
+ 586952
12
72
- 565257
+ 564122
72
250
- 43327
+ 43912
@@ -4271,67 +4345,67 @@
1
2
- 1748
+ 1746
2
6
- 1997
+ 1996
6
12
- 1872
+ 1871
12
40
- 1748
+ 1746
49
128
- 1748
+ 1746
129
253
- 1748
+ 1746
316
707
- 1748
+ 1746
791
1267
- 1748
+ 1746
1281
1943
- 1748
+ 1746
2017
2398
- 1748
+ 1746
- 2491
- 3203
- 1748
+ 2493
+ 3212
+ 1746
- 3252
+ 3260
7915
- 1748
+ 1746
- 10983
+ 11053
121029
- 624
+ 623
@@ -4347,62 +4421,62 @@
1
2
- 1997
+ 1996
2
4
- 1748
+ 1746
4
7
- 1748
+ 1746
7
18
- 1872
+ 1871
19
43
- 1748
+ 1746
44
60
- 1748
+ 1746
66
93
- 1748
+ 1746
96
117
- 1748
+ 1746
117
150
- 1748
+ 1746
150
169
- 1748
+ 1746
169
181
- 1748
+ 1746
182
217
- 1872
+ 1871
243
@@ -4423,67 +4497,67 @@
1
2
- 1872
+ 1871
2
5
- 1872
+ 1871
5
11
- 1748
+ 1746
11
36
- 1748
+ 1746
36
101
- 1748
+ 1746
108
217
- 1748
+ 1746
- 226
+ 225
543
- 1748
+ 1746
633
- 1057
- 1748
+ 1059
+ 1746
- 1072
- 1409
- 1748
+ 1071
+ 1410
+ 1746
- 1416
- 1614
- 1748
+ 1414
+ 1610
+ 1746
- 1615
- 1810
- 1748
+ 1613
+ 1807
+ 1746
- 1826
- 3777
- 1748
+ 1834
+ 3791
+ 1746
- 3834
+ 3837
59554
- 749
+ 748
@@ -4499,67 +4573,67 @@
1
2
- 1872
+ 1871
2
5
- 1872
+ 1871
5
11
- 1748
+ 1746
11
36
- 1748
+ 1746
36
102
- 1748
+ 1746
109
218
- 1748
+ 1746
- 225
+ 224
545
- 1748
+ 1746
631
- 1055
- 1748
+ 1057
+ 1746
- 1074
+ 1073
1407
- 1748
+ 1746
- 1425
- 1611
- 1748
+ 1423
+ 1609
+ 1746
- 1614
- 1807
- 1748
+ 1612
+ 1805
+ 1746
- 1827
- 3760
- 1748
+ 1835
+ 3774
+ 1746
- 3827
+ 3830
59562
- 749
+ 748
@@ -4575,67 +4649,67 @@
1
2
- 2122
+ 2120
2
5
- 1498
+ 1497
5
8
- 1623
+ 1621
8
13
- 1748
+ 1746
13
23
- 1997
+ 1996
23
33
- 1872
+ 1871
34
44
- 1748
+ 1746
45
57
- 1748
+ 1746
58
- 74
- 1997
+ 73
+ 1497
- 77
- 86
- 1872
+ 73
+ 83
+ 1746
- 86
- 98
- 1748
+ 83
+ 92
+ 1746
- 98
- 160
- 1748
+ 92
+ 144
+ 1746
- 258
+ 147
299
- 249
+ 873
@@ -4651,32 +4725,32 @@
1
2
- 4959830
+ 4955347
2
3
- 782270
+ 781563
3
4
- 545279
+ 544786
4
12
- 568378
+ 567865
12
- 96
- 564757
+ 95
+ 563498
- 96
+ 95
620
- 88028
+ 88697
@@ -4692,27 +4766,27 @@
1
2
- 5021138
+ 5016599
2
3
- 1224911
+ 1223804
3
6
- 633932
+ 633359
6
52
- 564633
+ 564122
52
329
- 63930
+ 63872
@@ -4728,12 +4802,12 @@
1
2
- 7057912
+ 7051657
2
- 18
- 450632
+ 15
+ 450100
@@ -4749,27 +4823,27 @@
1
2
- 5645580
+ 5640478
2
3
- 480974
+ 480539
3
7
- 587607
+ 587076
7
25
- 569752
+ 568863
25
89
- 224629
+ 224800
@@ -4785,32 +4859,32 @@
1
2
- 5029629
+ 5025082
2
3
- 744436
+ 743763
3
4
- 540034
+ 539546
4
12
- 588107
+ 587575
12
72
- 563509
+ 562750
72
250
- 42828
+ 43038
@@ -4826,52 +4900,52 @@
1
2
- 15732
+ 15718
2
3
- 5618
+ 5613
3
7
- 4245
+ 4241
7
17
- 4120
+ 4116
17
33
- 4120
+ 4116
33
106
- 4120
+ 4116
114
689
- 4120
+ 4116
721
- 2458
- 4120
+ 2460
+ 4116
- 2593
- 4731
- 4120
+ 2595
+ 4737
+ 4116
4759
33780
- 3121
+ 3118
@@ -4887,52 +4961,52 @@
1
2
- 18604
+ 18587
2
3
- 5618
+ 5613
3
5
- 3621
+ 3617
5
7
- 3745
+ 3742
7
16
- 4370
+ 4366
16
80
- 4120
+ 4116
81
152
- 4245
+ 4241
158
212
- 4245
+ 4241
212
265
- 4120
+ 4116
265
329
- 749
+ 748
@@ -4948,52 +5022,52 @@
1
2
- 15982
+ 15968
2
3
- 5993
+ 5988
3
8
- 4245
+ 4241
8
18
- 4370
+ 4366
18
42
- 4120
+ 4116
43
218
- 4120
+ 4116
- 235
- 759
- 4120
+ 234
+ 758
+ 4116
- 768
- 2177
- 4120
+ 767
+ 2176
+ 4116
- 2209
- 2884
- 4120
+ 2206
+ 2882
+ 4116
- 2885
+ 2890
30763
- 2247
+ 2245
@@ -5009,52 +5083,52 @@
1
2
- 17231
+ 17215
2
3
- 6243
+ 6237
3
4
- 3246
+ 3243
4
7
- 4245
+ 4241
7
14
- 4245
+ 4241
14
28
- 4120
+ 4491
28
- 45
- 4245
+ 46
+ 4116
- 45
- 69
- 4120
+ 46
+ 70
+ 4116
- 69
- 81
- 4245
+ 70
+ 82
+ 4241
- 81
+ 82
117
- 1498
+ 1247
@@ -5070,52 +5144,52 @@
1
2
- 15982
+ 15968
2
3
- 5993
+ 5988
3
8
- 4245
+ 4241
8
18
- 4370
+ 4366
18
41
- 4120
+ 4116
43
217
- 4120
+ 4116
- 233
- 756
- 4120
+ 232
+ 755
+ 4116
768
- 2177
- 4120
+ 2176
+ 4116
- 2208
- 2858
- 4120
+ 2206
+ 2862
+ 4116
- 2868
+ 2867
30757
- 2247
+ 2245
@@ -5125,15 +5199,15 @@
files
- 65211
+ 65207
id
- 65211
+ 65207
name
- 65211
+ 65207
@@ -5147,7 +5221,7 @@
1
2
- 65211
+ 65207
@@ -5163,7 +5237,7 @@
1
2
- 65211
+ 65207
@@ -5173,15 +5247,15 @@
folders
- 12389
+ 12388
id
- 12389
+ 12388
name
- 12389
+ 12388
@@ -5195,7 +5269,7 @@
1
2
- 12389
+ 12388
@@ -5211,7 +5285,7 @@
1
2
- 12389
+ 12388
@@ -5221,15 +5295,15 @@
containerparent
- 77579
+ 77574
parent
- 12389
+ 12388
child
- 77579
+ 77574
@@ -5243,7 +5317,7 @@
1
2
- 6031
+ 6030
2
@@ -5294,7 +5368,7 @@
1
2
- 77579
+ 77574
@@ -5304,23 +5378,23 @@
numlines
- 808616
+ 807885
element_id
- 807492
+ 806762
num_lines
- 39456
+ 39421
num_code
- 34087
+ 34056
num_comment
- 18230
+ 18338
@@ -5334,12 +5408,12 @@
1
2
- 806368
+ 805640
2
3
- 1123
+ 1122
@@ -5355,12 +5429,12 @@
1
2
- 806368
+ 805640
2
3
- 1123
+ 1122
@@ -5376,7 +5450,7 @@
1
2
- 807242
+ 806513
2
@@ -5397,27 +5471,27 @@
1
2
- 26720
+ 26696
2
3
- 3745
+ 3742
3
5
- 3371
+ 3368
5
35
- 2996
+ 2994
39
1983
- 2622
+ 2619
@@ -5433,27 +5507,27 @@
1
2
- 27220
+ 27195
2
3
- 4120
+ 4116
3
4
- 2497
+ 2495
4
7
- 3496
+ 3493
7
12
- 2122
+ 2120
@@ -5469,27 +5543,27 @@
1
2
- 26845
+ 26821
2
3
- 4120
+ 4116
3
4
- 2372
+ 2370
4
6
- 3246
+ 3243
6
10
- 2871
+ 2869
@@ -5505,32 +5579,32 @@
1
2
- 21851
+ 21831
2
3
- 3621
+ 3617
3
4
- 2372
+ 2370
4
13
- 2871
+ 2869
14
198
- 2622
+ 2619
204
2092
- 749
+ 748
@@ -5546,32 +5620,32 @@
1
2
- 22225
+ 22205
2
3
- 3621
+ 3617
3
4
- 2122
+ 2120
4
6
- 1872
+ 1871
6
9
- 2746
+ 2744
9
13
- 1498
+ 1497
@@ -5587,27 +5661,27 @@
1
2
- 21975
+ 21956
2
3
- 4245
+ 4241
3
5
- 2871
+ 2869
5
8
- 3121
+ 3118
8
12
- 1872
+ 1871
@@ -5623,32 +5697,32 @@
1
2
- 11112
+ 11352
2
3
- 2122
+ 1996
3
4
- 1123
+ 1122
4
7
- 1498
+ 1497
8
- 21
- 1373
+ 22
+ 1497
- 21
+ 42
3651
- 998
+ 873
@@ -5664,32 +5738,32 @@
1
2
- 11112
+ 11352
2
3
- 2122
+ 1996
3
4
- 1123
+ 1122
4
7
- 1623
+ 1621
8
- 21
- 1373
+ 27
+ 1497
- 26
+ 30
48
- 874
+ 748
@@ -5705,32 +5779,32 @@
1
2
- 11112
+ 11352
2
3
- 2122
+ 1996
3
4
- 1373
+ 1372
4
- 7
- 1373
+ 8
+ 1497
- 7
- 21
- 1373
+ 8
+ 31
+ 1497
- 23
+ 35
42
- 874
+ 623
@@ -6343,9 +6417,391 @@
+
+ pch_uses
+ 4134
+
+
+ pch
+ 162
+
+
+ compilation
+ 4134
+
+
+ id
+ 4134
+
+
+
+
+ pch
+ compilation
+
+
+ 12
+
+
+ 1
+ 2
+ 24
+
+
+ 4
+ 5
+ 8
+
+
+ 8
+ 9
+ 8
+
+
+ 10
+ 11
+ 16
+
+
+ 11
+ 12
+ 8
+
+
+ 13
+ 14
+ 8
+
+
+ 14
+ 15
+ 8
+
+
+ 19
+ 20
+ 16
+
+
+ 24
+ 25
+ 8
+
+
+ 25
+ 26
+ 8
+
+
+ 26
+ 27
+ 8
+
+
+ 36
+ 37
+ 8
+
+
+ 42
+ 43
+ 8
+
+
+ 51
+ 52
+ 8
+
+
+ 87
+ 88
+ 8
+
+
+ 107
+ 108
+ 8
+
+
+
+
+
+
+ pch
+ id
+
+
+ 12
+
+
+ 1
+ 2
+ 24
+
+
+ 4
+ 5
+ 8
+
+
+ 8
+ 9
+ 8
+
+
+ 10
+ 11
+ 16
+
+
+ 11
+ 12
+ 8
+
+
+ 13
+ 14
+ 8
+
+
+ 14
+ 15
+ 8
+
+
+ 19
+ 20
+ 16
+
+
+ 24
+ 25
+ 8
+
+
+ 25
+ 26
+ 8
+
+
+ 26
+ 27
+ 8
+
+
+ 36
+ 37
+ 8
+
+
+ 42
+ 43
+ 8
+
+
+ 51
+ 52
+ 8
+
+
+ 87
+ 88
+ 8
+
+
+ 107
+ 108
+ 8
+
+
+
+
+
+
+ compilation
+ pch
+
+
+ 12
+
+
+ 1
+ 2
+ 4134
+
+
+
+
+
+
+ compilation
+ id
+
+
+ 12
+
+
+ 1
+ 2
+ 4134
+
+
+
+
+
+
+ id
+ pch
+
+
+ 12
+
+
+ 1
+ 2
+ 4134
+
+
+
+
+
+
+ id
+ compilation
+
+
+ 12
+
+
+ 1
+ 2
+ 4134
+
+
+
+
+
+
+
+
+ pch_creations
+ 249
+
+
+ pch
+ 249
+
+
+ compilation
+ 249
+
+
+ from
+ 249
+
+
+
+
+ pch
+ compilation
+
+
+ 12
+
+
+ 1
+ 2
+ 249
+
+
+
+
+
+
+ pch
+ from
+
+
+ 12
+
+
+ 1
+ 2
+ 249
+
+
+
+
+
+
+ compilation
+ pch
+
+
+ 12
+
+
+ 1
+ 2
+ 249
+
+
+
+
+
+
+ compilation
+ from
+
+
+ 12
+
+
+ 1
+ 2
+ 249
+
+
+
+
+
+
+ from
+ pch
+
+
+ 12
+
+
+ 1
+ 2
+ 249
+
+
+
+
+
+
+ from
+ compilation
+
+
+ 12
+
+
+ 1
+ 2
+ 249
+
+
+
+
+
+
+
fileannotations
- 4200439
+ 4200182
id
@@ -6357,11 +6813,11 @@
name
- 58715
+ 58711
value
- 39513
+ 39510
@@ -6380,7 +6836,7 @@
2
3
- 5566
+ 5565
@@ -6611,17 +7067,17 @@
2
3
- 4362
+ 4361
3
5
- 5059
+ 5058
5
7
- 4098
+ 4097
7
@@ -6636,7 +7092,7 @@
16
19
- 4890
+ 4889
19
@@ -6656,12 +7112,12 @@
128
459
- 4626
+ 4625
459
546
- 1711
+ 1710
@@ -6677,7 +7133,7 @@
1
2
- 58715
+ 58711
@@ -6698,12 +7154,12 @@
2
3
- 7689
+ 7688
3
4
- 4098
+ 4097
4
@@ -6713,7 +7169,7 @@
6
8
- 3422
+ 3421
8
@@ -6723,17 +7179,17 @@
11
17
- 5397
+ 5396
17
23
- 4700
+ 4699
23
41
- 4679
+ 4678
41
@@ -6809,7 +7265,7 @@
81
151
- 3084
+ 3083
151
@@ -6824,7 +7280,7 @@
473
547
- 2313
+ 2312
@@ -6840,7 +7296,7 @@
1
2
- 39502
+ 39500
2
@@ -6861,7 +7317,7 @@
1
2
- 3401
+ 3400
2
@@ -6876,7 +7332,7 @@
5
8
- 2482
+ 2481
8
@@ -6906,7 +7362,7 @@
41
66
- 2989
+ 2988
66
@@ -6916,7 +7372,7 @@
92
113
- 2989
+ 2988
113
@@ -6936,15 +7392,15 @@
inmacroexpansion
- 149995963
+ 149996213
id
- 24670878
+ 24670919
inv
- 3705272
+ 3705278
@@ -6958,37 +7414,37 @@
1
3
- 2209399
+ 2209403
3
5
- 1474977
+ 1474980
5
6
- 1620369
+ 1620372
6
7
- 6582545
+ 6582556
7
8
- 8719001
+ 8719015
8
9
- 3557049
+ 3557055
9
22
- 507534
+ 507535
@@ -7004,17 +7460,17 @@
1
2
- 531661
+ 531662
2
3
- 743208
+ 743209
3
4
- 481512
+ 481513
4
@@ -7039,17 +7495,17 @@
10
11
- 444650
+ 444651
11
337
- 307798
+ 307799
339
423
- 281755
+ 281756
423
@@ -7064,15 +7520,15 @@
affectedbymacroexpansion
- 48735840
+ 48735923
id
- 7044740
+ 7044754
inv
- 3803121
+ 3803128
@@ -7086,32 +7542,32 @@
1
2
- 3846709
+ 3846717
2
3
- 766305
+ 766306
3
4
- 361841
+ 361842
4
5
- 772736
+ 772737
5
12
- 535160
+ 535161
12
50
- 556267
+ 556268
50
@@ -7132,12 +7588,12 @@
1
4
- 313248
+ 313249
4
7
- 316607
+ 316608
7
@@ -7147,12 +7603,12 @@
9
12
- 342938
+ 342939
12
13
- 456004
+ 456005
13
@@ -7162,7 +7618,7 @@
14
15
- 408038
+ 408039
15
@@ -7172,17 +7628,17 @@
16
17
- 377677
+ 377678
17
18
- 200636
+ 200637
18
20
- 344255
+ 344256
20
@@ -7202,19 +7658,19 @@
macroinvocations
- 40338469
+ 40337807
id
- 40338469
+ 40337807
macro_id
- 182070
+ 182049
location
- 5912755
+ 5912946
kind
@@ -7232,7 +7688,7 @@
1
2
- 40338469
+ 40337807
@@ -7248,7 +7704,7 @@
1
2
- 40338469
+ 40337807
@@ -7264,7 +7720,7 @@
1
2
- 40338469
+ 40337807
@@ -7280,47 +7736,47 @@
1
2
- 60781
+ 60774
2
3
- 27558
+ 27555
3
4
- 17972
+ 17970
4
5
- 10021
+ 10020
5
7
- 13779
+ 13777
7
13
- 14705
+ 14703
13
33
- 13779
+ 13777
33
180
- 13670
+ 13668
181
- 72144
- 9803
+ 72152
+ 9802
@@ -7336,42 +7792,42 @@
1
2
- 77283
+ 77274
2
3
- 30553
+ 30550
3
4
- 14323
+ 14322
4
5
- 10293
+ 10292
5
8
- 14105
+ 14104
8
18
- 14160
+ 14158
18
88
- 13670
+ 13668
89
- 12189
- 7679
+ 12187
+ 7678
@@ -7387,7 +7843,7 @@
1
2
- 177495
+ 177475
2
@@ -7408,17 +7864,17 @@
1
2
- 5255927
+ 5256194
2
4
- 422362
+ 422314
4
- 72144
- 234464
+ 72152
+ 234437
@@ -7434,12 +7890,12 @@
1
2
- 5890588
+ 5890782
2
37
- 22166
+ 22164
@@ -7455,7 +7911,7 @@
1
2
- 5912755
+ 5912946
@@ -7474,8 +7930,8 @@
54
- 739164
- 739165
+ 739237
+ 739238
54
@@ -7516,8 +7972,8 @@
54
- 107495
- 107496
+ 107511
+ 107512
54
@@ -7528,15 +7984,15 @@
macroparent
- 33655984
+ 33655219
id
- 33655984
+ 33655219
parent_id
- 15926379
+ 15926236
@@ -7550,7 +8006,7 @@
1
2
- 33655984
+ 33655219
@@ -7566,27 +8022,27 @@
1
2
- 7806498
+ 7806472
2
3
- 1595448
+ 1595482
3
4
- 4702906
+ 4702965
4
5
- 1295464
+ 1295315
5
205
- 526061
+ 526000
@@ -7596,15 +8052,15 @@
macrolocationbind
- 6046191
+ 6041019
id
- 4227950
+ 4222263
location
- 2278566
+ 2279211
@@ -7618,27 +8074,27 @@
1
2
- 3302009
+ 3296060
2
3
- 491104
+ 491244
3
4
- 7893
+ 7896
4
5
- 413756
+ 413873
5
17
- 13185
+ 13189
@@ -7654,27 +8110,27 @@
1
2
- 1336578
+ 1336957
2
3
- 481984
+ 482121
3
4
- 7807
+ 7810
4
5
- 428082
+ 428203
5
522
- 24112
+ 24118
@@ -7684,11 +8140,11 @@
macro_argument_unexpanded
- 82497361
+ 82490730
invocation
- 26285935
+ 26282743
argument_index
@@ -7696,7 +8152,7 @@
text
- 343260
+ 343239
@@ -7710,22 +8166,22 @@
1
2
- 9683509
+ 9681332
2
3
- 9770372
+ 9769775
3
4
- 5002131
+ 5001825
4
67
- 1829922
+ 1829810
@@ -7741,22 +8197,22 @@
1
2
- 9866140
+ 9863952
2
3
- 9787916
+ 9787317
3
4
- 4845472
+ 4845176
4
67
- 1786405
+ 1786296
@@ -7781,7 +8237,7 @@
646840
- 2488681
+ 2488531
31
@@ -7824,52 +8280,52 @@
1
2
- 39703
+ 39700
2
3
- 62327
+ 62323
3
4
- 21029
+ 21028
4
5
- 34580
+ 34578
5
6
- 39249
+ 39246
6
9
- 30873
+ 30871
9
15
- 28982
+ 28980
15
26
- 25887
+ 25886
26
57
- 27144
+ 27143
57
517
- 25993
+ 25991
518
@@ -7890,12 +8346,12 @@
1
2
- 243173
+ 243158
2
3
- 89873
+ 89868
3
@@ -7910,11 +8366,11 @@
macro_argument_expanded
- 82497361
+ 82490730
invocation
- 26285935
+ 26282743
argument_index
@@ -7922,7 +8378,7 @@
text
- 207927
+ 207914
@@ -7936,22 +8392,22 @@
1
2
- 9683509
+ 9681332
2
3
- 9770372
+ 9769775
3
4
- 5002131
+ 5001825
4
67
- 1829922
+ 1829810
@@ -7967,22 +8423,22 @@
1
2
- 12642108
+ 12639750
2
3
- 8428244
+ 8427729
3
4
- 4225217
+ 4224959
4
9
- 990364
+ 990304
@@ -8007,7 +8463,7 @@
646840
- 2488681
+ 2488531
31
@@ -8050,22 +8506,22 @@
1
2
- 21832
+ 21830
2
3
- 26859
+ 26858
3
4
- 43495
+ 43492
4
5
- 15906
+ 15905
5
@@ -8075,32 +8531,32 @@
6
7
- 18399
+ 18398
7
10
- 18969
+ 18968
10
19
- 18325
+ 18324
19
51
- 15779
+ 15778
51
252
- 15600
+ 15599
252
- 1169584
- 9495
+ 1169434
+ 9494
@@ -8116,17 +8572,17 @@
1
2
- 105083
+ 105076
2
3
- 88912
+ 88907
3
66
- 13931
+ 13930
@@ -8136,19 +8592,19 @@
functions
- 4053071
+ 4049407
id
- 4053071
+ 4049407
name
- 1694897
+ 1693365
kind
- 874
+ 873
@@ -8162,7 +8618,7 @@
1
2
- 4053071
+ 4049407
@@ -8178,7 +8634,7 @@
1
2
- 4053071
+ 4049407
@@ -8194,17 +8650,17 @@
1
2
- 1448542
+ 1447232
2
4
- 139098
+ 138972
4
3162
- 107257
+ 107160
@@ -8220,12 +8676,12 @@
1
2
- 1692026
+ 1690496
2
3
- 2871
+ 2869
@@ -8327,26 +8783,26 @@
builtin_functions
- 30926
+ 30924
id
- 30926
+ 30924
function_entry_point
- 1141555
+ 1141516
id
- 1137808
+ 1137768
entry_point
- 1141555
+ 1141516
@@ -8360,7 +8816,7 @@
1
2
- 1134605
+ 1134566
2
@@ -8381,7 +8837,7 @@
1
2
- 1141555
+ 1141516
@@ -8391,15 +8847,15 @@
function_return_type
- 4070552
+ 4066872
id
- 4053071
+ 4049407
return_type
- 619822
+ 619262
@@ -8413,12 +8869,12 @@
1
2
- 4035590
+ 4031942
2
3
- 17480
+ 17465
@@ -8434,27 +8890,27 @@
1
2
- 310161
+ 309880
2
3
- 213891
+ 213697
3
5
- 48072
+ 48029
5
365
- 46574
+ 46532
432
9944
- 1123
+ 1122
@@ -8734,22 +9190,22 @@
purefunctions
- 131414
+ 131704
id
- 131414
+ 131704
function_deleted
- 88085
+ 88084
id
- 88085
+ 88084
@@ -8767,26 +9223,26 @@
function_prototyped
- 4051572
+ 4047910
id
- 4051572
+ 4047910
deduction_guide_for_class
- 5868
+ 5863
id
- 5868
+ 5863
class_template
- 2247
+ 2245
@@ -8800,7 +9256,7 @@
1
2
- 5868
+ 5863
@@ -8816,7 +9272,7 @@
1
2
- 1123
+ 1122
2
@@ -8851,15 +9307,15 @@
member_function_this_type
- 674762
+ 674152
id
- 674762
+ 674152
this_type
- 176182
+ 176023
@@ -8873,7 +9329,7 @@
1
2
- 674762
+ 674152
@@ -8889,37 +9345,37 @@
1
2
- 47198
+ 47155
2
3
- 36959
+ 36926
3
4
- 32714
+ 32684
4
5
- 20103
+ 20084
5
6
- 12860
+ 12849
6
10
- 14484
+ 14471
10
65
- 11862
+ 11851
@@ -8929,27 +9385,27 @@
fun_decls
- 4212771
+ 4208963
id
- 4206778
+ 4202975
function
- 4028473
+ 4024831
type_id
- 611831
+ 611278
name
- 1693399
+ 1691868
location
- 2815798
+ 2813252
@@ -8963,7 +9419,7 @@
1
2
- 4206778
+ 4202975
@@ -8979,12 +9435,12 @@
1
2
- 4200784
+ 4196987
2
3
- 5993
+ 5988
@@ -9000,7 +9456,7 @@
1
2
- 4206778
+ 4202975
@@ -9016,7 +9472,7 @@
1
2
- 4206778
+ 4202975
@@ -9032,12 +9488,12 @@
1
2
- 3864776
+ 3861283
2
5
- 163696
+ 163548
@@ -9053,12 +9509,12 @@
1
2
- 4009993
+ 4006368
2
3
- 18479
+ 18463
@@ -9074,7 +9530,7 @@
1
2
- 4028473
+ 4024831
@@ -9090,12 +9546,12 @@
1
2
- 3885254
+ 3881742
2
4
- 143218
+ 143089
@@ -9111,27 +9567,27 @@
1
2
- 295427
+ 295160
2
3
- 220758
+ 220559
3
5
- 48447
+ 48403
5
364
- 45949
+ 45908
364
10292
- 1248
+ 1247
@@ -9147,22 +9603,22 @@
1
2
- 305541
+ 305264
2
3
- 212018
+ 211826
3
5
- 48072
+ 48029
5
1163
- 45949
+ 45908
1483
@@ -9183,22 +9639,22 @@
1
2
- 491962
+ 491517
2
3
- 52942
+ 52894
3
7
- 50195
+ 50149
7
2238
- 16731
+ 16716
@@ -9214,22 +9670,22 @@
1
2
- 455377
+ 454965
2
3
- 69549
+ 69486
3
6
- 56063
+ 56013
6
4756
- 30841
+ 30813
@@ -9245,22 +9701,22 @@
1
2
- 1332543
+ 1331339
2
3
- 194662
+ 194486
3
11
- 129608
+ 129491
11
3169
- 36585
+ 36551
@@ -9276,17 +9732,17 @@
1
2
- 1448042
+ 1446733
2
4
- 139597
+ 139471
4
3162
- 105759
+ 105663
@@ -9302,12 +9758,12 @@
1
2
- 1603497
+ 1602048
2
1596
- 89901
+ 89820
@@ -9323,17 +9779,17 @@
1
2
- 1368504
+ 1367267
2
3
- 208522
+ 208333
3
1592
- 116372
+ 116267
@@ -9349,17 +9805,17 @@
1
2
- 2422477
+ 2420288
2
3
- 251724
+ 251497
3
211
- 141595
+ 141467
@@ -9375,17 +9831,17 @@
1
2
- 2441207
+ 2439000
2
3
- 233494
+ 233283
3
211
- 141095
+ 140968
@@ -9401,12 +9857,12 @@
1
2
- 2701298
+ 2698856
2
211
- 114499
+ 114396
@@ -9422,12 +9878,12 @@
1
2
- 2776590
+ 2774081
2
8
- 39207
+ 39171
@@ -9437,11 +9893,11 @@
fun_def
- 1423569
+ 1422282
id
- 1423569
+ 1422282
@@ -9470,15 +9926,15 @@
fun_decl_specifiers
- 4283569
+ 4279697
id
- 1749837
+ 1748256
name
- 1373
+ 1372
@@ -9492,22 +9948,22 @@
1
2
- 363228
+ 362899
2
3
- 262463
+ 262225
3
4
- 1101171
+ 1100176
4
5
- 22974
+ 22954
@@ -9704,26 +10160,26 @@
fun_decl_empty_throws
- 420457
+ 420912
fun_decl
- 420457
+ 420912
fun_decl_noexcept
- 141829
+ 141825
fun_decl
- 141829
+ 141825
constant
- 141353
+ 141348
@@ -9737,7 +10193,7 @@
1
2
- 141829
+ 141825
@@ -9753,7 +10209,7 @@
1
2
- 140910
+ 140905
2
@@ -9768,22 +10224,22 @@
fun_decl_empty_noexcept
- 1164727
+ 1163674
fun_decl
- 1164727
+ 1163674
fun_decl_typedef_type
- 2763
+ 2761
fun_decl
- 2763
+ 2761
typedeftype_id
@@ -9801,7 +10257,7 @@
1
2
- 2763
+ 2761
@@ -9889,7 +10345,7 @@
constraint
- 28874
+ 28873
@@ -10028,7 +10484,7 @@
1
2
- 28874
+ 28873
@@ -10038,19 +10494,19 @@
param_decl_bind
- 7317004
+ 7310390
id
- 7317004
+ 7310390
index
- 7991
+ 7984
fun_decl
- 3534887
+ 3531692
@@ -10064,7 +10520,7 @@
1
2
- 7317004
+ 7310390
@@ -10080,7 +10536,7 @@
1
2
- 7317004
+ 7310390
@@ -10096,27 +10552,27 @@
2
3
- 3995
+ 3992
6
7
- 1997
+ 1996
16
20
- 624
+ 623
25
147
- 624
+ 623
343
16215
- 624
+ 623
28310
@@ -10137,27 +10593,27 @@
2
3
- 3995
+ 3992
6
7
- 1997
+ 1996
16
20
- 624
+ 623
25
147
- 624
+ 623
343
16215
- 624
+ 623
28310
@@ -10178,27 +10634,27 @@
1
2
- 1510349
+ 1508984
2
3
- 977182
+ 976298
3
4
- 602591
+ 602046
4
5
- 290932
+ 290669
5
65
- 153831
+ 153692
@@ -10214,27 +10670,27 @@
1
2
- 1510349
+ 1508984
2
3
- 977182
+ 976298
3
4
- 602591
+ 602046
4
5
- 290932
+ 290669
5
65
- 153831
+ 153692
@@ -10244,27 +10700,27 @@
var_decls
- 9398480
+ 9389985
id
- 9391612
+ 9383123
variable
- 9042868
+ 9034695
type_id
- 1457782
+ 1456464
name
- 853317
+ 852546
location
- 6280262
+ 6274585
@@ -10278,7 +10734,7 @@
1
2
- 9391612
+ 9383123
@@ -10294,12 +10750,12 @@
1
2
- 9384745
+ 9376262
2
3
- 6867
+ 6861
@@ -10315,7 +10771,7 @@
1
2
- 9391612
+ 9383123
@@ -10331,7 +10787,7 @@
1
2
- 9391612
+ 9383123
@@ -10347,12 +10803,12 @@
1
2
- 8711605
+ 8703731
2
5
- 331263
+ 330963
@@ -10368,12 +10824,12 @@
1
2
- 8989302
+ 8981176
2
3
- 53566
+ 53518
@@ -10389,12 +10845,12 @@
1
2
- 8937359
+ 8929280
2
4
- 105509
+ 105414
@@ -10410,12 +10866,12 @@
1
2
- 8791018
+ 8783072
2
4
- 251849
+ 251622
@@ -10431,27 +10887,27 @@
1
2
- 850695
+ 849926
2
3
- 284314
+ 284057
3
5
- 127485
+ 127370
5
11
- 113251
+ 113148
11
2944
- 82035
+ 81961
@@ -10467,27 +10923,27 @@
1
2
- 871547
+ 870759
2
3
- 269330
+ 269087
3
5
- 122865
+ 122754
5
11
- 113126
+ 113024
11
2860
- 80911
+ 80838
@@ -10503,22 +10959,22 @@
1
2
- 1120525
+ 1119512
2
3
- 192789
+ 192615
3
7
- 115373
+ 115269
7
1038
- 29093
+ 29066
@@ -10534,27 +10990,27 @@
1
2
- 986297
+ 985405
2
3
- 219260
+ 219062
3
6
- 133728
+ 133607
6
95
- 109380
+ 109281
97
2622
- 9115
+ 9106
@@ -10570,32 +11026,32 @@
1
2
- 466365
+ 465943
2
3
- 165943
+ 165793
3
4
- 59684
+ 59630
4
7
- 65927
+ 65868
7
25
- 64179
+ 64121
25
27139
- 31215
+ 31187
@@ -10611,32 +11067,32 @@
1
2
- 479351
+ 478917
2
3
- 165194
+ 165045
3
4
- 54690
+ 54640
4
8
- 71671
+ 71606
8
45
- 64304
+ 64246
45
26704
- 18105
+ 18088
@@ -10652,22 +11108,22 @@
1
2
- 655283
+ 654691
2
3
- 110878
+ 110778
3
11
- 65553
+ 65494
11
3463
- 21601
+ 21581
@@ -10683,27 +11139,27 @@
1
2
- 494209
+ 493763
2
3
- 183424
+ 183258
3
4
- 51693
+ 51646
4
8
- 65053
+ 64995
8
22619
- 58935
+ 58882
@@ -10719,17 +11175,17 @@
1
2
- 5780059
+ 5774834
2
21
- 472733
+ 472306
21
2943
- 27469
+ 27445
@@ -10745,12 +11201,12 @@
1
2
- 5860970
+ 5855673
2
2935
- 419291
+ 418912
@@ -10766,12 +11222,12 @@
1
2
- 5981463
+ 5976057
2
2555
- 298798
+ 298528
@@ -10787,12 +11243,12 @@
1
2
- 6267900
+ 6262235
2
5
- 12361
+ 12350
@@ -10802,11 +11258,11 @@
var_def
- 3770380
+ 3766972
id
- 3770380
+ 3766972
@@ -10824,11 +11280,11 @@
var_decl_specifiers
- 490339
+ 489895
id
- 490339
+ 489895
name
@@ -10846,7 +11302,7 @@
1
2
- 490339
+ 489895
@@ -10956,19 +11412,19 @@
type_decls
- 1634963
+ 1633485
id
- 1634963
+ 1633485
type_id
- 1615984
+ 1614523
location
- 1548807
+ 1547407
@@ -10982,7 +11438,7 @@
1
2
- 1634963
+ 1633485
@@ -10998,7 +11454,7 @@
1
2
- 1634963
+ 1633485
@@ -11014,12 +11470,12 @@
1
2
- 1599627
+ 1598181
2
10
- 16357
+ 16342
@@ -11035,12 +11491,12 @@
1
2
- 1599751
+ 1598305
2
10
- 16232
+ 16217
@@ -11056,12 +11512,12 @@
1
2
- 1526706
+ 1525326
2
64
- 22100
+ 22080
@@ -11077,12 +11533,12 @@
1
2
- 1526831
+ 1525451
2
64
- 21975
+ 21956
@@ -11092,22 +11548,22 @@
type_def
- 1096551
+ 1095560
id
- 1096551
+ 1095560
type_decl_top
- 673602
+ 673960
type_decl
- 673602
+ 673960
@@ -11187,11 +11643,11 @@
namespace_decls
- 407321
+ 407776
id
- 407321
+ 407776
namespace_id
@@ -11199,11 +11655,11 @@
location
- 407321
+ 407776
bodylocation
- 407321
+ 407776
@@ -11217,7 +11673,7 @@
1
2
- 407321
+ 407776
@@ -11233,7 +11689,7 @@
1
2
- 407321
+ 407776
@@ -11249,7 +11705,7 @@
1
2
- 407321
+ 407776
@@ -11308,13 +11764,13 @@
146
- 268
- 1868
+ 270
+ 1870
146
2205
- 12449
+ 12461
32
@@ -11374,13 +11830,13 @@
146
- 268
- 1868
+ 270
+ 1870
146
2205
- 12449
+ 12461
32
@@ -11440,13 +11896,13 @@
146
- 268
- 1868
+ 270
+ 1870
146
2205
- 12449
+ 12461
32
@@ -11463,7 +11919,7 @@
1
2
- 407321
+ 407776
@@ -11479,7 +11935,7 @@
1
2
- 407321
+ 407776
@@ -11495,7 +11951,7 @@
1
2
- 407321
+ 407776
@@ -11511,7 +11967,7 @@
1
2
- 407321
+ 407776
@@ -11527,7 +11983,7 @@
1
2
- 407321
+ 407776
@@ -11543,7 +11999,7 @@
1
2
- 407321
+ 407776
@@ -11553,19 +12009,19 @@
usings
- 272082
+ 272076
id
- 272082
+ 272076
element_id
- 59053
+ 59060
location
- 26849
+ 26847
kind
@@ -11583,7 +12039,7 @@
1
2
- 272082
+ 272076
@@ -11599,7 +12055,7 @@
1
2
- 272082
+ 272076
@@ -11615,7 +12071,7 @@
1
2
- 272082
+ 272076
@@ -11631,7 +12087,7 @@
1
2
- 51321
+ 51329
2
@@ -11657,7 +12113,7 @@
1
2
- 51321
+ 51329
2
@@ -11683,7 +12139,7 @@
1
2
- 59053
+ 59060
@@ -11699,17 +12155,17 @@
1
2
- 21177
+ 21175
2
4
- 2302
+ 2291
4
132
- 1943
+ 1953
145
@@ -11730,17 +12186,17 @@
1
2
- 21177
+ 21175
2
4
- 2302
+ 2291
4
132
- 1943
+ 1953
145
@@ -11761,7 +12217,7 @@
1
2
- 26849
+ 26847
@@ -11780,8 +12236,8 @@
10
- 25367
- 25368
+ 25368
+ 25369
10
@@ -11801,8 +12257,8 @@
10
- 5377
- 5378
+ 5378
+ 5379
10
@@ -11834,15 +12290,15 @@
using_container
- 580149
+ 580125
parent
- 21895
+ 21894
child
- 272082
+ 272076
@@ -11856,12 +12312,12 @@
1
2
- 10372
+ 10371
2
3
- 1616
+ 1615
3
@@ -11907,27 +12363,27 @@
1
2
- 96601
+ 96606
2
3
- 120282
+ 120274
3
4
- 20099
+ 20098
4
5
- 26711
+ 26710
5
65
- 8386
+ 8385
@@ -11937,23 +12393,23 @@
static_asserts
- 173266
+ 173263
id
- 173266
+ 173263
condition
- 173266
+ 173263
message
- 38765
+ 38764
location
- 22648
+ 22647
enclosing
@@ -11971,7 +12427,7 @@
1
2
- 173266
+ 173263
@@ -11987,7 +12443,7 @@
1
2
- 173266
+ 173263
@@ -12003,7 +12459,7 @@
1
2
- 173266
+ 173263
@@ -12019,7 +12475,7 @@
1
2
- 173266
+ 173263
@@ -12035,7 +12491,7 @@
1
2
- 173266
+ 173263
@@ -12051,7 +12507,7 @@
1
2
- 173266
+ 173263
@@ -12067,7 +12523,7 @@
1
2
- 173266
+ 173263
@@ -12083,7 +12539,7 @@
1
2
- 173266
+ 173263
@@ -12099,7 +12555,7 @@
1
2
- 28505
+ 28504
2
@@ -12140,7 +12596,7 @@
1
2
- 28505
+ 28504
2
@@ -12181,7 +12637,7 @@
1
2
- 35922
+ 35921
2
@@ -12217,7 +12673,7 @@
4
12
- 1909
+ 1908
12
@@ -12258,7 +12714,7 @@
5
6
- 4736
+ 4735
6
@@ -12319,7 +12775,7 @@
5
6
- 4736
+ 4735
6
@@ -12391,12 +12847,12 @@
1
2
- 5069
+ 5068
2
3
- 8099
+ 8098
3
@@ -12499,7 +12955,7 @@
1
2
- 5857
+ 5856
2
@@ -12545,23 +13001,23 @@
params
- 7067152
+ 7060764
id
- 7026197
+ 7019846
function
- 3408025
+ 3404945
index
- 7991
+ 7984
type_id
- 1221415
+ 1220311
@@ -12575,7 +13031,7 @@
1
2
- 7026197
+ 7019846
@@ -12591,7 +13047,7 @@
1
2
- 7026197
+ 7019846
@@ -12607,12 +13063,12 @@
1
2
- 6985242
+ 6978928
2
3
- 40955
+ 40918
@@ -12628,27 +13084,27 @@
1
2
- 1474513
+ 1473180
2
3
- 927111
+ 926273
3
4
- 579242
+ 578718
4
5
- 281067
+ 280813
5
65
- 146090
+ 145958
@@ -12664,27 +13120,27 @@
1
2
- 1474513
+ 1473180
2
3
- 927111
+ 926273
3
4
- 579242
+ 578718
4
5
- 281067
+ 280813
5
65
- 146090
+ 145958
@@ -12700,22 +13156,22 @@
1
2
- 1783301
+ 1781689
2
3
- 1031622
+ 1030690
3
4
- 437896
+ 437500
4
11
- 155205
+ 155065
@@ -12731,27 +13187,27 @@
2
3
- 3995
+ 3992
6
7
- 1997
+ 1996
14
18
- 624
+ 623
23
138
- 624
+ 623
320
15486
- 624
+ 623
27294
@@ -12772,27 +13228,27 @@
2
3
- 3995
+ 3992
6
7
- 1997
+ 1996
14
18
- 624
+ 623
23
138
- 624
+ 623
320
15486
- 624
+ 623
27294
@@ -12813,27 +13269,27 @@
1
2
- 3995
+ 3992
2
3
- 1997
+ 1996
4
7
- 624
+ 623
9
55
- 624
+ 623
116
2703
- 624
+ 623
7497
@@ -12854,27 +13310,27 @@
1
2
- 738193
+ 737526
2
3
- 240612
+ 240394
3
5
- 93273
+ 93188
5
13
- 93897
+ 93812
13
2574
- 55439
+ 55389
@@ -12890,27 +13346,27 @@
1
2
- 820353
+ 819612
2
3
- 179803
+ 179641
3
6
- 106258
+ 106162
6
27
- 92274
+ 92190
27
2562
- 22725
+ 22704
@@ -12926,17 +13382,17 @@
1
2
- 996036
+ 995136
2
3
- 166942
+ 166791
3
65
- 58436
+ 58383
@@ -12946,11 +13402,11 @@
overrides
- 159781
+ 159778
new
- 151073
+ 151070
old
@@ -12968,7 +13424,7 @@
1
2
- 142372
+ 142370
2
@@ -13024,19 +13480,19 @@
membervariables
- 1499266
+ 1500128
id
- 1496815
+ 1497677
type_id
- 456075
+ 456186
name
- 641686
+ 642157
@@ -13050,7 +13506,7 @@
1
2
- 1494473
+ 1495336
2
@@ -13071,7 +13527,7 @@
1
2
- 1496815
+ 1497677
@@ -13087,22 +13543,22 @@
1
2
- 338326
+ 338450
2
3
- 72218
+ 72155
3
10
- 35401
+ 35451
10
- 4444
- 10130
+ 4445
+ 10129
@@ -13118,22 +13574,22 @@
1
2
- 355917
+ 356040
2
3
- 64321
+ 64313
3
49
- 34311
+ 34253
- 56
- 2185
- 1524
+ 49
+ 2186
+ 1579
@@ -13149,22 +13605,22 @@
1
2
- 421164
+ 421497
2
3
- 122542
+ 122419
3
5
- 57785
+ 58051
5
656
- 40193
+ 40189
@@ -13180,17 +13636,17 @@
1
2
- 524318
+ 524421
2
3
- 72817
+ 73190
3
660
- 44550
+ 44545
@@ -13200,19 +13656,19 @@
globalvariables
- 488591
+ 488149
id
- 488591
+ 488149
type_id
- 10363
+ 10354
name
- 112626
+ 112525
@@ -13226,7 +13682,7 @@
1
2
- 488591
+ 488149
@@ -13242,7 +13698,7 @@
1
2
- 488591
+ 488149
@@ -13258,7 +13714,7 @@
1
2
- 6992
+ 6986
2
@@ -13268,17 +13724,17 @@
3
5
- 749
+ 748
5
20
- 874
+ 873
20
74
- 874
+ 873
152
@@ -13299,7 +13755,7 @@
1
2
- 7117
+ 7110
2
@@ -13309,17 +13765,17 @@
3
5
- 749
+ 748
5
20
- 749
+ 748
20
74
- 874
+ 873
125
@@ -13340,17 +13796,17 @@
1
2
- 95395
+ 95309
2
7
- 8865
+ 8857
7
604
- 8365
+ 8358
@@ -13366,12 +13822,12 @@
1
2
- 97018
+ 96931
2
3
- 15358
+ 15344
3
@@ -13386,19 +13842,19 @@
localvariables
- 726232
+ 726313
id
- 726232
+ 726313
type_id
- 53437
+ 53445
name
- 101525
+ 101635
@@ -13412,7 +13868,7 @@
1
2
- 726232
+ 726313
@@ -13428,7 +13884,7 @@
1
2
- 726232
+ 726313
@@ -13444,37 +13900,37 @@
1
2
- 28883
+ 28869
2
3
- 7837
+ 7843
3
4
- 4028
+ 4029
4
6
- 4053
+ 4065
6
12
- 4145
+ 4133
12
- 165
- 4008
+ 162
+ 4009
- 165
- 19323
- 480
+ 162
+ 19347
+ 492
@@ -13490,22 +13946,22 @@
1
2
- 38383
+ 38374
2
3
- 6700
+ 6707
3
5
- 4465
+ 4478
5
- 3502
- 3888
+ 3509
+ 3885
@@ -13521,32 +13977,32 @@
1
2
- 62449
+ 62541
2
3
- 16031
+ 16039
3
4
- 6524
+ 6531
4
8
- 8146
+ 8147
8
- 132
- 7617
+ 134
+ 7623
- 132
- 7547
- 756
+ 134
+ 7549
+ 752
@@ -13562,22 +14018,22 @@
1
2
- 84480
+ 84587
2
3
- 8414
+ 8411
3
15
- 7677
+ 7683
15
1509
- 953
+ 952
@@ -13587,15 +14043,15 @@
autoderivation
- 229374
+ 229167
var
- 229374
+ 229167
derivation_type
- 624
+ 623
@@ -13609,7 +14065,7 @@
1
2
- 229374
+ 229167
@@ -13655,15 +14111,15 @@
orphaned_variables
- 44323
+ 44322
var
- 44323
+ 44322
function
- 41052
+ 41051
@@ -13677,7 +14133,7 @@
1
2
- 44323
+ 44322
@@ -13693,7 +14149,7 @@
1
2
- 40201
+ 40200
2
@@ -13708,19 +14164,19 @@
enumconstants
- 345733
+ 347817
id
- 345733
+ 347817
parent
- 41337
+ 41550
index
- 13942
+ 13941
type_id
@@ -13728,11 +14184,11 @@
name
- 345351
+ 347435
location
- 318338
+ 320425
@@ -13746,7 +14202,7 @@
1
2
- 345733
+ 347817
@@ -13762,7 +14218,7 @@
1
2
- 345733
+ 347817
@@ -13778,7 +14234,7 @@
1
2
- 345733
+ 347817
@@ -13794,7 +14250,7 @@
1
2
- 345733
+ 347817
@@ -13810,7 +14266,7 @@
1
2
- 345733
+ 347817
@@ -13831,17 +14287,17 @@
2
3
- 5773
+ 5772
3
4
- 8714
+ 8713
4
5
- 5500
+ 5554
5
@@ -13861,22 +14317,22 @@
8
10
- 2941
+ 2995
10
15
- 3322
+ 3430
15
- 32
- 3104
+ 33
+ 3158
- 32
+ 33
257
- 1361
+ 1306
@@ -13897,17 +14353,17 @@
2
3
- 5773
+ 5772
3
4
- 8714
+ 8713
4
5
- 5500
+ 5554
5
@@ -13927,22 +14383,22 @@
8
10
- 2941
+ 2995
10
15
- 3322
+ 3430
15
- 32
- 3104
+ 33
+ 3158
- 32
+ 33
257
- 1361
+ 1306
@@ -13958,7 +14414,7 @@
1
2
- 41337
+ 41550
@@ -13979,17 +14435,17 @@
2
3
- 5773
+ 5772
3
4
- 8714
+ 8713
4
5
- 5500
+ 5554
5
@@ -14009,22 +14465,22 @@
8
10
- 2941
+ 2995
10
15
- 3322
+ 3430
15
- 32
- 3104
+ 33
+ 3158
- 32
+ 33
257
- 1361
+ 1306
@@ -14040,7 +14496,7 @@
1
2
- 2124
+ 2123
2
@@ -14050,12 +14506,12 @@
3
4
- 8768
+ 8767
4
5
- 5446
+ 5500
5
@@ -14075,22 +14531,22 @@
8
11
- 3757
+ 3811
11
17
- 3104
+ 3212
17
- 123
- 3104
+ 165
+ 3158
- 164
+ 256
257
- 108
+ 54
@@ -14145,7 +14601,7 @@
64
- 760
+ 764
980
@@ -14201,7 +14657,7 @@
64
- 760
+ 764
980
@@ -14218,7 +14674,7 @@
1
2
- 13942
+ 13941
@@ -14273,7 +14729,7 @@
64
- 757
+ 761
980
@@ -14329,7 +14785,7 @@
64
- 760
+ 764
980
@@ -14344,8 +14800,8 @@
12
- 6348
- 6349
+ 6387
+ 6388
54
@@ -14360,8 +14816,8 @@
12
- 759
- 760
+ 763
+ 764
54
@@ -14392,8 +14848,8 @@
12
- 6341
- 6342
+ 6380
+ 6381
54
@@ -14408,8 +14864,8 @@
12
- 5845
- 5846
+ 5884
+ 5885
54
@@ -14426,7 +14882,7 @@
1
2
- 344970
+ 347054
2
@@ -14447,7 +14903,7 @@
1
2
- 344970
+ 347054
2
@@ -14468,7 +14924,7 @@
1
2
- 345351
+ 347435
@@ -14484,7 +14940,7 @@
1
2
- 345351
+ 347435
@@ -14500,7 +14956,7 @@
1
2
- 344970
+ 347054
2
@@ -14521,7 +14977,7 @@
1
2
- 317303
+ 319390
2
@@ -14542,7 +14998,7 @@
1
2
- 318338
+ 320425
@@ -14558,7 +15014,7 @@
1
2
- 317303
+ 319390
2
@@ -14579,7 +15035,7 @@
1
2
- 318338
+ 320425
@@ -14595,7 +15051,7 @@
1
2
- 317303
+ 319390
2
@@ -14610,23 +15066,23 @@
builtintypes
- 7616
+ 7609
id
- 7616
+ 7609
name
- 7616
+ 7609
kind
- 7616
+ 7609
size
- 874
+ 873
sign
@@ -14634,7 +15090,7 @@
alignment
- 624
+ 623
@@ -14648,7 +15104,7 @@
1
2
- 7616
+ 7609
@@ -14664,7 +15120,7 @@
1
2
- 7616
+ 7609
@@ -14680,7 +15136,7 @@
1
2
- 7616
+ 7609
@@ -14696,7 +15152,7 @@
1
2
- 7616
+ 7609
@@ -14712,7 +15168,7 @@
1
2
- 7616
+ 7609
@@ -14728,7 +15184,7 @@
1
2
- 7616
+ 7609
@@ -14744,7 +15200,7 @@
1
2
- 7616
+ 7609
@@ -14760,7 +15216,7 @@
1
2
- 7616
+ 7609
@@ -14776,7 +15232,7 @@
1
2
- 7616
+ 7609
@@ -14792,7 +15248,7 @@
1
2
- 7616
+ 7609
@@ -14808,7 +15264,7 @@
1
2
- 7616
+ 7609
@@ -14824,7 +15280,7 @@
1
2
- 7616
+ 7609
@@ -14840,7 +15296,7 @@
1
2
- 7616
+ 7609
@@ -14856,7 +15312,7 @@
1
2
- 7616
+ 7609
@@ -14872,7 +15328,7 @@
1
2
- 7616
+ 7609
@@ -15016,7 +15472,7 @@
3
4
- 624
+ 623
@@ -15261,7 +15717,7 @@
2
3
- 624
+ 623
@@ -15277,7 +15733,7 @@
3
4
- 624
+ 623
@@ -15287,23 +15743,23 @@
derivedtypes
- 3033685
+ 3030942
id
- 3033685
+ 3030942
name
- 1461902
+ 1460581
kind
- 749
+ 748
type_id
- 1948495
+ 1946734
@@ -15317,7 +15773,7 @@
1
2
- 3033685
+ 3030942
@@ -15333,7 +15789,7 @@
1
2
- 3033685
+ 3030942
@@ -15349,7 +15805,7 @@
1
2
- 3033685
+ 3030942
@@ -15365,17 +15821,17 @@
1
2
- 1345279
+ 1344064
2
28
- 110004
+ 109905
29
4302
- 6617
+ 6611
@@ -15391,7 +15847,7 @@
1
2
- 1461902
+ 1460581
@@ -15407,17 +15863,17 @@
1
2
- 1345404
+ 1344188
2
28
- 109879
+ 109780
29
4302
- 6617
+ 6611
@@ -15556,22 +16012,22 @@
1
2
- 1318684
+ 1317492
2
3
- 376213
+ 375873
3
4
- 123365
+ 123253
4
137
- 130232
+ 130114
@@ -15587,22 +16043,22 @@
1
2
- 1320182
+ 1318989
2
3
- 376213
+ 375873
3
4
- 121866
+ 121756
4
137
- 130232
+ 130114
@@ -15618,22 +16074,22 @@
1
2
- 1320557
+ 1319363
2
3
- 376838
+ 376497
3
4
- 123614
+ 123503
4
6
- 127485
+ 127370
@@ -15643,11 +16099,11 @@
pointerishsize
- 2249417
+ 2247383
id
- 2249417
+ 2247383
size
@@ -15669,7 +16125,7 @@
1
2
- 2249417
+ 2247383
@@ -15685,7 +16141,7 @@
1
2
- 2249417
+ 2247383
@@ -15769,23 +16225,23 @@
arraysizes
- 80661
+ 80588
id
- 80661
+ 80588
num_elements
- 17855
+ 17839
bytesize
- 20227
+ 20209
alignment
- 624
+ 623
@@ -15799,7 +16255,7 @@
1
2
- 80661
+ 80588
@@ -15815,7 +16271,7 @@
1
2
- 80661
+ 80588
@@ -15831,7 +16287,7 @@
1
2
- 80661
+ 80588
@@ -15852,7 +16308,7 @@
2
3
- 10863
+ 10853
3
@@ -15862,17 +16318,17 @@
4
5
- 3496
+ 3493
5
9
- 1498
+ 1497
9
42
- 1373
+ 1372
56
@@ -15893,12 +16349,12 @@
1
2
- 11737
+ 11726
2
3
- 3995
+ 3992
3
@@ -15908,7 +16364,7 @@
5
11
- 1123
+ 1122
@@ -15924,22 +16380,22 @@
1
2
- 11737
+ 11726
2
3
- 3995
+ 3992
3
4
- 749
+ 748
4
6
- 1373
+ 1372
@@ -15955,12 +16411,12 @@
1
2
- 624
+ 623
2
3
- 12736
+ 12724
3
@@ -15970,17 +16426,17 @@
4
5
- 2746
+ 2744
5
7
- 1498
+ 1497
7
17
- 1623
+ 1621
24
@@ -16001,17 +16457,17 @@
1
2
- 14609
+ 14595
2
3
- 3621
+ 3617
3
6
- 1872
+ 1871
6
@@ -16032,17 +16488,17 @@
1
2
- 14858
+ 14845
2
3
- 3371
+ 3368
3
5
- 1623
+ 1621
5
@@ -16208,15 +16664,15 @@
typedefbase
- 1762239
+ 1762205
id
- 1762239
+ 1762205
type_id
- 838004
+ 837964
@@ -16230,7 +16686,7 @@
1
2
- 1762239
+ 1762205
@@ -16246,22 +16702,22 @@
1
2
- 662556
+ 662494
2
3
- 80927
+ 80933
3
6
- 64154
+ 64172
6
4526
- 30366
+ 30364
@@ -16271,7 +16727,7 @@
decltypes
- 814476
+ 814477
id
@@ -16279,7 +16735,7 @@
expr
- 814476
+ 814477
kind
@@ -16409,7 +16865,7 @@
1
2
- 814476
+ 814477
@@ -16425,7 +16881,7 @@
1
2
- 814476
+ 814477
@@ -16441,7 +16897,7 @@
1
2
- 814476
+ 814477
@@ -16457,7 +16913,7 @@
1
2
- 814476
+ 814477
@@ -17035,15 +17491,15 @@
usertypes
- 4151525
+ 4151345
id
- 4151525
+ 4151345
name
- 918510
+ 918453
kind
@@ -17061,7 +17517,7 @@
1
2
- 4151525
+ 4151345
@@ -17077,7 +17533,7 @@
1
2
- 4151525
+ 4151345
@@ -17093,22 +17549,22 @@
1
2
- 654243
+ 654203
2
3
- 158665
+ 158655
3
8
- 70566
+ 70561
8
32669
- 35034
+ 35032
@@ -17124,12 +17580,12 @@
1
2
- 866765
+ 866712
2
10
- 51744
+ 51741
@@ -17198,8 +17654,8 @@
10
- 166844
- 166845
+ 166851
+ 166852
10
@@ -17281,11 +17737,11 @@
usertypesize
- 1363780
+ 1363697
id
- 1363780
+ 1363697
size
@@ -17307,7 +17763,7 @@
1
2
- 1363780
+ 1363697
@@ -17323,7 +17779,7 @@
1
2
- 1363780
+ 1363697
@@ -17517,26 +17973,26 @@
usertype_final
- 11487
+ 11477
id
- 11487
+ 11477
usertype_uuid
- 47628
+ 47716
id
- 47628
+ 47716
uuid
- 47148
+ 47237
@@ -17550,7 +18006,7 @@
1
2
- 47628
+ 47716
@@ -17566,7 +18022,7 @@
1
2
- 46669
+ 46758
2
@@ -17581,11 +18037,11 @@
usertype_alias_kind
- 1762239
+ 1762205
id
- 1762239
+ 1762205
alias_kind
@@ -17603,7 +18059,7 @@
1
2
- 1762239
+ 1762205
@@ -17617,8 +18073,8 @@
12
- 36900
- 36901
+ 36907
+ 36908
10
@@ -17634,11 +18090,11 @@
nontype_template_parameters
- 766283
+ 766257
id
- 766283
+ 766257
@@ -17718,15 +18174,15 @@
mangled_name
- 7859536
+ 7852432
id
- 7859536
+ 7852432
mangled_name
- 6370039
+ 6364281
is_complete
@@ -17744,7 +18200,7 @@
1
2
- 7859536
+ 7852432
@@ -17760,7 +18216,7 @@
1
2
- 7859536
+ 7852432
@@ -17776,12 +18232,12 @@
1
2
- 6041648
+ 6036187
2
1120
- 328391
+ 328094
@@ -17797,7 +18253,7 @@
1
2
- 6370039
+ 6364281
@@ -17849,59 +18305,59 @@
is_pod_class
- 593757
+ 593736
id
- 593757
+ 593736
is_standard_layout_class
- 1124388
+ 1124319
id
- 1124388
+ 1124319
is_complete
- 1346258
+ 1346175
id
- 1346258
+ 1346175
is_class_template
- 232167
+ 232153
id
- 232167
+ 232153
class_instantiation
- 1126046
+ 1125977
to
- 1123004
+ 1122936
from
- 71801
+ 71797
@@ -17915,7 +18371,7 @@
1
2
- 1120871
+ 1120802
2
@@ -17936,7 +18392,7 @@
1
2
- 20490
+ 20499
2
@@ -17946,7 +18402,7 @@
3
4
- 7108
+ 7107
4
@@ -17956,22 +18412,22 @@
5
7
- 6073
+ 6072
7
10
- 5724
+ 5713
10
17
- 5904
+ 5903
17
51
- 5397
+ 5396
51
@@ -17986,11 +18442,11 @@
class_template_argument
- 2898595
+ 2898417
type_id
- 1367076
+ 1366992
index
@@ -17998,7 +18454,7 @@
arg_type
- 822077
+ 822026
@@ -18012,27 +18468,27 @@
1
2
- 579347
+ 579311
2
3
- 410278
+ 410252
3
4
- 251042
+ 251027
4
7
- 103097
+ 103091
7
113
- 23310
+ 23309
@@ -18048,22 +18504,22 @@
1
2
- 607886
+ 607849
2
3
- 424283
+ 424257
3
4
- 251876
+ 251861
4
113
- 83029
+ 83024
@@ -18171,27 +18627,27 @@
1
2
- 513703
+ 513671
2
3
- 167643
+ 167632
3
5
- 75086
+ 75082
5
47
- 61736
+ 61732
47
12618
- 3908
+ 3907
@@ -18207,17 +18663,17 @@
1
2
- 723795
+ 723751
2
3
- 79913
+ 79908
3
22
- 18367
+ 18366
@@ -18227,11 +18683,11 @@
class_template_argument_value
- 510083
+ 510065
type_id
- 205811
+ 205804
index
@@ -18239,7 +18695,7 @@
arg_value
- 509947
+ 509929
@@ -18253,12 +18709,12 @@
1
2
- 155798
+ 155792
2
3
- 43370
+ 43368
3
@@ -18279,12 +18735,12 @@
1
2
- 147928
+ 147923
2
3
- 40474
+ 40472
3
@@ -18422,7 +18878,7 @@
1
2
- 509811
+ 509793
2
@@ -18443,7 +18899,7 @@
1
2
- 509947
+ 509929
@@ -18453,15 +18909,15 @@
is_proxy_class_for
- 48438
+ 48435
id
- 48438
+ 48435
templ_param_id
- 45766
+ 45763
@@ -18475,7 +18931,7 @@
1
2
- 48438
+ 48435
@@ -18491,7 +18947,7 @@
1
2
- 45047
+ 45045
2
@@ -18506,19 +18962,19 @@
type_mentions
- 5902897
+ 5903906
id
- 5902897
+ 5903906
type_id
- 276673
+ 276914
location
- 5846582
+ 5847598
kind
@@ -18536,7 +18992,7 @@
1
2
- 5902897
+ 5903906
@@ -18552,7 +19008,7 @@
1
2
- 5902897
+ 5903906
@@ -18568,7 +19024,7 @@
1
2
- 5902897
+ 5903906
@@ -18584,42 +19040,42 @@
1
2
- 136593
+ 136796
2
3
- 31153
+ 31203
3
4
- 11273
+ 11272
4
5
- 14922
+ 14921
5
7
- 19988
+ 19931
7
12
- 21785
+ 21837
12
28
- 21077
+ 21074
28
- 8940
- 19879
+ 8941
+ 19876
@@ -18635,42 +19091,42 @@
1
2
- 136593
+ 136796
2
3
- 31153
+ 31203
3
4
- 11273
+ 11272
4
5
- 14922
+ 14921
5
7
- 19988
+ 19931
7
12
- 21785
+ 21837
12
28
- 21077
+ 21074
28
- 8940
- 19879
+ 8941
+ 19876
@@ -18686,7 +19142,7 @@
1
2
- 276673
+ 276914
@@ -18702,12 +19158,12 @@
1
2
- 5800887
+ 5801908
2
4
- 45694
+ 45689
@@ -18723,12 +19179,12 @@
1
2
- 5800887
+ 5801908
2
4
- 45694
+ 45689
@@ -18744,7 +19200,7 @@
1
2
- 5846582
+ 5847598
@@ -18758,8 +19214,8 @@
12
- 108383
- 108384
+ 108414
+ 108415
54
@@ -18774,8 +19230,8 @@
12
- 5080
- 5081
+ 5085
+ 5086
54
@@ -18790,8 +19246,8 @@
12
- 107349
- 107350
+ 107380
+ 107381
54
@@ -18802,26 +19258,26 @@
is_function_template
- 1332543
+ 1331339
id
- 1332543
+ 1331339
function_instantiation
- 973628
+ 973595
to
- 973628
+ 973595
from
- 182644
+ 182638
@@ -18835,7 +19291,7 @@
1
2
- 973628
+ 973595
@@ -18851,17 +19307,17 @@
1
2
- 110588
+ 110584
2
3
- 42790
+ 42789
3
9
- 14377
+ 14376
9
@@ -18881,11 +19337,11 @@
function_template_argument
- 2484801
+ 2484714
function_id
- 1453288
+ 1453238
index
@@ -18893,7 +19349,7 @@
arg_type
- 298003
+ 297992
@@ -18907,22 +19363,22 @@
1
2
- 783011
+ 782984
2
3
- 413156
+ 413142
3
4
- 171810
+ 171804
4
15
- 85309
+ 85306
@@ -18938,22 +19394,22 @@
1
2
- 802158
+ 802130
2
3
- 411249
+ 411234
3
4
- 169630
+ 169624
4
9
- 70250
+ 70248
@@ -19091,32 +19547,32 @@
1
2
- 174774
+ 174768
2
3
- 26335
+ 26334
3
4
- 19998
+ 19997
4
6
- 22656
+ 22655
6
11
- 23235
+ 23234
11
76
- 23371
+ 23370
79
@@ -19137,12 +19593,12 @@
1
2
- 256813
+ 256804
2
3
- 32127
+ 32126
3
@@ -19157,11 +19613,11 @@
function_template_argument_value
- 452779
+ 452763
function_id
- 196783
+ 196776
index
@@ -19169,7 +19625,7 @@
arg_value
- 450087
+ 450072
@@ -19183,17 +19639,17 @@
1
2
- 151403
+ 151398
2
3
- 42893
+ 42891
3
8
- 2487
+ 2486
@@ -19209,17 +19665,17 @@
1
2
- 144487
+ 144482
2
3
- 36692
+ 36691
3
54
- 14854
+ 14853
54
@@ -19362,7 +19818,7 @@
1
2
- 447396
+ 447380
2
@@ -19383,7 +19839,7 @@
1
2
- 450087
+ 450072
@@ -19393,26 +19849,26 @@
is_variable_template
- 58685
+ 58632
id
- 58685
+ 58632
variable_instantiation
- 423162
+ 422780
to
- 423162
+ 422780
from
- 35336
+ 35304
@@ -19426,7 +19882,7 @@
1
2
- 423162
+ 422780
@@ -19442,42 +19898,42 @@
1
2
- 15233
+ 15219
2
3
- 3870
+ 3867
3
4
- 2372
+ 2370
4
6
- 2996
+ 2994
6
8
- 2247
+ 2245
8
12
- 3121
+ 3118
12
31
- 2746
+ 2744
32
546
- 2746
+ 2744
@@ -19487,19 +19943,19 @@
variable_template_argument
- 769159
+ 768464
variable_id
- 401311
+ 400948
index
- 1997
+ 1996
arg_type
- 256344
+ 256113
@@ -19513,22 +19969,22 @@
1
2
- 156703
+ 156562
2
3
- 189917
+ 189745
3
4
- 36460
+ 36427
4
17
- 18230
+ 18213
@@ -19544,22 +20000,22 @@
1
2
- 171562
+ 171407
2
3
- 180178
+ 180015
3
4
- 33713
+ 33682
4
17
- 15857
+ 15843
@@ -19575,7 +20031,7 @@
28
29
- 874
+ 873
34
@@ -19626,7 +20082,7 @@
1
2
- 874
+ 873
2
@@ -19677,22 +20133,22 @@
1
2
- 175558
+ 175399
2
3
- 44701
+ 44660
3
6
- 21601
+ 21581
6
206
- 14484
+ 14471
@@ -19708,17 +20164,17 @@
1
2
- 228000
+ 227794
2
3
- 24722
+ 24700
3
7
- 3621
+ 3617
@@ -19728,11 +20184,11 @@
variable_template_argument_value
- 19978
+ 19960
variable_id
- 14858
+ 14845
index
@@ -19740,7 +20196,7 @@
arg_value
- 19978
+ 19960
@@ -19754,12 +20210,12 @@
1
2
- 13360
+ 13348
2
3
- 1498
+ 1497
@@ -19775,12 +20231,12 @@
1
2
- 10488
+ 10479
2
3
- 3995
+ 3992
4
@@ -19863,7 +20319,7 @@
1
2
- 19978
+ 19960
@@ -19879,7 +20335,7 @@
1
2
- 19978
+ 19960
@@ -19889,15 +20345,15 @@
template_template_instantiation
- 6368
+ 6362
to
- 4994
+ 4990
from
- 1123
+ 1122
@@ -19911,12 +20367,12 @@
1
2
- 3621
+ 3617
2
3
- 1373
+ 1372
@@ -19932,7 +20388,7 @@
1
2
- 749
+ 748
2
@@ -19969,7 +20425,7 @@
arg_type
- 9083
+ 9082
@@ -19983,7 +20439,7 @@
1
2
- 5017
+ 5016
2
@@ -20014,7 +20470,7 @@
1
2
- 5038
+ 5037
2
@@ -20188,7 +20644,7 @@
1
2
- 9062
+ 9061
2
@@ -20584,7 +21040,7 @@
concept_template_argument
- 113043
+ 113042
concept_id
@@ -20946,15 +21402,15 @@
routinetypes
- 604319
+ 604298
id
- 604319
+ 604298
return_type
- 283864
+ 283854
@@ -20968,7 +21424,7 @@
1
2
- 604319
+ 604298
@@ -20984,12 +21440,12 @@
1
2
- 234225
+ 234217
2
3
- 35091
+ 35090
3
@@ -21004,11 +21460,11 @@
routinetypeargs
- 1176788
+ 1176653
routine
- 415119
+ 415071
index
@@ -21016,7 +21472,7 @@
type_id
- 111595
+ 111582
@@ -21030,32 +21486,32 @@
1
2
- 82511
+ 82502
2
3
- 126028
+ 126013
3
4
- 107456
+ 107443
4
5
- 49289
+ 49283
5
7
- 33168
+ 33164
7
19
- 16665
+ 16663
@@ -21071,27 +21527,27 @@
1
2
- 88502
+ 88492
2
3
- 138663
+ 138647
3
4
- 114209
+ 114196
4
5
- 40738
+ 40733
5
10
- 32895
+ 32892
10
@@ -21289,42 +21745,42 @@
1
2
- 33222
+ 33218
2
3
- 15195
+ 15193
3
4
- 13234
+ 13233
4
5
- 9803
+ 9802
5
6
- 6372
+ 6371
6
8
- 9476
+ 9475
8
13
- 9531
+ 9529
13
26
- 8659
+ 8658
26
@@ -21345,22 +21801,22 @@
1
2
- 78917
+ 78908
2
3
- 17537
+ 17535
3
5
- 9476
+ 9475
5
17
- 5664
+ 5663
@@ -21378,11 +21834,11 @@
type_id
- 7974
+ 7973
class_id
- 4869
+ 4868
@@ -21526,15 +21982,15 @@
specifiers
- 7741
+ 7734
id
- 7741
+ 7734
str
- 7741
+ 7734
@@ -21548,7 +22004,7 @@
1
2
- 7741
+ 7734
@@ -21564,7 +22020,7 @@
1
2
- 7741
+ 7734
@@ -21574,15 +22030,15 @@
typespecifiers
- 854940
+ 854197
type_id
- 847448
+ 849053
spec_id
- 1623
+ 95
@@ -21596,12 +22052,12 @@
1
2
- 839957
+ 843910
2
3
- 7491
+ 5143
@@ -21615,69 +22071,49 @@
12
- 1
- 2
- 124
-
-
- 2
- 3
- 124
-
-
- 16
- 17
- 124
-
-
- 17
- 18
- 124
-
-
- 24
- 25
- 124
+ 168
+ 169
+ 10
- 44
- 45
- 124
+ 215
+ 216
+ 10
- 49
- 50
- 124
+ 225
+ 226
+ 10
- 51
- 52
- 124
+ 533
+ 534
+ 10
- 112
- 113
- 124
+ 821
+ 822
+ 10
- 199
- 200
- 124
+ 1568
+ 1569
+ 10
- 325
- 326
- 124
+ 4195
+ 4196
+ 10
- 545
- 546
- 124
+ 18295
+ 18296
+ 10
- 5462
- 5463
- 124
+ 54858
+ 54859
+ 10
@@ -21687,15 +22123,15 @@
funspecifiers
- 9723250
+ 9714461
func_id
- 4012490
+ 4008863
spec_id
- 2372
+ 2370
@@ -21709,27 +22145,27 @@
1
2
- 1528454
+ 1527073
2
3
- 506696
+ 506238
3
4
- 1037865
+ 1036927
4
5
- 693492
+ 692865
5
8
- 245981
+ 245758
@@ -21845,15 +22281,15 @@
varspecifiers
- 3078136
+ 3075354
var_id
- 2316968
+ 2314873
spec_id
- 1123
+ 1122
@@ -21867,17 +22303,17 @@
1
2
- 1659561
+ 1658061
2
3
- 554144
+ 553643
3
5
- 103262
+ 103168
@@ -21943,15 +22379,15 @@
explicit_specifier_exprs
- 41329
+ 41292
func_id
- 41329
+ 41292
constant
- 41329
+ 41292
@@ -21965,7 +22401,7 @@
1
2
- 41329
+ 41292
@@ -21981,7 +22417,7 @@
1
2
- 41329
+ 41292
@@ -21991,11 +22427,11 @@
attributes
- 654409
+ 653818
id
- 654409
+ 653818
kind
@@ -22003,7 +22439,7 @@
name
- 2122
+ 2120
name_space
@@ -22011,7 +22447,7 @@
location
- 648291
+ 647705
@@ -22025,7 +22461,7 @@
1
2
- 654409
+ 653818
@@ -22041,7 +22477,7 @@
1
2
- 654409
+ 653818
@@ -22057,7 +22493,7 @@
1
2
- 654409
+ 653818
@@ -22073,7 +22509,7 @@
1
2
- 654409
+ 653818
@@ -22269,7 +22705,7 @@
1
2
- 1872
+ 1871
2
@@ -22290,7 +22726,7 @@
1
2
- 2122
+ 2120
@@ -22476,12 +22912,12 @@
1
2
- 642423
+ 641842
2
5
- 5868
+ 5863
@@ -22497,7 +22933,7 @@
1
2
- 648291
+ 647705
@@ -22513,12 +22949,12 @@
1
2
- 643172
+ 642590
2
3
- 5119
+ 5114
@@ -22534,7 +22970,7 @@
1
2
- 648291
+ 647705
@@ -22814,7 +23250,7 @@
1
2
- 68747
+ 68748
2
@@ -23072,7 +23508,7 @@
1
2
- 56935
+ 56936
2
@@ -23243,15 +23679,15 @@
attribute_arg_constant
- 71875
+ 71712
arg
- 71875
+ 71712
constant
- 71875
+ 71712
@@ -23265,7 +23701,7 @@
1
2
- 71875
+ 71712
@@ -23281,7 +23717,7 @@
1
2
- 71875
+ 71712
@@ -23392,15 +23828,15 @@
typeattributes
- 96394
+ 96307
type_id
- 94646
+ 94561
spec_id
- 32464
+ 32435
@@ -23414,12 +23850,12 @@
1
2
- 92898
+ 92814
2
3
- 1748
+ 1746
@@ -23435,17 +23871,17 @@
1
2
- 27969
+ 27944
2
9
- 2497
+ 2495
11
58
- 1997
+ 1996
@@ -23455,15 +23891,15 @@
funcattributes
- 844327
+ 843564
func_id
- 799751
+ 799028
spec_id
- 617325
+ 616767
@@ -23477,12 +23913,12 @@
1
2
- 759669
+ 758983
2
7
- 40081
+ 40044
@@ -23498,12 +23934,12 @@
1
2
- 572249
+ 571732
2
213
- 45075
+ 45035
@@ -23576,7 +24012,7 @@
namespaceattributes
- 5996
+ 5995
namespace_id
@@ -23584,7 +24020,7 @@
spec_id
- 5996
+ 5995
@@ -23624,7 +24060,7 @@
1
2
- 5996
+ 5995
@@ -23702,15 +24138,15 @@
unspecifiedtype
- 7179404
+ 7172915
type_id
- 7179404
+ 7172915
unspecified_type_id
- 3965916
+ 3962331
@@ -23724,7 +24160,7 @@
1
2
- 7179404
+ 7172915
@@ -23740,22 +24176,22 @@
1
2
- 2482787
+ 2480542
2
3
- 1117778
+ 1116768
3
7
- 302918
+ 302645
7
537
- 62431
+ 62375
@@ -23765,19 +24201,19 @@
member
- 4193417
+ 4189627
parent
- 543780
+ 543289
index
- 29717
+ 29690
child
- 4188797
+ 4185011
@@ -23791,57 +24227,57 @@
1
2
- 129108
+ 128992
2
3
- 83408
+ 83333
3
4
- 32464
+ 32435
4
5
- 44950
+ 44910
5
6
- 42453
+ 42415
6
7
- 33962
+ 33932
7
9
- 42328
+ 42290
9
13
- 41204
+ 41167
13
18
- 41329
+ 41292
18
42
- 40830
+ 40793
42
239
- 11737
+ 11726
@@ -23857,57 +24293,57 @@
1
2
- 128859
+ 128742
2
3
- 83533
+ 83458
3
4
- 32214
+ 32185
4
5
- 45075
+ 45035
5
6
- 42578
+ 42539
6
7
- 32839
+ 32809
7
9
- 42703
+ 42664
9
13
- 41579
+ 41541
13
18
- 41454
+ 41417
18
42
- 40955
+ 40918
42
265
- 11986
+ 11976
@@ -23923,57 +24359,57 @@
1
2
- 6492
+ 6487
2
3
- 2622
+ 2619
3
8
- 1872
+ 1871
9
10
- 2871
+ 2869
10
19
- 2247
+ 2245
19
26
- 2247
+ 2245
26
36
- 2497
+ 2495
36
50
- 2247
+ 2245
54
141
- 2247
+ 2245
150
468
- 2247
+ 2245
480
4310
- 2122
+ 2120
@@ -23989,57 +24425,57 @@
1
2
- 5493
+ 5489
2
3
- 3621
+ 3617
3
9
- 1872
+ 1871
9
10
- 2871
+ 2869
10
20
- 2372
+ 2370
20
28
- 2372
+ 2370
28
37
- 2372
+ 2370
37
56
- 2372
+ 2370
58
156
- 2247
+ 2245
163
527
- 2247
+ 2245
547
4330
- 1872
+ 1871
@@ -24055,7 +24491,7 @@
1
2
- 4188797
+ 4185011
@@ -24071,12 +24507,12 @@
1
2
- 4184177
+ 4180395
2
3
- 4619
+ 4615
@@ -24086,15 +24522,15 @@
enclosingfunction
- 114813
+ 114809
child
- 114813
+ 114809
parent
- 71340
+ 71338
@@ -24108,7 +24544,7 @@
1
2
- 114813
+ 114809
@@ -24124,7 +24560,7 @@
1
2
- 49332
+ 49330
2
@@ -24134,7 +24570,7 @@
3
4
- 15365
+ 15364
4
@@ -24149,15 +24585,15 @@
derivations
- 476900
+ 476883
derivation
- 476900
+ 476883
sub
- 455164
+ 455148
index
@@ -24165,11 +24601,11 @@
super
- 235554
+ 235546
location
- 35397
+ 35396
@@ -24183,7 +24619,7 @@
1
2
- 476900
+ 476883
@@ -24199,7 +24635,7 @@
1
2
- 476900
+ 476883
@@ -24215,7 +24651,7 @@
1
2
- 476900
+ 476883
@@ -24231,7 +24667,7 @@
1
2
- 476900
+ 476883
@@ -24247,12 +24683,12 @@
1
2
- 438640
+ 438625
2
9
- 16523
+ 16522
@@ -24268,12 +24704,12 @@
1
2
- 438640
+ 438625
2
8
- 16523
+ 16522
@@ -24289,12 +24725,12 @@
1
2
- 438640
+ 438625
2
9
- 16523
+ 16522
@@ -24310,12 +24746,12 @@
1
2
- 438640
+ 438625
2
8
- 16523
+ 16522
@@ -24470,7 +24906,7 @@
1
2
- 225742
+ 225734
2
@@ -24491,7 +24927,7 @@
1
2
- 225742
+ 225734
2
@@ -24512,7 +24948,7 @@
1
2
- 235111
+ 235103
2
@@ -24533,7 +24969,7 @@
1
2
- 230205
+ 230197
2
@@ -24554,7 +24990,7 @@
1
2
- 26505
+ 26504
2
@@ -24590,7 +25026,7 @@
1
2
- 26505
+ 26504
2
@@ -24626,7 +25062,7 @@
1
2
- 35397
+ 35396
@@ -24642,7 +25078,7 @@
1
2
- 28720
+ 28719
2
@@ -24667,11 +25103,11 @@
derspecifiers
- 478671
+ 478655
der_id
- 476457
+ 476440
spec_id
@@ -24689,7 +25125,7 @@
1
2
- 474242
+ 474226
2
@@ -24735,11 +25171,11 @@
direct_base_offsets
- 449985
+ 449970
der_id
- 449985
+ 449970
offset
@@ -24757,7 +25193,7 @@
1
2
- 449985
+ 449970
@@ -24954,19 +25390,19 @@
frienddecls
- 700462
+ 700403
id
- 700462
+ 700403
type_id
- 42416
+ 42414
decl_id
- 77848
+ 77845
location
@@ -24984,7 +25420,7 @@
1
2
- 700462
+ 700403
@@ -25000,7 +25436,7 @@
1
2
- 700462
+ 700403
@@ -25016,7 +25452,7 @@
1
2
- 700462
+ 700403
@@ -25032,12 +25468,12 @@
1
2
- 6166
+ 6200
2
3
- 13968
+ 13933
3
@@ -25088,12 +25524,12 @@
1
2
- 6166
+ 6200
2
3
- 13968
+ 13933
3
@@ -25144,7 +25580,7 @@
1
2
- 41053
+ 41051
2
@@ -25165,17 +25601,17 @@
1
2
- 48071
+ 48104
2
3
- 5962
+ 5927
3
8
- 5996
+ 5995
8
@@ -25206,17 +25642,17 @@
1
2
- 48071
+ 48104
2
3
- 5962
+ 5927
3
8
- 5996
+ 5995
8
@@ -25247,7 +25683,7 @@
1
2
- 77166
+ 77163
2
@@ -25272,7 +25708,7 @@
2
- 20371
+ 20370
374
@@ -25289,7 +25725,7 @@
1
2
- 5962
+ 5961
2
@@ -25325,19 +25761,19 @@
comments
- 11241965
+ 11233426
id
- 11241965
+ 11233426
contents
- 4306669
+ 4303649
location
- 11241965
+ 11233426
@@ -25351,7 +25787,7 @@
1
2
- 11241965
+ 11233426
@@ -25367,7 +25803,7 @@
1
2
- 11241965
+ 11233426
@@ -25383,17 +25819,17 @@
1
2
- 3932328
+ 3928898
2
- 7
- 330014
+ 6
+ 322979
- 7
+ 6
34447
- 44326
+ 51771
@@ -25409,17 +25845,17 @@
1
2
- 3932328
+ 3928898
2
- 7
- 330014
+ 6
+ 322979
- 7
+ 6
34447
- 44326
+ 51771
@@ -25435,7 +25871,7 @@
1
2
- 11241965
+ 11233426
@@ -25451,7 +25887,7 @@
1
2
- 11241965
+ 11233426
@@ -25461,15 +25897,15 @@
commentbinding
- 3916720
+ 3914801
id
- 3352211
+ 3350803
element
- 3751026
+ 3749257
@@ -25483,12 +25919,12 @@
1
2
- 3290529
+ 3289176
2
1706
- 61682
+ 61626
@@ -25504,12 +25940,12 @@
1
2
- 3585332
+ 3583713
2
3
- 165693
+ 165544
@@ -25519,15 +25955,15 @@
exprconv
- 9633088
+ 9633104
converted
- 9632982
+ 9632998
conversion
- 9633088
+ 9633104
@@ -25541,7 +25977,7 @@
1
2
- 9632877
+ 9632893
2
@@ -25562,7 +25998,7 @@
1
2
- 9633088
+ 9633104
@@ -25572,22 +26008,22 @@
compgenerated
- 9891529
+ 9892067
id
- 9891529
+ 9892067
synthetic_destructor_call
- 1671638
+ 1671632
element
- 1244918
+ 1244913
i
@@ -25595,7 +26031,7 @@
destructor_call
- 1671638
+ 1671632
@@ -25609,12 +26045,12 @@
1
2
- 828654
+ 828651
2
3
- 409464
+ 409463
3
@@ -25635,12 +26071,12 @@
1
2
- 828654
+ 828651
2
3
- 409464
+ 409463
3
@@ -25793,7 +26229,7 @@
1
2
- 1671638
+ 1671632
@@ -25809,7 +26245,7 @@
1
2
- 1671638
+ 1671632
@@ -25819,11 +26255,11 @@
namespaces
- 8650
+ 8649
id
- 8650
+ 8649
name
@@ -25841,7 +26277,7 @@
1
2
- 8650
+ 8649
@@ -25857,7 +26293,7 @@
1
2
- 3739
+ 3738
2
@@ -25888,15 +26324,15 @@
namespacembrs
- 2039521
+ 2037677
parentid
- 3995
+ 3992
memberid
- 2039521
+ 2037677
@@ -25925,7 +26361,7 @@
4
5
- 624
+ 623
5
@@ -25986,7 +26422,7 @@
1
2
- 2039521
+ 2037677
@@ -25996,11 +26432,11 @@
exprparents
- 19454218
+ 19454250
expr_id
- 19454218
+ 19454250
child_index
@@ -26008,7 +26444,7 @@
parent_id
- 12939988
+ 12940010
@@ -26022,7 +26458,7 @@
1
2
- 19454218
+ 19454250
@@ -26038,7 +26474,7 @@
1
2
- 19454218
+ 19454250
@@ -26156,17 +26592,17 @@
1
2
- 7394757
+ 7394770
2
3
- 5082680
+ 5082689
3
712
- 462550
+ 462551
@@ -26182,17 +26618,17 @@
1
2
- 7394757
+ 7394770
2
3
- 5082680
+ 5082689
3
712
- 462550
+ 462551
@@ -26202,22 +26638,22 @@
expr_isload
- 6909475
+ 6909346
expr_id
- 6909475
+ 6909346
conversionkinds
- 6050433
+ 6050442
expr_id
- 6050433
+ 6050442
kind
@@ -26235,7 +26671,7 @@
1
2
- 6050433
+ 6050442
@@ -26259,8 +26695,8 @@
1
- 7362
- 7363
+ 7371
+ 7372
1
@@ -26291,11 +26727,11 @@
iscall
- 5802603
+ 5802562
caller
- 5802603
+ 5802562
kind
@@ -26313,7 +26749,7 @@
1
2
- 5802603
+ 5802562
@@ -26337,8 +26773,8 @@
21
- 268054
- 268055
+ 268053
+ 268054
21
@@ -26349,11 +26785,11 @@
numtemplatearguments
- 627938
+ 627371
expr_id
- 627938
+ 627371
num
@@ -26371,7 +26807,7 @@
1
2
- 627938
+ 627371
@@ -26455,23 +26891,23 @@
namequalifiers
- 3041863
+ 3041831
id
- 3041863
+ 3041831
qualifiableelement
- 3041863
+ 3041831
qualifyingelement
- 47485
+ 47484
location
- 552436
+ 552434
@@ -26485,7 +26921,7 @@
1
2
- 3041863
+ 3041831
@@ -26501,7 +26937,7 @@
1
2
- 3041863
+ 3041831
@@ -26517,7 +26953,7 @@
1
2
- 3041863
+ 3041831
@@ -26533,7 +26969,7 @@
1
2
- 3041863
+ 3041831
@@ -26549,7 +26985,7 @@
1
2
- 3041863
+ 3041831
@@ -26565,7 +27001,7 @@
1
2
- 3041863
+ 3041831
@@ -26595,7 +27031,7 @@
5
- 6811
+ 6810
3571
@@ -26631,7 +27067,7 @@
5
- 6811
+ 6810
3571
@@ -26684,17 +27120,17 @@
1
2
- 79134
+ 79155
2
6
- 38104
+ 38082
6
7
- 398986
+ 398985
7
@@ -26715,17 +27151,17 @@
1
2
- 79134
+ 79155
2
6
- 38104
+ 38082
6
7
- 398986
+ 398985
7
@@ -26746,7 +27182,7 @@
1
2
- 111537
+ 111536
2
@@ -26756,7 +27192,7 @@
4
5
- 415295
+ 415294
5
@@ -26771,15 +27207,15 @@
varbind
- 8254632
+ 8254646
expr
- 8254632
+ 8254646
var
- 1050376
+ 1050377
@@ -26793,7 +27229,7 @@
1
2
- 8254632
+ 8254646
@@ -26809,17 +27245,17 @@
1
2
- 171535
+ 171536
2
3
- 188700
+ 188701
3
4
- 145647
+ 145648
4
@@ -26864,15 +27300,15 @@
funbind
- 5812199
+ 5812287
expr
- 5809833
+ 5809813
fun
- 275916
+ 275937
@@ -26886,12 +27322,12 @@
1
2
- 5807466
+ 5807338
2
3
- 2366
+ 2474
@@ -26907,7 +27343,7 @@
1
2
- 181420
+ 181441
2
@@ -26917,12 +27353,12 @@
3
4
- 17212
+ 17190
4
8
- 22720
+ 22741
8
@@ -26937,11 +27373,11 @@
expr_allocator
- 45243
+ 45242
expr
- 45243
+ 45242
func
@@ -26963,7 +27399,7 @@
1
2
- 45243
+ 45242
@@ -26979,7 +27415,7 @@
1
2
- 45243
+ 45242
@@ -27063,11 +27499,11 @@
expr_deallocator
- 53829
+ 53827
expr
- 53829
+ 53827
func
@@ -27089,7 +27525,7 @@
1
2
- 53829
+ 53827
@@ -27105,7 +27541,7 @@
1
2
- 53829
+ 53827
@@ -27210,15 +27646,15 @@
expr_cond_guard
- 897880
+ 897881
cond
- 897880
+ 897881
guard
- 897880
+ 897881
@@ -27232,7 +27668,7 @@
1
2
- 897880
+ 897881
@@ -27248,7 +27684,7 @@
1
2
- 897880
+ 897881
@@ -27258,15 +27694,15 @@
expr_cond_true
- 897876
+ 897877
cond
- 897876
+ 897877
true
- 897876
+ 897877
@@ -27280,7 +27716,7 @@
1
2
- 897876
+ 897877
@@ -27296,7 +27732,7 @@
1
2
- 897876
+ 897877
@@ -27306,15 +27742,15 @@
expr_cond_false
- 897880
+ 897881
cond
- 897880
+ 897881
false
- 897880
+ 897881
@@ -27328,7 +27764,7 @@
1
2
- 897880
+ 897881
@@ -27344,7 +27780,7 @@
1
2
- 897880
+ 897881
@@ -27354,11 +27790,11 @@
values
- 13474606
+ 13474629
id
- 13474606
+ 13474629
str
@@ -27376,7 +27812,7 @@
1
2
- 13474606
+ 13474629
@@ -27392,7 +27828,7 @@
1
2
- 78302
+ 78303
2
@@ -27422,11 +27858,11 @@
valuetext
- 6647578
+ 6647554
id
- 6647578
+ 6647554
text
@@ -27444,7 +27880,7 @@
1
2
- 6647578
+ 6647554
@@ -27485,15 +27921,15 @@
valuebind
- 13583189
+ 13583211
val
- 13474606
+ 13474629
expr
- 13583189
+ 13583211
@@ -27507,7 +27943,7 @@
1
2
- 13384052
+ 13384074
2
@@ -27528,7 +27964,7 @@
1
2
- 13583189
+ 13583211
@@ -27538,15 +27974,15 @@
fieldoffsets
- 1496815
+ 1497677
id
- 1496815
+ 1497677
byteoffset
- 31370
+ 31367
bitoffset
@@ -27564,7 +28000,7 @@
1
2
- 1496815
+ 1497677
@@ -27580,7 +28016,7 @@
1
2
- 1496815
+ 1497677
@@ -27596,7 +28032,7 @@
1
2
- 17700
+ 17698
2
@@ -27611,7 +28047,7 @@
5
12
- 2614
+ 2613
12
@@ -27625,7 +28061,7 @@
250
- 5947
+ 5950
1089
@@ -27642,7 +28078,7 @@
1
2
- 30390
+ 30387
2
@@ -27696,8 +28132,8 @@
54
- 27127
- 27128
+ 27146
+ 27147
54
@@ -27739,19 +28175,19 @@
bitfield
- 30341
+ 30314
id
- 30341
+ 30314
bits
- 3496
+ 3493
declared_bits
- 3496
+ 3493
@@ -27765,7 +28201,7 @@
1
2
- 30341
+ 30314
@@ -27781,7 +28217,7 @@
1
2
- 30341
+ 30314
@@ -27802,7 +28238,7 @@
2
3
- 749
+ 748
3
@@ -27848,7 +28284,7 @@
1
2
- 3496
+ 3493
@@ -27869,7 +28305,7 @@
2
3
- 749
+ 748
3
@@ -27915,7 +28351,7 @@
1
2
- 3496
+ 3493
@@ -27925,23 +28361,23 @@
initialisers
- 2251035
+ 2251326
init
- 2251035
+ 2251326
var
- 980971
+ 981180
expr
- 2251035
+ 2251326
location
- 516371
+ 516962
@@ -27955,7 +28391,7 @@
1
2
- 2251035
+ 2251326
@@ -27971,7 +28407,7 @@
1
2
- 2251035
+ 2251326
@@ -27987,7 +28423,7 @@
1
2
- 2251035
+ 2251326
@@ -28003,17 +28439,17 @@
1
2
- 870556
+ 870760
2
15
- 37441
+ 37448
16
25
- 72973
+ 72972
@@ -28029,17 +28465,17 @@
1
2
- 870556
+ 870760
2
15
- 37441
+ 37448
16
25
- 72973
+ 72972
@@ -28055,7 +28491,7 @@
1
2
- 980963
+ 981172
2
@@ -28076,7 +28512,7 @@
1
2
- 2251035
+ 2251326
@@ -28092,7 +28528,7 @@
1
2
- 2251035
+ 2251326
@@ -28108,7 +28544,7 @@
1
2
- 2251035
+ 2251326
@@ -28124,22 +28560,22 @@
1
2
- 414356
+ 415112
2
3
- 33606
+ 33614
3
13
- 42250
+ 42070
13
- 111911
- 26157
+ 111925
+ 26165
@@ -28155,17 +28591,17 @@
1
2
- 443657
+ 444413
2
3
- 34516
+ 34524
3
- 12237
- 38196
+ 12238
+ 38025
@@ -28181,22 +28617,22 @@
1
2
- 414356
+ 415112
2
3
- 33606
+ 33614
3
13
- 42250
+ 42070
13
- 111911
- 26157
+ 111925
+ 26165
@@ -28206,26 +28642,26 @@
braced_initialisers
- 68468
+ 68440
init
- 68468
+ 68440
expr_ancestor
- 1677619
+ 1677613
exp
- 1677619
+ 1677613
ancestor
- 839627
+ 839624
@@ -28239,7 +28675,7 @@
1
2
- 1677619
+ 1677613
@@ -28260,7 +28696,7 @@
2
3
- 812474
+ 812471
3
@@ -28275,11 +28711,11 @@
exprs
- 25210577
+ 25210619
id
- 25210577
+ 25210619
kind
@@ -28287,7 +28723,7 @@
location
- 10582671
+ 10585876
@@ -28301,7 +28737,7 @@
1
2
- 25210577
+ 25210619
@@ -28317,7 +28753,7 @@
1
2
- 25210577
+ 25210619
@@ -28477,8 +28913,8 @@
109
- 224080
- 224081
+ 224225
+ 224226
21
@@ -28495,22 +28931,22 @@
1
2
- 8900701
+ 8903903
2
3
- 820608
+ 820610
3
16
- 797199
+ 797200
16
71733
- 64161
+ 64162
@@ -28526,17 +28962,17 @@
1
2
- 9040103
+ 9043306
2
3
- 774273
+ 774274
3
32
- 768294
+ 768295
@@ -28546,15 +28982,15 @@
expr_reuse
- 847007
+ 847004
reuse
- 847007
+ 847004
original
- 847007
+ 847004
value_category
@@ -28572,7 +29008,7 @@
1
2
- 847007
+ 847004
@@ -28588,7 +29024,7 @@
1
2
- 847007
+ 847004
@@ -28604,7 +29040,7 @@
1
2
- 847007
+ 847004
@@ -28620,7 +29056,7 @@
1
2
- 847007
+ 847004
@@ -28672,15 +29108,15 @@
expr_types
- 25210577
+ 25210619
id
- 25210577
+ 25210619
typeid
- 214202
+ 214203
value_category
@@ -28698,7 +29134,7 @@
1
2
- 25210577
+ 25210619
@@ -28714,7 +29150,7 @@
1
2
- 25210577
+ 25210619
@@ -28859,15 +29295,15 @@
new_allocated_type
- 46197
+ 46196
expr
- 46197
+ 46196
type_id
- 27391
+ 27390
@@ -28881,7 +29317,7 @@
1
2
- 46197
+ 46196
@@ -28897,12 +29333,12 @@
1
2
- 11515
+ 11514
2
3
- 14479
+ 14478
3
@@ -30316,15 +30752,15 @@
condition_decl_bind
- 408905
+ 408903
expr
- 408905
+ 408903
decl
- 408905
+ 408903
@@ -30338,7 +30774,7 @@
1
2
- 408905
+ 408903
@@ -30354,7 +30790,7 @@
1
2
- 408905
+ 408903
@@ -30364,15 +30800,15 @@
typeid_bind
- 47901
+ 47899
expr
- 47901
+ 47899
type_id
- 15944
+ 15943
@@ -30386,7 +30822,7 @@
1
2
- 47901
+ 47899
@@ -30402,7 +30838,7 @@
1
2
- 2964
+ 2963
2
@@ -30422,15 +30858,15 @@
uuidof_bind
- 26588
+ 26677
expr
- 26588
+ 26677
type_id
- 26336
+ 26425
@@ -30444,7 +30880,7 @@
1
2
- 26588
+ 26677
@@ -30460,7 +30896,7 @@
1
2
- 26125
+ 26214
2
@@ -30852,11 +31288,11 @@
lambda_capture
- 31966
+ 31965
id
- 31966
+ 31965
lambda
@@ -30868,7 +31304,7 @@
field
- 31966
+ 31965
captured_by_reference
@@ -30894,7 +31330,7 @@
1
2
- 31966
+ 31965
@@ -30910,7 +31346,7 @@
1
2
- 31966
+ 31965
@@ -30926,7 +31362,7 @@
1
2
- 31966
+ 31965
@@ -30942,7 +31378,7 @@
1
2
- 31966
+ 31965
@@ -30958,7 +31394,7 @@
1
2
- 31966
+ 31965
@@ -30974,7 +31410,7 @@
1
2
- 31966
+ 31965
@@ -31602,7 +32038,7 @@
1
2
- 31966
+ 31965
@@ -31618,7 +32054,7 @@
1
2
- 31966
+ 31965
@@ -31634,7 +32070,7 @@
1
2
- 31966
+ 31965
@@ -31650,7 +32086,7 @@
1
2
- 31966
+ 31965
@@ -31666,7 +32102,7 @@
1
2
- 31966
+ 31965
@@ -31682,7 +32118,7 @@
1
2
- 31966
+ 31965
@@ -32196,11 +32632,11 @@
stmts
- 6368968
+ 6368850
id
- 6368968
+ 6368850
kind
@@ -32208,7 +32644,7 @@
location
- 2684538
+ 2684488
@@ -32222,7 +32658,7 @@
1
2
- 6368968
+ 6368850
@@ -32238,7 +32674,7 @@
1
2
- 6368968
+ 6368850
@@ -32476,22 +32912,22 @@
1
2
- 2225039
+ 2224998
2
3
- 182234
+ 182231
3
10
- 202178
+ 202174
10
1789
- 75085
+ 75084
@@ -32507,12 +32943,12 @@
1
2
- 2601581
+ 2601532
2
10
- 82957
+ 82955
@@ -32677,15 +33113,15 @@
if_then
- 990214
+ 990216
if_stmt
- 990214
+ 990216
then_id
- 990214
+ 990216
@@ -32699,7 +33135,7 @@
1
2
- 990214
+ 990216
@@ -32715,7 +33151,7 @@
1
2
- 990214
+ 990216
@@ -32725,15 +33161,15 @@
if_else
- 437090
+ 437089
if_stmt
- 437090
+ 437089
else_id
- 437090
+ 437089
@@ -32747,7 +33183,7 @@
1
2
- 437090
+ 437089
@@ -32763,7 +33199,7 @@
1
2
- 437090
+ 437089
@@ -32821,15 +33257,15 @@
constexpr_if_then
- 106134
+ 106038
constexpr_if_stmt
- 106134
+ 106038
then_id
- 106134
+ 106038
@@ -32843,7 +33279,7 @@
1
2
- 106134
+ 106038
@@ -32859,7 +33295,7 @@
1
2
- 106134
+ 106038
@@ -32869,15 +33305,15 @@
constexpr_if_else
- 76166
+ 76097
constexpr_if_stmt
- 76166
+ 76097
else_id
- 76166
+ 76097
@@ -32891,7 +33327,7 @@
1
2
- 76166
+ 76097
@@ -32907,7 +33343,7 @@
1
2
- 76166
+ 76097
@@ -33013,15 +33449,15 @@
while_body
- 39647
+ 39648
while_stmt
- 39647
+ 39648
body_id
- 39647
+ 39648
@@ -33035,7 +33471,7 @@
1
2
- 39647
+ 39648
@@ -33051,7 +33487,7 @@
1
2
- 39647
+ 39648
@@ -33157,11 +33593,11 @@
switch_case
- 836120
+ 836117
switch_stmt
- 411852
+ 411851
index
@@ -33169,7 +33605,7 @@
case_id
- 836120
+ 836117
@@ -33188,7 +33624,7 @@
2
3
- 408969
+ 408968
3
@@ -33214,7 +33650,7 @@
2
3
- 408969
+ 408968
3
@@ -33377,7 +33813,7 @@
1
2
- 836120
+ 836117
@@ -33393,7 +33829,7 @@
1
2
- 836120
+ 836117
@@ -33403,15 +33839,15 @@
switch_body
- 411852
+ 411851
switch_stmt
- 411852
+ 411851
body_id
- 411852
+ 411851
@@ -33425,7 +33861,7 @@
1
2
- 411852
+ 411851
@@ -33441,7 +33877,7 @@
1
2
- 411852
+ 411851
@@ -33643,11 +34079,11 @@
stmtparents
- 5628380
+ 5628275
id
- 5628380
+ 5628275
index
@@ -33655,7 +34091,7 @@
parent
- 2381490
+ 2381446
@@ -33669,7 +34105,7 @@
1
2
- 5628380
+ 5628275
@@ -33685,7 +34121,7 @@
1
2
- 5628380
+ 5628275
@@ -33721,7 +34157,7 @@
7
8
- 1316
+ 1315
8
@@ -33782,7 +34218,7 @@
7
8
- 1316
+ 1315
8
@@ -33823,27 +34259,27 @@
1
2
- 1359015
+ 1358990
2
3
- 517378
+ 517369
3
4
- 151519
+ 151517
4
6
- 155727
+ 155724
6
16
- 178871
+ 178868
16
@@ -33864,27 +34300,27 @@
1
2
- 1359015
+ 1358990
2
3
- 517378
+ 517369
3
4
- 151519
+ 151517
4
6
- 155727
+ 155724
6
16
- 178871
+ 178868
16
@@ -33899,22 +34335,22 @@
ishandler
- 43746
+ 43790
block
- 43746
+ 43790
stmt_decl_bind
- 725885
+ 725871
stmt
- 715316
+ 715303
num
@@ -33922,7 +34358,7 @@
decl
- 725885
+ 725871
@@ -33936,7 +34372,7 @@
1
2
- 707850
+ 707837
2
@@ -33957,7 +34393,7 @@
1
2
- 707850
+ 707837
2
@@ -34090,7 +34526,7 @@
1
2
- 725885
+ 725871
@@ -34106,7 +34542,7 @@
1
2
- 725885
+ 725871
@@ -34116,11 +34552,11 @@
stmt_decl_entry_bind
- 725885
+ 725871
stmt
- 715316
+ 715303
num
@@ -34128,7 +34564,7 @@
decl_entry
- 725885
+ 725871
@@ -34142,7 +34578,7 @@
1
2
- 707850
+ 707837
2
@@ -34163,7 +34599,7 @@
1
2
- 707850
+ 707837
2
@@ -34296,7 +34732,7 @@
1
2
- 725885
+ 725871
@@ -34312,7 +34748,7 @@
1
2
- 725885
+ 725871
@@ -34322,15 +34758,15 @@
blockscope
- 1644952
+ 1644338
block
- 1644952
+ 1644338
enclosing
- 1428064
+ 1427147
@@ -34344,7 +34780,7 @@
1
2
- 1644952
+ 1644338
@@ -34360,17 +34796,17 @@
1
2
- 1295584
+ 1294537
2
4
- 117122
+ 117265
4
- 28
- 15358
+ 29
+ 15344
@@ -34380,11 +34816,11 @@
jumpinfo
- 348320
+ 348321
id
- 348320
+ 348321
str
@@ -34406,7 +34842,7 @@
1
2
- 348320
+ 348321
@@ -34422,7 +34858,7 @@
1
2
- 348320
+ 348321
@@ -34515,7 +34951,7 @@
2
3
- 36210
+ 36211
3
@@ -34561,19 +34997,19 @@
preprocdirects
- 5413334
+ 5408441
id
- 5413334
+ 5408441
kind
- 1373
+ 1372
location
- 5410088
+ 5405198
@@ -34587,7 +35023,7 @@
1
2
- 5413334
+ 5408441
@@ -34603,7 +35039,7 @@
1
2
- 5413334
+ 5408441
@@ -34751,7 +35187,7 @@
1
2
- 5409963
+ 5405073
27
@@ -34772,7 +35208,7 @@
1
2
- 5410088
+ 5405198
@@ -34782,15 +35218,15 @@
preprocpair
- 1142251
+ 1141219
begin
- 889777
+ 888973
elseelifend
- 1142251
+ 1141219
@@ -34804,17 +35240,17 @@
1
2
- 650164
+ 649576
2
3
- 230622
+ 230414
3
9
- 8990
+ 8982
@@ -34830,7 +35266,7 @@
1
2
- 1142251
+ 1141219
@@ -34840,41 +35276,41 @@
preproctrue
- 439769
+ 439371
branch
- 439769
+ 439371
preprocfalse
- 285562
+ 285304
branch
- 285562
+ 285304
preproctext
- 4356364
+ 4352427
id
- 4356364
+ 4352427
head
- 2957767
+ 2955094
body
- 1684908
+ 1683385
@@ -34888,7 +35324,7 @@
1
2
- 4356364
+ 4352427
@@ -34904,7 +35340,7 @@
1
2
- 4356364
+ 4352427
@@ -34920,12 +35356,12 @@
1
2
- 2758985
+ 2756491
2
798
- 198782
+ 198603
@@ -34941,12 +35377,12 @@
1
2
- 2876481
+ 2873881
2
5
- 81286
+ 81212
@@ -34962,17 +35398,17 @@
1
2
- 1536570
+ 1535182
2
10
- 127360
+ 127245
10
13606
- 20977
+ 20958
@@ -34988,17 +35424,17 @@
1
2
- 1540816
+ 1539423
2
12
- 126986
+ 126871
12
3246
- 17106
+ 17090
@@ -35008,15 +35444,15 @@
includes
- 318629
+ 318610
id
- 318629
+ 318610
included
- 58694
+ 58690
@@ -35030,7 +35466,7 @@
1
2
- 318629
+ 318610
@@ -35046,7 +35482,7 @@
1
2
- 29046
+ 29044
2
@@ -35061,7 +35497,7 @@
4
6
- 5355
+ 5354
6
@@ -35134,11 +35570,11 @@
link_parent
- 30398086
+ 30397027
element
- 3866101
+ 3865967
link_target
@@ -35156,17 +35592,17 @@
1
2
- 530457
+ 530438
2
9
- 26948
+ 26947
9
10
- 3308696
+ 3308580
diff --git a/cpp/ql/lib/upgrades/5340d6d5f428557632b1a50113e406430f29ef7d/old.dbscheme b/cpp/ql/lib/upgrades/5340d6d5f428557632b1a50113e406430f29ef7d/old.dbscheme
new file mode 100644
index 000000000000..5340d6d5f428
--- /dev/null
+++ b/cpp/ql/lib/upgrades/5340d6d5f428557632b1a50113e406430f29ef7d/old.dbscheme
@@ -0,0 +1,2423 @@
+/*- Compilations -*/
+
+/**
+ * An invocation of the compiler. Note that more than one file may be
+ * compiled per invocation. For example, this command compiles three
+ * source files:
+ *
+ * gcc -c f1.c f2.c f3.c
+ *
+ * The `id` simply identifies the invocation, while `cwd` is the working
+ * directory from which the compiler was invoked.
+ */
+compilations(
+ /**
+ * An invocation of the compiler. Note that more than one file may
+ * be compiled per invocation. For example, this command compiles
+ * three source files:
+ *
+ * gcc -c f1.c f2.c f3.c
+ */
+ unique int id : @compilation,
+ string cwd : string ref
+);
+
+/**
+ * The arguments that were passed to the extractor for a compiler
+ * invocation. If `id` is for the compiler invocation
+ *
+ * gcc -c f1.c f2.c f3.c
+ *
+ * then typically there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0 | *path to extractor*
+ * 1 | `--mimic`
+ * 2 | `/usr/bin/gcc`
+ * 3 | `-c`
+ * 4 | f1.c
+ * 5 | f2.c
+ * 6 | f3.c
+ */
+#keyset[id, num]
+compilation_args(
+ int id : @compilation ref,
+ int num : int ref,
+ string arg : string ref
+);
+
+/**
+ * Optionally, record the build mode for each compilation.
+ */
+compilation_build_mode(
+ unique int id : @compilation ref,
+ int mode : int ref
+);
+
+/*
+case @compilation_build_mode.mode of
+ 0 = @build_mode_none
+| 1 = @build_mode_manual
+| 2 = @build_mode_auto
+;
+*/
+
+/**
+ * The source files that are compiled by a compiler invocation.
+ * If `id` is for the compiler invocation
+ *
+ * gcc -c f1.c f2.c f3.c
+ *
+ * then there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0 | f1.c
+ * 1 | f2.c
+ * 2 | f3.c
+ *
+ * Note that even if those files `#include` headers, those headers
+ * do not appear as rows.
+ */
+#keyset[id, num]
+compilation_compiling_files(
+ int id : @compilation ref,
+ int num : int ref,
+ int file : @file ref
+);
+
+/**
+ * The time taken by the extractor for a compiler invocation.
+ *
+ * For each file `num`, there will be rows for
+ *
+ * kind | seconds
+ * ---- | ---
+ * 1 | CPU seconds used by the extractor frontend
+ * 2 | Elapsed seconds during the extractor frontend
+ * 3 | CPU seconds used by the extractor backend
+ * 4 | Elapsed seconds during the extractor backend
+ */
+#keyset[id, num, kind]
+compilation_time(
+ int id : @compilation ref,
+ int num : int ref,
+ /* kind:
+ 1 = frontend_cpu_seconds
+ 2 = frontend_elapsed_seconds
+ 3 = extractor_cpu_seconds
+ 4 = extractor_elapsed_seconds
+ */
+ int kind : int ref,
+ float seconds : float ref
+);
+
+/**
+ * An error or warning generated by the extractor.
+ * The diagnostic message `diagnostic` was generated during compiler
+ * invocation `compilation`, and is the `file_number_diagnostic_number`th
+ * message generated while extracting the `file_number`th file of that
+ * invocation.
+ */
+#keyset[compilation, file_number, file_number_diagnostic_number]
+diagnostic_for(
+ int diagnostic : @diagnostic ref,
+ int compilation : @compilation ref,
+ int file_number : int ref,
+ int file_number_diagnostic_number : int ref
+);
+
+/**
+ * If extraction was successful, then `cpu_seconds` and
+ * `elapsed_seconds` are the CPU time and elapsed time (respectively)
+ * that extraction took for compiler invocation `id`.
+ */
+compilation_finished(
+ unique int id : @compilation ref,
+ float cpu_seconds : float ref,
+ float elapsed_seconds : float ref
+);
+
+/*- External data -*/
+
+/**
+ * External data, loaded from CSV files during snapshot creation. See
+ * [Tutorial: Incorporating external data](https://help.semmle.com/wiki/display/SD/Tutorial%3A+Incorporating+external+data)
+ * for more information.
+ */
+externalData(
+ int id : @externalDataElement,
+ string path : string ref,
+ int column: int ref,
+ string value : string ref
+);
+
+/*- Source location prefix -*/
+
+/**
+ * The source location of the snapshot.
+ */
+sourceLocationPrefix(string prefix : string ref);
+
+/*- Files and folders -*/
+
+/**
+ * The location of an element.
+ * The location spans column `startcolumn` of line `startline` to
+ * column `endcolumn` of line `endline` in file `file`.
+ * For more information, see
+ * [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
+ */
+locations_default(
+ unique int id: @location_default,
+ int file: @file ref,
+ int beginLine: int ref,
+ int beginColumn: int ref,
+ int endLine: int ref,
+ int endColumn: int ref
+);
+
+files(
+ unique int id: @file,
+ string name: string ref
+);
+
+folders(
+ unique int id: @folder,
+ string name: string ref
+);
+
+@container = @file | @folder
+
+containerparent(
+ int parent: @container ref,
+ unique int child: @container ref
+);
+
+/*- Lines of code -*/
+
+numlines(
+ int element_id: @sourceline ref,
+ int num_lines: int ref,
+ int num_code: int ref,
+ int num_comment: int ref
+);
+
+/*- Diagnostic messages -*/
+
+diagnostics(
+ unique int id: @diagnostic,
+ int severity: int ref,
+ string error_tag: string ref,
+ string error_message: string ref,
+ string full_error_message: string ref,
+ int location: @location_default ref
+);
+
+/*- C++ dbscheme -*/
+
+extractor_version(
+ string codeql_version: string ref,
+ string frontend_version: string ref
+)
+
+/** An element for which line-count information is available. */
+@sourceline = @file | @function | @variable | @enumconstant | @xmllocatable;
+
+fileannotations(
+ int id: @file ref,
+ int kind: int ref,
+ string name: string ref,
+ string value: string ref
+);
+
+inmacroexpansion(
+ int id: @element ref,
+ int inv: @macroinvocation ref
+);
+
+affectedbymacroexpansion(
+ int id: @element ref,
+ int inv: @macroinvocation ref
+);
+
+case @macroinvocation.kind of
+ 1 = @macro_expansion
+| 2 = @other_macro_reference
+;
+
+macroinvocations(
+ unique int id: @macroinvocation,
+ int macro_id: @ppd_define ref,
+ int location: @location_default ref,
+ int kind: int ref
+);
+
+macroparent(
+ unique int id: @macroinvocation ref,
+ int parent_id: @macroinvocation ref
+);
+
+// a macroinvocation may be part of another location
+// the way to find a constant expression that uses a macro
+// is thus to find a constant expression that has a location
+// to which a macro invocation is bound
+macrolocationbind(
+ int id: @macroinvocation ref,
+ int location: @location_default ref
+);
+
+#keyset[invocation, argument_index]
+macro_argument_unexpanded(
+ int invocation: @macroinvocation ref,
+ int argument_index: int ref,
+ string text: string ref
+);
+
+#keyset[invocation, argument_index]
+macro_argument_expanded(
+ int invocation: @macroinvocation ref,
+ int argument_index: int ref,
+ string text: string ref
+);
+
+case @function.kind of
+ 0 = @unknown_function
+| 1 = @normal_function
+| 2 = @constructor
+| 3 = @destructor
+| 4 = @conversion_function
+| 5 = @operator
+// ... 6 = @builtin_function deprecated // GCC built-in functions, e.g. __builtin___memcpy_chk
+| 7 = @user_defined_literal
+| 8 = @deduction_guide
+;
+
+functions(
+ unique int id: @function,
+ string name: string ref,
+ int kind: int ref
+);
+
+builtin_functions(
+ int id: @function ref
+)
+
+function_entry_point(
+ int id: @function ref,
+ unique int entry_point: @stmt ref
+);
+
+function_return_type(
+ int id: @function ref,
+ int return_type: @type ref
+);
+
+/**
+ * If `function` is a coroutine, then this gives the `std::experimental::resumable_traits`
+ * instance associated with it, and the variables representing the `handle` and `promise`
+ * for it.
+ */
+coroutine(
+ unique int function: @function ref,
+ int traits: @type ref
+);
+
+/*
+case @coroutine_placeholder_variable.kind of
+ 1 = @handle
+| 2 = @promise
+| 3 = @init_await_resume
+;
+*/
+
+coroutine_placeholder_variable(
+ unique int placeholder_variable: @variable ref,
+ int kind: int ref,
+ int function: @function ref
+)
+
+/** The `new` function used for allocating the coroutine state, if any. */
+coroutine_new(
+ unique int function: @function ref,
+ int new: @function ref
+);
+
+/** The `delete` function used for deallocating the coroutine state, if any. */
+coroutine_delete(
+ unique int function: @function ref,
+ int delete: @function ref
+);
+
+purefunctions(unique int id: @function ref);
+
+function_deleted(unique int id: @function ref);
+
+function_defaulted(unique int id: @function ref);
+
+function_prototyped(unique int id: @function ref)
+
+deduction_guide_for_class(
+ int id: @function ref,
+ int class_template: @usertype ref
+)
+
+member_function_this_type(
+ unique int id: @function ref,
+ int this_type: @type ref
+);
+
+#keyset[id, type_id]
+fun_decls(
+ int id: @fun_decl,
+ int function: @function ref,
+ int type_id: @type ref,
+ string name: string ref,
+ int location: @location_default ref
+);
+fun_def(unique int id: @fun_decl ref);
+fun_specialized(unique int id: @fun_decl ref);
+fun_implicit(unique int id: @fun_decl ref);
+fun_decl_specifiers(
+ int id: @fun_decl ref,
+ string name: string ref
+)
+#keyset[fun_decl, index]
+fun_decl_throws(
+ int fun_decl: @fun_decl ref,
+ int index: int ref,
+ int type_id: @type ref
+);
+/* an empty throw specification is different from none */
+fun_decl_empty_throws(unique int fun_decl: @fun_decl ref);
+fun_decl_noexcept(
+ int fun_decl: @fun_decl ref,
+ int constant: @expr ref
+);
+fun_decl_empty_noexcept(int fun_decl: @fun_decl ref);
+fun_decl_typedef_type(
+ unique int fun_decl: @fun_decl ref,
+ int typedeftype_id: @usertype ref
+);
+
+/*
+case @fun_requires.kind of
+ 1 = @template_attached
+| 2 = @function_attached
+;
+*/
+
+fun_requires(
+ int id: @fun_decl ref,
+ int kind: int ref,
+ int constraint: @expr ref
+);
+
+param_decl_bind(
+ unique int id: @var_decl ref,
+ int index: int ref,
+ int fun_decl: @fun_decl ref
+);
+
+#keyset[id, type_id]
+var_decls(
+ int id: @var_decl,
+ int variable: @variable ref,
+ int type_id: @type ref,
+ string name: string ref,
+ int location: @location_default ref
+);
+var_def(unique int id: @var_decl ref);
+var_specialized(int id: @var_decl ref);
+var_decl_specifiers(
+ int id: @var_decl ref,
+ string name: string ref
+)
+is_structured_binding(unique int id: @variable ref);
+var_requires(
+ int id: @var_decl ref,
+ int constraint: @expr ref
+);
+
+type_decls(
+ unique int id: @type_decl,
+ int type_id: @type ref,
+ int location: @location_default ref
+);
+type_def(unique int id: @type_decl ref);
+type_decl_top(
+ unique int type_decl: @type_decl ref
+);
+type_requires(
+ int id: @type_decl ref,
+ int constraint: @expr ref
+);
+
+namespace_decls(
+ unique int id: @namespace_decl,
+ int namespace_id: @namespace ref,
+ int location: @location_default ref,
+ int bodylocation: @location_default ref
+);
+
+case @using.kind of
+ 1 = @using_declaration
+| 2 = @using_directive
+| 3 = @using_enum_declaration
+;
+
+usings(
+ unique int id: @using,
+ int element_id: @element ref,
+ int location: @location_default ref,
+ int kind: int ref
+);
+
+/** The element which contains the `using` declaration. */
+using_container(
+ int parent: @element ref,
+ int child: @using ref
+);
+
+static_asserts(
+ unique int id: @static_assert,
+ int condition : @expr ref,
+ string message : string ref,
+ int location: @location_default ref,
+ int enclosing : @element ref
+);
+
+// each function has an ordered list of parameters
+#keyset[id, type_id]
+#keyset[function, index, type_id]
+params(
+ int id: @parameter,
+ int function: @parameterized_element ref,
+ int index: int ref,
+ int type_id: @type ref
+);
+
+overrides(
+ int new: @function ref,
+ int old: @function ref
+);
+
+#keyset[id, type_id]
+membervariables(
+ int id: @membervariable,
+ int type_id: @type ref,
+ string name: string ref
+);
+
+#keyset[id, type_id]
+globalvariables(
+ int id: @globalvariable,
+ int type_id: @type ref,
+ string name: string ref
+);
+
+#keyset[id, type_id]
+localvariables(
+ int id: @localvariable,
+ int type_id: @type ref,
+ string name: string ref
+);
+
+autoderivation(
+ unique int var: @variable ref,
+ int derivation_type: @type ref
+);
+
+orphaned_variables(
+ int var: @localvariable ref,
+ int function: @function ref
+)
+
+enumconstants(
+ unique int id: @enumconstant,
+ int parent: @usertype ref,
+ int index: int ref,
+ int type_id: @type ref,
+ string name: string ref,
+ int location: @location_default ref
+);
+
+@variable = @localscopevariable | @globalvariable | @membervariable;
+
+@localscopevariable = @localvariable | @parameter;
+
+/**
+ * Built-in types are the fundamental types, e.g., integral, floating, and void.
+ */
+case @builtintype.kind of
+ 1 = @errortype
+| 2 = @unknowntype
+| 3 = @void
+| 4 = @boolean
+| 5 = @char
+| 6 = @unsigned_char
+| 7 = @signed_char
+| 8 = @short
+| 9 = @unsigned_short
+| 10 = @signed_short
+| 11 = @int
+| 12 = @unsigned_int
+| 13 = @signed_int
+| 14 = @long
+| 15 = @unsigned_long
+| 16 = @signed_long
+| 17 = @long_long
+| 18 = @unsigned_long_long
+| 19 = @signed_long_long
+// ... 20 Microsoft-specific __int8
+// ... 21 Microsoft-specific __int16
+// ... 22 Microsoft-specific __int32
+// ... 23 Microsoft-specific __int64
+| 24 = @float
+| 25 = @double
+| 26 = @long_double
+| 27 = @complex_float // C99-specific _Complex float
+| 28 = @complex_double // C99-specific _Complex double
+| 29 = @complex_long_double // C99-specific _Complex long double
+| 30 = @imaginary_float // C99-specific _Imaginary float
+| 31 = @imaginary_double // C99-specific _Imaginary double
+| 32 = @imaginary_long_double // C99-specific _Imaginary long double
+| 33 = @wchar_t // Microsoft-specific
+| 34 = @decltype_nullptr // C++11
+| 35 = @int128 // __int128
+| 36 = @unsigned_int128 // unsigned __int128
+| 37 = @signed_int128 // signed __int128
+| 38 = @float128 // __float128
+| 39 = @complex_float128 // _Complex __float128
+| 40 = @decimal32 // _Decimal32
+| 41 = @decimal64 // _Decimal64
+| 42 = @decimal128 // _Decimal128
+| 43 = @char16_t
+| 44 = @char32_t
+| 45 = @std_float32 // _Float32
+| 46 = @float32x // _Float32x
+| 47 = @std_float64 // _Float64
+| 48 = @float64x // _Float64x
+| 49 = @std_float128 // _Float128
+// ... 50 _Float128x
+| 51 = @char8_t
+| 52 = @float16 // _Float16
+| 53 = @complex_float16 // _Complex _Float16
+| 54 = @fp16 // __fp16
+| 55 = @std_bfloat16 // __bf16
+| 56 = @std_float16 // std::float16_t
+| 57 = @complex_std_float32 // _Complex _Float32
+| 58 = @complex_float32x // _Complex _Float32x
+| 59 = @complex_std_float64 // _Complex _Float64
+| 60 = @complex_float64x // _Complex _Float64x
+| 61 = @complex_std_float128 // _Complex _Float128
+| 62 = @mfp8 // __mfp8
+| 63 = @scalable_vector_count // __SVCount_t
+| 64 = @complex_fp16 // _Complex __fp16
+| 65 = @complex_std_bfloat16 // _Complex __bf16
+| 66 = @complex_std_float16 // _Complex std::float16_t
+;
+
+builtintypes(
+ unique int id: @builtintype,
+ string name: string ref,
+ int kind: int ref,
+ int size: int ref,
+ int sign: int ref,
+ int alignment: int ref
+);
+
+/**
+ * Derived types are types that are directly derived from existing types and
+ * point to, refer to, transform type data to return a new type.
+ */
+case @derivedtype.kind of
+ 1 = @pointer
+| 2 = @reference
+| 3 = @type_with_specifiers
+| 4 = @array
+| 5 = @gnu_vector
+| 6 = @routineptr
+| 7 = @routinereference
+| 8 = @rvalue_reference // C++11
+// ... 9 type_conforming_to_protocols deprecated
+| 10 = @block
+| 11 = @scalable_vector // Arm SVE
+;
+
+derivedtypes(
+ unique int id: @derivedtype,
+ string name: string ref,
+ int kind: int ref,
+ int type_id: @type ref
+);
+
+pointerishsize(unique int id: @derivedtype ref,
+ int size: int ref,
+ int alignment: int ref);
+
+arraysizes(
+ unique int id: @derivedtype ref,
+ int num_elements: int ref,
+ int bytesize: int ref,
+ int alignment: int ref
+);
+
+tupleelements(
+ unique int id: @derivedtype ref,
+ int num_elements: int ref
+);
+
+typedefbase(
+ unique int id: @usertype ref,
+ int type_id: @type ref
+);
+
+/**
+ * An instance of the C++11 `decltype` operator or C23 `typeof`/`typeof_unqual`
+ * operator taking an expression as its argument. For example:
+ * ```
+ * int a;
+ * decltype(1+a) b;
+ * typeof(1+a) c;
+ * ```
+ * Here `expr` is `1+a`.
+ *
+ * Sometimes an additional pair of parentheses around the expression
+ * changes the semantics of the decltype, e.g.
+ * ```
+ * struct A { double x; };
+ * const A* a = new A();
+ * decltype( a->x ); // type is double
+ * decltype((a->x)); // type is const double&
+ * ```
+ * (Please consult the C++11 standard for more details).
+ * `parentheses_would_change_meaning` is `true` iff that is the case.
+ */
+
+/*
+case @decltype.kind of
+| 0 = @decltype
+| 1 = @typeof // The frontend does not differentiate between typeof and typeof_unqual
+;
+*/
+
+#keyset[id, expr]
+decltypes(
+ int id: @decltype,
+ int expr: @expr ref,
+ int kind: int ref,
+ int base_type: @type ref,
+ boolean parentheses_would_change_meaning: boolean ref
+);
+
+case @type_operator.kind of
+ 0 = @typeof // The frontend does not differentiate between typeof and typeof_unqual
+| 1 = @underlying_type
+| 2 = @bases
+| 3 = @direct_bases
+| 4 = @add_lvalue_reference
+| 5 = @add_pointer
+| 6 = @add_rvalue_reference
+| 7 = @decay
+| 8 = @make_signed
+| 9 = @make_unsigned
+| 10 = @remove_all_extents
+| 11 = @remove_const
+| 12 = @remove_cv
+| 13 = @remove_cvref
+| 14 = @remove_extent
+| 15 = @remove_pointer
+| 16 = @remove_reference_t
+| 17 = @remove_restrict
+| 18 = @remove_volatile
+| 19 = @remove_reference
+;
+
+type_operators(
+ unique int id: @type_operator,
+ int arg_type: @type ref,
+ int kind: int ref,
+ int base_type: @type ref
+)
+
+case @usertype.kind of
+ 0 = @unknown_usertype
+| 1 = @struct
+| 2 = @class
+| 3 = @union
+| 4 = @enum
+// ... 5 = @typedef deprecated // classic C: typedef typedef type name
+// ... 6 = @template deprecated
+| 7 = @template_parameter
+| 8 = @template_template_parameter
+| 9 = @proxy_class // a proxy class associated with a template parameter
+// ... 10 objc_class deprecated
+// ... 11 objc_protocol deprecated
+// ... 12 objc_category deprecated
+| 13 = @scoped_enum
+// ... 14 = @using_alias deprecated // a using name = type style typedef
+| 15 = @template_struct
+| 16 = @template_class
+| 17 = @template_union
+| 18 = @alias
+;
+
+usertypes(
+ unique int id: @usertype,
+ string name: string ref,
+ int kind: int ref
+);
+
+usertypesize(
+ unique int id: @usertype ref,
+ int size: int ref,
+ int alignment: int ref
+);
+
+usertype_final(unique int id: @usertype ref);
+
+usertype_uuid(
+ unique int id: @usertype ref,
+ string uuid: string ref
+);
+
+/*
+case @usertype.alias_kind of
+| 0 = @typedef
+| 1 = @alias
+*/
+
+usertype_alias_kind(
+ int id: @usertype ref,
+ int alias_kind: int ref
+)
+
+nontype_template_parameters(
+ int id: @expr ref
+);
+
+type_template_type_constraint(
+ int id: @usertype ref,
+ int constraint: @expr ref
+);
+
+mangled_name(
+ unique int id: @declaration ref,
+ int mangled_name : @mangledname,
+ boolean is_complete: boolean ref
+);
+
+is_pod_class(unique int id: @usertype ref);
+is_standard_layout_class(unique int id: @usertype ref);
+
+is_complete(unique int id: @usertype ref);
+
+is_class_template(unique int id: @usertype ref);
+class_instantiation(
+ int to: @usertype ref,
+ int from: @usertype ref
+);
+class_template_argument(
+ int type_id: @usertype ref,
+ int index: int ref,
+ int arg_type: @type ref
+);
+class_template_argument_value(
+ int type_id: @usertype ref,
+ int index: int ref,
+ int arg_value: @expr ref
+);
+
+@user_or_decltype = @usertype | @decltype;
+
+is_proxy_class_for(
+ unique int id: @usertype ref,
+ int templ_param_id: @user_or_decltype ref
+);
+
+type_mentions(
+ unique int id: @type_mention,
+ int type_id: @type ref,
+ int location: @location_default ref,
+ // a_symbol_reference_kind from the frontend.
+ int kind: int ref
+);
+
+is_function_template(unique int id: @function ref);
+function_instantiation(
+ unique int to: @function ref,
+ int from: @function ref
+);
+function_template_argument(
+ int function_id: @function ref,
+ int index: int ref,
+ int arg_type: @type ref
+);
+function_template_argument_value(
+ int function_id: @function ref,
+ int index: int ref,
+ int arg_value: @expr ref
+);
+
+is_variable_template(unique int id: @variable ref);
+variable_instantiation(
+ unique int to: @variable ref,
+ int from: @variable ref
+);
+variable_template_argument(
+ int variable_id: @variable ref,
+ int index: int ref,
+ int arg_type: @type ref
+);
+variable_template_argument_value(
+ int variable_id: @variable ref,
+ int index: int ref,
+ int arg_value: @expr ref
+);
+
+template_template_instantiation(
+ int to: @usertype ref,
+ int from: @usertype ref
+);
+template_template_argument(
+ int type_id: @usertype ref,
+ int index: int ref,
+ int arg_type: @type ref
+);
+template_template_argument_value(
+ int type_id: @usertype ref,
+ int index: int ref,
+ int arg_value: @expr ref
+);
+
+@concept = @concept_template | @concept_id;
+
+concept_templates(
+ unique int concept_id: @concept_template,
+ string name: string ref,
+ int location: @location_default ref
+);
+concept_instantiation(
+ unique int to: @concept_id ref,
+ int from: @concept_template ref
+);
+is_type_constraint(int concept_id: @concept_id ref);
+concept_template_argument(
+ int concept_id: @concept ref,
+ int index: int ref,
+ int arg_type: @type ref
+);
+concept_template_argument_value(
+ int concept_id: @concept ref,
+ int index: int ref,
+ int arg_value: @expr ref
+);
+
+routinetypes(
+ unique int id: @routinetype,
+ int return_type: @type ref
+);
+
+routinetypeargs(
+ int routine: @routinetype ref,
+ int index: int ref,
+ int type_id: @type ref
+);
+
+ptrtomembers(
+ unique int id: @ptrtomember,
+ int type_id: @type ref,
+ int class_id: @type ref
+);
+
+/*
+ specifiers for types, functions, and variables
+
+ "public",
+ "protected",
+ "private",
+
+ "const",
+ "volatile",
+ "static",
+
+ "pure",
+ "virtual",
+ "sealed", // Microsoft
+ "__interface", // Microsoft
+ "inline",
+ "explicit",
+
+ "near", // near far extension
+ "far", // near far extension
+ "__ptr32", // Microsoft
+ "__ptr64", // Microsoft
+ "__sptr", // Microsoft
+ "__uptr", // Microsoft
+ "dllimport", // Microsoft
+ "dllexport", // Microsoft
+ "thread", // Microsoft
+ "naked", // Microsoft
+ "microsoft_inline", // Microsoft
+ "forceinline", // Microsoft
+ "selectany", // Microsoft
+ "nothrow", // Microsoft
+ "novtable", // Microsoft
+ "noreturn", // Microsoft
+ "noinline", // Microsoft
+ "noalias", // Microsoft
+ "restrict", // Microsoft
+*/
+
+specifiers(
+ unique int id: @specifier,
+ unique string str: string ref
+);
+
+typespecifiers(
+ int type_id: @type ref,
+ int spec_id: @specifier ref
+);
+
+funspecifiers(
+ int func_id: @function ref,
+ int spec_id: @specifier ref
+);
+
+varspecifiers(
+ int var_id: @accessible ref,
+ int spec_id: @specifier ref
+);
+
+explicit_specifier_exprs(
+ unique int func_id: @function ref,
+ int constant: @expr ref
+)
+
+attributes(
+ unique int id: @attribute,
+ int kind: int ref,
+ string name: string ref,
+ string name_space: string ref,
+ int location: @location_default ref
+);
+
+case @attribute.kind of
+ 0 = @gnuattribute
+| 1 = @stdattribute
+| 2 = @declspec
+| 3 = @msattribute
+| 4 = @alignas
+// ... 5 @objc_propertyattribute deprecated
+;
+
+attribute_args(
+ unique int id: @attribute_arg,
+ int kind: int ref,
+ int attribute: @attribute ref,
+ int index: int ref,
+ int location: @location_default ref
+);
+
+case @attribute_arg.kind of
+ 0 = @attribute_arg_empty
+| 1 = @attribute_arg_token
+| 2 = @attribute_arg_constant
+| 3 = @attribute_arg_type
+| 4 = @attribute_arg_constant_expr
+| 5 = @attribute_arg_expr
+;
+
+attribute_arg_value(
+ unique int arg: @attribute_arg ref,
+ string value: string ref
+);
+attribute_arg_type(
+ unique int arg: @attribute_arg ref,
+ int type_id: @type ref
+);
+attribute_arg_constant(
+ unique int arg: @attribute_arg ref,
+ int constant: @expr ref
+)
+attribute_arg_expr(
+ unique int arg: @attribute_arg ref,
+ int expr: @expr ref
+)
+attribute_arg_name(
+ unique int arg: @attribute_arg ref,
+ string name: string ref
+);
+
+typeattributes(
+ int type_id: @type ref,
+ int spec_id: @attribute ref
+);
+
+funcattributes(
+ int func_id: @function ref,
+ int spec_id: @attribute ref
+);
+
+varattributes(
+ int var_id: @accessible ref,
+ int spec_id: @attribute ref
+);
+
+namespaceattributes(
+ int namespace_id: @namespace ref,
+ int spec_id: @attribute ref
+);
+
+stmtattributes(
+ int stmt_id: @stmt ref,
+ int spec_id: @attribute ref
+);
+
+@type = @builtintype
+ | @derivedtype
+ | @usertype
+ | @routinetype
+ | @ptrtomember
+ | @decltype
+ | @type_operator;
+
+unspecifiedtype(
+ unique int type_id: @type ref,
+ int unspecified_type_id: @type ref
+);
+
+member(
+ int parent: @type ref,
+ int index: int ref,
+ int child: @member ref
+);
+
+@enclosingfunction_child = @usertype | @variable | @namespace
+
+enclosingfunction(
+ unique int child: @enclosingfunction_child ref,
+ int parent: @function ref
+);
+
+derivations(
+ unique int derivation: @derivation,
+ int sub: @type ref,
+ int index: int ref,
+ int super: @type ref,
+ int location: @location_default ref
+);
+
+derspecifiers(
+ int der_id: @derivation ref,
+ int spec_id: @specifier ref
+);
+
+/**
+ * Contains the byte offset of the base class subobject within the derived
+ * class. Only holds for non-virtual base classes, but see table
+ * `virtual_base_offsets` for offsets of virtual base class subobjects.
+ */
+direct_base_offsets(
+ unique int der_id: @derivation ref,
+ int offset: int ref
+);
+
+/**
+ * Contains the byte offset of the virtual base class subobject for class
+ * `super` within a most-derived object of class `sub`. `super` can be either a
+ * direct or indirect base class.
+ */
+#keyset[sub, super]
+virtual_base_offsets(
+ int sub: @usertype ref,
+ int super: @usertype ref,
+ int offset: int ref
+);
+
+frienddecls(
+ unique int id: @frienddecl,
+ int type_id: @type ref,
+ int decl_id: @declaration ref,
+ int location: @location_default ref
+);
+
+@declaredtype = @usertype ;
+
+@declaration = @function
+ | @declaredtype
+ | @variable
+ | @enumconstant
+ | @frienddecl
+ | @concept_template;
+
+@member = @membervariable
+ | @function
+ | @declaredtype
+ | @enumconstant;
+
+@locatable = @diagnostic
+ | @declaration
+ | @ppd_include
+ | @ppd_define
+ | @macroinvocation
+ /*| @funcall*/
+ | @xmllocatable
+ | @attribute
+ | @attribute_arg;
+
+@namedscope = @namespace | @usertype;
+
+@element = @locatable
+ | @file
+ | @folder
+ | @specifier
+ | @type
+ | @expr
+ | @namespace
+ | @initialiser
+ | @stmt
+ | @derivation
+ | @comment
+ | @preprocdirect
+ | @fun_decl
+ | @var_decl
+ | @type_decl
+ | @namespace_decl
+ | @using
+ | @namequalifier
+ | @specialnamequalifyingelement
+ | @static_assert
+ | @type_mention
+ | @lambdacapture;
+
+@exprparent = @element;
+
+comments(
+ unique int id: @comment,
+ string contents: string ref,
+ int location: @location_default ref
+);
+
+commentbinding(
+ int id: @comment ref,
+ int element: @element ref
+);
+
+exprconv(
+ int converted: @expr ref,
+ unique int conversion: @expr ref
+);
+
+compgenerated(unique int id: @element ref);
+
+/**
+ * `destructor_call` destructs the `i`'th entity that should be
+ * destructed following `element`. Note that entities should be
+ * destructed in reverse construction order, so for a given `element`
+ * these should be called from highest to lowest `i`.
+ */
+#keyset[element, destructor_call]
+#keyset[element, i]
+synthetic_destructor_call(
+ int element: @element ref,
+ int i: int ref,
+ int destructor_call: @routineexpr ref
+);
+
+namespaces(
+ unique int id: @namespace,
+ string name: string ref
+);
+
+namespace_inline(
+ unique int id: @namespace ref
+);
+
+namespacembrs(
+ int parentid: @namespace ref,
+ unique int memberid: @namespacembr ref
+);
+
+@namespacembr = @declaration | @namespace;
+
+exprparents(
+ int expr_id: @expr ref,
+ int child_index: int ref,
+ int parent_id: @exprparent ref
+);
+
+expr_isload(unique int expr_id: @expr ref);
+
+@cast = @c_style_cast
+ | @const_cast
+ | @dynamic_cast
+ | @reinterpret_cast
+ | @static_cast
+ ;
+
+/*
+case @conversion.kind of
+ 0 = @simple_conversion // a numeric conversion, qualification conversion, or a reinterpret_cast
+| 1 = @bool_conversion // conversion to 'bool'
+| 2 = @base_class_conversion // a derived-to-base conversion
+| 3 = @derived_class_conversion // a base-to-derived conversion
+| 4 = @pm_base_class_conversion // a derived-to-base conversion of a pointer to member
+| 5 = @pm_derived_class_conversion // a base-to-derived conversion of a pointer to member
+| 6 = @glvalue_adjust // an adjustment of the type of a glvalue
+| 7 = @prvalue_adjust // an adjustment of the type of a prvalue
+;
+*/
+/**
+ * Describes the semantics represented by a cast expression. This is largely
+ * independent of the source syntax of the cast, so it is separate from the
+ * regular expression kind.
+ */
+conversionkinds(
+ unique int expr_id: @cast ref,
+ int kind: int ref
+);
+
+@conversion = @cast
+ | @array_to_pointer
+ | @parexpr
+ | @reference_to
+ | @ref_indirect
+ | @temp_init
+ | @c11_generic
+ ;
+
+/*
+case @funbindexpr.kind of
+ 0 = @normal_call // a normal call
+| 1 = @virtual_call // a virtual call
+| 2 = @adl_call // a call whose target is only found by ADL
+;
+*/
+iscall(
+ unique int caller: @funbindexpr ref,
+ int kind: int ref
+);
+
+numtemplatearguments(
+ unique int expr_id: @expr ref,
+ int num: int ref
+);
+
+specialnamequalifyingelements(
+ unique int id: @specialnamequalifyingelement,
+ unique string name: string ref
+);
+
+@namequalifiableelement = @expr | @namequalifier;
+@namequalifyingelement = @namespace
+ | @specialnamequalifyingelement
+ | @usertype;
+
+namequalifiers(
+ unique int id: @namequalifier,
+ unique int qualifiableelement: @namequalifiableelement ref,
+ int qualifyingelement: @namequalifyingelement ref,
+ int location: @location_default ref
+);
+
+varbind(
+ int expr: @varbindexpr ref,
+ int var: @accessible ref
+);
+
+funbind(
+ int expr: @funbindexpr ref,
+ int fun: @function ref
+);
+
+@any_new_expr = @new_expr
+ | @new_array_expr;
+
+@new_or_delete_expr = @any_new_expr
+ | @delete_expr
+ | @delete_array_expr;
+
+@prefix_crement_expr = @preincrexpr | @predecrexpr;
+
+@postfix_crement_expr = @postincrexpr | @postdecrexpr;
+
+@increment_expr = @preincrexpr | @postincrexpr;
+
+@decrement_expr = @predecrexpr | @postdecrexpr;
+
+@crement_expr = @increment_expr | @decrement_expr;
+
+@un_arith_op_expr = @arithnegexpr
+ | @unaryplusexpr
+ | @conjugation
+ | @realpartexpr
+ | @imagpartexpr
+ | @crement_expr
+ ;
+
+@un_bitwise_op_expr = @complementexpr;
+
+@un_log_op_expr = @notexpr;
+
+@un_op_expr = @address_of
+ | @indirect
+ | @un_arith_op_expr
+ | @un_bitwise_op_expr
+ | @builtinaddressof
+ | @vec_fill
+ | @un_log_op_expr
+ | @co_await
+ | @co_yield
+ ;
+
+@bin_log_op_expr = @andlogicalexpr | @orlogicalexpr;
+
+@cmp_op_expr = @eq_op_expr | @rel_op_expr;
+
+@eq_op_expr = @eqexpr | @neexpr;
+
+@rel_op_expr = @gtexpr
+ | @ltexpr
+ | @geexpr
+ | @leexpr
+ | @spaceshipexpr
+ ;
+
+@bin_bitwise_op_expr = @lshiftexpr
+ | @rshiftexpr
+ | @andexpr
+ | @orexpr
+ | @xorexpr
+ ;
+
+@p_arith_op_expr = @paddexpr
+ | @psubexpr
+ | @pdiffexpr
+ ;
+
+@bin_arith_op_expr = @addexpr
+ | @subexpr
+ | @mulexpr
+ | @divexpr
+ | @remexpr
+ | @jmulexpr
+ | @jdivexpr
+ | @fjaddexpr
+ | @jfaddexpr
+ | @fjsubexpr
+ | @jfsubexpr
+ | @minexpr
+ | @maxexpr
+ | @p_arith_op_expr
+ ;
+
+@bin_op_expr = @bin_arith_op_expr
+ | @bin_bitwise_op_expr
+ | @cmp_op_expr
+ | @bin_log_op_expr
+ ;
+
+@op_expr = @un_op_expr
+ | @bin_op_expr
+ | @assign_expr
+ | @conditionalexpr
+ ;
+
+@assign_arith_expr = @assignaddexpr
+ | @assignsubexpr
+ | @assignmulexpr
+ | @assigndivexpr
+ | @assignremexpr
+ ;
+
+@assign_bitwise_expr = @assignandexpr
+ | @assignorexpr
+ | @assignxorexpr
+ | @assignlshiftexpr
+ | @assignrshiftexpr
+ ;
+
+@assign_pointer_expr = @assignpaddexpr
+ | @assignpsubexpr
+ ;
+
+@assign_op_expr = @assign_arith_expr
+ | @assign_bitwise_expr
+ | @assign_pointer_expr
+ ;
+
+@assign_expr = @assignexpr | @assign_op_expr | @blockassignexpr
+
+/*
+ Binary encoding of the allocator form.
+
+ case @allocator.form of
+ 0 = plain
+ | 1 = alignment
+ ;
+*/
+
+/**
+ * The allocator function associated with a `new` or `new[]` expression.
+ * The `form` column specified whether the allocation call contains an alignment
+ * argument.
+ */
+expr_allocator(
+ unique int expr: @any_new_expr ref,
+ int func: @function ref,
+ int form: int ref
+);
+
+/*
+ Binary encoding of the deallocator form.
+
+ case @deallocator.form of
+ 0 = plain
+ | 1 = size
+ | 2 = alignment
+ | 4 = destroying_delete
+ ;
+*/
+
+/**
+ * The deallocator function associated with a `delete`, `delete[]`, `new`, or
+ * `new[]` expression. For a `new` or `new[]` expression, the deallocator is the
+ * one used to free memory if the initialization throws an exception.
+ * The `form` column specifies whether the deallocation call contains a size
+ * argument, and alignment argument, or both.
+ */
+expr_deallocator(
+ unique int expr: @new_or_delete_expr ref,
+ int func: @function ref,
+ int form: int ref
+);
+
+/**
+ * Holds if the `@conditionalexpr` is of the two operand form
+ * `guard ? : false`.
+ */
+expr_cond_two_operand(
+ unique int cond: @conditionalexpr ref
+);
+
+/**
+ * The guard of `@conditionalexpr` `guard ? true : false`
+ */
+expr_cond_guard(
+ unique int cond: @conditionalexpr ref,
+ int guard: @expr ref
+);
+
+/**
+ * The expression used when the guard of `@conditionalexpr`
+ * `guard ? true : false` holds. For the two operand form
+ * `guard ?: false` consider using `expr_cond_guard` instead.
+ */
+expr_cond_true(
+ unique int cond: @conditionalexpr ref,
+ int true: @expr ref
+);
+
+/**
+ * The expression used when the guard of `@conditionalexpr`
+ * `guard ? true : false` does not hold.
+ */
+expr_cond_false(
+ unique int cond: @conditionalexpr ref,
+ int false: @expr ref
+);
+
+/** A string representation of the value. */
+values(
+ unique int id: @value,
+ string str: string ref
+);
+
+/** The actual text in the source code for the value, if any. */
+valuetext(
+ unique int id: @value ref,
+ string text: string ref
+);
+
+valuebind(
+ int val: @value ref,
+ unique int expr: @expr ref
+);
+
+fieldoffsets(
+ unique int id: @variable ref,
+ int byteoffset: int ref,
+ int bitoffset: int ref
+);
+
+bitfield(
+ unique int id: @variable ref,
+ int bits: int ref,
+ int declared_bits: int ref
+);
+
+/* TODO
+memberprefix(
+ int member: @expr ref,
+ int prefix: @expr ref
+);
+*/
+
+/*
+ kind(1) = mbrcallexpr
+ kind(2) = mbrptrcallexpr
+ kind(3) = mbrptrmbrcallexpr
+ kind(4) = ptrmbrptrmbrcallexpr
+ kind(5) = mbrreadexpr // x.y
+ kind(6) = mbrptrreadexpr // p->y
+ kind(7) = mbrptrmbrreadexpr // x.*pm
+ kind(8) = mbrptrmbrptrreadexpr // x->*pm
+ kind(9) = staticmbrreadexpr // static x.y
+ kind(10) = staticmbrptrreadexpr // static p->y
+*/
+/* TODO
+memberaccess(
+ int member: @expr ref,
+ int kind: int ref
+);
+*/
+
+initialisers(
+ unique int init: @initialiser,
+ int var: @accessible ref,
+ unique int expr: @expr ref,
+ int location: @location_default ref
+);
+
+braced_initialisers(
+ int init: @initialiser ref
+);
+
+/**
+ * An ancestor for the expression, for cases in which we cannot
+ * otherwise find the expression's parent.
+ */
+expr_ancestor(
+ int exp: @expr ref,
+ int ancestor: @element ref
+);
+
+exprs(
+ unique int id: @expr,
+ int kind: int ref,
+ int location: @location_default ref
+);
+
+expr_reuse(
+ int reuse: @expr ref,
+ int original: @expr ref,
+ int value_category: int ref
+)
+
+/*
+ case @value.category of
+ 1 = prval
+ | 2 = xval
+ | 3 = lval
+ ;
+*/
+expr_types(
+ int id: @expr ref,
+ int typeid: @type ref,
+ int value_category: int ref
+);
+
+case @expr.kind of
+ 1 = @errorexpr
+| 2 = @address_of // & AddressOfExpr
+| 3 = @reference_to // ReferenceToExpr (implicit?)
+| 4 = @indirect // * PointerDereferenceExpr
+| 5 = @ref_indirect // ReferenceDereferenceExpr (implicit?)
+// ...
+| 8 = @array_to_pointer // (???)
+| 9 = @vacuous_destructor_call // VacuousDestructorCall
+// ...
+| 11 = @assume // Microsoft
+| 12 = @parexpr
+| 13 = @arithnegexpr
+| 14 = @unaryplusexpr
+| 15 = @complementexpr
+| 16 = @notexpr
+| 17 = @conjugation // GNU ~ operator
+| 18 = @realpartexpr // GNU __real
+| 19 = @imagpartexpr // GNU __imag
+| 20 = @postincrexpr
+| 21 = @postdecrexpr
+| 22 = @preincrexpr
+| 23 = @predecrexpr
+| 24 = @conditionalexpr
+| 25 = @addexpr
+| 26 = @subexpr
+| 27 = @mulexpr
+| 28 = @divexpr
+| 29 = @remexpr
+| 30 = @jmulexpr // C99 mul imaginary
+| 31 = @jdivexpr // C99 div imaginary
+| 32 = @fjaddexpr // C99 add real + imaginary
+| 33 = @jfaddexpr // C99 add imaginary + real
+| 34 = @fjsubexpr // C99 sub real - imaginary
+| 35 = @jfsubexpr // C99 sub imaginary - real
+| 36 = @paddexpr // pointer add (pointer + int or int + pointer)
+| 37 = @psubexpr // pointer sub (pointer - integer)
+| 38 = @pdiffexpr // difference between two pointers
+| 39 = @lshiftexpr
+| 40 = @rshiftexpr
+| 41 = @andexpr
+| 42 = @orexpr
+| 43 = @xorexpr
+| 44 = @eqexpr
+| 45 = @neexpr
+| 46 = @gtexpr
+| 47 = @ltexpr
+| 48 = @geexpr
+| 49 = @leexpr
+| 50 = @minexpr // GNU minimum
+| 51 = @maxexpr // GNU maximum
+| 52 = @assignexpr
+| 53 = @assignaddexpr
+| 54 = @assignsubexpr
+| 55 = @assignmulexpr
+| 56 = @assigndivexpr
+| 57 = @assignremexpr
+| 58 = @assignlshiftexpr
+| 59 = @assignrshiftexpr
+| 60 = @assignandexpr
+| 61 = @assignorexpr
+| 62 = @assignxorexpr
+| 63 = @assignpaddexpr // assign pointer add
+| 64 = @assignpsubexpr // assign pointer sub
+| 65 = @andlogicalexpr
+| 66 = @orlogicalexpr
+| 67 = @commaexpr
+| 68 = @subscriptexpr // access to member of an array, e.g., a[5]
+// ... 69 @objc_subscriptexpr deprecated
+// ... 70 @cmdaccess deprecated
+// ...
+| 73 = @virtfunptrexpr
+| 74 = @callexpr
+// ... 75 @msgexpr_normal deprecated
+// ... 76 @msgexpr_super deprecated
+// ... 77 @atselectorexpr deprecated
+// ... 78 @atprotocolexpr deprecated
+| 79 = @vastartexpr
+| 80 = @vaargexpr
+| 81 = @vaendexpr
+| 82 = @vacopyexpr
+// ... 83 @atencodeexpr deprecated
+| 84 = @varaccess
+| 85 = @thisaccess
+// ... 86 @objc_box_expr deprecated
+| 87 = @new_expr
+| 88 = @delete_expr
+| 89 = @throw_expr
+| 90 = @condition_decl // a variable declared in a condition, e.g., if(int x = y > 2)
+| 91 = @braced_init_list
+| 92 = @type_id
+| 93 = @runtime_sizeof
+| 94 = @runtime_alignof
+| 95 = @sizeof_pack
+| 96 = @expr_stmt // GNU extension
+| 97 = @routineexpr
+| 98 = @type_operand // used to access a type in certain contexts (haven't found any examples yet....)
+| 99 = @offsetofexpr // offsetof ::= type and field
+| 100 = @hasassignexpr // __has_assign ::= type
+| 101 = @hascopyexpr // __has_copy ::= type
+| 102 = @hasnothrowassign // __has_nothrow_assign ::= type
+| 103 = @hasnothrowconstr // __has_nothrow_constructor ::= type
+| 104 = @hasnothrowcopy // __has_nothrow_copy ::= type
+| 105 = @hastrivialassign // __has_trivial_assign ::= type
+| 106 = @hastrivialconstr // __has_trivial_constructor ::= type
+| 107 = @hastrivialcopy // __has_trivial_copy ::= type
+| 108 = @hasuserdestr // __has_user_destructor ::= type
+| 109 = @hasvirtualdestr // __has_virtual_destructor ::= type
+| 110 = @isabstractexpr // __is_abstract ::= type
+| 111 = @isbaseofexpr // __is_base_of ::= type type
+| 112 = @isclassexpr // __is_class ::= type
+| 113 = @isconvtoexpr // __is_convertible_to ::= type type
+| 114 = @isemptyexpr // __is_empty ::= type
+| 115 = @isenumexpr // __is_enum ::= type
+| 116 = @ispodexpr // __is_pod ::= type
+| 117 = @ispolyexpr // __is_polymorphic ::= type
+| 118 = @isunionexpr // __is_union ::= type
+| 119 = @typescompexpr // GNU __builtin_types_compatible ::= type type
+| 120 = @intaddrexpr // frontend internal builtin, used to implement offsetof
+// ...
+| 122 = @hastrivialdestructor // __has_trivial_destructor ::= type
+| 123 = @literal
+| 124 = @uuidof
+| 127 = @aggregateliteral
+| 128 = @delete_array_expr
+| 129 = @new_array_expr
+// ... 130 @objc_array_literal deprecated
+// ... 131 @objc_dictionary_literal deprecated
+| 132 = @foldexpr
+// ...
+| 200 = @ctordirectinit
+| 201 = @ctorvirtualinit
+| 202 = @ctorfieldinit
+| 203 = @ctordelegatinginit
+| 204 = @dtordirectdestruct
+| 205 = @dtorvirtualdestruct
+| 206 = @dtorfielddestruct
+// ...
+| 210 = @static_cast
+| 211 = @reinterpret_cast
+| 212 = @const_cast
+| 213 = @dynamic_cast
+| 214 = @c_style_cast
+| 215 = @lambdaexpr
+| 216 = @param_ref
+| 217 = @noopexpr
+// ...
+| 294 = @istriviallyconstructibleexpr
+| 295 = @isdestructibleexpr
+| 296 = @isnothrowdestructibleexpr
+| 297 = @istriviallydestructibleexpr
+| 298 = @istriviallyassignableexpr
+| 299 = @isnothrowassignableexpr
+| 300 = @istrivialexpr
+| 301 = @isstandardlayoutexpr
+| 302 = @istriviallycopyableexpr
+| 303 = @isliteraltypeexpr
+| 304 = @hastrivialmoveconstructorexpr
+| 305 = @hastrivialmoveassignexpr
+| 306 = @hasnothrowmoveassignexpr
+| 307 = @isconstructibleexpr
+| 308 = @isnothrowconstructibleexpr
+| 309 = @hasfinalizerexpr
+| 310 = @isdelegateexpr
+| 311 = @isinterfaceclassexpr
+| 312 = @isrefarrayexpr
+| 313 = @isrefclassexpr
+| 314 = @issealedexpr
+| 315 = @issimplevalueclassexpr
+| 316 = @isvalueclassexpr
+| 317 = @isfinalexpr
+| 319 = @noexceptexpr
+| 320 = @builtinshufflevector
+| 321 = @builtinchooseexpr
+| 322 = @builtinaddressof
+| 323 = @vec_fill
+| 324 = @builtinconvertvector
+| 325 = @builtincomplex
+| 326 = @spaceshipexpr
+| 327 = @co_await
+| 328 = @co_yield
+| 329 = @temp_init
+| 330 = @isassignable
+| 331 = @isaggregate
+| 332 = @hasuniqueobjectrepresentations
+| 333 = @builtinbitcast
+| 334 = @builtinshuffle
+| 335 = @blockassignexpr
+| 336 = @issame
+| 337 = @isfunction
+| 338 = @islayoutcompatible
+| 339 = @ispointerinterconvertiblebaseof
+| 340 = @isarray
+| 341 = @arrayrank
+| 342 = @arrayextent
+| 343 = @isarithmetic
+| 344 = @iscompletetype
+| 345 = @iscompound
+| 346 = @isconst
+| 347 = @isfloatingpoint
+| 348 = @isfundamental
+| 349 = @isintegral
+| 350 = @islvaluereference
+| 351 = @ismemberfunctionpointer
+| 352 = @ismemberobjectpointer
+| 353 = @ismemberpointer
+| 354 = @isobject
+| 355 = @ispointer
+| 356 = @isreference
+| 357 = @isrvaluereference
+| 358 = @isscalar
+| 359 = @issigned
+| 360 = @isunsigned
+| 361 = @isvoid
+| 362 = @isvolatile
+| 363 = @reuseexpr
+| 364 = @istriviallycopyassignable
+| 365 = @isassignablenopreconditioncheck
+| 366 = @referencebindstotemporary
+| 367 = @issameas
+| 368 = @builtinhasattribute
+| 369 = @ispointerinterconvertiblewithclass
+| 370 = @builtinispointerinterconvertiblewithclass
+| 371 = @iscorrespondingmember
+| 372 = @builtiniscorrespondingmember
+| 373 = @isboundedarray
+| 374 = @isunboundedarray
+| 375 = @isreferenceable
+| 378 = @isnothrowconvertible
+| 379 = @referenceconstructsfromtemporary
+| 380 = @referenceconvertsfromtemporary
+| 381 = @isconvertible
+| 382 = @isvalidwinrttype
+| 383 = @iswinclass
+| 384 = @iswininterface
+| 385 = @istriviallyequalitycomparable
+| 386 = @isscopedenum
+| 387 = @istriviallyrelocatable
+| 388 = @datasizeof
+| 389 = @c11_generic
+| 390 = @requires_expr
+| 391 = @nested_requirement
+| 392 = @compound_requirement
+| 393 = @concept_id
+;
+
+@var_args_expr = @vastartexpr
+ | @vaendexpr
+ | @vaargexpr
+ | @vacopyexpr
+ ;
+
+@builtin_op = @var_args_expr
+ | @noopexpr
+ | @offsetofexpr
+ | @intaddrexpr
+ | @hasassignexpr
+ | @hascopyexpr
+ | @hasnothrowassign
+ | @hasnothrowconstr
+ | @hasnothrowcopy
+ | @hastrivialassign
+ | @hastrivialconstr
+ | @hastrivialcopy
+ | @hastrivialdestructor
+ | @hasuserdestr
+ | @hasvirtualdestr
+ | @isabstractexpr
+ | @isbaseofexpr
+ | @isclassexpr
+ | @isconvtoexpr
+ | @isemptyexpr
+ | @isenumexpr
+ | @ispodexpr
+ | @ispolyexpr
+ | @isunionexpr
+ | @typescompexpr
+ | @builtinshufflevector
+ | @builtinconvertvector
+ | @builtinaddressof
+ | @istriviallyconstructibleexpr
+ | @isdestructibleexpr
+ | @isnothrowdestructibleexpr
+ | @istriviallydestructibleexpr
+ | @istriviallyassignableexpr
+ | @isnothrowassignableexpr
+ | @istrivialexpr
+ | @isstandardlayoutexpr
+ | @istriviallycopyableexpr
+ | @isliteraltypeexpr
+ | @hastrivialmoveconstructorexpr
+ | @hastrivialmoveassignexpr
+ | @hasnothrowmoveassignexpr
+ | @isconstructibleexpr
+ | @isnothrowconstructibleexpr
+ | @hasfinalizerexpr
+ | @isdelegateexpr
+ | @isinterfaceclassexpr
+ | @isrefarrayexpr
+ | @isrefclassexpr
+ | @issealedexpr
+ | @issimplevalueclassexpr
+ | @isvalueclassexpr
+ | @isfinalexpr
+ | @builtinchooseexpr
+ | @builtincomplex
+ | @isassignable
+ | @isaggregate
+ | @hasuniqueobjectrepresentations
+ | @builtinbitcast
+ | @builtinshuffle
+ | @issame
+ | @isfunction
+ | @islayoutcompatible
+ | @ispointerinterconvertiblebaseof
+ | @isarray
+ | @arrayrank
+ | @arrayextent
+ | @isarithmetic
+ | @iscompletetype
+ | @iscompound
+ | @isconst
+ | @isfloatingpoint
+ | @isfundamental
+ | @isintegral
+ | @islvaluereference
+ | @ismemberfunctionpointer
+ | @ismemberobjectpointer
+ | @ismemberpointer
+ | @isobject
+ | @ispointer
+ | @isreference
+ | @isrvaluereference
+ | @isscalar
+ | @issigned
+ | @isunsigned
+ | @isvoid
+ | @isvolatile
+ | @istriviallycopyassignable
+ | @isassignablenopreconditioncheck
+ | @referencebindstotemporary
+ | @issameas
+ | @builtinhasattribute
+ | @ispointerinterconvertiblewithclass
+ | @builtinispointerinterconvertiblewithclass
+ | @iscorrespondingmember
+ | @builtiniscorrespondingmember
+ | @isboundedarray
+ | @isunboundedarray
+ | @isreferenceable
+ | @isnothrowconvertible
+ | @referenceconstructsfromtemporary
+ | @referenceconvertsfromtemporary
+ | @isconvertible
+ | @isvalidwinrttype
+ | @iswinclass
+ | @iswininterface
+ | @istriviallyequalitycomparable
+ | @isscopedenum
+ | @istriviallyrelocatable
+ ;
+
+compound_requirement_is_noexcept(
+ int expr: @compound_requirement ref
+);
+
+new_allocated_type(
+ unique int expr: @new_expr ref,
+ int type_id: @type ref
+);
+
+new_array_allocated_type(
+ unique int expr: @new_array_expr ref,
+ int type_id: @type ref
+);
+
+/**
+ * The field being initialized by an initializer expression within an aggregate
+ * initializer for a class/struct/union. Position is used to sort repeated initializers.
+ */
+#keyset[aggregate, position]
+aggregate_field_init(
+ int aggregate: @aggregateliteral ref,
+ int initializer: @expr ref,
+ int field: @membervariable ref,
+ int position: int ref,
+ boolean is_designated: boolean ref
+);
+
+/**
+ * The index of the element being initialized by an initializer expression
+ * within an aggregate initializer for an array. Position is used to sort repeated initializers.
+ */
+#keyset[aggregate, position]
+aggregate_array_init(
+ int aggregate: @aggregateliteral ref,
+ int initializer: @expr ref,
+ int element_index: int ref,
+ int position: int ref,
+ boolean is_designated: boolean ref
+);
+
+@ctorinit = @ctordirectinit
+ | @ctorvirtualinit
+ | @ctorfieldinit
+ | @ctordelegatinginit;
+@dtordestruct = @dtordirectdestruct
+ | @dtorvirtualdestruct
+ | @dtorfielddestruct;
+
+
+condition_decl_bind(
+ unique int expr: @condition_decl ref,
+ unique int decl: @declaration ref
+);
+
+typeid_bind(
+ unique int expr: @type_id ref,
+ int type_id: @type ref
+);
+
+uuidof_bind(
+ unique int expr: @uuidof ref,
+ int type_id: @type ref
+);
+
+@sizeof_or_alignof = @runtime_sizeof | @runtime_alignof | @datasizeof | @sizeof_pack;
+
+sizeof_bind(
+ unique int expr: @sizeof_or_alignof ref,
+ int type_id: @type ref
+);
+
+code_block(
+ unique int block: @literal ref,
+ unique int routine: @function ref
+);
+
+lambdas(
+ unique int expr: @lambdaexpr ref,
+ string default_capture: string ref,
+ boolean has_explicit_return_type: boolean ref,
+ boolean has_explicit_parameter_list: boolean ref
+);
+
+lambda_capture(
+ unique int id: @lambdacapture,
+ int lambda: @lambdaexpr ref,
+ int index: int ref,
+ int field: @membervariable ref,
+ boolean captured_by_reference: boolean ref,
+ boolean is_implicit: boolean ref,
+ int location: @location_default ref
+);
+
+@funbindexpr = @routineexpr
+ | @new_expr
+ | @delete_expr
+ | @delete_array_expr
+ | @ctordirectinit
+ | @ctorvirtualinit
+ | @ctordelegatinginit
+ | @dtordirectdestruct
+ | @dtorvirtualdestruct;
+
+@varbindexpr = @varaccess | @ctorfieldinit | @dtorfielddestruct;
+@addressable = @function | @variable ;
+@accessible = @addressable | @enumconstant ;
+
+@access = @varaccess | @routineexpr ;
+
+fold(
+ int expr: @foldexpr ref,
+ string operator: string ref,
+ boolean is_left_fold: boolean ref
+);
+
+stmts(
+ unique int id: @stmt,
+ int kind: int ref,
+ int location: @location_default ref
+);
+
+case @stmt.kind of
+ 1 = @stmt_expr
+| 2 = @stmt_if
+| 3 = @stmt_while
+| 4 = @stmt_goto
+| 5 = @stmt_label
+| 6 = @stmt_return
+| 7 = @stmt_block
+| 8 = @stmt_end_test_while // do { ... } while ( ... )
+| 9 = @stmt_for
+| 10 = @stmt_switch_case
+| 11 = @stmt_switch
+| 13 = @stmt_asm // "asm" statement or the body of an asm function
+| 15 = @stmt_try_block
+| 16 = @stmt_microsoft_try // Microsoft
+| 17 = @stmt_decl
+| 18 = @stmt_set_vla_size // C99
+| 19 = @stmt_vla_decl // C99
+| 25 = @stmt_assigned_goto // GNU
+| 26 = @stmt_empty
+| 27 = @stmt_continue
+| 28 = @stmt_break
+| 29 = @stmt_range_based_for // C++11
+// ... 30 @stmt_at_autoreleasepool_block deprecated
+// ... 31 @stmt_objc_for_in deprecated
+// ... 32 @stmt_at_synchronized deprecated
+| 33 = @stmt_handler
+// ... 34 @stmt_finally_end deprecated
+| 35 = @stmt_constexpr_if
+| 37 = @stmt_co_return
+| 38 = @stmt_consteval_if
+| 39 = @stmt_not_consteval_if
+| 40 = @stmt_leave
+;
+
+type_vla(
+ int type_id: @type ref,
+ int decl: @stmt_vla_decl ref
+);
+
+variable_vla(
+ int var: @variable ref,
+ int decl: @stmt_vla_decl ref
+);
+
+type_is_vla(unique int type_id: @derivedtype ref)
+
+if_initialization(
+ unique int if_stmt: @stmt_if ref,
+ int init_id: @stmt ref
+);
+
+if_then(
+ unique int if_stmt: @stmt_if ref,
+ int then_id: @stmt ref
+);
+
+if_else(
+ unique int if_stmt: @stmt_if ref,
+ int else_id: @stmt ref
+);
+
+constexpr_if_initialization(
+ unique int constexpr_if_stmt: @stmt_constexpr_if ref,
+ int init_id: @stmt ref
+);
+
+constexpr_if_then(
+ unique int constexpr_if_stmt: @stmt_constexpr_if ref,
+ int then_id: @stmt ref
+);
+
+constexpr_if_else(
+ unique int constexpr_if_stmt: @stmt_constexpr_if ref,
+ int else_id: @stmt ref
+);
+
+@stmt_consteval_or_not_consteval_if = @stmt_consteval_if | @stmt_not_consteval_if;
+
+consteval_if_then(
+ unique int constexpr_if_stmt: @stmt_consteval_or_not_consteval_if ref,
+ int then_id: @stmt ref
+);
+
+consteval_if_else(
+ unique int constexpr_if_stmt: @stmt_consteval_or_not_consteval_if ref,
+ int else_id: @stmt ref
+);
+
+while_body(
+ unique int while_stmt: @stmt_while ref,
+ int body_id: @stmt ref
+);
+
+do_body(
+ unique int do_stmt: @stmt_end_test_while ref,
+ int body_id: @stmt ref
+);
+
+switch_initialization(
+ unique int switch_stmt: @stmt_switch ref,
+ int init_id: @stmt ref
+);
+
+#keyset[switch_stmt, index]
+switch_case(
+ int switch_stmt: @stmt_switch ref,
+ int index: int ref,
+ int case_id: @stmt_switch_case ref
+);
+
+switch_body(
+ unique int switch_stmt: @stmt_switch ref,
+ int body_id: @stmt ref
+);
+
+@stmt_for_or_range_based_for = @stmt_for
+ | @stmt_range_based_for;
+
+for_initialization(
+ unique int for_stmt: @stmt_for_or_range_based_for ref,
+ int init_id: @stmt ref
+);
+
+for_condition(
+ unique int for_stmt: @stmt_for ref,
+ int condition_id: @expr ref
+);
+
+for_update(
+ unique int for_stmt: @stmt_for ref,
+ int update_id: @expr ref
+);
+
+for_body(
+ unique int for_stmt: @stmt_for ref,
+ int body_id: @stmt ref
+);
+
+@stmtparent = @stmt | @expr_stmt ;
+stmtparents(
+ unique int id: @stmt ref,
+ int index: int ref,
+ int parent: @stmtparent ref
+);
+
+ishandler(unique int block: @stmt_block ref);
+
+@cfgnode = @stmt | @expr | @function | @initialiser ;
+
+stmt_decl_bind(
+ int stmt: @stmt_decl ref,
+ int num: int ref,
+ int decl: @declaration ref
+);
+
+stmt_decl_entry_bind(
+ int stmt: @stmt_decl ref,
+ int num: int ref,
+ int decl_entry: @element ref
+);
+
+@parameterized_element = @function | @stmt_block | @requires_expr;
+
+blockscope(
+ unique int block: @stmt_block ref,
+ int enclosing: @parameterized_element ref
+);
+
+@jump = @stmt_goto | @stmt_break | @stmt_continue | @stmt_leave;
+
+@jumporlabel = @jump | @stmt_label | @literal;
+
+jumpinfo(
+ unique int id: @jumporlabel ref,
+ string str: string ref,
+ int target: @stmt ref
+);
+
+preprocdirects(
+ unique int id: @preprocdirect,
+ int kind: int ref,
+ int location: @location_default ref
+);
+case @preprocdirect.kind of
+ 0 = @ppd_if
+| 1 = @ppd_ifdef
+| 2 = @ppd_ifndef
+| 3 = @ppd_elif
+| 4 = @ppd_else
+| 5 = @ppd_endif
+| 6 = @ppd_plain_include
+| 7 = @ppd_define
+| 8 = @ppd_undef
+| 9 = @ppd_line
+| 10 = @ppd_error
+| 11 = @ppd_pragma
+| 12 = @ppd_objc_import
+| 13 = @ppd_include_next
+| 14 = @ppd_ms_import
+| 15 = @ppd_elifdef
+| 16 = @ppd_elifndef
+| 18 = @ppd_warning
+;
+
+@ppd_include = @ppd_plain_include | @ppd_objc_import | @ppd_include_next | @ppd_ms_import;
+
+@ppd_branch = @ppd_if | @ppd_ifdef | @ppd_ifndef | @ppd_elif | @ppd_elifdef | @ppd_elifndef;
+
+preprocpair(
+ int begin : @ppd_branch ref,
+ int elseelifend : @preprocdirect ref
+);
+
+preproctrue(int branch : @ppd_branch ref);
+preprocfalse(int branch : @ppd_branch ref);
+
+preproctext(
+ unique int id: @preprocdirect ref,
+ string head: string ref,
+ string body: string ref
+);
+
+includes(
+ unique int id: @ppd_include ref,
+ int included: @file ref
+);
+
+link_targets(
+ int id: @link_target,
+ int binary: @file ref
+);
+
+link_parent(
+ int element : @element ref,
+ int link_target : @link_target ref
+);
+
+/*- XML Files -*/
+
+xmlEncoding(
+ unique int id: @file ref,
+ string encoding: string ref
+);
+
+xmlDTDs(
+ unique int id: @xmldtd,
+ string root: string ref,
+ string publicId: string ref,
+ string systemId: string ref,
+ int fileid: @file ref
+);
+
+xmlElements(
+ unique int id: @xmlelement,
+ string name: string ref,
+ int parentid: @xmlparent ref,
+ int idx: int ref,
+ int fileid: @file ref
+);
+
+xmlAttrs(
+ unique int id: @xmlattribute,
+ int elementid: @xmlelement ref,
+ string name: string ref,
+ string value: string ref,
+ int idx: int ref,
+ int fileid: @file ref
+);
+
+xmlNs(
+ int id: @xmlnamespace,
+ string prefixName: string ref,
+ string URI: string ref,
+ int fileid: @file ref
+);
+
+xmlHasNs(
+ int elementId: @xmlnamespaceable ref,
+ int nsId: @xmlnamespace ref,
+ int fileid: @file ref
+);
+
+xmlComments(
+ unique int id: @xmlcomment,
+ string text: string ref,
+ int parentid: @xmlparent ref,
+ int fileid: @file ref
+);
+
+xmlChars(
+ unique int id: @xmlcharacters,
+ string text: string ref,
+ int parentid: @xmlparent ref,
+ int idx: int ref,
+ int isCDATA: int ref,
+ int fileid: @file ref
+);
+
+@xmlparent = @file | @xmlelement;
+@xmlnamespaceable = @xmlelement | @xmlattribute;
+
+xmllocations(
+ int xmlElement: @xmllocatable ref,
+ int location: @location_default ref
+);
+
+@xmllocatable = @xmlcharacters | @xmlelement | @xmlcomment | @xmlattribute | @xmldtd | @file | @xmlnamespace;
diff --git a/cpp/ql/lib/upgrades/5340d6d5f428557632b1a50113e406430f29ef7d/semmlecode.cpp.dbscheme b/cpp/ql/lib/upgrades/5340d6d5f428557632b1a50113e406430f29ef7d/semmlecode.cpp.dbscheme
new file mode 100644
index 000000000000..c16b29b27f71
--- /dev/null
+++ b/cpp/ql/lib/upgrades/5340d6d5f428557632b1a50113e406430f29ef7d/semmlecode.cpp.dbscheme
@@ -0,0 +1,2436 @@
+/*- Compilations -*/
+
+/**
+ * An invocation of the compiler. Note that more than one file may be
+ * compiled per invocation. For example, this command compiles three
+ * source files:
+ *
+ * gcc -c f1.c f2.c f3.c
+ *
+ * The `id` simply identifies the invocation, while `cwd` is the working
+ * directory from which the compiler was invoked.
+ */
+compilations(
+ /**
+ * An invocation of the compiler. Note that more than one file may
+ * be compiled per invocation. For example, this command compiles
+ * three source files:
+ *
+ * gcc -c f1.c f2.c f3.c
+ */
+ unique int id : @compilation,
+ string cwd : string ref
+);
+
+/**
+ * The arguments that were passed to the extractor for a compiler
+ * invocation. If `id` is for the compiler invocation
+ *
+ * gcc -c f1.c f2.c f3.c
+ *
+ * then typically there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0 | *path to extractor*
+ * 1 | `--mimic`
+ * 2 | `/usr/bin/gcc`
+ * 3 | `-c`
+ * 4 | f1.c
+ * 5 | f2.c
+ * 6 | f3.c
+ */
+#keyset[id, num]
+compilation_args(
+ int id : @compilation ref,
+ int num : int ref,
+ string arg : string ref
+);
+
+/**
+ * Optionally, record the build mode for each compilation.
+ */
+compilation_build_mode(
+ unique int id : @compilation ref,
+ int mode : int ref
+);
+
+/*
+case @compilation_build_mode.mode of
+ 0 = @build_mode_none
+| 1 = @build_mode_manual
+| 2 = @build_mode_auto
+;
+*/
+
+/**
+ * The source files that are compiled by a compiler invocation.
+ * If `id` is for the compiler invocation
+ *
+ * gcc -c f1.c f2.c f3.c
+ *
+ * then there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0 | f1.c
+ * 1 | f2.c
+ * 2 | f3.c
+ *
+ * Note that even if those files `#include` headers, those headers
+ * do not appear as rows.
+ */
+#keyset[id, num]
+compilation_compiling_files(
+ int id : @compilation ref,
+ int num : int ref,
+ int file : @file ref
+);
+
+/**
+ * The time taken by the extractor for a compiler invocation.
+ *
+ * For each file `num`, there will be rows for
+ *
+ * kind | seconds
+ * ---- | ---
+ * 1 | CPU seconds used by the extractor frontend
+ * 2 | Elapsed seconds during the extractor frontend
+ * 3 | CPU seconds used by the extractor backend
+ * 4 | Elapsed seconds during the extractor backend
+ */
+#keyset[id, num, kind]
+compilation_time(
+ int id : @compilation ref,
+ int num : int ref,
+ /* kind:
+ 1 = frontend_cpu_seconds
+ 2 = frontend_elapsed_seconds
+ 3 = extractor_cpu_seconds
+ 4 = extractor_elapsed_seconds
+ */
+ int kind : int ref,
+ float seconds : float ref
+);
+
+/**
+ * An error or warning generated by the extractor.
+ * The diagnostic message `diagnostic` was generated during compiler
+ * invocation `compilation`, and is the `file_number_diagnostic_number`th
+ * message generated while extracting the `file_number`th file of that
+ * invocation.
+ */
+#keyset[compilation, file_number, file_number_diagnostic_number]
+diagnostic_for(
+ int diagnostic : @diagnostic ref,
+ int compilation : @compilation ref,
+ int file_number : int ref,
+ int file_number_diagnostic_number : int ref
+);
+
+/**
+ * If extraction was successful, then `cpu_seconds` and
+ * `elapsed_seconds` are the CPU time and elapsed time (respectively)
+ * that extraction took for compiler invocation `id`.
+ */
+compilation_finished(
+ unique int id : @compilation ref,
+ float cpu_seconds : float ref,
+ float elapsed_seconds : float ref
+);
+
+/*- External data -*/
+
+/**
+ * External data, loaded from CSV files during snapshot creation. See
+ * [Tutorial: Incorporating external data](https://help.semmle.com/wiki/display/SD/Tutorial%3A+Incorporating+external+data)
+ * for more information.
+ */
+externalData(
+ int id : @externalDataElement,
+ string path : string ref,
+ int column: int ref,
+ string value : string ref
+);
+
+/*- Source location prefix -*/
+
+/**
+ * The source location of the snapshot.
+ */
+sourceLocationPrefix(string prefix : string ref);
+
+/*- Files and folders -*/
+
+/**
+ * The location of an element.
+ * The location spans column `startcolumn` of line `startline` to
+ * column `endcolumn` of line `endline` in file `file`.
+ * For more information, see
+ * [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
+ */
+locations_default(
+ unique int id: @location_default,
+ int file: @file ref,
+ int beginLine: int ref,
+ int beginColumn: int ref,
+ int endLine: int ref,
+ int endColumn: int ref
+);
+
+files(
+ unique int id: @file,
+ string name: string ref
+);
+
+folders(
+ unique int id: @folder,
+ string name: string ref
+);
+
+@container = @file | @folder
+
+containerparent(
+ int parent: @container ref,
+ unique int child: @container ref
+);
+
+/*- Lines of code -*/
+
+numlines(
+ int element_id: @sourceline ref,
+ int num_lines: int ref,
+ int num_code: int ref,
+ int num_comment: int ref
+);
+
+/*- Diagnostic messages -*/
+
+diagnostics(
+ unique int id: @diagnostic,
+ int severity: int ref,
+ string error_tag: string ref,
+ string error_message: string ref,
+ string full_error_message: string ref,
+ int location: @location_default ref
+);
+
+/*- C++ dbscheme -*/
+
+extractor_version(
+ string codeql_version: string ref,
+ string frontend_version: string ref
+)
+
+pch_uses(
+ int pch: @pch ref,
+ int compilation: @compilation ref,
+ int id: @file ref
+)
+
+#keyset[pch, compilation]
+pch_creations(
+ int pch: @pch,
+ int compilation: @compilation ref,
+ int from: @file ref
+)
+
+/** An element for which line-count information is available. */
+@sourceline = @file | @function | @variable | @enumconstant | @xmllocatable;
+
+fileannotations(
+ int id: @file ref,
+ int kind: int ref,
+ string name: string ref,
+ string value: string ref
+);
+
+inmacroexpansion(
+ int id: @element ref,
+ int inv: @macroinvocation ref
+);
+
+affectedbymacroexpansion(
+ int id: @element ref,
+ int inv: @macroinvocation ref
+);
+
+case @macroinvocation.kind of
+ 1 = @macro_expansion
+| 2 = @other_macro_reference
+;
+
+macroinvocations(
+ unique int id: @macroinvocation,
+ int macro_id: @ppd_define ref,
+ int location: @location_default ref,
+ int kind: int ref
+);
+
+macroparent(
+ unique int id: @macroinvocation ref,
+ int parent_id: @macroinvocation ref
+);
+
+// a macroinvocation may be part of another location
+// the way to find a constant expression that uses a macro
+// is thus to find a constant expression that has a location
+// to which a macro invocation is bound
+macrolocationbind(
+ int id: @macroinvocation ref,
+ int location: @location_default ref
+);
+
+#keyset[invocation, argument_index]
+macro_argument_unexpanded(
+ int invocation: @macroinvocation ref,
+ int argument_index: int ref,
+ string text: string ref
+);
+
+#keyset[invocation, argument_index]
+macro_argument_expanded(
+ int invocation: @macroinvocation ref,
+ int argument_index: int ref,
+ string text: string ref
+);
+
+case @function.kind of
+ 0 = @unknown_function
+| 1 = @normal_function
+| 2 = @constructor
+| 3 = @destructor
+| 4 = @conversion_function
+| 5 = @operator
+// ... 6 = @builtin_function deprecated // GCC built-in functions, e.g. __builtin___memcpy_chk
+| 7 = @user_defined_literal
+| 8 = @deduction_guide
+;
+
+functions(
+ unique int id: @function,
+ string name: string ref,
+ int kind: int ref
+);
+
+builtin_functions(
+ int id: @function ref
+)
+
+function_entry_point(
+ int id: @function ref,
+ unique int entry_point: @stmt ref
+);
+
+function_return_type(
+ int id: @function ref,
+ int return_type: @type ref
+);
+
+/**
+ * If `function` is a coroutine, then this gives the `std::experimental::resumable_traits`
+ * instance associated with it, and the variables representing the `handle` and `promise`
+ * for it.
+ */
+coroutine(
+ unique int function: @function ref,
+ int traits: @type ref
+);
+
+/*
+case @coroutine_placeholder_variable.kind of
+ 1 = @handle
+| 2 = @promise
+| 3 = @init_await_resume
+;
+*/
+
+coroutine_placeholder_variable(
+ unique int placeholder_variable: @variable ref,
+ int kind: int ref,
+ int function: @function ref
+)
+
+/** The `new` function used for allocating the coroutine state, if any. */
+coroutine_new(
+ unique int function: @function ref,
+ int new: @function ref
+);
+
+/** The `delete` function used for deallocating the coroutine state, if any. */
+coroutine_delete(
+ unique int function: @function ref,
+ int delete: @function ref
+);
+
+purefunctions(unique int id: @function ref);
+
+function_deleted(unique int id: @function ref);
+
+function_defaulted(unique int id: @function ref);
+
+function_prototyped(unique int id: @function ref)
+
+deduction_guide_for_class(
+ int id: @function ref,
+ int class_template: @usertype ref
+)
+
+member_function_this_type(
+ unique int id: @function ref,
+ int this_type: @type ref
+);
+
+#keyset[id, type_id]
+fun_decls(
+ int id: @fun_decl,
+ int function: @function ref,
+ int type_id: @type ref,
+ string name: string ref,
+ int location: @location_default ref
+);
+fun_def(unique int id: @fun_decl ref);
+fun_specialized(unique int id: @fun_decl ref);
+fun_implicit(unique int id: @fun_decl ref);
+fun_decl_specifiers(
+ int id: @fun_decl ref,
+ string name: string ref
+)
+#keyset[fun_decl, index]
+fun_decl_throws(
+ int fun_decl: @fun_decl ref,
+ int index: int ref,
+ int type_id: @type ref
+);
+/* an empty throw specification is different from none */
+fun_decl_empty_throws(unique int fun_decl: @fun_decl ref);
+fun_decl_noexcept(
+ int fun_decl: @fun_decl ref,
+ int constant: @expr ref
+);
+fun_decl_empty_noexcept(int fun_decl: @fun_decl ref);
+fun_decl_typedef_type(
+ unique int fun_decl: @fun_decl ref,
+ int typedeftype_id: @usertype ref
+);
+
+/*
+case @fun_requires.kind of
+ 1 = @template_attached
+| 2 = @function_attached
+;
+*/
+
+fun_requires(
+ int id: @fun_decl ref,
+ int kind: int ref,
+ int constraint: @expr ref
+);
+
+param_decl_bind(
+ unique int id: @var_decl ref,
+ int index: int ref,
+ int fun_decl: @fun_decl ref
+);
+
+#keyset[id, type_id]
+var_decls(
+ int id: @var_decl,
+ int variable: @variable ref,
+ int type_id: @type ref,
+ string name: string ref,
+ int location: @location_default ref
+);
+var_def(unique int id: @var_decl ref);
+var_specialized(int id: @var_decl ref);
+var_decl_specifiers(
+ int id: @var_decl ref,
+ string name: string ref
+)
+is_structured_binding(unique int id: @variable ref);
+var_requires(
+ int id: @var_decl ref,
+ int constraint: @expr ref
+);
+
+type_decls(
+ unique int id: @type_decl,
+ int type_id: @type ref,
+ int location: @location_default ref
+);
+type_def(unique int id: @type_decl ref);
+type_decl_top(
+ unique int type_decl: @type_decl ref
+);
+type_requires(
+ int id: @type_decl ref,
+ int constraint: @expr ref
+);
+
+namespace_decls(
+ unique int id: @namespace_decl,
+ int namespace_id: @namespace ref,
+ int location: @location_default ref,
+ int bodylocation: @location_default ref
+);
+
+case @using.kind of
+ 1 = @using_declaration
+| 2 = @using_directive
+| 3 = @using_enum_declaration
+;
+
+usings(
+ unique int id: @using,
+ int element_id: @element ref,
+ int location: @location_default ref,
+ int kind: int ref
+);
+
+/** The element which contains the `using` declaration. */
+using_container(
+ int parent: @element ref,
+ int child: @using ref
+);
+
+static_asserts(
+ unique int id: @static_assert,
+ int condition : @expr ref,
+ string message : string ref,
+ int location: @location_default ref,
+ int enclosing : @element ref
+);
+
+// each function has an ordered list of parameters
+#keyset[id, type_id]
+#keyset[function, index, type_id]
+params(
+ int id: @parameter,
+ int function: @parameterized_element ref,
+ int index: int ref,
+ int type_id: @type ref
+);
+
+overrides(
+ int new: @function ref,
+ int old: @function ref
+);
+
+#keyset[id, type_id]
+membervariables(
+ int id: @membervariable,
+ int type_id: @type ref,
+ string name: string ref
+);
+
+#keyset[id, type_id]
+globalvariables(
+ int id: @globalvariable,
+ int type_id: @type ref,
+ string name: string ref
+);
+
+#keyset[id, type_id]
+localvariables(
+ int id: @localvariable,
+ int type_id: @type ref,
+ string name: string ref
+);
+
+autoderivation(
+ unique int var: @variable ref,
+ int derivation_type: @type ref
+);
+
+orphaned_variables(
+ int var: @localvariable ref,
+ int function: @function ref
+)
+
+enumconstants(
+ unique int id: @enumconstant,
+ int parent: @usertype ref,
+ int index: int ref,
+ int type_id: @type ref,
+ string name: string ref,
+ int location: @location_default ref
+);
+
+@variable = @localscopevariable | @globalvariable | @membervariable;
+
+@localscopevariable = @localvariable | @parameter;
+
+/**
+ * Built-in types are the fundamental types, e.g., integral, floating, and void.
+ */
+case @builtintype.kind of
+ 1 = @errortype
+| 2 = @unknowntype
+| 3 = @void
+| 4 = @boolean
+| 5 = @char
+| 6 = @unsigned_char
+| 7 = @signed_char
+| 8 = @short
+| 9 = @unsigned_short
+| 10 = @signed_short
+| 11 = @int
+| 12 = @unsigned_int
+| 13 = @signed_int
+| 14 = @long
+| 15 = @unsigned_long
+| 16 = @signed_long
+| 17 = @long_long
+| 18 = @unsigned_long_long
+| 19 = @signed_long_long
+// ... 20 Microsoft-specific __int8
+// ... 21 Microsoft-specific __int16
+// ... 22 Microsoft-specific __int32
+// ... 23 Microsoft-specific __int64
+| 24 = @float
+| 25 = @double
+| 26 = @long_double
+| 27 = @complex_float // C99-specific _Complex float
+| 28 = @complex_double // C99-specific _Complex double
+| 29 = @complex_long_double // C99-specific _Complex long double
+| 30 = @imaginary_float // C99-specific _Imaginary float
+| 31 = @imaginary_double // C99-specific _Imaginary double
+| 32 = @imaginary_long_double // C99-specific _Imaginary long double
+| 33 = @wchar_t // Microsoft-specific
+| 34 = @decltype_nullptr // C++11
+| 35 = @int128 // __int128
+| 36 = @unsigned_int128 // unsigned __int128
+| 37 = @signed_int128 // signed __int128
+| 38 = @float128 // __float128
+| 39 = @complex_float128 // _Complex __float128
+| 40 = @decimal32 // _Decimal32
+| 41 = @decimal64 // _Decimal64
+| 42 = @decimal128 // _Decimal128
+| 43 = @char16_t
+| 44 = @char32_t
+| 45 = @std_float32 // _Float32
+| 46 = @float32x // _Float32x
+| 47 = @std_float64 // _Float64
+| 48 = @float64x // _Float64x
+| 49 = @std_float128 // _Float128
+// ... 50 _Float128x
+| 51 = @char8_t
+| 52 = @float16 // _Float16
+| 53 = @complex_float16 // _Complex _Float16
+| 54 = @fp16 // __fp16
+| 55 = @std_bfloat16 // __bf16
+| 56 = @std_float16 // std::float16_t
+| 57 = @complex_std_float32 // _Complex _Float32
+| 58 = @complex_float32x // _Complex _Float32x
+| 59 = @complex_std_float64 // _Complex _Float64
+| 60 = @complex_float64x // _Complex _Float64x
+| 61 = @complex_std_float128 // _Complex _Float128
+| 62 = @mfp8 // __mfp8
+| 63 = @scalable_vector_count // __SVCount_t
+| 64 = @complex_fp16 // _Complex __fp16
+| 65 = @complex_std_bfloat16 // _Complex __bf16
+| 66 = @complex_std_float16 // _Complex std::float16_t
+;
+
+builtintypes(
+ unique int id: @builtintype,
+ string name: string ref,
+ int kind: int ref,
+ int size: int ref,
+ int sign: int ref,
+ int alignment: int ref
+);
+
+/**
+ * Derived types are types that are directly derived from existing types and
+ * point to, refer to, transform type data to return a new type.
+ */
+case @derivedtype.kind of
+ 1 = @pointer
+| 2 = @reference
+| 3 = @type_with_specifiers
+| 4 = @array
+| 5 = @gnu_vector
+| 6 = @routineptr
+| 7 = @routinereference
+| 8 = @rvalue_reference // C++11
+// ... 9 type_conforming_to_protocols deprecated
+| 10 = @block
+| 11 = @scalable_vector // Arm SVE
+;
+
+derivedtypes(
+ unique int id: @derivedtype,
+ string name: string ref,
+ int kind: int ref,
+ int type_id: @type ref
+);
+
+pointerishsize(unique int id: @derivedtype ref,
+ int size: int ref,
+ int alignment: int ref);
+
+arraysizes(
+ unique int id: @derivedtype ref,
+ int num_elements: int ref,
+ int bytesize: int ref,
+ int alignment: int ref
+);
+
+tupleelements(
+ unique int id: @derivedtype ref,
+ int num_elements: int ref
+);
+
+typedefbase(
+ unique int id: @usertype ref,
+ int type_id: @type ref
+);
+
+/**
+ * An instance of the C++11 `decltype` operator or C23 `typeof`/`typeof_unqual`
+ * operator taking an expression as its argument. For example:
+ * ```
+ * int a;
+ * decltype(1+a) b;
+ * typeof(1+a) c;
+ * ```
+ * Here `expr` is `1+a`.
+ *
+ * Sometimes an additional pair of parentheses around the expression
+ * changes the semantics of the decltype, e.g.
+ * ```
+ * struct A { double x; };
+ * const A* a = new A();
+ * decltype( a->x ); // type is double
+ * decltype((a->x)); // type is const double&
+ * ```
+ * (Please consult the C++11 standard for more details).
+ * `parentheses_would_change_meaning` is `true` iff that is the case.
+ */
+
+/*
+case @decltype.kind of
+| 0 = @decltype
+| 1 = @typeof // The frontend does not differentiate between typeof and typeof_unqual
+;
+*/
+
+#keyset[id, expr]
+decltypes(
+ int id: @decltype,
+ int expr: @expr ref,
+ int kind: int ref,
+ int base_type: @type ref,
+ boolean parentheses_would_change_meaning: boolean ref
+);
+
+case @type_operator.kind of
+ 0 = @typeof // The frontend does not differentiate between typeof and typeof_unqual
+| 1 = @underlying_type
+| 2 = @bases
+| 3 = @direct_bases
+| 4 = @add_lvalue_reference
+| 5 = @add_pointer
+| 6 = @add_rvalue_reference
+| 7 = @decay
+| 8 = @make_signed
+| 9 = @make_unsigned
+| 10 = @remove_all_extents
+| 11 = @remove_const
+| 12 = @remove_cv
+| 13 = @remove_cvref
+| 14 = @remove_extent
+| 15 = @remove_pointer
+| 16 = @remove_reference_t
+| 17 = @remove_restrict
+| 18 = @remove_volatile
+| 19 = @remove_reference
+;
+
+type_operators(
+ unique int id: @type_operator,
+ int arg_type: @type ref,
+ int kind: int ref,
+ int base_type: @type ref
+)
+
+case @usertype.kind of
+ 0 = @unknown_usertype
+| 1 = @struct
+| 2 = @class
+| 3 = @union
+| 4 = @enum
+// ... 5 = @typedef deprecated // classic C: typedef typedef type name
+// ... 6 = @template deprecated
+| 7 = @template_parameter
+| 8 = @template_template_parameter
+| 9 = @proxy_class // a proxy class associated with a template parameter
+// ... 10 objc_class deprecated
+// ... 11 objc_protocol deprecated
+// ... 12 objc_category deprecated
+| 13 = @scoped_enum
+// ... 14 = @using_alias deprecated // a using name = type style typedef
+| 15 = @template_struct
+| 16 = @template_class
+| 17 = @template_union
+| 18 = @alias
+;
+
+usertypes(
+ unique int id: @usertype,
+ string name: string ref,
+ int kind: int ref
+);
+
+usertypesize(
+ unique int id: @usertype ref,
+ int size: int ref,
+ int alignment: int ref
+);
+
+usertype_final(unique int id: @usertype ref);
+
+usertype_uuid(
+ unique int id: @usertype ref,
+ string uuid: string ref
+);
+
+/*
+case @usertype.alias_kind of
+| 0 = @typedef
+| 1 = @alias
+*/
+
+usertype_alias_kind(
+ int id: @usertype ref,
+ int alias_kind: int ref
+)
+
+nontype_template_parameters(
+ int id: @expr ref
+);
+
+type_template_type_constraint(
+ int id: @usertype ref,
+ int constraint: @expr ref
+);
+
+mangled_name(
+ unique int id: @declaration ref,
+ int mangled_name : @mangledname,
+ boolean is_complete: boolean ref
+);
+
+is_pod_class(unique int id: @usertype ref);
+is_standard_layout_class(unique int id: @usertype ref);
+
+is_complete(unique int id: @usertype ref);
+
+is_class_template(unique int id: @usertype ref);
+class_instantiation(
+ int to: @usertype ref,
+ int from: @usertype ref
+);
+class_template_argument(
+ int type_id: @usertype ref,
+ int index: int ref,
+ int arg_type: @type ref
+);
+class_template_argument_value(
+ int type_id: @usertype ref,
+ int index: int ref,
+ int arg_value: @expr ref
+);
+
+@user_or_decltype = @usertype | @decltype;
+
+is_proxy_class_for(
+ unique int id: @usertype ref,
+ int templ_param_id: @user_or_decltype ref
+);
+
+type_mentions(
+ unique int id: @type_mention,
+ int type_id: @type ref,
+ int location: @location_default ref,
+ // a_symbol_reference_kind from the frontend.
+ int kind: int ref
+);
+
+is_function_template(unique int id: @function ref);
+function_instantiation(
+ unique int to: @function ref,
+ int from: @function ref
+);
+function_template_argument(
+ int function_id: @function ref,
+ int index: int ref,
+ int arg_type: @type ref
+);
+function_template_argument_value(
+ int function_id: @function ref,
+ int index: int ref,
+ int arg_value: @expr ref
+);
+
+is_variable_template(unique int id: @variable ref);
+variable_instantiation(
+ unique int to: @variable ref,
+ int from: @variable ref
+);
+variable_template_argument(
+ int variable_id: @variable ref,
+ int index: int ref,
+ int arg_type: @type ref
+);
+variable_template_argument_value(
+ int variable_id: @variable ref,
+ int index: int ref,
+ int arg_value: @expr ref
+);
+
+template_template_instantiation(
+ int to: @usertype ref,
+ int from: @usertype ref
+);
+template_template_argument(
+ int type_id: @usertype ref,
+ int index: int ref,
+ int arg_type: @type ref
+);
+template_template_argument_value(
+ int type_id: @usertype ref,
+ int index: int ref,
+ int arg_value: @expr ref
+);
+
+@concept = @concept_template | @concept_id;
+
+concept_templates(
+ unique int concept_id: @concept_template,
+ string name: string ref,
+ int location: @location_default ref
+);
+concept_instantiation(
+ unique int to: @concept_id ref,
+ int from: @concept_template ref
+);
+is_type_constraint(int concept_id: @concept_id ref);
+concept_template_argument(
+ int concept_id: @concept ref,
+ int index: int ref,
+ int arg_type: @type ref
+);
+concept_template_argument_value(
+ int concept_id: @concept ref,
+ int index: int ref,
+ int arg_value: @expr ref
+);
+
+routinetypes(
+ unique int id: @routinetype,
+ int return_type: @type ref
+);
+
+routinetypeargs(
+ int routine: @routinetype ref,
+ int index: int ref,
+ int type_id: @type ref
+);
+
+ptrtomembers(
+ unique int id: @ptrtomember,
+ int type_id: @type ref,
+ int class_id: @type ref
+);
+
+/*
+ specifiers for types, functions, and variables
+
+ "public",
+ "protected",
+ "private",
+
+ "const",
+ "volatile",
+ "static",
+
+ "pure",
+ "virtual",
+ "sealed", // Microsoft
+ "__interface", // Microsoft
+ "inline",
+ "explicit",
+
+ "near", // near far extension
+ "far", // near far extension
+ "__ptr32", // Microsoft
+ "__ptr64", // Microsoft
+ "__sptr", // Microsoft
+ "__uptr", // Microsoft
+ "dllimport", // Microsoft
+ "dllexport", // Microsoft
+ "thread", // Microsoft
+ "naked", // Microsoft
+ "microsoft_inline", // Microsoft
+ "forceinline", // Microsoft
+ "selectany", // Microsoft
+ "nothrow", // Microsoft
+ "novtable", // Microsoft
+ "noreturn", // Microsoft
+ "noinline", // Microsoft
+ "noalias", // Microsoft
+ "restrict", // Microsoft
+*/
+
+specifiers(
+ unique int id: @specifier,
+ unique string str: string ref
+);
+
+typespecifiers(
+ int type_id: @type ref,
+ int spec_id: @specifier ref
+);
+
+funspecifiers(
+ int func_id: @function ref,
+ int spec_id: @specifier ref
+);
+
+varspecifiers(
+ int var_id: @accessible ref,
+ int spec_id: @specifier ref
+);
+
+explicit_specifier_exprs(
+ unique int func_id: @function ref,
+ int constant: @expr ref
+)
+
+attributes(
+ unique int id: @attribute,
+ int kind: int ref,
+ string name: string ref,
+ string name_space: string ref,
+ int location: @location_default ref
+);
+
+case @attribute.kind of
+ 0 = @gnuattribute
+| 1 = @stdattribute
+| 2 = @declspec
+| 3 = @msattribute
+| 4 = @alignas
+// ... 5 @objc_propertyattribute deprecated
+;
+
+attribute_args(
+ unique int id: @attribute_arg,
+ int kind: int ref,
+ int attribute: @attribute ref,
+ int index: int ref,
+ int location: @location_default ref
+);
+
+case @attribute_arg.kind of
+ 0 = @attribute_arg_empty
+| 1 = @attribute_arg_token
+| 2 = @attribute_arg_constant
+| 3 = @attribute_arg_type
+| 4 = @attribute_arg_constant_expr
+| 5 = @attribute_arg_expr
+;
+
+attribute_arg_value(
+ unique int arg: @attribute_arg ref,
+ string value: string ref
+);
+attribute_arg_type(
+ unique int arg: @attribute_arg ref,
+ int type_id: @type ref
+);
+attribute_arg_constant(
+ unique int arg: @attribute_arg ref,
+ int constant: @expr ref
+)
+attribute_arg_expr(
+ unique int arg: @attribute_arg ref,
+ int expr: @expr ref
+)
+attribute_arg_name(
+ unique int arg: @attribute_arg ref,
+ string name: string ref
+);
+
+typeattributes(
+ int type_id: @type ref,
+ int spec_id: @attribute ref
+);
+
+funcattributes(
+ int func_id: @function ref,
+ int spec_id: @attribute ref
+);
+
+varattributes(
+ int var_id: @accessible ref,
+ int spec_id: @attribute ref
+);
+
+namespaceattributes(
+ int namespace_id: @namespace ref,
+ int spec_id: @attribute ref
+);
+
+stmtattributes(
+ int stmt_id: @stmt ref,
+ int spec_id: @attribute ref
+);
+
+@type = @builtintype
+ | @derivedtype
+ | @usertype
+ | @routinetype
+ | @ptrtomember
+ | @decltype
+ | @type_operator;
+
+unspecifiedtype(
+ unique int type_id: @type ref,
+ int unspecified_type_id: @type ref
+);
+
+member(
+ int parent: @type ref,
+ int index: int ref,
+ int child: @member ref
+);
+
+@enclosingfunction_child = @usertype | @variable | @namespace
+
+enclosingfunction(
+ unique int child: @enclosingfunction_child ref,
+ int parent: @function ref
+);
+
+derivations(
+ unique int derivation: @derivation,
+ int sub: @type ref,
+ int index: int ref,
+ int super: @type ref,
+ int location: @location_default ref
+);
+
+derspecifiers(
+ int der_id: @derivation ref,
+ int spec_id: @specifier ref
+);
+
+/**
+ * Contains the byte offset of the base class subobject within the derived
+ * class. Only holds for non-virtual base classes, but see table
+ * `virtual_base_offsets` for offsets of virtual base class subobjects.
+ */
+direct_base_offsets(
+ unique int der_id: @derivation ref,
+ int offset: int ref
+);
+
+/**
+ * Contains the byte offset of the virtual base class subobject for class
+ * `super` within a most-derived object of class `sub`. `super` can be either a
+ * direct or indirect base class.
+ */
+#keyset[sub, super]
+virtual_base_offsets(
+ int sub: @usertype ref,
+ int super: @usertype ref,
+ int offset: int ref
+);
+
+frienddecls(
+ unique int id: @frienddecl,
+ int type_id: @type ref,
+ int decl_id: @declaration ref,
+ int location: @location_default ref
+);
+
+@declaredtype = @usertype ;
+
+@declaration = @function
+ | @declaredtype
+ | @variable
+ | @enumconstant
+ | @frienddecl
+ | @concept_template;
+
+@member = @membervariable
+ | @function
+ | @declaredtype
+ | @enumconstant;
+
+@locatable = @diagnostic
+ | @declaration
+ | @ppd_include
+ | @ppd_define
+ | @macroinvocation
+ /*| @funcall*/
+ | @xmllocatable
+ | @attribute
+ | @attribute_arg;
+
+@namedscope = @namespace | @usertype;
+
+@element = @locatable
+ | @file
+ | @folder
+ | @specifier
+ | @type
+ | @expr
+ | @namespace
+ | @initialiser
+ | @stmt
+ | @derivation
+ | @comment
+ | @preprocdirect
+ | @fun_decl
+ | @var_decl
+ | @type_decl
+ | @namespace_decl
+ | @using
+ | @namequalifier
+ | @specialnamequalifyingelement
+ | @static_assert
+ | @type_mention
+ | @lambdacapture;
+
+@exprparent = @element;
+
+comments(
+ unique int id: @comment,
+ string contents: string ref,
+ int location: @location_default ref
+);
+
+commentbinding(
+ int id: @comment ref,
+ int element: @element ref
+);
+
+exprconv(
+ int converted: @expr ref,
+ unique int conversion: @expr ref
+);
+
+compgenerated(unique int id: @element ref);
+
+/**
+ * `destructor_call` destructs the `i`'th entity that should be
+ * destructed following `element`. Note that entities should be
+ * destructed in reverse construction order, so for a given `element`
+ * these should be called from highest to lowest `i`.
+ */
+#keyset[element, destructor_call]
+#keyset[element, i]
+synthetic_destructor_call(
+ int element: @element ref,
+ int i: int ref,
+ int destructor_call: @routineexpr ref
+);
+
+namespaces(
+ unique int id: @namespace,
+ string name: string ref
+);
+
+namespace_inline(
+ unique int id: @namespace ref
+);
+
+namespacembrs(
+ int parentid: @namespace ref,
+ unique int memberid: @namespacembr ref
+);
+
+@namespacembr = @declaration | @namespace;
+
+exprparents(
+ int expr_id: @expr ref,
+ int child_index: int ref,
+ int parent_id: @exprparent ref
+);
+
+expr_isload(unique int expr_id: @expr ref);
+
+@cast = @c_style_cast
+ | @const_cast
+ | @dynamic_cast
+ | @reinterpret_cast
+ | @static_cast
+ ;
+
+/*
+case @conversion.kind of
+ 0 = @simple_conversion // a numeric conversion, qualification conversion, or a reinterpret_cast
+| 1 = @bool_conversion // conversion to 'bool'
+| 2 = @base_class_conversion // a derived-to-base conversion
+| 3 = @derived_class_conversion // a base-to-derived conversion
+| 4 = @pm_base_class_conversion // a derived-to-base conversion of a pointer to member
+| 5 = @pm_derived_class_conversion // a base-to-derived conversion of a pointer to member
+| 6 = @glvalue_adjust // an adjustment of the type of a glvalue
+| 7 = @prvalue_adjust // an adjustment of the type of a prvalue
+;
+*/
+/**
+ * Describes the semantics represented by a cast expression. This is largely
+ * independent of the source syntax of the cast, so it is separate from the
+ * regular expression kind.
+ */
+conversionkinds(
+ unique int expr_id: @cast ref,
+ int kind: int ref
+);
+
+@conversion = @cast
+ | @array_to_pointer
+ | @parexpr
+ | @reference_to
+ | @ref_indirect
+ | @temp_init
+ | @c11_generic
+ ;
+
+/*
+case @funbindexpr.kind of
+ 0 = @normal_call // a normal call
+| 1 = @virtual_call // a virtual call
+| 2 = @adl_call // a call whose target is only found by ADL
+;
+*/
+iscall(
+ unique int caller: @funbindexpr ref,
+ int kind: int ref
+);
+
+numtemplatearguments(
+ unique int expr_id: @expr ref,
+ int num: int ref
+);
+
+specialnamequalifyingelements(
+ unique int id: @specialnamequalifyingelement,
+ unique string name: string ref
+);
+
+@namequalifiableelement = @expr | @namequalifier;
+@namequalifyingelement = @namespace
+ | @specialnamequalifyingelement
+ | @usertype;
+
+namequalifiers(
+ unique int id: @namequalifier,
+ unique int qualifiableelement: @namequalifiableelement ref,
+ int qualifyingelement: @namequalifyingelement ref,
+ int location: @location_default ref
+);
+
+varbind(
+ int expr: @varbindexpr ref,
+ int var: @accessible ref
+);
+
+funbind(
+ int expr: @funbindexpr ref,
+ int fun: @function ref
+);
+
+@any_new_expr = @new_expr
+ | @new_array_expr;
+
+@new_or_delete_expr = @any_new_expr
+ | @delete_expr
+ | @delete_array_expr;
+
+@prefix_crement_expr = @preincrexpr | @predecrexpr;
+
+@postfix_crement_expr = @postincrexpr | @postdecrexpr;
+
+@increment_expr = @preincrexpr | @postincrexpr;
+
+@decrement_expr = @predecrexpr | @postdecrexpr;
+
+@crement_expr = @increment_expr | @decrement_expr;
+
+@un_arith_op_expr = @arithnegexpr
+ | @unaryplusexpr
+ | @conjugation
+ | @realpartexpr
+ | @imagpartexpr
+ | @crement_expr
+ ;
+
+@un_bitwise_op_expr = @complementexpr;
+
+@un_log_op_expr = @notexpr;
+
+@un_op_expr = @address_of
+ | @indirect
+ | @un_arith_op_expr
+ | @un_bitwise_op_expr
+ | @builtinaddressof
+ | @vec_fill
+ | @un_log_op_expr
+ | @co_await
+ | @co_yield
+ ;
+
+@bin_log_op_expr = @andlogicalexpr | @orlogicalexpr;
+
+@cmp_op_expr = @eq_op_expr | @rel_op_expr;
+
+@eq_op_expr = @eqexpr | @neexpr;
+
+@rel_op_expr = @gtexpr
+ | @ltexpr
+ | @geexpr
+ | @leexpr
+ | @spaceshipexpr
+ ;
+
+@bin_bitwise_op_expr = @lshiftexpr
+ | @rshiftexpr
+ | @andexpr
+ | @orexpr
+ | @xorexpr
+ ;
+
+@p_arith_op_expr = @paddexpr
+ | @psubexpr
+ | @pdiffexpr
+ ;
+
+@bin_arith_op_expr = @addexpr
+ | @subexpr
+ | @mulexpr
+ | @divexpr
+ | @remexpr
+ | @jmulexpr
+ | @jdivexpr
+ | @fjaddexpr
+ | @jfaddexpr
+ | @fjsubexpr
+ | @jfsubexpr
+ | @minexpr
+ | @maxexpr
+ | @p_arith_op_expr
+ ;
+
+@bin_op_expr = @bin_arith_op_expr
+ | @bin_bitwise_op_expr
+ | @cmp_op_expr
+ | @bin_log_op_expr
+ ;
+
+@op_expr = @un_op_expr
+ | @bin_op_expr
+ | @assign_expr
+ | @conditionalexpr
+ ;
+
+@assign_arith_expr = @assignaddexpr
+ | @assignsubexpr
+ | @assignmulexpr
+ | @assigndivexpr
+ | @assignremexpr
+ ;
+
+@assign_bitwise_expr = @assignandexpr
+ | @assignorexpr
+ | @assignxorexpr
+ | @assignlshiftexpr
+ | @assignrshiftexpr
+ ;
+
+@assign_pointer_expr = @assignpaddexpr
+ | @assignpsubexpr
+ ;
+
+@assign_op_expr = @assign_arith_expr
+ | @assign_bitwise_expr
+ | @assign_pointer_expr
+ ;
+
+@assign_expr = @assignexpr | @assign_op_expr | @blockassignexpr
+
+/*
+ Binary encoding of the allocator form.
+
+ case @allocator.form of
+ 0 = plain
+ | 1 = alignment
+ ;
+*/
+
+/**
+ * The allocator function associated with a `new` or `new[]` expression.
+ * The `form` column specified whether the allocation call contains an alignment
+ * argument.
+ */
+expr_allocator(
+ unique int expr: @any_new_expr ref,
+ int func: @function ref,
+ int form: int ref
+);
+
+/*
+ Binary encoding of the deallocator form.
+
+ case @deallocator.form of
+ 0 = plain
+ | 1 = size
+ | 2 = alignment
+ | 4 = destroying_delete
+ ;
+*/
+
+/**
+ * The deallocator function associated with a `delete`, `delete[]`, `new`, or
+ * `new[]` expression. For a `new` or `new[]` expression, the deallocator is the
+ * one used to free memory if the initialization throws an exception.
+ * The `form` column specifies whether the deallocation call contains a size
+ * argument, and alignment argument, or both.
+ */
+expr_deallocator(
+ unique int expr: @new_or_delete_expr ref,
+ int func: @function ref,
+ int form: int ref
+);
+
+/**
+ * Holds if the `@conditionalexpr` is of the two operand form
+ * `guard ? : false`.
+ */
+expr_cond_two_operand(
+ unique int cond: @conditionalexpr ref
+);
+
+/**
+ * The guard of `@conditionalexpr` `guard ? true : false`
+ */
+expr_cond_guard(
+ unique int cond: @conditionalexpr ref,
+ int guard: @expr ref
+);
+
+/**
+ * The expression used when the guard of `@conditionalexpr`
+ * `guard ? true : false` holds. For the two operand form
+ * `guard ?: false` consider using `expr_cond_guard` instead.
+ */
+expr_cond_true(
+ unique int cond: @conditionalexpr ref,
+ int true: @expr ref
+);
+
+/**
+ * The expression used when the guard of `@conditionalexpr`
+ * `guard ? true : false` does not hold.
+ */
+expr_cond_false(
+ unique int cond: @conditionalexpr ref,
+ int false: @expr ref
+);
+
+/** A string representation of the value. */
+values(
+ unique int id: @value,
+ string str: string ref
+);
+
+/** The actual text in the source code for the value, if any. */
+valuetext(
+ unique int id: @value ref,
+ string text: string ref
+);
+
+valuebind(
+ int val: @value ref,
+ unique int expr: @expr ref
+);
+
+fieldoffsets(
+ unique int id: @variable ref,
+ int byteoffset: int ref,
+ int bitoffset: int ref
+);
+
+bitfield(
+ unique int id: @variable ref,
+ int bits: int ref,
+ int declared_bits: int ref
+);
+
+/* TODO
+memberprefix(
+ int member: @expr ref,
+ int prefix: @expr ref
+);
+*/
+
+/*
+ kind(1) = mbrcallexpr
+ kind(2) = mbrptrcallexpr
+ kind(3) = mbrptrmbrcallexpr
+ kind(4) = ptrmbrptrmbrcallexpr
+ kind(5) = mbrreadexpr // x.y
+ kind(6) = mbrptrreadexpr // p->y
+ kind(7) = mbrptrmbrreadexpr // x.*pm
+ kind(8) = mbrptrmbrptrreadexpr // x->*pm
+ kind(9) = staticmbrreadexpr // static x.y
+ kind(10) = staticmbrptrreadexpr // static p->y
+*/
+/* TODO
+memberaccess(
+ int member: @expr ref,
+ int kind: int ref
+);
+*/
+
+initialisers(
+ unique int init: @initialiser,
+ int var: @accessible ref,
+ unique int expr: @expr ref,
+ int location: @location_default ref
+);
+
+braced_initialisers(
+ int init: @initialiser ref
+);
+
+/**
+ * An ancestor for the expression, for cases in which we cannot
+ * otherwise find the expression's parent.
+ */
+expr_ancestor(
+ int exp: @expr ref,
+ int ancestor: @element ref
+);
+
+exprs(
+ unique int id: @expr,
+ int kind: int ref,
+ int location: @location_default ref
+);
+
+expr_reuse(
+ int reuse: @expr ref,
+ int original: @expr ref,
+ int value_category: int ref
+)
+
+/*
+ case @value.category of
+ 1 = prval
+ | 2 = xval
+ | 3 = lval
+ ;
+*/
+expr_types(
+ int id: @expr ref,
+ int typeid: @type ref,
+ int value_category: int ref
+);
+
+case @expr.kind of
+ 1 = @errorexpr
+| 2 = @address_of // & AddressOfExpr
+| 3 = @reference_to // ReferenceToExpr (implicit?)
+| 4 = @indirect // * PointerDereferenceExpr
+| 5 = @ref_indirect // ReferenceDereferenceExpr (implicit?)
+// ...
+| 8 = @array_to_pointer // (???)
+| 9 = @vacuous_destructor_call // VacuousDestructorCall
+// ...
+| 11 = @assume // Microsoft
+| 12 = @parexpr
+| 13 = @arithnegexpr
+| 14 = @unaryplusexpr
+| 15 = @complementexpr
+| 16 = @notexpr
+| 17 = @conjugation // GNU ~ operator
+| 18 = @realpartexpr // GNU __real
+| 19 = @imagpartexpr // GNU __imag
+| 20 = @postincrexpr
+| 21 = @postdecrexpr
+| 22 = @preincrexpr
+| 23 = @predecrexpr
+| 24 = @conditionalexpr
+| 25 = @addexpr
+| 26 = @subexpr
+| 27 = @mulexpr
+| 28 = @divexpr
+| 29 = @remexpr
+| 30 = @jmulexpr // C99 mul imaginary
+| 31 = @jdivexpr // C99 div imaginary
+| 32 = @fjaddexpr // C99 add real + imaginary
+| 33 = @jfaddexpr // C99 add imaginary + real
+| 34 = @fjsubexpr // C99 sub real - imaginary
+| 35 = @jfsubexpr // C99 sub imaginary - real
+| 36 = @paddexpr // pointer add (pointer + int or int + pointer)
+| 37 = @psubexpr // pointer sub (pointer - integer)
+| 38 = @pdiffexpr // difference between two pointers
+| 39 = @lshiftexpr
+| 40 = @rshiftexpr
+| 41 = @andexpr
+| 42 = @orexpr
+| 43 = @xorexpr
+| 44 = @eqexpr
+| 45 = @neexpr
+| 46 = @gtexpr
+| 47 = @ltexpr
+| 48 = @geexpr
+| 49 = @leexpr
+| 50 = @minexpr // GNU minimum
+| 51 = @maxexpr // GNU maximum
+| 52 = @assignexpr
+| 53 = @assignaddexpr
+| 54 = @assignsubexpr
+| 55 = @assignmulexpr
+| 56 = @assigndivexpr
+| 57 = @assignremexpr
+| 58 = @assignlshiftexpr
+| 59 = @assignrshiftexpr
+| 60 = @assignandexpr
+| 61 = @assignorexpr
+| 62 = @assignxorexpr
+| 63 = @assignpaddexpr // assign pointer add
+| 64 = @assignpsubexpr // assign pointer sub
+| 65 = @andlogicalexpr
+| 66 = @orlogicalexpr
+| 67 = @commaexpr
+| 68 = @subscriptexpr // access to member of an array, e.g., a[5]
+// ... 69 @objc_subscriptexpr deprecated
+// ... 70 @cmdaccess deprecated
+// ...
+| 73 = @virtfunptrexpr
+| 74 = @callexpr
+// ... 75 @msgexpr_normal deprecated
+// ... 76 @msgexpr_super deprecated
+// ... 77 @atselectorexpr deprecated
+// ... 78 @atprotocolexpr deprecated
+| 79 = @vastartexpr
+| 80 = @vaargexpr
+| 81 = @vaendexpr
+| 82 = @vacopyexpr
+// ... 83 @atencodeexpr deprecated
+| 84 = @varaccess
+| 85 = @thisaccess
+// ... 86 @objc_box_expr deprecated
+| 87 = @new_expr
+| 88 = @delete_expr
+| 89 = @throw_expr
+| 90 = @condition_decl // a variable declared in a condition, e.g., if(int x = y > 2)
+| 91 = @braced_init_list
+| 92 = @type_id
+| 93 = @runtime_sizeof
+| 94 = @runtime_alignof
+| 95 = @sizeof_pack
+| 96 = @expr_stmt // GNU extension
+| 97 = @routineexpr
+| 98 = @type_operand // used to access a type in certain contexts (haven't found any examples yet....)
+| 99 = @offsetofexpr // offsetof ::= type and field
+| 100 = @hasassignexpr // __has_assign ::= type
+| 101 = @hascopyexpr // __has_copy ::= type
+| 102 = @hasnothrowassign // __has_nothrow_assign ::= type
+| 103 = @hasnothrowconstr // __has_nothrow_constructor ::= type
+| 104 = @hasnothrowcopy // __has_nothrow_copy ::= type
+| 105 = @hastrivialassign // __has_trivial_assign ::= type
+| 106 = @hastrivialconstr // __has_trivial_constructor ::= type
+| 107 = @hastrivialcopy // __has_trivial_copy ::= type
+| 108 = @hasuserdestr // __has_user_destructor ::= type
+| 109 = @hasvirtualdestr // __has_virtual_destructor ::= type
+| 110 = @isabstractexpr // __is_abstract ::= type
+| 111 = @isbaseofexpr // __is_base_of ::= type type
+| 112 = @isclassexpr // __is_class ::= type
+| 113 = @isconvtoexpr // __is_convertible_to ::= type type
+| 114 = @isemptyexpr // __is_empty ::= type
+| 115 = @isenumexpr // __is_enum ::= type
+| 116 = @ispodexpr // __is_pod ::= type
+| 117 = @ispolyexpr // __is_polymorphic ::= type
+| 118 = @isunionexpr // __is_union ::= type
+| 119 = @typescompexpr // GNU __builtin_types_compatible ::= type type
+| 120 = @intaddrexpr // frontend internal builtin, used to implement offsetof
+// ...
+| 122 = @hastrivialdestructor // __has_trivial_destructor ::= type
+| 123 = @literal
+| 124 = @uuidof
+| 127 = @aggregateliteral
+| 128 = @delete_array_expr
+| 129 = @new_array_expr
+// ... 130 @objc_array_literal deprecated
+// ... 131 @objc_dictionary_literal deprecated
+| 132 = @foldexpr
+// ...
+| 200 = @ctordirectinit
+| 201 = @ctorvirtualinit
+| 202 = @ctorfieldinit
+| 203 = @ctordelegatinginit
+| 204 = @dtordirectdestruct
+| 205 = @dtorvirtualdestruct
+| 206 = @dtorfielddestruct
+// ...
+| 210 = @static_cast
+| 211 = @reinterpret_cast
+| 212 = @const_cast
+| 213 = @dynamic_cast
+| 214 = @c_style_cast
+| 215 = @lambdaexpr
+| 216 = @param_ref
+| 217 = @noopexpr
+// ...
+| 294 = @istriviallyconstructibleexpr
+| 295 = @isdestructibleexpr
+| 296 = @isnothrowdestructibleexpr
+| 297 = @istriviallydestructibleexpr
+| 298 = @istriviallyassignableexpr
+| 299 = @isnothrowassignableexpr
+| 300 = @istrivialexpr
+| 301 = @isstandardlayoutexpr
+| 302 = @istriviallycopyableexpr
+| 303 = @isliteraltypeexpr
+| 304 = @hastrivialmoveconstructorexpr
+| 305 = @hastrivialmoveassignexpr
+| 306 = @hasnothrowmoveassignexpr
+| 307 = @isconstructibleexpr
+| 308 = @isnothrowconstructibleexpr
+| 309 = @hasfinalizerexpr
+| 310 = @isdelegateexpr
+| 311 = @isinterfaceclassexpr
+| 312 = @isrefarrayexpr
+| 313 = @isrefclassexpr
+| 314 = @issealedexpr
+| 315 = @issimplevalueclassexpr
+| 316 = @isvalueclassexpr
+| 317 = @isfinalexpr
+| 319 = @noexceptexpr
+| 320 = @builtinshufflevector
+| 321 = @builtinchooseexpr
+| 322 = @builtinaddressof
+| 323 = @vec_fill
+| 324 = @builtinconvertvector
+| 325 = @builtincomplex
+| 326 = @spaceshipexpr
+| 327 = @co_await
+| 328 = @co_yield
+| 329 = @temp_init
+| 330 = @isassignable
+| 331 = @isaggregate
+| 332 = @hasuniqueobjectrepresentations
+| 333 = @builtinbitcast
+| 334 = @builtinshuffle
+| 335 = @blockassignexpr
+| 336 = @issame
+| 337 = @isfunction
+| 338 = @islayoutcompatible
+| 339 = @ispointerinterconvertiblebaseof
+| 340 = @isarray
+| 341 = @arrayrank
+| 342 = @arrayextent
+| 343 = @isarithmetic
+| 344 = @iscompletetype
+| 345 = @iscompound
+| 346 = @isconst
+| 347 = @isfloatingpoint
+| 348 = @isfundamental
+| 349 = @isintegral
+| 350 = @islvaluereference
+| 351 = @ismemberfunctionpointer
+| 352 = @ismemberobjectpointer
+| 353 = @ismemberpointer
+| 354 = @isobject
+| 355 = @ispointer
+| 356 = @isreference
+| 357 = @isrvaluereference
+| 358 = @isscalar
+| 359 = @issigned
+| 360 = @isunsigned
+| 361 = @isvoid
+| 362 = @isvolatile
+| 363 = @reuseexpr
+| 364 = @istriviallycopyassignable
+| 365 = @isassignablenopreconditioncheck
+| 366 = @referencebindstotemporary
+| 367 = @issameas
+| 368 = @builtinhasattribute
+| 369 = @ispointerinterconvertiblewithclass
+| 370 = @builtinispointerinterconvertiblewithclass
+| 371 = @iscorrespondingmember
+| 372 = @builtiniscorrespondingmember
+| 373 = @isboundedarray
+| 374 = @isunboundedarray
+| 375 = @isreferenceable
+| 378 = @isnothrowconvertible
+| 379 = @referenceconstructsfromtemporary
+| 380 = @referenceconvertsfromtemporary
+| 381 = @isconvertible
+| 382 = @isvalidwinrttype
+| 383 = @iswinclass
+| 384 = @iswininterface
+| 385 = @istriviallyequalitycomparable
+| 386 = @isscopedenum
+| 387 = @istriviallyrelocatable
+| 388 = @datasizeof
+| 389 = @c11_generic
+| 390 = @requires_expr
+| 391 = @nested_requirement
+| 392 = @compound_requirement
+| 393 = @concept_id
+;
+
+@var_args_expr = @vastartexpr
+ | @vaendexpr
+ | @vaargexpr
+ | @vacopyexpr
+ ;
+
+@builtin_op = @var_args_expr
+ | @noopexpr
+ | @offsetofexpr
+ | @intaddrexpr
+ | @hasassignexpr
+ | @hascopyexpr
+ | @hasnothrowassign
+ | @hasnothrowconstr
+ | @hasnothrowcopy
+ | @hastrivialassign
+ | @hastrivialconstr
+ | @hastrivialcopy
+ | @hastrivialdestructor
+ | @hasuserdestr
+ | @hasvirtualdestr
+ | @isabstractexpr
+ | @isbaseofexpr
+ | @isclassexpr
+ | @isconvtoexpr
+ | @isemptyexpr
+ | @isenumexpr
+ | @ispodexpr
+ | @ispolyexpr
+ | @isunionexpr
+ | @typescompexpr
+ | @builtinshufflevector
+ | @builtinconvertvector
+ | @builtinaddressof
+ | @istriviallyconstructibleexpr
+ | @isdestructibleexpr
+ | @isnothrowdestructibleexpr
+ | @istriviallydestructibleexpr
+ | @istriviallyassignableexpr
+ | @isnothrowassignableexpr
+ | @istrivialexpr
+ | @isstandardlayoutexpr
+ | @istriviallycopyableexpr
+ | @isliteraltypeexpr
+ | @hastrivialmoveconstructorexpr
+ | @hastrivialmoveassignexpr
+ | @hasnothrowmoveassignexpr
+ | @isconstructibleexpr
+ | @isnothrowconstructibleexpr
+ | @hasfinalizerexpr
+ | @isdelegateexpr
+ | @isinterfaceclassexpr
+ | @isrefarrayexpr
+ | @isrefclassexpr
+ | @issealedexpr
+ | @issimplevalueclassexpr
+ | @isvalueclassexpr
+ | @isfinalexpr
+ | @builtinchooseexpr
+ | @builtincomplex
+ | @isassignable
+ | @isaggregate
+ | @hasuniqueobjectrepresentations
+ | @builtinbitcast
+ | @builtinshuffle
+ | @issame
+ | @isfunction
+ | @islayoutcompatible
+ | @ispointerinterconvertiblebaseof
+ | @isarray
+ | @arrayrank
+ | @arrayextent
+ | @isarithmetic
+ | @iscompletetype
+ | @iscompound
+ | @isconst
+ | @isfloatingpoint
+ | @isfundamental
+ | @isintegral
+ | @islvaluereference
+ | @ismemberfunctionpointer
+ | @ismemberobjectpointer
+ | @ismemberpointer
+ | @isobject
+ | @ispointer
+ | @isreference
+ | @isrvaluereference
+ | @isscalar
+ | @issigned
+ | @isunsigned
+ | @isvoid
+ | @isvolatile
+ | @istriviallycopyassignable
+ | @isassignablenopreconditioncheck
+ | @referencebindstotemporary
+ | @issameas
+ | @builtinhasattribute
+ | @ispointerinterconvertiblewithclass
+ | @builtinispointerinterconvertiblewithclass
+ | @iscorrespondingmember
+ | @builtiniscorrespondingmember
+ | @isboundedarray
+ | @isunboundedarray
+ | @isreferenceable
+ | @isnothrowconvertible
+ | @referenceconstructsfromtemporary
+ | @referenceconvertsfromtemporary
+ | @isconvertible
+ | @isvalidwinrttype
+ | @iswinclass
+ | @iswininterface
+ | @istriviallyequalitycomparable
+ | @isscopedenum
+ | @istriviallyrelocatable
+ ;
+
+compound_requirement_is_noexcept(
+ int expr: @compound_requirement ref
+);
+
+new_allocated_type(
+ unique int expr: @new_expr ref,
+ int type_id: @type ref
+);
+
+new_array_allocated_type(
+ unique int expr: @new_array_expr ref,
+ int type_id: @type ref
+);
+
+/**
+ * The field being initialized by an initializer expression within an aggregate
+ * initializer for a class/struct/union. Position is used to sort repeated initializers.
+ */
+#keyset[aggregate, position]
+aggregate_field_init(
+ int aggregate: @aggregateliteral ref,
+ int initializer: @expr ref,
+ int field: @membervariable ref,
+ int position: int ref,
+ boolean is_designated: boolean ref
+);
+
+/**
+ * The index of the element being initialized by an initializer expression
+ * within an aggregate initializer for an array. Position is used to sort repeated initializers.
+ */
+#keyset[aggregate, position]
+aggregate_array_init(
+ int aggregate: @aggregateliteral ref,
+ int initializer: @expr ref,
+ int element_index: int ref,
+ int position: int ref,
+ boolean is_designated: boolean ref
+);
+
+@ctorinit = @ctordirectinit
+ | @ctorvirtualinit
+ | @ctorfieldinit
+ | @ctordelegatinginit;
+@dtordestruct = @dtordirectdestruct
+ | @dtorvirtualdestruct
+ | @dtorfielddestruct;
+
+
+condition_decl_bind(
+ unique int expr: @condition_decl ref,
+ unique int decl: @declaration ref
+);
+
+typeid_bind(
+ unique int expr: @type_id ref,
+ int type_id: @type ref
+);
+
+uuidof_bind(
+ unique int expr: @uuidof ref,
+ int type_id: @type ref
+);
+
+@sizeof_or_alignof = @runtime_sizeof | @runtime_alignof | @datasizeof | @sizeof_pack;
+
+sizeof_bind(
+ unique int expr: @sizeof_or_alignof ref,
+ int type_id: @type ref
+);
+
+code_block(
+ unique int block: @literal ref,
+ unique int routine: @function ref
+);
+
+lambdas(
+ unique int expr: @lambdaexpr ref,
+ string default_capture: string ref,
+ boolean has_explicit_return_type: boolean ref,
+ boolean has_explicit_parameter_list: boolean ref
+);
+
+lambda_capture(
+ unique int id: @lambdacapture,
+ int lambda: @lambdaexpr ref,
+ int index: int ref,
+ int field: @membervariable ref,
+ boolean captured_by_reference: boolean ref,
+ boolean is_implicit: boolean ref,
+ int location: @location_default ref
+);
+
+@funbindexpr = @routineexpr
+ | @new_expr
+ | @delete_expr
+ | @delete_array_expr
+ | @ctordirectinit
+ | @ctorvirtualinit
+ | @ctordelegatinginit
+ | @dtordirectdestruct
+ | @dtorvirtualdestruct;
+
+@varbindexpr = @varaccess | @ctorfieldinit | @dtorfielddestruct;
+@addressable = @function | @variable ;
+@accessible = @addressable | @enumconstant ;
+
+@access = @varaccess | @routineexpr ;
+
+fold(
+ int expr: @foldexpr ref,
+ string operator: string ref,
+ boolean is_left_fold: boolean ref
+);
+
+stmts(
+ unique int id: @stmt,
+ int kind: int ref,
+ int location: @location_default ref
+);
+
+case @stmt.kind of
+ 1 = @stmt_expr
+| 2 = @stmt_if
+| 3 = @stmt_while
+| 4 = @stmt_goto
+| 5 = @stmt_label
+| 6 = @stmt_return
+| 7 = @stmt_block
+| 8 = @stmt_end_test_while // do { ... } while ( ... )
+| 9 = @stmt_for
+| 10 = @stmt_switch_case
+| 11 = @stmt_switch
+| 13 = @stmt_asm // "asm" statement or the body of an asm function
+| 15 = @stmt_try_block
+| 16 = @stmt_microsoft_try // Microsoft
+| 17 = @stmt_decl
+| 18 = @stmt_set_vla_size // C99
+| 19 = @stmt_vla_decl // C99
+| 25 = @stmt_assigned_goto // GNU
+| 26 = @stmt_empty
+| 27 = @stmt_continue
+| 28 = @stmt_break
+| 29 = @stmt_range_based_for // C++11
+// ... 30 @stmt_at_autoreleasepool_block deprecated
+// ... 31 @stmt_objc_for_in deprecated
+// ... 32 @stmt_at_synchronized deprecated
+| 33 = @stmt_handler
+// ... 34 @stmt_finally_end deprecated
+| 35 = @stmt_constexpr_if
+| 37 = @stmt_co_return
+| 38 = @stmt_consteval_if
+| 39 = @stmt_not_consteval_if
+| 40 = @stmt_leave
+;
+
+type_vla(
+ int type_id: @type ref,
+ int decl: @stmt_vla_decl ref
+);
+
+variable_vla(
+ int var: @variable ref,
+ int decl: @stmt_vla_decl ref
+);
+
+type_is_vla(unique int type_id: @derivedtype ref)
+
+if_initialization(
+ unique int if_stmt: @stmt_if ref,
+ int init_id: @stmt ref
+);
+
+if_then(
+ unique int if_stmt: @stmt_if ref,
+ int then_id: @stmt ref
+);
+
+if_else(
+ unique int if_stmt: @stmt_if ref,
+ int else_id: @stmt ref
+);
+
+constexpr_if_initialization(
+ unique int constexpr_if_stmt: @stmt_constexpr_if ref,
+ int init_id: @stmt ref
+);
+
+constexpr_if_then(
+ unique int constexpr_if_stmt: @stmt_constexpr_if ref,
+ int then_id: @stmt ref
+);
+
+constexpr_if_else(
+ unique int constexpr_if_stmt: @stmt_constexpr_if ref,
+ int else_id: @stmt ref
+);
+
+@stmt_consteval_or_not_consteval_if = @stmt_consteval_if | @stmt_not_consteval_if;
+
+consteval_if_then(
+ unique int constexpr_if_stmt: @stmt_consteval_or_not_consteval_if ref,
+ int then_id: @stmt ref
+);
+
+consteval_if_else(
+ unique int constexpr_if_stmt: @stmt_consteval_or_not_consteval_if ref,
+ int else_id: @stmt ref
+);
+
+while_body(
+ unique int while_stmt: @stmt_while ref,
+ int body_id: @stmt ref
+);
+
+do_body(
+ unique int do_stmt: @stmt_end_test_while ref,
+ int body_id: @stmt ref
+);
+
+switch_initialization(
+ unique int switch_stmt: @stmt_switch ref,
+ int init_id: @stmt ref
+);
+
+#keyset[switch_stmt, index]
+switch_case(
+ int switch_stmt: @stmt_switch ref,
+ int index: int ref,
+ int case_id: @stmt_switch_case ref
+);
+
+switch_body(
+ unique int switch_stmt: @stmt_switch ref,
+ int body_id: @stmt ref
+);
+
+@stmt_for_or_range_based_for = @stmt_for
+ | @stmt_range_based_for;
+
+for_initialization(
+ unique int for_stmt: @stmt_for_or_range_based_for ref,
+ int init_id: @stmt ref
+);
+
+for_condition(
+ unique int for_stmt: @stmt_for ref,
+ int condition_id: @expr ref
+);
+
+for_update(
+ unique int for_stmt: @stmt_for ref,
+ int update_id: @expr ref
+);
+
+for_body(
+ unique int for_stmt: @stmt_for ref,
+ int body_id: @stmt ref
+);
+
+@stmtparent = @stmt | @expr_stmt ;
+stmtparents(
+ unique int id: @stmt ref,
+ int index: int ref,
+ int parent: @stmtparent ref
+);
+
+ishandler(unique int block: @stmt_block ref);
+
+@cfgnode = @stmt | @expr | @function | @initialiser ;
+
+stmt_decl_bind(
+ int stmt: @stmt_decl ref,
+ int num: int ref,
+ int decl: @declaration ref
+);
+
+stmt_decl_entry_bind(
+ int stmt: @stmt_decl ref,
+ int num: int ref,
+ int decl_entry: @element ref
+);
+
+@parameterized_element = @function | @stmt_block | @requires_expr;
+
+blockscope(
+ unique int block: @stmt_block ref,
+ int enclosing: @parameterized_element ref
+);
+
+@jump = @stmt_goto | @stmt_break | @stmt_continue | @stmt_leave;
+
+@jumporlabel = @jump | @stmt_label | @literal;
+
+jumpinfo(
+ unique int id: @jumporlabel ref,
+ string str: string ref,
+ int target: @stmt ref
+);
+
+preprocdirects(
+ unique int id: @preprocdirect,
+ int kind: int ref,
+ int location: @location_default ref
+);
+case @preprocdirect.kind of
+ 0 = @ppd_if
+| 1 = @ppd_ifdef
+| 2 = @ppd_ifndef
+| 3 = @ppd_elif
+| 4 = @ppd_else
+| 5 = @ppd_endif
+| 6 = @ppd_plain_include
+| 7 = @ppd_define
+| 8 = @ppd_undef
+| 9 = @ppd_line
+| 10 = @ppd_error
+| 11 = @ppd_pragma
+| 12 = @ppd_objc_import
+| 13 = @ppd_include_next
+| 14 = @ppd_ms_import
+| 15 = @ppd_elifdef
+| 16 = @ppd_elifndef
+| 18 = @ppd_warning
+;
+
+@ppd_include = @ppd_plain_include | @ppd_objc_import | @ppd_include_next | @ppd_ms_import;
+
+@ppd_branch = @ppd_if | @ppd_ifdef | @ppd_ifndef | @ppd_elif | @ppd_elifdef | @ppd_elifndef;
+
+preprocpair(
+ int begin : @ppd_branch ref,
+ int elseelifend : @preprocdirect ref
+);
+
+preproctrue(int branch : @ppd_branch ref);
+preprocfalse(int branch : @ppd_branch ref);
+
+preproctext(
+ unique int id: @preprocdirect ref,
+ string head: string ref,
+ string body: string ref
+);
+
+includes(
+ unique int id: @ppd_include ref,
+ int included: @file ref
+);
+
+link_targets(
+ int id: @link_target,
+ int binary: @file ref
+);
+
+link_parent(
+ int element : @element ref,
+ int link_target : @link_target ref
+);
+
+/*- XML Files -*/
+
+xmlEncoding(
+ unique int id: @file ref,
+ string encoding: string ref
+);
+
+xmlDTDs(
+ unique int id: @xmldtd,
+ string root: string ref,
+ string publicId: string ref,
+ string systemId: string ref,
+ int fileid: @file ref
+);
+
+xmlElements(
+ unique int id: @xmlelement,
+ string name: string ref,
+ int parentid: @xmlparent ref,
+ int idx: int ref,
+ int fileid: @file ref
+);
+
+xmlAttrs(
+ unique int id: @xmlattribute,
+ int elementid: @xmlelement ref,
+ string name: string ref,
+ string value: string ref,
+ int idx: int ref,
+ int fileid: @file ref
+);
+
+xmlNs(
+ int id: @xmlnamespace,
+ string prefixName: string ref,
+ string URI: string ref,
+ int fileid: @file ref
+);
+
+xmlHasNs(
+ int elementId: @xmlnamespaceable ref,
+ int nsId: @xmlnamespace ref,
+ int fileid: @file ref
+);
+
+xmlComments(
+ unique int id: @xmlcomment,
+ string text: string ref,
+ int parentid: @xmlparent ref,
+ int fileid: @file ref
+);
+
+xmlChars(
+ unique int id: @xmlcharacters,
+ string text: string ref,
+ int parentid: @xmlparent ref,
+ int idx: int ref,
+ int isCDATA: int ref,
+ int fileid: @file ref
+);
+
+@xmlparent = @file | @xmlelement;
+@xmlnamespaceable = @xmlelement | @xmlattribute;
+
+xmllocations(
+ int xmlElement: @xmllocatable ref,
+ int location: @location_default ref
+);
+
+@xmllocatable = @xmlcharacters | @xmlelement | @xmlcomment | @xmlattribute | @xmldtd | @file | @xmlnamespace;
diff --git a/cpp/ql/lib/upgrades/5340d6d5f428557632b1a50113e406430f29ef7d/upgrade.properties b/cpp/ql/lib/upgrades/5340d6d5f428557632b1a50113e406430f29ef7d/upgrade.properties
new file mode 100644
index 000000000000..d8e09e944fe5
--- /dev/null
+++ b/cpp/ql/lib/upgrades/5340d6d5f428557632b1a50113e406430f29ef7d/upgrade.properties
@@ -0,0 +1,2 @@
+description: Link PCH creations and uses
+compatibility: backwards
diff --git a/cpp/ql/src/Security/CWE/CWE-078/ExecTainted.ql b/cpp/ql/src/Security/CWE/CWE-078/ExecTainted.ql
index 1098656f7a20..9119f5271fe6 100644
--- a/cpp/ql/src/Security/CWE/CWE-078/ExecTainted.ql
+++ b/cpp/ql/src/Security/CWE/CWE-078/ExecTainted.ql
@@ -147,8 +147,8 @@ module ExecTaintConfig implements DataFlow::StateConfigSig {
predicate isBarrier(DataFlow::Node node) { isBarrierImpl(node) }
- predicate isBarrierOut(DataFlow::Node node) {
- isSink(node, _) // Prevent duplicates along a call chain, since `shellCommand` will include wrappers
+ predicate isBarrierOut(DataFlow::Node node, FlowState state) {
+ isSink(node, state) // Prevent duplicates along a call chain, since `shellCommand` will include wrappers
}
predicate observeDiffInformedIncrementalMode() { any() }
diff --git a/cpp/ql/src/change-notes/2025-08-20-add-customizations.md b/cpp/ql/src/change-notes/2025-08-20-add-customizations.md
new file mode 100644
index 000000000000..3a01298283ca
--- /dev/null
+++ b/cpp/ql/src/change-notes/2025-08-20-add-customizations.md
@@ -0,0 +1,4 @@
+---
+category: fix
+---
+* Fixed an inconsistency across languages where most have a `Customizations.qll` file for adding customizations, but not all did.
\ No newline at end of file
diff --git a/cpp/ql/src/qlpack.yml b/cpp/ql/src/qlpack.yml
index bd7ff423c7cb..3e64a19c68b3 100644
--- a/cpp/ql/src/qlpack.yml
+++ b/cpp/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/cpp-queries
-version: 1.4.6
+version: 1.4.7-dev
groups:
- cpp
- queries
diff --git a/cpp/ql/test/library-tests/dataflow/dataflow-tests/dispatch.cpp b/cpp/ql/test/library-tests/dataflow/dataflow-tests/dispatch.cpp
index 105212ccca67..63528d712c0c 100644
--- a/cpp/ql/test/library-tests/dataflow/dataflow-tests/dispatch.cpp
+++ b/cpp/ql/test/library-tests/dataflow/dataflow-tests/dispatch.cpp
@@ -8,7 +8,7 @@ struct Top {
virtual void isSink(int x) { }
virtual int notSource1() { return source(); }
virtual int notSource2() { return source(); }
- virtual void notSink(int x) { sink(x); } // $ SPURIOUS: ast,ir=37:19 ast,ir=45:18
+ virtual void notSink(int x) { sink(x); } // $ SPURIOUS: ast=37:19 ast=45:18
};
// This class has the correct behavior for just the functions ending in 2.
@@ -32,16 +32,16 @@ void VirtualDispatch(Bottom *bottomPtr, Bottom &bottomRef) { // $ ast-def=bottom
sink(topPtr->isSource2()); // $ ir MISSING: ast
topPtr->isSink(source()); // causing a MISSING for ast
- sink(topPtr->notSource1()); // $ SPURIOUS: ast,ir
- sink(topPtr->notSource2()); // $ SPURIOUS: ast,ir
+ sink(topPtr->notSource1()); // $ SPURIOUS: ast
+ sink(topPtr->notSource2()); // $ SPURIOUS: ast
topPtr->notSink(source()); // causing SPURIOUS for ast,ir
sink(topRef.isSource1()); // $ ir MISSING: ast
sink(topRef.isSource2()); // $ ir MISSING: ast
topRef.isSink(source()); // causing a MISSING for ast
- sink(topRef.notSource1()); // $ SPURIOUS: ast,ir
- sink(topRef.notSource2()); // $ SPURIOUS: ast,ir
+ sink(topRef.notSource1()); // $ SPURIOUS: ast
+ sink(topRef.notSource2()); // $ SPURIOUS: ast
topRef.notSink(source()); // causing SPURIOUS for ast,ir
}
@@ -126,8 +126,8 @@ namespace virtual_inheritance {
// get flow from a `Middle` value to the call qualifier.
Top *topPtr = bottomPtr, &topRef = bottomRef;
- sink(topPtr->isSource()); // $ MISSING: ast,ir
- sink(topRef.isSource()); // $ MISSING: ast,ir
+ sink(topPtr->isSource()); // $ ir MISSING: ast
+ sink(topRef.isSource()); // $ ir MISSING: ast
}
}
diff --git a/cpp/ql/test/library-tests/dataflow/dataflow-tests/test-source-sink.expected b/cpp/ql/test/library-tests/dataflow/dataflow-tests/test-source-sink.expected
index 6e0b03be9c61..8c009241734a 100644
--- a/cpp/ql/test/library-tests/dataflow/dataflow-tests/test-source-sink.expected
+++ b/cpp/ql/test/library-tests/dataflow/dataflow-tests/test-source-sink.expected
@@ -169,10 +169,6 @@ irFlow
| clang.cpp:50:35:50:40 | call to source | clang.cpp:53:17:53:26 | *stackArray |
| clang.cpp:51:19:51:24 | call to source | clang.cpp:53:17:53:26 | *stackArray |
| clang.cpp:57:21:57:28 | call to source | clang.cpp:59:8:59:8 | d |
-| dispatch.cpp:9:37:9:42 | call to source | dispatch.cpp:35:16:35:25 | call to notSource1 |
-| dispatch.cpp:9:37:9:42 | call to source | dispatch.cpp:43:15:43:24 | call to notSource1 |
-| dispatch.cpp:10:37:10:42 | call to source | dispatch.cpp:36:16:36:25 | call to notSource2 |
-| dispatch.cpp:10:37:10:42 | call to source | dispatch.cpp:44:15:44:24 | call to notSource2 |
| dispatch.cpp:16:37:16:42 | call to source | dispatch.cpp:32:16:32:24 | call to isSource2 |
| dispatch.cpp:16:37:16:42 | call to source | dispatch.cpp:40:15:40:23 | call to isSource2 |
| dispatch.cpp:22:37:22:42 | call to source | dispatch.cpp:31:16:31:24 | call to isSource1 |
@@ -180,13 +176,13 @@ irFlow
| dispatch.cpp:22:37:22:42 | call to source | dispatch.cpp:55:22:55:30 | call to isSource1 |
| dispatch.cpp:22:37:22:42 | call to source | dispatch.cpp:58:28:58:36 | call to isSource1 |
| dispatch.cpp:33:18:33:23 | call to source | dispatch.cpp:23:38:23:38 | x |
-| dispatch.cpp:37:19:37:24 | call to source | dispatch.cpp:11:38:11:38 | x |
| dispatch.cpp:41:17:41:22 | call to source | dispatch.cpp:23:38:23:38 | x |
-| dispatch.cpp:45:18:45:23 | call to source | dispatch.cpp:11:38:11:38 | x |
| dispatch.cpp:69:15:69:20 | call to source | dispatch.cpp:23:38:23:38 | x |
| dispatch.cpp:73:14:73:19 | call to source | dispatch.cpp:23:38:23:38 | x |
| dispatch.cpp:81:13:81:18 | call to source | dispatch.cpp:23:38:23:38 | x |
| dispatch.cpp:107:17:107:22 | call to source | dispatch.cpp:96:8:96:8 | x |
+| dispatch.cpp:117:38:117:43 | call to source | dispatch.cpp:129:18:129:25 | call to isSource |
+| dispatch.cpp:117:38:117:43 | call to source | dispatch.cpp:130:17:130:24 | call to isSource |
| dispatch.cpp:140:8:140:13 | call to source | dispatch.cpp:96:8:96:8 | x |
| dispatch.cpp:144:8:144:13 | call to source | dispatch.cpp:96:8:96:8 | x |
| flowOut.cpp:5:16:5:21 | call to source | flowOut.cpp:31:9:31:9 | x |
diff --git a/cpp/ql/test/library-tests/dataflow/dispatch/test.cpp b/cpp/ql/test/library-tests/dataflow/dispatch/test.cpp
new file mode 100644
index 000000000000..f243b76ad140
--- /dev/null
+++ b/cpp/ql/test/library-tests/dataflow/dispatch/test.cpp
@@ -0,0 +1,127 @@
+struct Base {
+ void f();
+ virtual void virtual_f();
+};
+
+struct Derived : Base {
+ void f();
+ void virtual_f();
+};
+
+void test_simple() {
+ Base b;
+ b.f(); // $ target=2
+ b.virtual_f(); // $ target=3
+
+ Derived d;
+ d.f(); // $ target=7
+ d.virtual_f(); // $ target=8
+
+ Base* b_ptr = &d;
+ b_ptr->f(); // $ target=2
+ b_ptr->virtual_f(); // $ target=8
+
+ Base& b_ref = d;
+ b_ref.f(); // $ target=2
+ b_ref.virtual_f(); // $ target=8
+
+ Base* b_null = nullptr;
+ b_null->f(); // $ target=2
+ b_null->virtual_f(); // $ target=3
+
+ Base* base_is_derived = new Derived();
+ base_is_derived->f(); // $ target=2
+ base_is_derived->virtual_f(); // $ target=8
+
+ Base* base_is_base = new Base();
+ base_is_base->f(); // $ target=2
+ base_is_base->virtual_f(); // $ target=3
+
+ Derived* derived_is_derived = new Derived();
+ derived_is_derived->f(); // $ target=7
+ derived_is_derived->virtual_f(); // $ target=8
+
+ Base& b_ref2 = b;
+ b_ref2 = d;
+ b_ref2.f(); // $ target=2
+ b_ref2.virtual_f(); // $ target=3
+}
+
+struct S {
+ Base* b1;
+ Base* b2;
+};
+
+void test_fields() {
+ S s;
+
+ s.b1 = new Base();
+ s.b2 = new Derived();
+
+ s.b1->virtual_f(); // $ target=3
+ s.b2->virtual_f(); // $ target=8
+
+ s.b1 = new Derived();
+ s.b2 = new Base();
+ s.b1->virtual_f(); // $ target=8 SPURIOUS: target=3 // type-tracking has no 'clearsContent' feature and C/C++ doesn't have field-based SSA
+ s.b2->virtual_f(); // $ target=3 SPURIOUS: target=8 // type-tracking has no 'clearsContent' feature and C/C++ doesn't have field-based SSA
+}
+
+Base* getDerived() {
+ return new Derived();
+}
+
+void test_getDerived() {
+ Base* b = getDerived();
+ b->virtual_f(); // $ target=8
+
+ Derived d = *(Derived*)getDerived();
+ d.virtual_f(); // $ target=8
+}
+
+void write_to_arg(Base* b) {
+ *b = Derived();
+}
+
+void write_to_arg_2(Base** b) {
+ Derived* d = new Derived();
+ *b = d;
+}
+
+void test_write_to_arg() {
+ {
+ Base b;
+ write_to_arg(&b);
+ b.virtual_f(); // $ SPURIOUS: target=3 MISSING: target=8 // missing flow through the copy-constructor in write_to_arg
+ }
+
+ {
+ Base* b;
+ write_to_arg_2(&b);
+ b->virtual_f(); // $ target=8
+ }
+}
+
+Base* global_derived;
+
+void set_global_to_derived() {
+ global_derived = new Derived();
+}
+
+void read_global() {
+ global_derived->virtual_f(); // $ target=8
+}
+
+Base* global_base_or_derived;
+
+void set_global_base_or_derived_1() {
+ global_base_or_derived = new Base();
+}
+
+void set_global_base_or_derived_2() {
+ global_base_or_derived = new Derived();
+}
+
+void read_global_base_or_derived() {
+ global_base_or_derived->virtual_f(); // $ target=3 target=8
+}
\ No newline at end of file
diff --git a/cpp/ql/test/library-tests/dataflow/dispatch/test.expected b/cpp/ql/test/library-tests/dataflow/dispatch/test.expected
new file mode 100644
index 000000000000..e69de29bb2d1
diff --git a/cpp/ql/test/library-tests/dataflow/dispatch/test.ql b/cpp/ql/test/library-tests/dataflow/dispatch/test.ql
new file mode 100644
index 000000000000..de16d6da1ef1
--- /dev/null
+++ b/cpp/ql/test/library-tests/dataflow/dispatch/test.ql
@@ -0,0 +1,22 @@
+import cpp
+import utils.test.InlineExpectationsTest
+import semmle.code.cpp.ir.dataflow.internal.DataFlowDispatch
+import semmle.code.cpp.ir.dataflow.internal.DataFlowPrivate
+
+module ResolveDispatchTest implements TestSig {
+ string getARelevantTag() { result = "target" }
+
+ predicate hasActualResult(Location location, string element, string tag, string value) {
+ exists(DataFlowCall call, SourceCallable callable, MemberFunction mf |
+ mf = callable.asSourceCallable() and
+ not mf.isCompilerGenerated() and
+ callable = viableCallable(call) and
+ location = call.getLocation() and
+ element = call.toString() and
+ tag = "target" and
+ value = callable.getLocation().getStartLine().toString()
+ )
+ }
+}
+
+import MakeTest
diff --git a/cpp/ql/test/library-tests/dataflow/external-models/validatemodels.expected b/cpp/ql/test/library-tests/dataflow/external-models/validatemodels.expected
index aeb2362ef339..1b74b290eb39 100644
--- a/cpp/ql/test/library-tests/dataflow/external-models/validatemodels.expected
+++ b/cpp/ql/test/library-tests/dataflow/external-models/validatemodels.expected
@@ -6,12 +6,14 @@
| Dubious member name "operator LPWSTR" in summary model. |
| Dubious member name "operator PCXSTR" in summary model. |
| Dubious member name "operator PXSTR" in summary model. |
+| Dubious member name "operator void**" in summary model. |
| Dubious member name "operator&" in summary model. |
| Dubious member name "operator*" in summary model. |
| Dubious member name "operator+" in summary model. |
| Dubious member name "operator+=" in summary model. |
| Dubious member name "operator->" in summary model. |
| Dubious member name "operator=" in summary model. |
+| Dubious member name "operator=" in summary model. |
| Dubious member name "operator[]" in summary model. |
| Dubious signature "(..(*)(..))" in summary model. |
| Dubious signature "(..(*)(..),..(*)(..),..(*)(..),..(*)(..))" in summary model. |
@@ -503,6 +505,7 @@
| Dubious signature "(CURLU *,CURLUPart,const char *,unsigned int)" in summary model. |
| Dubious signature "(CURLU *,const char *)" in summary model. |
| Dubious signature "(CURLU *,const char *,char **,OperationConfig *)" in summary model. |
+| Dubious signature "(ComPtr &&)" in summary model. |
| Dubious signature "(CompoundDictionary *,const PreparedDictionary *)" in summary model. |
| Dubious signature "(Curl_cfilter *)" in summary model. |
| Dubious signature "(Curl_cfilter **,Curl_easy *)" in summary model. |
@@ -2130,6 +2133,7 @@
| Dubious signature "(RAND_POOL *,unsigned char *)" in summary model. |
| Dubious signature "(RAND_POOL *,unsigned int)" in summary model. |
| Dubious signature "(RECORD_LAYER *,SSL_CONNECTION *)" in summary model. |
+| Dubious signature "(REFIID,void **)" in summary model. |
| Dubious signature "(RIO_NOTIFIER *)" in summary model. |
| Dubious signature "(RIPEMD160_CTX *,const unsigned char *)" in summary model. |
| Dubious signature "(RIPEMD160_CTX *,const void *,size_t)" in summary model. |
@@ -2431,6 +2435,8 @@
| Dubious signature "(Strent *)" in summary model. |
| Dubious signature "(Strtab *,const char *,size_t)" in summary model. |
| Dubious signature "(Strtab *,size_t *)" in summary model. |
+| Dubious signature "(T *)" in summary model. |
+| Dubious signature "(T **)" in summary model. |
| Dubious signature "(TLS_FEATURE *)" in summary model. |
| Dubious signature "(TLS_RL_RECORD *,const unsigned char *)" in summary model. |
| Dubious signature "(TS_ACCURACY *)" in summary model. |
@@ -2493,6 +2499,7 @@
| Dubious signature "(TS_VERIFY_CTX *,unsigned char *,long)" in summary model. |
| Dubious signature "(TXT_DB *,OPENSSL_STRING *)" in summary model. |
| Dubious signature "(TXT_DB *,int,..(*)(..),OPENSSL_LH_HASHFUNC,OPENSSL_LH_COMPFUNC)" in summary model. |
+| Dubious signature "(U *)" in summary model. |
| Dubious signature "(UI *)" in summary model. |
| Dubious signature "(UI *,UI_STRING *,const char *)" in summary model. |
| Dubious signature "(UI *,UI_STRING *,const char *,int)" in summary model. |
@@ -3155,6 +3162,7 @@
| Dubious signature "(const CT_POLICY_EVAL_CTX *)" in summary model. |
| Dubious signature "(const CURLU *)" in summary model. |
| Dubious signature "(const CURLU *,CURLUPart,char **,unsigned int)" in summary model. |
+| Dubious signature "(const ComPtr &)" in summary model. |
| Dubious signature "(const Command *,const size_t,const BlockSplit *,const BlockSplit *,const BlockSplit *,const uint8_t *,size_t,size_t,uint8_t,uint8_t,const ContextType *,HistogramLiteral *,HistogramCommand *,HistogramDistance *)" in summary model. |
| Dubious signature "(const Curl_easy *,const connectdata *,int)" in summary model. |
| Dubious signature "(const DH *)" in summary model. |
diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/atl.cpp b/cpp/ql/test/library-tests/dataflow/taint-tests/atl.cpp
index e26416a0e68c..aff51f629647 100644
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/atl.cpp
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/atl.cpp
@@ -1241,4 +1241,221 @@ namespace ATL {
sink(static_cast::PCXSTR>(b)); // $ ir
sink(static_cast::PXSTR>(b)); // $ ir
}
+}
+
+namespace Microsoft {
+ namespace WRL {
+ template
+ class ComPtr;
+
+ struct GUID;
+
+ typedef GUID IID;
+
+ typedef IID *REFIID;
+
+ class IUnknown;
+
+ class WeakRef;
+
+ namespace Details {
+ template
+ class ComPtrRef {
+ public:
+ using InterfaceType = T;
+
+ ComPtrRef(T*);
+
+ InterfaceType* const * GetAddressOf() const;
+ InterfaceType** ReleaseAndGetAddressOf();
+
+ operator InterfaceType**();
+ operator T*();
+ operator void**() const;
+ InterfaceType* operator *();
+ };
+ }
+
+ template
+ class ComPtr
+ {
+ public:
+ using InterfaceType = T;
+
+ ComPtr();
+ ComPtr(const ComPtr &);
+ ComPtr(ComPtr &&);
+
+ template
+ ComPtr(U *);
+
+ ~ComPtr();
+
+ template
+ HRESULT As(ComPtr *p) const;
+
+ HRESULT AsWeak(WeakRef *);
+
+ void Attach(InterfaceType *);
+
+ HRESULT CopyTo(InterfaceType **);
+
+ HRESULT CopyTo(REFIID, void **) const;
+
+ template
+ HRESULT CopyTo(U **) const;
+
+ T *Detach();
+
+ T *Get() const;
+
+ T *const *GetAddressOf() const;
+ T **GetAddressOf();
+
+ T **ReleaseAndGetAddressOf();
+
+ unsigned long Reset();
+
+ void Swap(ComPtr &&r);
+
+ void Swap(ComPtr &r);
+
+ Details::ComPtrRef> operator&();
+ const Details::ComPtrRef> operator&() const;
+
+ InterfaceType* operator->() const; // return type simplified from Microsoft::WRL::Details::RemoveIUnknown*
+
+ ComPtr& operator=(T *);
+ template
+ ComPtr& operator=(U *);
+ ComPtr& operator=(const ComPtr &);
+ template
+ ComPtr& operator=(const ComPtr&);
+ ComPtr& operator=(ComPtr &&);
+ template
+ ComPtr& operator=(ComPtr&&);
+ };
+
+ }
+}
+
+namespace std {
+ template T&& move(T& t) noexcept; // simplified signature
+}
+
+void test_constructor()
+{
+ Microsoft::WRL::ComPtr p0;
+ sink(*p0.Get()); // clean
+
+ int x = source();
+ Microsoft::WRL::ComPtr p1(new int(x));
+ sink(*p1.Get()); // $ ir MISSING: ast
+ sink(*p1.Detach()); // $ ir MISSING: ast
+
+ Microsoft::WRL::ComPtr p2(p1);
+ sink(*p2.Get()); // $ ir MISSING: ast
+
+ Microsoft::WRL::ComPtr p3(std::move(p1));
+ sink(*p3.Get()); // $ ir MISSING: ast
+}
+
+void test_As()
+{
+ int x = source();
+ Microsoft::WRL::ComPtr p1(new int(x));
+ Microsoft::WRL::ComPtr* p2;
+ p1.As(p2);
+ sink(*p2->Get()); // $ ir MISSING: ast
+}
+
+void test_CopyTo()
+{
+ int x = source();
+ Microsoft::WRL::ComPtr p1(new int(x));
+ int *raw = nullptr;
+ p1.CopyTo(&raw);
+ sink(*raw); // $ ir MISSING: ast
+
+ Microsoft::WRL::ComPtr p2;
+ p1.CopyTo(nullptr, (void**)&raw);
+ sink(*raw); // $ ir MISSING: ast
+
+ Microsoft::WRL::ComPtr p3(new int(x));
+
+ int* raw2 = nullptr;
+ p3.CopyTo(&raw2);
+ sink(*raw2); // $ ir MISSING: ast
+}
+
+void test_Swap()
+{
+ int x = source();
+ Microsoft::WRL::ComPtr p1(new int(x));
+ Microsoft::WRL::ComPtr p2;
+ p1.Swap(p2);
+ sink(*p2.Get()); // $ ir MISSING: ast
+ sink(*p1.Get()); // $ SPURIOUS: ir
+}
+
+void test_GetAddressOf()
+{
+ int x = source();
+ Microsoft::WRL::ComPtr p1(new int(x));
+ sink(**p1.GetAddressOf()); // $ ir MISSING: ast
+
+ const Microsoft::WRL::ComPtr p2(new int(x));
+ sink(**p2.GetAddressOf()); // $ ir MISSING: ast
+
+ Microsoft::WRL::ComPtr p3(new int(x));
+ int **pp = p3.ReleaseAndGetAddressOf();
+ sink(**pp); // $ ir MISSING: ast
+}
+
+struct S {
+ int x;
+};
+
+void test_address_of_deref_operators() {
+ int x = source();
+ Microsoft::WRL::ComPtr p1(new int(x));
+ Microsoft::WRL::Details::ComPtrRef> pp = &p1;
+ Microsoft::WRL::ComPtr* qq = *pp;
+ sink(*qq->Get()); // $ ir MISSING: ast
+
+ const Microsoft::WRL::ComPtr p2(new int(x));
+ Microsoft::WRL::Details::ComPtrRef> pp2 = &p2;
+ const Microsoft::WRL::ComPtr* qq2 = *pp2;
+ sink(*qq2->Get()); // $ ir MISSING: ast
+
+ S s;
+ s.x = source();
+ Microsoft::WRL::ComPtr p3(&s);
+ sink(p3->x); // $ ir MISSING: ast
+}
+
+void test_assignments() {
+ Microsoft::WRL::ComPtr p1;
+ p1 = new int(source());
+ sink(*p1.Get()); // $ ir MISSING: ast
+
+ Microsoft::WRL::ComPtr p2;
+ p2 = new long(source());
+ sink(*p2.Get()); // $ ir MISSING: ast
+
+ Microsoft::WRL::ComPtr p3;
+ p3 = p1;
+ sink(*p3.Get()); // $ ir MISSING: ast
+
+ Microsoft::WRL::ComPtr p4;
+ p4 = p1;
+ sink(*p4.Get()); // $ ir MISSING: ast
+
+ Microsoft::WRL::ComPtr p5;
+ p5 = std::move(p1);
+ sink(*p5.Get()); // $ ir MISSING: ast
+
+ Microsoft::WRL::ComPtr p6;
+ p6 = std::move(p1);
+ sink(*p6.Get()); // $ ir MISSING: ast
}
\ No newline at end of file
diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected b/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
index e19f34eb2170..e8f0a8e34b25 100644
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
@@ -1278,6 +1278,223 @@ WARNING: module 'TaintTracking' has been deprecated and may be removed in future
| atl.cpp:1240:22:1240:30 | call to CStrBufT | atl.cpp:1241:46:1241:46 | b | |
| atl.cpp:1240:22:1240:30 | call to CStrBufT | atl.cpp:1242:45:1242:45 | b | |
| atl.cpp:1241:46:1241:46 | ref arg b | atl.cpp:1242:45:1242:45 | b | |
+| atl.cpp:1348:31:1348:32 | call to ComPtr | atl.cpp:1349:9:1349:10 | p0 | |
+| atl.cpp:1348:31:1348:32 | call to ComPtr | atl.cpp:1361:1:1361:1 | p0 | |
+| atl.cpp:1349:9:1349:10 | ref arg p0 | atl.cpp:1361:1:1361:1 | p0 | |
+| atl.cpp:1349:12:1349:14 | call to Get | atl.cpp:1349:8:1349:16 | * ... | TAINT |
+| atl.cpp:1351:11:1351:21 | call to source | atl.cpp:1352:42:1352:42 | x | |
+| atl.cpp:1352:34:1352:43 | new | atl.cpp:1352:34:1352:44 | call to ComPtr | TAINT |
+| atl.cpp:1352:34:1352:44 | call to ComPtr | atl.cpp:1353:9:1353:10 | p1 | |
+| atl.cpp:1352:34:1352:44 | call to ComPtr | atl.cpp:1354:9:1354:10 | p1 | |
+| atl.cpp:1352:34:1352:44 | call to ComPtr | atl.cpp:1356:34:1356:35 | p1 | |
+| atl.cpp:1352:34:1352:44 | call to ComPtr | atl.cpp:1359:44:1359:45 | p1 | |
+| atl.cpp:1352:34:1352:44 | call to ComPtr | atl.cpp:1361:1:1361:1 | p1 | |
+| atl.cpp:1352:42:1352:42 | x | atl.cpp:1352:34:1352:43 | new | |
+| atl.cpp:1353:9:1353:10 | ref arg p1 | atl.cpp:1354:9:1354:10 | p1 | |
+| atl.cpp:1353:9:1353:10 | ref arg p1 | atl.cpp:1356:34:1356:35 | p1 | |
+| atl.cpp:1353:9:1353:10 | ref arg p1 | atl.cpp:1359:44:1359:45 | p1 | |
+| atl.cpp:1353:9:1353:10 | ref arg p1 | atl.cpp:1361:1:1361:1 | p1 | |
+| atl.cpp:1353:12:1353:14 | call to Get | atl.cpp:1353:8:1353:16 | * ... | TAINT |
+| atl.cpp:1354:9:1354:10 | ref arg p1 | atl.cpp:1356:34:1356:35 | p1 | |
+| atl.cpp:1354:9:1354:10 | ref arg p1 | atl.cpp:1359:44:1359:45 | p1 | |
+| atl.cpp:1354:9:1354:10 | ref arg p1 | atl.cpp:1361:1:1361:1 | p1 | |
+| atl.cpp:1354:12:1354:17 | call to Detach | atl.cpp:1354:8:1354:19 | * ... | TAINT |
+| atl.cpp:1356:34:1356:35 | p1 | atl.cpp:1356:34:1356:36 | call to ComPtr | |
+| atl.cpp:1356:34:1356:36 | call to ComPtr | atl.cpp:1357:9:1357:10 | p2 | |
+| atl.cpp:1356:34:1356:36 | call to ComPtr | atl.cpp:1361:1:1361:1 | p2 | |
+| atl.cpp:1357:9:1357:10 | ref arg p2 | atl.cpp:1361:1:1361:1 | p2 | |
+| atl.cpp:1357:12:1357:14 | call to Get | atl.cpp:1357:8:1357:16 | * ... | TAINT |
+| atl.cpp:1359:34:1359:42 | call to move | atl.cpp:1359:34:1359:47 | call to ComPtr | TAINT |
+| atl.cpp:1359:34:1359:42 | ref arg call to move | atl.cpp:1359:44:1359:45 | p1 [inner post update] | |
+| atl.cpp:1359:34:1359:42 | ref arg call to move | atl.cpp:1361:1:1361:1 | p1 | |
+| atl.cpp:1359:34:1359:47 | call to ComPtr | atl.cpp:1360:9:1360:10 | p3 | |
+| atl.cpp:1359:34:1359:47 | call to ComPtr | atl.cpp:1361:1:1361:1 | p3 | |
+| atl.cpp:1359:44:1359:45 | p1 | atl.cpp:1359:34:1359:42 | call to move | TAINT |
+| atl.cpp:1359:44:1359:45 | p1 | atl.cpp:1359:34:1359:47 | call to ComPtr | |
+| atl.cpp:1360:9:1360:10 | ref arg p3 | atl.cpp:1361:1:1361:1 | p3 | |
+| atl.cpp:1360:12:1360:14 | call to Get | atl.cpp:1360:8:1360:16 | * ... | TAINT |
+| atl.cpp:1365:11:1365:21 | call to source | atl.cpp:1366:42:1366:42 | x | |
+| atl.cpp:1366:34:1366:43 | new | atl.cpp:1366:34:1366:44 | call to ComPtr | TAINT |
+| atl.cpp:1366:34:1366:44 | call to ComPtr | atl.cpp:1368:3:1368:4 | p1 | |
+| atl.cpp:1366:34:1366:44 | call to ComPtr | atl.cpp:1370:1:1370:1 | p1 | |
+| atl.cpp:1366:42:1366:42 | x | atl.cpp:1366:34:1366:43 | new | |
+| atl.cpp:1367:32:1367:33 | p2 | atl.cpp:1368:9:1368:10 | p2 | |
+| atl.cpp:1367:32:1367:33 | p2 | atl.cpp:1369:9:1369:10 | p2 | |
+| atl.cpp:1368:9:1368:10 | ref arg p2 | atl.cpp:1369:9:1369:10 | p2 | |
+| atl.cpp:1369:13:1369:15 | call to Get | atl.cpp:1369:8:1369:17 | * ... | TAINT |
+| atl.cpp:1374:11:1374:21 | call to source | atl.cpp:1375:42:1375:42 | x | |
+| atl.cpp:1374:11:1374:21 | call to source | atl.cpp:1384:42:1384:42 | x | |
+| atl.cpp:1375:34:1375:43 | new | atl.cpp:1375:34:1375:44 | call to ComPtr | TAINT |
+| atl.cpp:1375:34:1375:44 | call to ComPtr | atl.cpp:1377:3:1377:4 | p1 | |
+| atl.cpp:1375:34:1375:44 | call to ComPtr | atl.cpp:1381:3:1381:4 | p1 | |
+| atl.cpp:1375:34:1375:44 | call to ComPtr | atl.cpp:1389:1:1389:1 | p1 | |
+| atl.cpp:1375:42:1375:42 | x | atl.cpp:1375:34:1375:43 | new | |
+| atl.cpp:1376:14:1376:20 | 0 | atl.cpp:1377:14:1377:16 | raw | |
+| atl.cpp:1376:14:1376:20 | 0 | atl.cpp:1378:9:1378:11 | raw | |
+| atl.cpp:1376:14:1376:20 | 0 | atl.cpp:1381:31:1381:33 | raw | |
+| atl.cpp:1376:14:1376:20 | 0 | atl.cpp:1382:9:1382:11 | raw | |
+| atl.cpp:1377:3:1377:4 | ref arg p1 | atl.cpp:1381:3:1381:4 | p1 | |
+| atl.cpp:1377:3:1377:4 | ref arg p1 | atl.cpp:1389:1:1389:1 | p1 | |
+| atl.cpp:1377:13:1377:16 | ref arg & ... | atl.cpp:1377:14:1377:16 | raw [inner post update] | |
+| atl.cpp:1377:13:1377:16 | ref arg & ... | atl.cpp:1378:9:1378:11 | raw | |
+| atl.cpp:1377:13:1377:16 | ref arg & ... | atl.cpp:1381:31:1381:33 | raw | |
+| atl.cpp:1377:13:1377:16 | ref arg & ... | atl.cpp:1382:9:1382:11 | raw | |
+| atl.cpp:1377:14:1377:16 | raw | atl.cpp:1377:13:1377:16 | & ... | |
+| atl.cpp:1378:9:1378:11 | raw | atl.cpp:1378:8:1378:11 | * ... | TAINT |
+| atl.cpp:1380:31:1380:32 | call to ComPtr | atl.cpp:1389:1:1389:1 | p2 | |
+| atl.cpp:1381:30:1381:33 | ref arg & ... | atl.cpp:1381:31:1381:33 | raw [inner post update] | |
+| atl.cpp:1381:30:1381:33 | ref arg & ... | atl.cpp:1382:9:1382:11 | raw | |
+| atl.cpp:1381:31:1381:33 | raw | atl.cpp:1381:30:1381:33 | & ... | |
+| atl.cpp:1382:9:1382:11 | raw | atl.cpp:1382:8:1382:11 | * ... | TAINT |
+| atl.cpp:1384:34:1384:43 | new | atl.cpp:1384:34:1384:44 | call to ComPtr | TAINT |
+| atl.cpp:1384:34:1384:44 | call to ComPtr | atl.cpp:1387:3:1387:4 | p3 | |
+| atl.cpp:1384:34:1384:44 | call to ComPtr | atl.cpp:1389:1:1389:1 | p3 | |
+| atl.cpp:1384:42:1384:42 | x | atl.cpp:1384:34:1384:43 | new | |
+| atl.cpp:1386:15:1386:21 | 0 | atl.cpp:1387:19:1387:22 | raw2 | |
+| atl.cpp:1386:15:1386:21 | 0 | atl.cpp:1388:9:1388:12 | raw2 | |
+| atl.cpp:1387:18:1387:22 | ref arg & ... | atl.cpp:1387:19:1387:22 | raw2 [inner post update] | |
+| atl.cpp:1387:18:1387:22 | ref arg & ... | atl.cpp:1388:9:1388:12 | raw2 | |
+| atl.cpp:1387:19:1387:22 | raw2 | atl.cpp:1387:18:1387:22 | & ... | |
+| atl.cpp:1388:9:1388:12 | raw2 | atl.cpp:1388:8:1388:12 | * ... | TAINT |
+| atl.cpp:1393:11:1393:21 | call to source | atl.cpp:1394:42:1394:42 | x | |
+| atl.cpp:1394:34:1394:43 | new | atl.cpp:1394:34:1394:44 | call to ComPtr | TAINT |
+| atl.cpp:1394:34:1394:44 | call to ComPtr | atl.cpp:1396:3:1396:4 | p1 | |
+| atl.cpp:1394:34:1394:44 | call to ComPtr | atl.cpp:1398:9:1398:10 | p1 | |
+| atl.cpp:1394:34:1394:44 | call to ComPtr | atl.cpp:1399:1:1399:1 | p1 | |
+| atl.cpp:1394:42:1394:42 | x | atl.cpp:1394:34:1394:43 | new | |
+| atl.cpp:1395:31:1395:32 | call to ComPtr | atl.cpp:1396:11:1396:12 | p2 | |
+| atl.cpp:1395:31:1395:32 | call to ComPtr | atl.cpp:1397:9:1397:10 | p2 | |
+| atl.cpp:1395:31:1395:32 | call to ComPtr | atl.cpp:1399:1:1399:1 | p2 | |
+| atl.cpp:1396:3:1396:4 | ref arg p1 | atl.cpp:1398:9:1398:10 | p1 | |
+| atl.cpp:1396:3:1396:4 | ref arg p1 | atl.cpp:1399:1:1399:1 | p1 | |
+| atl.cpp:1396:11:1396:12 | ref arg p2 | atl.cpp:1397:9:1397:10 | p2 | |
+| atl.cpp:1396:11:1396:12 | ref arg p2 | atl.cpp:1399:1:1399:1 | p2 | |
+| atl.cpp:1397:9:1397:10 | ref arg p2 | atl.cpp:1399:1:1399:1 | p2 | |
+| atl.cpp:1397:12:1397:14 | call to Get | atl.cpp:1397:8:1397:16 | * ... | TAINT |
+| atl.cpp:1398:9:1398:10 | ref arg p1 | atl.cpp:1399:1:1399:1 | p1 | |
+| atl.cpp:1398:12:1398:14 | call to Get | atl.cpp:1398:8:1398:16 | * ... | TAINT |
+| atl.cpp:1403:11:1403:21 | call to source | atl.cpp:1404:42:1404:42 | x | |
+| atl.cpp:1403:11:1403:21 | call to source | atl.cpp:1407:48:1407:48 | x | |
+| atl.cpp:1403:11:1403:21 | call to source | atl.cpp:1410:42:1410:42 | x | |
+| atl.cpp:1404:34:1404:43 | new | atl.cpp:1404:34:1404:44 | call to ComPtr | TAINT |
+| atl.cpp:1404:34:1404:44 | call to ComPtr | atl.cpp:1405:10:1405:11 | p1 | |
+| atl.cpp:1404:34:1404:44 | call to ComPtr | atl.cpp:1413:1:1413:1 | p1 | |
+| atl.cpp:1404:42:1404:42 | x | atl.cpp:1404:34:1404:43 | new | |
+| atl.cpp:1405:9:1405:26 | * ... | atl.cpp:1405:8:1405:26 | * ... | TAINT |
+| atl.cpp:1405:10:1405:11 | ref arg p1 | atl.cpp:1413:1:1413:1 | p1 | |
+| atl.cpp:1405:13:1405:24 | call to GetAddressOf | atl.cpp:1405:9:1405:26 | * ... | TAINT |
+| atl.cpp:1407:40:1407:49 | new | atl.cpp:1407:40:1407:50 | call to ComPtr | TAINT |
+| atl.cpp:1407:40:1407:50 | call to ComPtr | atl.cpp:1408:10:1408:11 | p2 | |
+| atl.cpp:1407:40:1407:50 | call to ComPtr | atl.cpp:1413:1:1413:1 | p2 | |
+| atl.cpp:1407:48:1407:48 | x | atl.cpp:1407:40:1407:49 | new | |
+| atl.cpp:1408:9:1408:26 | * ... | atl.cpp:1408:8:1408:26 | * ... | TAINT |
+| atl.cpp:1408:10:1408:11 | ref arg p2 | atl.cpp:1413:1:1413:1 | p2 | |
+| atl.cpp:1408:13:1408:24 | call to GetAddressOf | atl.cpp:1408:9:1408:26 | * ... | TAINT |
+| atl.cpp:1410:34:1410:43 | new | atl.cpp:1410:34:1410:44 | call to ComPtr | TAINT |
+| atl.cpp:1410:34:1410:44 | call to ComPtr | atl.cpp:1411:14:1411:15 | p3 | |
+| atl.cpp:1410:34:1410:44 | call to ComPtr | atl.cpp:1413:1:1413:1 | p3 | |
+| atl.cpp:1410:42:1410:42 | x | atl.cpp:1410:34:1410:43 | new | |
+| atl.cpp:1411:14:1411:15 | ref arg p3 | atl.cpp:1413:1:1413:1 | p3 | |
+| atl.cpp:1411:17:1411:38 | call to ReleaseAndGetAddressOf | atl.cpp:1412:10:1412:11 | pp | |
+| atl.cpp:1412:9:1412:11 | * ... | atl.cpp:1412:8:1412:11 | * ... | TAINT |
+| atl.cpp:1412:10:1412:11 | pp | atl.cpp:1412:9:1412:11 | * ... | TAINT |
+| atl.cpp:1420:11:1420:21 | call to source | atl.cpp:1421:42:1421:42 | x | |
+| atl.cpp:1420:11:1420:21 | call to source | atl.cpp:1426:48:1426:48 | x | |
+| atl.cpp:1421:34:1421:43 | new | atl.cpp:1421:34:1421:44 | call to ComPtr | TAINT |
+| atl.cpp:1421:34:1421:44 | call to ComPtr | atl.cpp:1422:73:1422:74 | p1 | |
+| atl.cpp:1421:34:1421:44 | call to ComPtr | atl.cpp:1435:1:1435:1 | p1 | |
+| atl.cpp:1421:42:1421:42 | x | atl.cpp:1421:34:1421:43 | new | |
+| atl.cpp:1422:72:1422:72 | call to operator& | atl.cpp:1423:38:1423:39 | pp | |
+| atl.cpp:1422:73:1422:74 | ref arg p1 | atl.cpp:1435:1:1435:1 | p1 | |
+| atl.cpp:1423:37:1423:37 | call to operator* | atl.cpp:1424:9:1424:10 | qq | |
+| atl.cpp:1424:13:1424:15 | call to Get | atl.cpp:1424:8:1424:17 | * ... | TAINT |
+| atl.cpp:1426:40:1426:49 | new | atl.cpp:1426:40:1426:50 | call to ComPtr | TAINT |
+| atl.cpp:1426:40:1426:50 | call to ComPtr | atl.cpp:1427:80:1427:81 | p2 | |
+| atl.cpp:1426:40:1426:50 | call to ComPtr | atl.cpp:1435:1:1435:1 | p2 | |
+| atl.cpp:1426:48:1426:48 | x | atl.cpp:1426:40:1426:49 | new | |
+| atl.cpp:1427:79:1427:79 | call to operator& | atl.cpp:1428:45:1428:47 | pp2 | |
+| atl.cpp:1428:44:1428:44 | call to operator* | atl.cpp:1429:9:1429:11 | qq2 | |
+| atl.cpp:1429:14:1429:16 | call to Get | atl.cpp:1429:8:1429:18 | * ... | TAINT |
+| atl.cpp:1431:5:1431:5 | s | atl.cpp:1432:3:1432:3 | s | |
+| atl.cpp:1431:5:1431:5 | s | atl.cpp:1433:33:1433:33 | s | |
+| atl.cpp:1432:3:1432:3 | s [post update] | atl.cpp:1433:33:1433:33 | s | |
+| atl.cpp:1432:3:1432:21 | ... = ... | atl.cpp:1432:5:1432:5 | x [post update] | |
+| atl.cpp:1432:9:1432:19 | call to source | atl.cpp:1432:3:1432:21 | ... = ... | |
+| atl.cpp:1433:32:1433:33 | & ... | atl.cpp:1433:32:1433:34 | call to ComPtr | TAINT |
+| atl.cpp:1433:32:1433:33 | ref arg & ... | atl.cpp:1433:33:1433:33 | s [inner post update] | |
+| atl.cpp:1433:32:1433:34 | call to ComPtr | atl.cpp:1434:8:1434:9 | p3 | |
+| atl.cpp:1433:32:1433:34 | call to ComPtr | atl.cpp:1435:1:1435:1 | p3 | |
+| atl.cpp:1433:33:1433:33 | s | atl.cpp:1433:32:1433:33 | & ... | |
+| atl.cpp:1434:8:1434:9 | ref arg p3 | atl.cpp:1435:1:1435:1 | p3 | |
+| atl.cpp:1438:31:1438:32 | call to ComPtr | atl.cpp:1439:3:1439:4 | p1 | |
+| atl.cpp:1438:31:1438:32 | call to ComPtr | atl.cpp:1440:9:1440:10 | p1 | |
+| atl.cpp:1438:31:1438:32 | call to ComPtr | atl.cpp:1447:8:1447:9 | p1 | |
+| atl.cpp:1438:31:1438:32 | call to ComPtr | atl.cpp:1451:8:1451:9 | p1 | |
+| atl.cpp:1438:31:1438:32 | call to ComPtr | atl.cpp:1455:18:1455:19 | p1 | |
+| atl.cpp:1438:31:1438:32 | call to ComPtr | atl.cpp:1459:18:1459:19 | p1 | |
+| atl.cpp:1438:31:1438:32 | call to ComPtr | atl.cpp:1461:1:1461:1 | p1 | |
+| atl.cpp:1439:3:1439:4 | ref arg p1 | atl.cpp:1440:9:1440:10 | p1 | |
+| atl.cpp:1439:3:1439:4 | ref arg p1 | atl.cpp:1447:8:1447:9 | p1 | |
+| atl.cpp:1439:3:1439:4 | ref arg p1 | atl.cpp:1451:8:1451:9 | p1 | |
+| atl.cpp:1439:3:1439:4 | ref arg p1 | atl.cpp:1455:18:1455:19 | p1 | |
+| atl.cpp:1439:3:1439:4 | ref arg p1 | atl.cpp:1459:18:1459:19 | p1 | |
+| atl.cpp:1439:3:1439:4 | ref arg p1 | atl.cpp:1461:1:1461:1 | p1 | |
+| atl.cpp:1439:16:1439:26 | call to source | atl.cpp:1439:8:1439:29 | new | |
+| atl.cpp:1440:9:1440:10 | ref arg p1 | atl.cpp:1447:8:1447:9 | p1 | |
+| atl.cpp:1440:9:1440:10 | ref arg p1 | atl.cpp:1451:8:1451:9 | p1 | |
+| atl.cpp:1440:9:1440:10 | ref arg p1 | atl.cpp:1455:18:1455:19 | p1 | |
+| atl.cpp:1440:9:1440:10 | ref arg p1 | atl.cpp:1459:18:1459:19 | p1 | |
+| atl.cpp:1440:9:1440:10 | ref arg p1 | atl.cpp:1461:1:1461:1 | p1 | |
+| atl.cpp:1440:12:1440:14 | call to Get | atl.cpp:1440:8:1440:16 | * ... | TAINT |
+| atl.cpp:1442:31:1442:32 | call to ComPtr | atl.cpp:1443:3:1443:4 | p2 | |
+| atl.cpp:1442:31:1442:32 | call to ComPtr | atl.cpp:1444:9:1444:10 | p2 | |
+| atl.cpp:1442:31:1442:32 | call to ComPtr | atl.cpp:1461:1:1461:1 | p2 | |
+| atl.cpp:1443:3:1443:4 | ref arg p2 | atl.cpp:1444:9:1444:10 | p2 | |
+| atl.cpp:1443:3:1443:4 | ref arg p2 | atl.cpp:1461:1:1461:1 | p2 | |
+| atl.cpp:1443:17:1443:28 | call to source | atl.cpp:1443:8:1443:31 | new | |
+| atl.cpp:1444:9:1444:10 | ref arg p2 | atl.cpp:1461:1:1461:1 | p2 | |
+| atl.cpp:1444:12:1444:14 | call to Get | atl.cpp:1444:8:1444:16 | * ... | TAINT |
+| atl.cpp:1446:31:1446:32 | call to ComPtr | atl.cpp:1447:3:1447:4 | p3 | |
+| atl.cpp:1446:31:1446:32 | call to ComPtr | atl.cpp:1448:9:1448:10 | p3 | |
+| atl.cpp:1446:31:1446:32 | call to ComPtr | atl.cpp:1461:1:1461:1 | p3 | |
+| atl.cpp:1447:3:1447:4 | ref arg p3 | atl.cpp:1448:9:1448:10 | p3 | |
+| atl.cpp:1447:3:1447:4 | ref arg p3 | atl.cpp:1461:1:1461:1 | p3 | |
+| atl.cpp:1447:8:1447:9 | p1 | atl.cpp:1447:3:1447:4 | ref arg p3 | TAINT |
+| atl.cpp:1447:8:1447:9 | p1 | atl.cpp:1447:6:1447:6 | call to operator= | TAINT |
+| atl.cpp:1448:9:1448:10 | ref arg p3 | atl.cpp:1461:1:1461:1 | p3 | |
+| atl.cpp:1448:12:1448:14 | call to Get | atl.cpp:1448:8:1448:16 | * ... | TAINT |
+| atl.cpp:1450:32:1450:33 | call to ComPtr | atl.cpp:1451:3:1451:4 | p4 | |
+| atl.cpp:1450:32:1450:33 | call to ComPtr | atl.cpp:1452:9:1452:10 | p4 | |
+| atl.cpp:1450:32:1450:33 | call to ComPtr | atl.cpp:1461:1:1461:1 | p4 | |
+| atl.cpp:1451:3:1451:4 | ref arg p4 | atl.cpp:1452:9:1452:10 | p4 | |
+| atl.cpp:1451:3:1451:4 | ref arg p4 | atl.cpp:1461:1:1461:1 | p4 | |
+| atl.cpp:1452:9:1452:10 | ref arg p4 | atl.cpp:1461:1:1461:1 | p4 | |
+| atl.cpp:1452:12:1452:14 | call to Get | atl.cpp:1452:8:1452:16 | * ... | TAINT |
+| atl.cpp:1454:31:1454:32 | call to ComPtr | atl.cpp:1455:3:1455:4 | p5 | |
+| atl.cpp:1454:31:1454:32 | call to ComPtr | atl.cpp:1456:9:1456:10 | p5 | |
+| atl.cpp:1454:31:1454:32 | call to ComPtr | atl.cpp:1461:1:1461:1 | p5 | |
+| atl.cpp:1455:3:1455:4 | ref arg p5 | atl.cpp:1456:9:1456:10 | p5 | |
+| atl.cpp:1455:3:1455:4 | ref arg p5 | atl.cpp:1461:1:1461:1 | p5 | |
+| atl.cpp:1455:8:1455:16 | call to move | atl.cpp:1455:3:1455:4 | ref arg p5 | TAINT |
+| atl.cpp:1455:8:1455:16 | call to move | atl.cpp:1455:6:1455:6 | call to operator= | TAINT |
+| atl.cpp:1455:8:1455:16 | ref arg call to move | atl.cpp:1455:18:1455:19 | p1 [inner post update] | |
+| atl.cpp:1455:8:1455:16 | ref arg call to move | atl.cpp:1459:18:1459:19 | p1 | |
+| atl.cpp:1455:8:1455:16 | ref arg call to move | atl.cpp:1461:1:1461:1 | p1 | |
+| atl.cpp:1455:18:1455:19 | p1 | atl.cpp:1455:3:1455:4 | ref arg p5 | TAINT |
+| atl.cpp:1455:18:1455:19 | p1 | atl.cpp:1455:6:1455:6 | call to operator= | TAINT |
+| atl.cpp:1455:18:1455:19 | p1 | atl.cpp:1455:8:1455:16 | call to move | TAINT |
+| atl.cpp:1456:9:1456:10 | ref arg p5 | atl.cpp:1461:1:1461:1 | p5 | |
+| atl.cpp:1456:12:1456:14 | call to Get | atl.cpp:1456:8:1456:16 | * ... | TAINT |
+| atl.cpp:1458:32:1458:33 | call to ComPtr | atl.cpp:1459:3:1459:4 | p6 | |
+| atl.cpp:1458:32:1458:33 | call to ComPtr | atl.cpp:1460:9:1460:10 | p6 | |
+| atl.cpp:1458:32:1458:33 | call to ComPtr | atl.cpp:1461:1:1461:1 | p6 | |
+| atl.cpp:1459:3:1459:4 | ref arg p6 | atl.cpp:1460:9:1460:10 | p6 | |
+| atl.cpp:1459:3:1459:4 | ref arg p6 | atl.cpp:1461:1:1461:1 | p6 | |
+| atl.cpp:1459:8:1459:16 | ref arg call to move | atl.cpp:1459:18:1459:19 | p1 [inner post update] | |
+| atl.cpp:1459:8:1459:16 | ref arg call to move | atl.cpp:1461:1:1461:1 | p1 | |
+| atl.cpp:1459:18:1459:19 | p1 | atl.cpp:1459:8:1459:16 | call to move | TAINT |
+| atl.cpp:1460:9:1460:10 | ref arg p6 | atl.cpp:1461:1:1461:1 | p6 | |
+| atl.cpp:1460:12:1460:14 | call to Get | atl.cpp:1460:8:1460:16 | * ... | TAINT |
| bsd.cpp:17:11:17:16 | call to source | bsd.cpp:20:18:20:18 | s | |
| bsd.cpp:18:12:18:15 | addr | bsd.cpp:20:22:20:25 | addr | |
| bsd.cpp:18:12:18:15 | addr | bsd.cpp:23:8:23:11 | addr | |
@@ -7767,6 +7984,10 @@ WARNING: module 'TaintTracking' has been deprecated and may be removed in future
| taint.cpp:830:20:830:34 | call to indirect_source | taint.cpp:832:23:832:24 | in | |
| taint.cpp:831:15:831:17 | out | taint.cpp:832:18:832:20 | out | |
| taint.cpp:831:15:831:17 | out | taint.cpp:833:8:833:10 | out | |
+| taint.cpp:841:21:841:35 | call to indirect_source | taint.cpp:842:11:842:12 | fp | |
+| taint.cpp:841:21:841:35 | call to indirect_source | taint.cpp:843:16:843:17 | fp | |
+| taint.cpp:842:11:842:12 | ref arg fp | taint.cpp:843:16:843:17 | fp | |
+| taint.cpp:842:15:842:16 | | taint.cpp:842:11:842:12 | ref arg fp | TAINT |
| thread.cpp:10:27:10:27 | s | thread.cpp:10:27:10:27 | s | |
| thread.cpp:10:27:10:27 | s | thread.cpp:11:8:11:8 | s | |
| thread.cpp:14:26:14:26 | s | thread.cpp:15:8:15:8 | s | |
diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/taint.cpp b/cpp/ql/test/library-tests/dataflow/taint-tests/taint.cpp
index 74bcf26ea7d2..0c09665de1cd 100644
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/taint.cpp
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/taint.cpp
@@ -831,4 +831,15 @@ void test_write_to_const_ptr_ptr() {
const char* out;
take_const_ptr(out, in);
sink(out); // $ SPURIOUS: ast
+}
+
+void indirect_sink(FILE *fp);
+int fprintf(FILE *fp, const char *format, ...);
+
+int f7(void)
+{
+ FILE* fp = (FILE*)indirect_source();
+ fprintf(fp, "");
+ indirect_sink(fp); // $ ir MISSING: ast
+ return 0;
}
\ No newline at end of file
diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/taint.ql b/cpp/ql/test/library-tests/dataflow/taint-tests/taint.ql
index f5f483cdf1b6..3bde6ca03f06 100644
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/taint.ql
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/taint.ql
@@ -117,6 +117,11 @@ module IRTest {
call.getTarget().getName() = "sink" and
[sink.asExpr(), sink.asIndirectExpr()] = call.getAnArgument()
)
+ or
+ exists(FunctionCall call |
+ call.getTarget().getName() = "indirect_sink" and
+ sink.asIndirectExpr() = call.getAnArgument()
+ )
}
predicate isBarrier(DataFlow::Node barrier) {
diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/test_mad-signatures.expected b/cpp/ql/test/library-tests/dataflow/taint-tests/test_mad-signatures.expected
index 239ed2ec607d..846359fd6b23 100644
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/test_mad-signatures.expected
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/test_mad-signatures.expected
@@ -5567,6 +5567,31 @@ signatureMatches
| atl.cpp:1231:5:1231:12 | CStrBufT | (const char *,const char *,unsigned long) | | __ngettext | 2 |
| atl.cpp:1231:5:1231:12 | CStrBufT | (unsigned char *,int,unsigned long) | | UTF8_putc | 1 |
| atl.cpp:1231:5:1231:12 | CStrBufT | (unsigned char *,int,unsigned long) | | UTF8_putc | 2 |
+| atl.cpp:1286:5:1286:10 | ComPtr | (const ComPtr &) | ComPtr | ComPtr | 0 |
+| atl.cpp:1286:5:1286:10 | ComPtr | (const ComPtr &) | ComPtr | operator= | 0 |
+| atl.cpp:1287:5:1287:10 | ComPtr | (ComPtr &&) | ComPtr | ComPtr | 0 |
+| atl.cpp:1287:5:1287:10 | ComPtr | (ComPtr &&) | ComPtr | operator= | 0 |
+| atl.cpp:1290:5:1290:10 | ComPtr | (T *) | ComPtr | ComPtr | 0 |
+| atl.cpp:1290:5:1290:10 | ComPtr | (T *) | ComPtr | ComPtr | 0 |
+| atl.cpp:1290:5:1290:10 | ComPtr | (U *) | ComPtr | operator= | 0 |
+| atl.cpp:1290:5:1290:10 | ComPtr | (U *) | ComPtr | operator= | 0 |
+| atl.cpp:1301:13:1301:18 | CopyTo | (T **) | ComPtr | CopyTo | 0 |
+| atl.cpp:1303:13:1303:18 | CopyTo | (Curl_easy *,void **) | | Curl_resolver_init | 1 |
+| atl.cpp:1303:13:1303:18 | CopyTo | (REFIID,void **) | ComPtr | CopyTo | 0 |
+| atl.cpp:1303:13:1303:18 | CopyTo | (REFIID,void **) | ComPtr | CopyTo | 1 |
+| atl.cpp:1303:13:1303:18 | CopyTo | (size_t,void **) | | __libc_alloc_buffer_allocate | 1 |
+| atl.cpp:1306:13:1306:18 | CopyTo | (T **) | ComPtr | CopyTo | 0 |
+| atl.cpp:1328:13:1328:21 | operator= | (T *) | ComPtr | operator= | 0 |
+| atl.cpp:1330:13:1330:21 | operator= | (T *) | ComPtr | ComPtr | 0 |
+| atl.cpp:1330:13:1330:21 | operator= | (U *) | ComPtr | operator= | 0 |
+| atl.cpp:1331:13:1331:21 | operator= | (const ComPtr &) | ComPtr | ComPtr | 0 |
+| atl.cpp:1331:13:1331:21 | operator= | (const ComPtr &) | ComPtr | operator= | 0 |
+| atl.cpp:1333:13:1333:21 | operator= | (const ComPtr &) | ComPtr | ComPtr | 0 |
+| atl.cpp:1333:13:1333:21 | operator= | (const ComPtr &) | ComPtr | operator= | 0 |
+| atl.cpp:1334:13:1334:21 | operator= | (ComPtr &&) | ComPtr | ComPtr | 0 |
+| atl.cpp:1334:13:1334:21 | operator= | (ComPtr &&) | ComPtr | operator= | 0 |
+| atl.cpp:1336:13:1336:21 | operator= | (ComPtr &&) | ComPtr | ComPtr | 0 |
+| atl.cpp:1336:13:1336:21 | operator= | (ComPtr &&) | ComPtr | operator= | 0 |
| bsd.cpp:12:5:12:10 | accept | (CURLM *,curl_socket_t,int *) | | curl_multi_socket | 2 |
| bsd.cpp:12:5:12:10 | accept | (Curl_easy *,ssize_t *,int *) | | Curl_GetFTPResponse | 2 |
| bsd.cpp:12:5:12:10 | accept | (EVP_CIPHER_CTX *,unsigned char *,int *) | | EVP_CipherFinal | 2 |
@@ -9386,6 +9411,8 @@ signatureMatches
| stl.h:333:42:333:47 | insert | (const_iterator,InputIt,InputIt) | vector | insert | 2 |
| stl.h:333:42:333:47 | insert | (const_iterator,InputIt,InputIt) | vector | insert | 2 |
| stl.h:335:37:335:43 | emplace | (format_string,Args &&) | | format | 1 |
+| stl.h:351:12:351:21 | shared_ptr | (T *) | ComPtr | operator= | 0 |
+| stl.h:369:12:369:21 | unique_ptr | (T *) | ComPtr | operator= | 0 |
| stl.h:396:3:396:3 | pair | (const deque &,const Allocator &) | deque | deque | 1 |
| stl.h:396:3:396:3 | pair | (const deque &,const Allocator &) | deque | deque | 1 |
| stl.h:396:3:396:3 | pair | (const deque &,const Allocator &) | deque | deque | 1 |
@@ -17670,6 +17697,55 @@ signatureMatches
| taint.cpp:822:6:822:19 | take_const_ptr | (unsigned long *,const char *) | | set_cert_ex | 1 |
| taint.cpp:822:6:822:19 | take_const_ptr | (unsigned long *,const char *) | | set_name_ex | 1 |
| taint.cpp:822:6:822:19 | take_const_ptr | (uv_pipe_t *,const char *) | | uv_pipe_bind | 1 |
+| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | _IO_default_uflow | 0 |
+| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | _IO_feof | 0 |
+| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | _IO_ferror | 0 |
+| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | _IO_file_close_mmap | 0 |
+| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | _IO_file_underflow_mmap | 0 |
+| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | _IO_ftell | 0 |
+| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | _IO_getc | 0 |
+| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | _IO_getwc | 0 |
+| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | _IO_new_file_underflow | 0 |
+| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | _IO_peekc_locked | 0 |
+| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | _IO_str_count | 0 |
+| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | _IO_str_underflow | 0 |
+| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | _IO_sungetc | 0 |
+| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | _IO_sungetwc | 0 |
+| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | _IO_wdefault_uflow | 0 |
+| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | _IO_wfile_underflow | 0 |
+| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | _IO_wfile_underflow_mmap | 0 |
+| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | _IO_wstr_count | 0 |
+| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | _IO_wstr_underflow | 0 |
+| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | __fbufsize | 0 |
+| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | __feof_unlocked | 0 |
+| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | __ferror_unlocked | 0 |
+| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | __fileno | 0 |
+| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | __flbf | 0 |
+| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | __fopen_maybe_mmap | 0 |
+| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | __fpending | 0 |
+| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | __ftello | 0 |
+| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | __fwriting | 0 |
+| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | __getc_unlocked | 0 |
+| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | __getwc_unlocked | 0 |
+| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | __uflow | 0 |
+| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | __underflow | 0 |
+| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | __wuflow | 0 |
+| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | __wunderflow | 0 |
+| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | feof_unlocked | 0 |
+| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | ferror_unlocked | 0 |
+| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | fgetc_unlocked | 0 |
+| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | fgetgrent | 0 |
+| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | fgetpwent | 0 |
+| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | fgetsgent | 0 |
+| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | fgetspent | 0 |
+| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | getc_unlocked | 0 |
+| taint.cpp:836:6:836:18 | indirect_sink | (FILE *) | | getmntent | 0 |
+| taint.cpp:837:5:837:11 | fprintf | (CURLSH *,CURLSHoption,...) | | curl_share_setopt | 2 |
+| taint.cpp:837:5:837:11 | fprintf | (Jim_Interp *,const char *,...) | | Jim_SetResultFormatted | 1 |
+| taint.cpp:837:5:837:11 | fprintf | (Jim_Interp *,const char *,...) | | Jim_SetResultFormatted | 2 |
+| taint.cpp:837:5:837:11 | fprintf | (char **,const char *,...) | | ___asprintf | 1 |
+| taint.cpp:837:5:837:11 | fprintf | (char **,const char *,...) | | ___asprintf | 2 |
+| taint.cpp:837:5:837:11 | fprintf | (curl_httppost **,curl_httppost **,...) | | curl_formadd | 2 |
| thread.cpp:4:6:4:9 | sink | (int) | | ASN1_STRING_type_new | 0 |
| thread.cpp:4:6:4:9 | sink | (int) | | ASN1_tag2bit | 0 |
| thread.cpp:4:6:4:9 | sink | (int) | | ASN1_tag2str | 0 |
@@ -21701,6 +21777,8 @@ getSignatureParameterName
| (CURLU *,const char *,char **,OperationConfig *) | | ipfs_url_rewrite | 1 | const char * |
| (CURLU *,const char *,char **,OperationConfig *) | | ipfs_url_rewrite | 2 | char ** |
| (CURLU *,const char *,char **,OperationConfig *) | | ipfs_url_rewrite | 3 | OperationConfig * |
+| (ComPtr &&) | ComPtr | ComPtr | 0 | ComPtr && |
+| (ComPtr &&) | ComPtr | operator= | 0 | ComPtr && |
| (CompoundDictionary *,const PreparedDictionary *) | | AttachPreparedDictionary | 0 | CompoundDictionary * |
| (CompoundDictionary *,const PreparedDictionary *) | | AttachPreparedDictionary | 1 | const PreparedDictionary * |
| (Curl_cfilter *) | | Curl_conn_cf_is_ssl | 0 | Curl_cfilter * |
@@ -28531,6 +28609,8 @@ getSignatureParameterName
| (RAND_POOL *,unsigned int) | | ossl_rand_pool_bytes_needed | 1 | unsigned int |
| (RECORD_LAYER *,SSL_CONNECTION *) | | RECORD_LAYER_init | 0 | RECORD_LAYER * |
| (RECORD_LAYER *,SSL_CONNECTION *) | | RECORD_LAYER_init | 1 | SSL_CONNECTION * |
+| (REFIID,void **) | ComPtr | CopyTo | 0 | REFIID |
+| (REFIID,void **) | ComPtr | CopyTo | 1 | void ** |
| (RIO_NOTIFIER *) | | ossl_rio_notifier_cleanup | 0 | RIO_NOTIFIER * |
| (RIPEMD160_CTX *,const unsigned char *) | | RIPEMD160_Transform | 0 | RIPEMD160_CTX * |
| (RIPEMD160_CTX *,const unsigned char *) | | RIPEMD160_Transform | 1 | const unsigned char * |
@@ -30114,6 +30194,10 @@ getSignatureParameterName
| (Strtab *,const char *,size_t) | | strtabadd | 2 | size_t |
| (Strtab *,size_t *) | | strtabfinalize | 0 | Strtab * |
| (Strtab *,size_t *) | | strtabfinalize | 1 | size_t * |
+| (T *) | ComPtr | ComPtr | 0 | func:0 * |
+| (T *) | ComPtr | operator= | 0 | class:0 * |
+| (T **) | ComPtr | CopyTo | 0 | func:0 ** |
+| (T **) | ComPtr | CopyTo | 0 | class:0 ** |
| (TLS_FEATURE *) | | TLS_FEATURE_free | 0 | TLS_FEATURE * |
| (TLS_RL_RECORD *,const unsigned char *) | | ossl_tls_rl_record_set_seq_num | 0 | TLS_RL_RECORD * |
| (TLS_RL_RECORD *,const unsigned char *) | | ossl_tls_rl_record_set_seq_num | 1 | const unsigned char * |
@@ -30306,6 +30390,7 @@ getSignatureParameterName
| (TXT_DB *,int,..(*)(..),OPENSSL_LH_HASHFUNC,OPENSSL_LH_COMPFUNC) | | TXT_DB_create_index | 2 | ..(*)(..) |
| (TXT_DB *,int,..(*)(..),OPENSSL_LH_HASHFUNC,OPENSSL_LH_COMPFUNC) | | TXT_DB_create_index | 3 | OPENSSL_LH_HASHFUNC |
| (TXT_DB *,int,..(*)(..),OPENSSL_LH_HASHFUNC,OPENSSL_LH_COMPFUNC) | | TXT_DB_create_index | 4 | OPENSSL_LH_COMPFUNC |
+| (U *) | ComPtr | operator= | 0 | func:0 * |
| (UI *) | | UI_get0_user_data | 0 | UI * |
| (UI *) | | UI_get_method | 0 | UI * |
| (UI *,UI_STRING *,const char *) | | UI_set_result | 0 | UI * |
@@ -33256,6 +33341,8 @@ getSignatureParameterName
| (const CURLU *,CURLUPart,char **,unsigned int) | | curl_url_get | 1 | CURLUPart |
| (const CURLU *,CURLUPart,char **,unsigned int) | | curl_url_get | 2 | char ** |
| (const CURLU *,CURLUPart,char **,unsigned int) | | curl_url_get | 3 | unsigned int |
+| (const ComPtr &) | ComPtr | ComPtr | 0 | const ComPtr & |
+| (const ComPtr &) | ComPtr | operator= | 0 | const ComPtr & |
| (const Command *,const size_t,const BlockSplit *,const BlockSplit *,const BlockSplit *,const uint8_t *,size_t,size_t,uint8_t,uint8_t,const ContextType *,HistogramLiteral *,HistogramCommand *,HistogramDistance *) | | BrotliBuildHistogramsWithContext | 0 | const Command * |
| (const Command *,const size_t,const BlockSplit *,const BlockSplit *,const BlockSplit *,const uint8_t *,size_t,size_t,uint8_t,uint8_t,const ContextType *,HistogramLiteral *,HistogramCommand *,HistogramDistance *) | | BrotliBuildHistogramsWithContext | 1 | const size_t |
| (const Command *,const size_t,const BlockSplit *,const BlockSplit *,const BlockSplit *,const uint8_t *,size_t,size_t,uint8_t,uint8_t,const ContextType *,HistogramLiteral *,HistogramCommand *,HistogramDistance *) | | BrotliBuildHistogramsWithContext | 2 | const BlockSplit * |
@@ -46355,6 +46442,27 @@ getParameterTypeName
| atl.cpp:1231:5:1231:12 | CStrBufT | 1 | int |
| atl.cpp:1231:5:1231:12 | CStrBufT | 2 | DWORD |
| atl.cpp:1231:5:1231:12 | CStrBufT | 2 | unsigned long |
+| atl.cpp:1286:5:1286:10 | ComPtr | 0 | const ComPtr & |
+| atl.cpp:1287:5:1287:10 | ComPtr | 0 | ComPtr && |
+| atl.cpp:1290:5:1290:10 | ComPtr | 0 | func:0 * |
+| atl.cpp:1290:5:1290:10 | ComPtr | 0 | func:0 * |
+| atl.cpp:1295:13:1295:14 | As | 0 | ComPtr * |
+| atl.cpp:1301:13:1301:18 | CopyTo | 0 | Interfaceclass:0ype ** |
+| atl.cpp:1301:13:1301:18 | CopyTo | 0 | class:0 ** |
+| atl.cpp:1303:13:1303:18 | CopyTo | 0 | GUID * |
+| atl.cpp:1303:13:1303:18 | CopyTo | 0 | REFIID |
+| atl.cpp:1303:13:1303:18 | CopyTo | 1 | void ** |
+| atl.cpp:1306:13:1306:18 | CopyTo | 0 | func:0 ** |
+| atl.cpp:1321:10:1321:13 | Swap | 0 | ComPtr & |
+| atl.cpp:1328:13:1328:21 | operator= | 0 | class:0 * |
+| atl.cpp:1330:13:1330:21 | operator= | 0 | func:0 * |
+| atl.cpp:1331:13:1331:21 | operator= | 0 | const ComPtr & |
+| atl.cpp:1333:13:1333:21 | operator= | 0 | const ComPtr & |
+| atl.cpp:1334:13:1334:21 | operator= | 0 | ComPtr && |
+| atl.cpp:1336:13:1336:21 | operator= | 0 | ComPtr && |
+| atl.cpp:1343:25:1343:28 | move | 0 | func:0 & |
+| atl.cpp:1415:8:1415:8 | operator= | 0 | S && |
+| atl.cpp:1415:8:1415:8 | operator= | 0 | const S & |
| bsd.cpp:6:8:6:8 | operator= | 0 | const sockaddr & |
| bsd.cpp:6:8:6:8 | operator= | 0 | sockaddr && |
| bsd.cpp:12:5:12:10 | accept | 0 | int |
@@ -47191,6 +47299,10 @@ getParameterTypeName
| taint.cpp:817:6:817:27 | write_to_const_ptr_ptr | 1 | const char ** |
| taint.cpp:822:6:822:19 | take_const_ptr | 0 | const char * |
| taint.cpp:822:6:822:19 | take_const_ptr | 1 | const char * |
+| taint.cpp:836:6:836:18 | indirect_sink | 0 | FILE * |
+| taint.cpp:837:5:837:11 | fprintf | 0 | FILE * |
+| taint.cpp:837:5:837:11 | fprintf | 1 | const char * |
+| taint.cpp:837:5:837:11 | fprintf | 2 | ... |
| thread.cpp:4:6:4:9 | sink | 0 | int |
| thread.cpp:6:8:6:8 | operator= | 0 | S && |
| thread.cpp:6:8:6:8 | operator= | 0 | const S & |
diff --git a/cpp/ql/test/library-tests/ir/ir/PrintAST.expected b/cpp/ql/test/library-tests/ir/ir/PrintAST.expected
index 6e62071e7d97..c3085da03ab5 100644
--- a/cpp/ql/test/library-tests/ir/ir/PrintAST.expected
+++ b/cpp/ql/test/library-tests/ir/ir/PrintAST.expected
@@ -24550,6 +24550,37 @@ ir.cpp:
# 2771| Type = [LValueReferenceType] ThreeWay &
# 2771| ValueCategory = prvalue
# 2772| getStmt(2): [ReturnStmt] return ...
+# 2774| [TopLevelFunction] void test_allocation_with_initializer()
+# 2774| :
+# 2774| getEntryPoint(): [BlockStmt] { ... }
+# 2775| getStmt(0): [DeclStmt] declaration
+# 2775| getDeclarationEntry(0): [VariableDeclarationEntry] definition of p1
+# 2775| Type = [IntPointerType] int *
+# 2775| getVariable().getInitializer(): [Initializer] initializer for p1
+# 2775| getExpr(): [NewExpr] new
+# 2775| Type = [IntPointerType] int *
+# 2775| ValueCategory = prvalue
+# 2775| getInitializer(): [Literal] 42
+# 2775| Type = [IntType] int
+# 2775| Value = [Literal] 42
+# 2775| ValueCategory = prvalue
+# 2776| getStmt(1): [DeclStmt] declaration
+# 2776| getDeclarationEntry(0): [VariableDeclarationEntry] definition of p2
+# 2776| Type = [PointerType] long *
+# 2776| getVariable().getInitializer(): [Initializer] initializer for p2
+# 2776| getExpr(): [NewExpr] new
+# 2776| Type = [PointerType] long *
+# 2776| ValueCategory = prvalue
+# 2776| getInitializer(): [Literal] 42
+# 2776| Type = [IntType] int
+# 2776| Value = [Literal] 42
+# 2776| ValueCategory = prvalue
+# 2776| getInitializer().getFullyConverted(): [CStyleCast] (long)...
+# 2776| Conversion = [IntegralConversion] integral conversion
+# 2776| Type = [LongType] long
+# 2776| Value = [CStyleCast] 42
+# 2776| ValueCategory = prvalue
+# 2777| getStmt(2): [ReturnStmt] return ...
ir23.cpp:
# 1| [TopLevelFunction] bool consteval_1()
# 1| :
diff --git a/cpp/ql/test/library-tests/ir/ir/aliased_ir.expected b/cpp/ql/test/library-tests/ir/ir/aliased_ir.expected
index 6bf6801a48bd..d8babdb54e20 100644
--- a/cpp/ql/test/library-tests/ir/ir/aliased_ir.expected
+++ b/cpp/ql/test/library-tests/ir/ir/aliased_ir.expected
@@ -20395,6 +20395,41 @@ ir.cpp:
# 2769| v2769_14(void) = AliasedUse : ~m2771_8
# 2769| v2769_15(void) = ExitFunction :
+# 2774| void test_allocation_with_initializer()
+# 2774| Block 0
+# 2774| v2774_1(void) = EnterFunction :
+# 2774| m2774_2(unknown) = AliasedDefinition :
+# 2774| m2774_3(unknown) = InitializeNonLocal :
+# 2774| m2774_4(unknown) = Chi : total:m2774_2, partial:m2774_3
+# 2775| r2775_1(glval) = VariableAddress[p1] :
+# 2775| r2775_2(glval) = FunctionAddress[operator new] :
+# 2775| r2775_3(unsigned long) = Constant[4] :
+# 2775| r2775_4(void *) = Call[operator new] : func:r2775_2, 0:r2775_3
+# 2775| m2775_5(unknown) = ^CallSideEffect : ~m2774_4
+# 2775| m2775_6(unknown) = Chi : total:m2774_4, partial:m2775_5
+# 2775| m2775_7(unknown) = ^InitializeDynamicAllocation : &:r2775_4
+# 2775| r2775_8(int *) = Convert : r2775_4
+# 2775| r2775_9(int) = Constant[42] :
+# 2775| m2775_10(int) = Store[?] : &:r2775_8, r2775_9
+# 2775| m2775_11(unknown) = Chi : total:m2775_7, partial:m2775_10
+# 2775| m2775_12(int *) = Store[p1] : &:r2775_1, r2775_8
+# 2776| r2776_1(glval) = VariableAddress[p2] :
+# 2776| r2776_2(glval) = FunctionAddress[operator new] :
+# 2776| r2776_3(unsigned long) = Constant[8] :
+# 2776| r2776_4(void *) = Call[operator new] : func:r2776_2, 0:r2776_3
+# 2776| m2776_5(unknown) = ^CallSideEffect : ~m2775_6
+# 2776| m2776_6(unknown) = Chi : total:m2775_6, partial:m2776_5
+# 2776| m2776_7(unknown) = ^InitializeDynamicAllocation : &:r2776_4
+# 2776| r2776_8(long *) = Convert : r2776_4
+# 2776| r2776_9(long) = Constant[42] :
+# 2776| m2776_10(long) = Store[?] : &:r2776_8, r2776_9
+# 2776| m2776_11(unknown) = Chi : total:m2776_7, partial:m2776_10
+# 2776| m2776_12(long *) = Store[p2] : &:r2776_1, r2776_8
+# 2777| v2777_1(void) = NoOp :
+# 2774| v2774_5(void) = ReturnVoid :
+# 2774| v2774_6(void) = AliasedUse : ~m2776_6
+# 2774| v2774_7(void) = ExitFunction :
+
ir23.cpp:
# 1| bool consteval_1()
# 1| Block 0
diff --git a/cpp/ql/test/library-tests/ir/ir/ir.cpp b/cpp/ql/test/library-tests/ir/ir/ir.cpp
index 74c41c7e916b..66af788db12d 100644
--- a/cpp/ql/test/library-tests/ir/ir/ir.cpp
+++ b/cpp/ql/test/library-tests/ir/ir/ir.cpp
@@ -2771,4 +2771,9 @@ void test_three_way(int a, int b, ThreeWay c, ThreeWay d) {
auto y = c <=> d;
}
+void test_allocation_with_initializer() {
+ int* p1 = new int(42);
+ long* p2 = new long(42);
+}
+
// semmle-extractor-options: -std=c++20 --clang
diff --git a/cpp/ql/test/library-tests/ir/ir/raw_ir.expected b/cpp/ql/test/library-tests/ir/ir/raw_ir.expected
index bf4cef8c3f49..a567c651ca24 100644
--- a/cpp/ql/test/library-tests/ir/ir/raw_ir.expected
+++ b/cpp/ql/test/library-tests/ir/ir/raw_ir.expected
@@ -18547,6 +18547,36 @@ ir.cpp:
# 2769| v2769_13(void) = AliasedUse : ~m?
# 2769| v2769_14(void) = ExitFunction :
+# 2774| void test_allocation_with_initializer()
+# 2774| Block 0
+# 2774| v2774_1(void) = EnterFunction :
+# 2774| mu2774_2(unknown) = AliasedDefinition :
+# 2774| mu2774_3(unknown) = InitializeNonLocal :
+# 2775| r2775_1(glval) = VariableAddress[p1] :
+# 2775| r2775_2(glval) = FunctionAddress[operator new] :
+# 2775| r2775_3(unsigned long) = Constant[4] :
+# 2775| r2775_4(void *) = Call[operator new] : func:r2775_2, 0:r2775_3
+# 2775| mu2775_5(unknown) = ^CallSideEffect : ~m?
+# 2775| mu2775_6(unknown) = ^InitializeDynamicAllocation : &:r2775_4
+# 2775| r2775_7(int *) = Convert : r2775_4
+# 2775| r2775_8(int) = Constant[42] :
+# 2775| mu2775_9(int) = Store[?] : &:r2775_7, r2775_8
+# 2775| mu2775_10(int *) = Store[p1] : &:r2775_1, r2775_7
+# 2776| r2776_1(glval) = VariableAddress[p2] :
+# 2776| r2776_2(glval) = FunctionAddress[operator new] :
+# 2776| r2776_3(unsigned long) = Constant[8] :
+# 2776| r2776_4(void *) = Call[operator new] : func:r2776_2, 0:r2776_3
+# 2776| mu2776_5(unknown) = ^CallSideEffect : ~m?
+# 2776| mu2776_6(unknown) = ^InitializeDynamicAllocation : &:r2776_4
+# 2776| r2776_7(long *) = Convert : r2776_4
+# 2776| r2776_8(long) = Constant[42] :
+# 2776| mu2776_9(long) = Store[?] : &:r2776_7, r2776_8
+# 2776| mu2776_10(long *) = Store[p2] : &:r2776_1, r2776_7
+# 2777| v2777_1(void) = NoOp :
+# 2774| v2774_4(void) = ReturnVoid :
+# 2774| v2774_5(void) = AliasedUse : ~m?
+# 2774| v2774_6(void) = ExitFunction :
+
ir23.cpp:
# 1| bool consteval_1()
# 1| Block 0
diff --git a/cpp/ql/test/library-tests/macros/arguments/macro_arguments.expected b/cpp/ql/test/library-tests/macros/arguments/macro_arguments.expected
index 0ddac7d27a6f..5a18945cc0f6 100644
--- a/cpp/ql/test/library-tests/macros/arguments/macro_arguments.expected
+++ b/cpp/ql/test/library-tests/macros/arguments/macro_arguments.expected
@@ -23,7 +23,7 @@
| test.c:27:17:33:1 | test.c:27:17:33:1 | CONCAT | 1 | "Semmle" | "Semmle" |
| test.c:42:1:42:13 | test.c:42:1:42:13 | APPLY | 0 | top | top |
| test.c:42:1:42:13 | test.c:42:1:42:13 | APPLY | 1 | 3 | 3 |
-| test.c:42:1:42:13 | test.c:42:7:41:24 | APPLY -> top | 0 | 3 | 3 |
+| test.c:42:1:42:13 | test.c:42:7:42:7 | APPLY -> top | 0 | 3 | 3 |
| test.c:42:1:42:13 | top_and_nested.h:2:16:2:24 | APPLY -> top -> nested | 0 | 3 | |
| test.c:42:1:42:13 | top_and_nested.h:3:16:3:30 | APPLY -> top -> nested | 0 | 2 + (3) | |
| test.c:47:1:47:23 | test.c:45:15:45:22 | DECLARE_STRING -> ID | 0 | string1 | string1 |
@@ -49,7 +49,7 @@
| test.c:82:1:82:4 | test.c:82:1:82:4 | ID | 0 | | |
| test.c:84:5:84:20 | test.c:84:5:84:20 | APPLY | 0 | ID | ID |
| test.c:84:5:84:20 | test.c:84:5:84:20 | APPLY | 1 | ID(1) | 1 |
-| test.c:84:5:84:20 | test.c:84:11:41:24 | APPLY -> ID | 0 | 1 | 1 |
+| test.c:84:5:84:20 | test.c:84:11:84:11 | APPLY -> ID | 0 | 1 | 1 |
| test.c:84:5:84:20 | test.c:84:15:84:19 | APPLY -> ID | 0 | 1 | 1 |
| test.c:85:21:85:40 | test.c:85:21:85:40 | CMD_LINE_MACRO | 0 | 5 | 5 |
| test.c:85:21:85:40 | test.c:85:21:85:40 | CMD_LINE_MACRO | 1 | 6 | 6 |
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-457/semmle/tests/ms_vacopy.c b/cpp/ql/test/query-tests/Security/CWE/CWE-457/semmle/tests/ms_vacopy.c
new file mode 100644
index 000000000000..4aef7d79eb57
--- /dev/null
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-457/semmle/tests/ms_vacopy.c
@@ -0,0 +1,8 @@
+#include
+
+int va_copy_test(va_list va) {
+ va_list va2;
+ va_copy(va2, va);
+ return 0;
+}
+// semmle-extractor-options: --microsoft
diff --git a/csharp/ql/campaigns/Solorigate/lib/qlpack.yml b/csharp/ql/campaigns/Solorigate/lib/qlpack.yml
index d9430bc679ce..ea7b1f0c021b 100644
--- a/csharp/ql/campaigns/Solorigate/lib/qlpack.yml
+++ b/csharp/ql/campaigns/Solorigate/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-solorigate-all
-version: 1.7.46
+version: 1.7.47-dev
groups:
- csharp
- solorigate
diff --git a/csharp/ql/campaigns/Solorigate/src/qlpack.yml b/csharp/ql/campaigns/Solorigate/src/qlpack.yml
index 747eaaec33b9..377ad66a5baa 100644
--- a/csharp/ql/campaigns/Solorigate/src/qlpack.yml
+++ b/csharp/ql/campaigns/Solorigate/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-solorigate-queries
-version: 1.7.46
+version: 1.7.47-dev
groups:
- csharp
- solorigate
diff --git a/csharp/ql/lib/change-notes/2025-08-18-byte-char-bulk-types.md b/csharp/ql/lib/change-notes/2025-08-18-byte-char-bulk-types.md
new file mode 100644
index 000000000000..e5a081c33403
--- /dev/null
+++ b/csharp/ql/lib/change-notes/2025-08-18-byte-char-bulk-types.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Models-as-data summaries for byte and char arrays and pointers now treat the entire collection as tainted, reflecting their common use as string alternatives.
diff --git a/csharp/ql/lib/change-notes/2025-08-18-implicit-reads-at-sinks.md b/csharp/ql/lib/change-notes/2025-08-18-implicit-reads-at-sinks.md
new file mode 100644
index 000000000000..d66e982e6aeb
--- /dev/null
+++ b/csharp/ql/lib/change-notes/2025-08-18-implicit-reads-at-sinks.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The default taint tracking configuration now allows implicit reads from collections at sinks and in additional flow steps. This increases flow coverage for many taint tracking queries and helps reduce false negatives.
diff --git a/csharp/ql/lib/ext/System.IO.model.yml b/csharp/ql/lib/ext/System.IO.model.yml
index 0b8b52d9e8a5..549c324d66eb 100644
--- a/csharp/ql/lib/ext/System.IO.model.yml
+++ b/csharp/ql/lib/ext/System.IO.model.yml
@@ -77,7 +77,7 @@ extensions:
- ["System.IO", "Path", False, "GetPathRoot", "(System.ReadOnlySpan)", "", "Argument[0].Element", "ReturnValue", "taint", "manual"]
- ["System.IO", "Path", False, "GetPathRoot", "(System.String)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
- ["System.IO", "Path", False, "GetRelativePath", "(System.String,System.String)", "", "Argument[1]", "ReturnValue", "taint", "manual"]
- - ["System.IO", "Stream", True, "BeginRead", "(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object)", "", "Argument[this]", "Argument[0].Element", "taint", "manual"]
+ - ["System.IO", "Stream", True, "BeginRead", "(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object)", "", "Argument[this]", "Argument[0]", "taint", "manual"]
- ["System.IO", "Stream", True, "BeginWrite", "(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object)", "", "Argument[0].Element", "Argument[this]", "taint", "manual"]
- ["System.IO", "Stream", False, "CopyTo", "(System.IO.Stream)", "", "Argument[this]", "Argument[0]", "taint", "manual"]
- ["System.IO", "Stream", True, "CopyTo", "(System.IO.Stream,System.Int32)", "", "Argument[this]", "Argument[0]", "taint", "manual"]
@@ -85,17 +85,17 @@ extensions:
- ["System.IO", "Stream", False, "CopyToAsync", "(System.IO.Stream,System.Int32)", "", "Argument[this]", "Argument[0]", "taint", "manual"]
- ["System.IO", "Stream", True, "CopyToAsync", "(System.IO.Stream,System.Int32,System.Threading.CancellationToken)", "", "Argument[this]", "Argument[0]", "taint", "manual"]
- ["System.IO", "Stream", False, "CopyToAsync", "(System.IO.Stream,System.Threading.CancellationToken)", "", "Argument[this]", "Argument[0]", "taint", "manual"]
- - ["System.IO", "Stream", True, "Read", "(System.Byte[],System.Int32,System.Int32)", "", "Argument[this]", "Argument[0].Element", "taint", "manual"]
- - ["System.IO", "Stream", True, "Read", "(System.Span)", "", "Argument[this]", "Argument[0].Element", "taint", "manual"]
- - ["System.IO", "Stream", False, "ReadAsync", "(System.Byte[],System.Int32,System.Int32)", "", "Argument[this]", "Argument[0].Element", "taint", "manual"]
- - ["System.IO", "Stream", True, "ReadAsync", "(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken)", "", "Argument[this]", "Argument[0].Element", "taint", "manual"]
+ - ["System.IO", "Stream", True, "Read", "(System.Byte[],System.Int32,System.Int32)", "", "Argument[this]", "Argument[0]", "taint", "manual"]
+ - ["System.IO", "Stream", True, "Read", "(System.Span)", "", "Argument[this]", "Argument[0]", "taint", "manual"]
+ - ["System.IO", "Stream", False, "ReadAsync", "(System.Byte[],System.Int32,System.Int32)", "", "Argument[this]", "Argument[0]", "taint", "manual"]
+ - ["System.IO", "Stream", True, "ReadAsync", "(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken)", "", "Argument[this]", "Argument[0]", "taint", "manual"]
# Post-update nodes for `Memory` are currently unsupported. This model is provided for completeness
- - ["System.IO", "Stream", True, "ReadAsync", "(System.Memory,System.Threading.CancellationToken)", "", "Argument[this]", "Argument[0].Element", "taint", "manual"]
- - ["System.IO", "Stream", True, "ReadAtLeast", "(System.Span,System.Int32,System.Boolean)", "", "Argument[this]", "Argument[0].Element", "taint", "manual"]
+ - ["System.IO", "Stream", True, "ReadAsync", "(System.Memory,System.Threading.CancellationToken)", "", "Argument[this]", "Argument[0]", "taint", "manual"]
+ - ["System.IO", "Stream", True, "ReadAtLeast", "(System.Span,System.Int32,System.Boolean)", "", "Argument[this]", "Argument[0]", "taint", "manual"]
# Post-update nodes for `Memory` are currently unsupported. This model is provided for completeness
- ["System.IO", "Stream", True, "ReadAtLeastAsync", "(System.Memory,System.Int32,System.Boolean,System.Threading.CancellationToken)", "", "Argument[this]", "Argument[0]", "taint", "manual"]
- - ["System.IO", "Stream", True, "ReadExactly", "(System.Span)", "", "Argument[this]", "Argument[0].Element", "taint", "manual"]
- - ["System.IO", "Stream", True, "ReadExactly", "(System.Byte[],System.Int32,System.Int32)", "", "Argument[this]", "Argument[0].Element", "taint", "manual"]
+ - ["System.IO", "Stream", True, "ReadExactly", "(System.Span)", "", "Argument[this]", "Argument[0]", "taint", "manual"]
+ - ["System.IO", "Stream", True, "ReadExactly", "(System.Byte[],System.Int32,System.Int32)", "", "Argument[this]", "Argument[0]", "taint", "manual"]
- ["System.IO", "Stream", True, "Write", "(System.Byte[],System.Int32,System.Int32)", "", "Argument[0].Element", "Argument[this]", "taint", "manual"]
- ["System.IO", "Stream", True, "Write", "(System.ReadOnlySpan)", "", "Argument[0].Element", "Argument[this]", "taint", "manual"]
- ["System.IO", "Stream", False, "WriteAsync", "(System.Byte[],System.Int32,System.Int32)", "", "Argument[0].Element", "Argument[this]", "taint", "manual"]
@@ -128,16 +128,16 @@ extensions:
- ["System.IO", "StringWriter", True, "WriteLineAsync", "(System.String)", "", "Argument[0]", "Argument[this]", "taint", "manual"]
- ["System.IO", "StringWriter", True, "WriteLineAsync", "(System.Text.StringBuilder,System.Threading.CancellationToken)", "", "Argument[0]", "Argument[this]", "taint", "manual"]
- ["System.IO", "TextReader", True, "Read", "()", "", "Argument[this]", "ReturnValue", "taint", "manual"]
- - ["System.IO", "TextReader", True, "Read", "(System.Char[],System.Int32,System.Int32)", "", "Argument[this]", "Argument[0].Element", "taint", "manual"]
- - ["System.IO", "TextReader", True, "Read", "(System.Span)", "", "Argument[this]", "Argument[0].Element", "taint", "manual"]
- - ["System.IO", "TextReader", True, "ReadAsync", "(System.Char[],System.Int32,System.Int32)", "", "Argument[this]", "Argument[0].Element", "taint", "manual"]
+ - ["System.IO", "TextReader", True, "Read", "(System.Char[],System.Int32,System.Int32)", "", "Argument[this]", "Argument[0]", "taint", "manual"]
+ - ["System.IO", "TextReader", True, "Read", "(System.Span)", "", "Argument[this]", "Argument[0]", "taint", "manual"]
+ - ["System.IO", "TextReader", True, "ReadAsync", "(System.Char[],System.Int32,System.Int32)", "", "Argument[this]", "Argument[0]", "taint", "manual"]
# Post-update nodes for `Memory` are currently unsupported. This model is provided for completeness
- - ["System.IO", "TextReader", True, "ReadAsync", "(System.Memory,System.Threading.CancellationToken)", "", "Argument[this]", "Argument[0].Element", "taint", "manual"]
- - ["System.IO", "TextReader", True, "ReadBlock", "(System.Char[],System.Int32,System.Int32)", "", "Argument[this]", "Argument[0].Element", "taint", "manual"]
- - ["System.IO", "TextReader", True, "ReadBlock", "(System.Span)", "", "Argument[this]", "Argument[0].Element", "taint", "manual"]
- - ["System.IO", "TextReader", True, "ReadBlockAsync", "(System.Char[],System.Int32,System.Int32)", "", "Argument[this]", "Argument[0].Element", "taint", "manual"]
+ - ["System.IO", "TextReader", True, "ReadAsync", "(System.Memory,System.Threading.CancellationToken)", "", "Argument[this]", "Argument[0]", "taint", "manual"]
+ - ["System.IO", "TextReader", True, "ReadBlock", "(System.Char[],System.Int32,System.Int32)", "", "Argument[this]", "Argument[0]", "taint", "manual"]
+ - ["System.IO", "TextReader", True, "ReadBlock", "(System.Span)", "", "Argument[this]", "Argument[0]", "taint", "manual"]
+ - ["System.IO", "TextReader", True, "ReadBlockAsync", "(System.Char[],System.Int32,System.Int32)", "", "Argument[this]", "Argument[0]", "taint", "manual"]
# Post-update nodes for `Memory` are currently unsupported. This model is provided for completeness
- - ["System.IO", "TextReader", True, "ReadBlockAsync", "(System.Memory,System.Threading.CancellationToken)", "", "Argument[this]", "Argument[0].Element", "taint", "manual"]
+ - ["System.IO", "TextReader", True, "ReadBlockAsync", "(System.Memory,System.Threading.CancellationToken)", "", "Argument[this]", "Argument[0]", "taint", "manual"]
- ["System.IO", "TextReader", True, "ReadLine", "()", "", "Argument[this]", "ReturnValue", "taint", "manual"]
- ["System.IO", "TextReader", True, "ReadLineAsync", "()", "", "Argument[this]", "ReturnValue", "taint", "manual"]
- ["System.IO", "TextReader", True, "ReadToEnd", "()", "", "Argument[this]", "ReturnValue", "taint", "manual"]
diff --git a/csharp/ql/lib/ext/System.model.yml b/csharp/ql/lib/ext/System.model.yml
index 3853f03dc2fc..870413e75698 100644
--- a/csharp/ql/lib/ext/System.model.yml
+++ b/csharp/ql/lib/ext/System.model.yml
@@ -39,15 +39,15 @@ extensions:
- ["System", "Convert", False, "ChangeType", "(System.Object,System.Type,System.IFormatProvider)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
- ["System", "Convert", False, "ChangeType", "(System.Object,System.TypeCode)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
- ["System", "Convert", False, "ChangeType", "(System.Object,System.TypeCode,System.IFormatProvider)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
- - ["System", "Convert", False, "FromBase64CharArray", "(System.Char[],System.Int32,System.Int32)", "", "Argument[0].Element", "ReturnValue.Element", "taint", "manual"]
- - ["System", "Convert", False, "FromBase64String", "(System.String)", "", "Argument[0]", "ReturnValue.Element", "taint", "manual"]
- - ["System", "Convert", False, "FromHexString", "(System.ReadOnlySpan)", "", "Argument[0].Element", "ReturnValue.Element", "taint", "manual"]
- - ["System", "Convert", False, "FromHexString", "(System.String)", "", "Argument[0]", "ReturnValue.Element", "taint", "manual"]
+ - ["System", "Convert", False, "FromBase64CharArray", "(System.Char[],System.Int32,System.Int32)", "", "Argument[0].Element", "ReturnValue", "taint", "manual"]
+ - ["System", "Convert", False, "FromBase64String", "(System.String)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
+ - ["System", "Convert", False, "FromHexString", "(System.ReadOnlySpan)", "", "Argument[0].Element", "ReturnValue", "taint", "manual"]
+ - ["System", "Convert", False, "FromHexString", "(System.String)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
- ["System", "Convert", False, "GetTypeCode", "(System.Object)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
- ["System", "Convert", False, "IsDBNull", "(System.Object)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
- - ["System", "Convert", False, "ToBase64CharArray", "(System.Byte[],System.Int32,System.Int32,System.Char[],System.Int32)", "", "Argument[0].Element", "Argument[3].Element", "taint", "manual"]
+ - ["System", "Convert", False, "ToBase64CharArray", "(System.Byte[],System.Int32,System.Int32,System.Char[],System.Int32)", "", "Argument[0].Element", "Argument[3]", "taint", "manual"]
- ["System", "Convert", False, "ToBase64CharArray", "(System.Byte[],System.Int32,System.Int32,System.Char[],System.Int32)", "", "Argument[0].Element", "ReturnValue", "taint", "manual"]
- - ["System", "Convert", False, "ToBase64CharArray", "(System.Byte[],System.Int32,System.Int32,System.Char[],System.Int32,System.Base64FormattingOptions)", "", "Argument[0].Element", "Argument[3].Element", "taint", "manual"]
+ - ["System", "Convert", False, "ToBase64CharArray", "(System.Byte[],System.Int32,System.Int32,System.Char[],System.Int32,System.Base64FormattingOptions)", "", "Argument[0].Element", "Argument[3]", "taint", "manual"]
- ["System", "Convert", False, "ToBase64CharArray", "(System.Byte[],System.Int32,System.Int32,System.Char[],System.Int32,System.Base64FormattingOptions)", "", "Argument[0].Element", "ReturnValue", "taint", "manual"]
- ["System", "Convert", False, "ToBase64String", "(System.Byte[])", "", "Argument[0].Element", "ReturnValue", "taint", "manual"]
- ["System", "Convert", False, "ToBase64String", "(System.Byte[],System.Base64FormattingOptions)", "", "Argument[0].Element", "ReturnValue", "taint", "manual"]
@@ -353,13 +353,13 @@ extensions:
- ["System", "Convert", False, "ToUInt64", "(System.UInt16)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
- ["System", "Convert", False, "ToUInt64", "(System.UInt32)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
- ["System", "Convert", False, "ToUInt64", "(System.UInt64)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
- - ["System", "Convert", False, "TryFromBase64Chars", "(System.ReadOnlySpan,System.Span,System.Int32)", "", "Argument[0].Element", "Argument[1].Element", "taint", "manual"]
+ - ["System", "Convert", False, "TryFromBase64Chars", "(System.ReadOnlySpan,System.Span,System.Int32)", "", "Argument[0].Element", "Argument[1]", "taint", "manual"]
- ["System", "Convert", False, "TryFromBase64Chars", "(System.ReadOnlySpan,System.Span,System.Int32)", "", "Argument[0].Element", "Argument[2]", "taint", "manual"]
- ["System", "Convert", False, "TryFromBase64Chars", "(System.ReadOnlySpan,System.Span,System.Int32)", "", "Argument[0].Element", "ReturnValue", "taint", "manual"]
- - ["System", "Convert", False, "TryFromBase64String", "(System.String,System.Span,System.Int32)", "", "Argument[0]", "Argument[1].Element", "taint", "manual"]
+ - ["System", "Convert", False, "TryFromBase64String", "(System.String,System.Span,System.Int32)", "", "Argument[0]", "Argument[1]", "taint", "manual"]
- ["System", "Convert", False, "TryFromBase64String", "(System.String,System.Span,System.Int32)", "", "Argument[0]", "Argument[2]", "taint", "manual"]
- ["System", "Convert", False, "TryFromBase64String", "(System.String,System.Span,System.Int32)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
- - ["System", "Convert", False, "TryToBase64Chars", "(System.ReadOnlySpan,System.Span,System.Int32,System.Base64FormattingOptions)", "", "Argument[0].Element", "Argument[1].Element", "taint", "manual"]
+ - ["System", "Convert", False, "TryToBase64Chars", "(System.ReadOnlySpan,System.Span,System.Int32,System.Base64FormattingOptions)", "", "Argument[0].Element", "Argument[1]", "taint", "manual"]
- ["System", "Convert", False, "TryToBase64Chars", "(System.ReadOnlySpan,System.Span,System.Int32,System.Base64FormattingOptions)", "", "Argument[0].Element", "Argument[2]", "taint", "manual"]
- ["System", "Convert", False, "TryToBase64Chars", "(System.ReadOnlySpan,System.Span,System.Int32,System.Base64FormattingOptions)", "", "Argument[0].Element", "ReturnValue", "taint", "manual"]
- ["System", "Int32", False, "Parse", "(System.ReadOnlySpan,System.Globalization.NumberStyles,System.IFormatProvider)", "", "Argument[0].Element", "ReturnValue", "taint", "manual"]
diff --git a/csharp/ql/lib/qlpack.yml b/csharp/ql/lib/qlpack.yml
index 2a606aa966c5..f5ad09a43fa3 100644
--- a/csharp/ql/lib/qlpack.yml
+++ b/csharp/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-all
-version: 5.2.2
+version: 5.2.3-dev
groups: csharp
dbscheme: semmlecode.csharp.dbscheme
extractor: csharp
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/TaintTrackingPrivate.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/TaintTrackingPrivate.qll
index b7681994e2c3..3146720efe86 100644
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/TaintTrackingPrivate.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/TaintTrackingPrivate.qll
@@ -29,7 +29,10 @@ predicate defaultTaintSanitizer(DataFlow::Node node) {
* of `c` at sinks and inputs to additional taint steps.
*/
bindingset[node]
-predicate defaultImplicitTaintRead(DataFlow::Node node, DataFlow::ContentSet c) { none() }
+predicate defaultImplicitTaintRead(DataFlow::Node node, DataFlow::ContentSet c) {
+ exists(node) and
+ c.isElement()
+}
private class LocalTaintExprStepConfiguration extends ControlFlowReachabilityConfiguration {
LocalTaintExprStepConfiguration() { this = "LocalTaintExprStepConfiguration" }
diff --git a/csharp/ql/src/Security Features/CWE-090/LDAPInjection.qhelp b/csharp/ql/src/Security Features/CWE-090/LDAPInjection.qhelp
index 04f01720ce66..4af37eadfd76 100644
--- a/csharp/ql/src/Security Features/CWE-090/LDAPInjection.qhelp
+++ b/csharp/ql/src/Security Features/CWE-090/LDAPInjection.qhelp
@@ -12,7 +12,7 @@ is likely to be able to run malicious LDAP queries.
If user input must be included in an LDAP query, it should be escaped to
avoid a malicious user providing special characters that change the meaning
of the query. If possible, use an existing library, such as the AntiXSS
-library.
+library. One may also make their own encoder filter `LdapEncode`
following RFC 4515 standards.
@@ -35,7 +35,6 @@ the query cannot be changed by a malicious user.
OWASP: LDAP Injection Prevention Cheat Sheet .
OWASP: Preventing LDAP Injection in Java .
-AntiXSS doc: LdapFilterEncode .
-AntiXSS doc: LdapDistinguishedNameEncode .
+RFC 4515: String Search Filter Definition .
diff --git a/csharp/ql/src/experimental/Security Features/CWE-759/HashWithoutSalt.ql b/csharp/ql/src/experimental/Security Features/CWE-759/HashWithoutSalt.ql
index f18798c8b086..f175723c0997 100644
--- a/csharp/ql/src/experimental/Security Features/CWE-759/HashWithoutSalt.ql
+++ b/csharp/ql/src/experimental/Security Features/CWE-759/HashWithoutSalt.ql
@@ -10,6 +10,7 @@
*/
import csharp
+import semmle.code.csharp.frameworks.system.Collections
import HashWithoutSalt::PathGraph
/** The C# class `Windows.Security.Cryptography.Core.HashAlgorithmProvider`. */
@@ -93,12 +94,17 @@ predicate hasAnotherHashCall(MethodCall mc) {
/** Holds if a password hash without salt is further processed in another method call. */
predicate hasFurtherProcessing(MethodCall mc) {
- mc.getTarget().fromLibrary() and
- (
- mc.getTarget().hasFullyQualifiedName("System", "Array", "Copy") or // Array.Copy(passwordHash, 0, password.Length), 0, key, 0, keyLen);
- mc.getTarget().hasFullyQualifiedName("System", "String", "Concat") or // string.Concat(passwordHash, saltkey)
- mc.getTarget().hasFullyQualifiedName("System", "Buffer", "BlockCopy") or // Buffer.BlockCopy(passwordHash, 0, allBytes, 0, 20)
- mc.getTarget().hasFullyQualifiedName("System", "String", "Format") // String.Format("{0}:{1}:{2}", username, salt, password)
+ exists(Method m | m = mc.getTarget() and m.fromLibrary() |
+ m.hasFullyQualifiedName("System", "Array", "Copy") // Array.Copy(passwordHash, 0, password.Length), 0, key, 0, keyLen);
+ or
+ m.hasFullyQualifiedName("System", "String", "Concat") // string.Concat(passwordHash, saltkey)
+ or
+ m.hasFullyQualifiedName("System", "Buffer", "BlockCopy") // Buffer.BlockCopy(passwordHash, 0, allBytes, 0, 20)
+ or
+ m.hasFullyQualifiedName("System", "String", "Format") // String.Format("{0}:{1}:{2}", username, salt, password)
+ or
+ m.getName() = "CopyTo" and
+ m.getDeclaringType().getABaseType*() instanceof SystemCollectionsICollectionInterface // passBytes.CopyTo(rawSalted, 0);
)
}
diff --git a/csharp/ql/src/qlpack.yml b/csharp/ql/src/qlpack.yml
index 959446de1d76..0567f7203009 100644
--- a/csharp/ql/src/qlpack.yml
+++ b/csharp/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-queries
-version: 1.3.3
+version: 1.3.4-dev
groups:
- csharp
- queries
diff --git a/csharp/ql/test/library-tests/dataflow/external-models/ExternalFlow.cs b/csharp/ql/test/library-tests/dataflow/external-models/ExternalFlow.cs
index 705efd35e38a..d7552376c0f0 100644
--- a/csharp/ql/test/library-tests/dataflow/external-models/ExternalFlow.cs
+++ b/csharp/ql/test/library-tests/dataflow/external-models/ExternalFlow.cs
@@ -116,7 +116,7 @@ void M17()
{
var a = new object[] { new object() };
var b = Reverse(a);
- Sink(b); // No flow
+ Sink(b); // Flow
Sink(b[0]); // Flow
}
diff --git a/csharp/ql/test/library-tests/dataflow/external-models/ExternalFlow.expected b/csharp/ql/test/library-tests/dataflow/external-models/ExternalFlow.expected
index 7254208be186..3099a3fec7e6 100644
--- a/csharp/ql/test/library-tests/dataflow/external-models/ExternalFlow.expected
+++ b/csharp/ql/test/library-tests/dataflow/external-models/ExternalFlow.expected
@@ -104,6 +104,7 @@ edges
| ExternalFlow.cs:117:17:117:17 | access to local variable a : null [element] : Object | ExternalFlow.cs:118:29:118:29 | access to local variable a : null [element] : Object | provenance | |
| ExternalFlow.cs:117:34:117:49 | { ..., ... } : null [element] : Object | ExternalFlow.cs:117:17:117:17 | access to local variable a : null [element] : Object | provenance | |
| ExternalFlow.cs:117:36:117:47 | object creation of type Object : Object | ExternalFlow.cs:117:34:117:49 | { ..., ... } : null [element] : Object | provenance | |
+| ExternalFlow.cs:118:17:118:17 | access to local variable b : null [element] : Object | ExternalFlow.cs:119:18:119:18 | access to local variable b | provenance | |
| ExternalFlow.cs:118:17:118:17 | access to local variable b : null [element] : Object | ExternalFlow.cs:120:18:120:18 | access to local variable b : null [element] : Object | provenance | |
| ExternalFlow.cs:118:21:118:30 | call to method Reverse : null [element] : Object | ExternalFlow.cs:118:17:118:17 | access to local variable b : null [element] : Object | provenance | |
| ExternalFlow.cs:118:29:118:29 | access to local variable a : null [element] : Object | ExternalFlow.cs:118:21:118:30 | call to method Reverse : null [element] : Object | provenance | MaD:7 |
@@ -240,6 +241,7 @@ nodes
| ExternalFlow.cs:118:17:118:17 | access to local variable b : null [element] : Object | semmle.label | access to local variable b : null [element] : Object |
| ExternalFlow.cs:118:21:118:30 | call to method Reverse : null [element] : Object | semmle.label | call to method Reverse : null [element] : Object |
| ExternalFlow.cs:118:29:118:29 | access to local variable a : null [element] : Object | semmle.label | access to local variable a : null [element] : Object |
+| ExternalFlow.cs:119:18:119:18 | access to local variable b | semmle.label | access to local variable b |
| ExternalFlow.cs:120:18:120:18 | access to local variable b : null [element] : Object | semmle.label | access to local variable b : null [element] : Object |
| ExternalFlow.cs:120:18:120:21 | access to array element | semmle.label | access to array element |
| ExternalFlow.cs:205:17:205:18 | access to local variable o2 : Object | semmle.label | access to local variable o2 : Object |
@@ -315,6 +317,7 @@ invalidModelRow
| ExternalFlow.cs:102:22:102:22 | access to parameter d | ExternalFlow.cs:98:24:98:35 | object creation of type Object : Object | ExternalFlow.cs:102:22:102:22 | access to parameter d | $@ | ExternalFlow.cs:98:24:98:35 | object creation of type Object : Object | object creation of type Object : Object |
| ExternalFlow.cs:104:18:104:25 | access to field Field | ExternalFlow.cs:98:24:98:35 | object creation of type Object : Object | ExternalFlow.cs:104:18:104:25 | access to field Field | $@ | ExternalFlow.cs:98:24:98:35 | object creation of type Object : Object | object creation of type Object : Object |
| ExternalFlow.cs:112:18:112:25 | access to property MyProp | ExternalFlow.cs:111:24:111:35 | object creation of type Object : Object | ExternalFlow.cs:112:18:112:25 | access to property MyProp | $@ | ExternalFlow.cs:111:24:111:35 | object creation of type Object : Object | object creation of type Object : Object |
+| ExternalFlow.cs:119:18:119:18 | access to local variable b | ExternalFlow.cs:117:36:117:47 | object creation of type Object : Object | ExternalFlow.cs:119:18:119:18 | access to local variable b | $@ | ExternalFlow.cs:117:36:117:47 | object creation of type Object : Object | object creation of type Object : Object |
| ExternalFlow.cs:120:18:120:21 | access to array element | ExternalFlow.cs:117:36:117:47 | object creation of type Object : Object | ExternalFlow.cs:120:18:120:21 | access to array element | $@ | ExternalFlow.cs:117:36:117:47 | object creation of type Object : Object | object creation of type Object : Object |
| ExternalFlow.cs:206:18:206:48 | call to method MixedFlowArgs | ExternalFlow.cs:205:22:205:33 | object creation of type Object : Object | ExternalFlow.cs:206:18:206:48 | call to method MixedFlowArgs | $@ | ExternalFlow.cs:205:22:205:33 | object creation of type Object : Object | object creation of type Object : Object |
| ExternalFlow.cs:212:18:212:62 | call to method GeneratedFlowWithGeneratedNeutral | ExternalFlow.cs:211:22:211:33 | object creation of type Object : Object | ExternalFlow.cs:212:18:212:62 | call to method GeneratedFlowWithGeneratedNeutral | $@ | ExternalFlow.cs:211:22:211:33 | object creation of type Object : Object | object creation of type Object : Object |
diff --git a/csharp/ql/test/library-tests/dataflow/library/FlowSummaries.expected b/csharp/ql/test/library-tests/dataflow/library/FlowSummaries.expected
index ff615d531152..a87c1fea3757 100644
--- a/csharp/ql/test/library-tests/dataflow/library/FlowSummaries.expected
+++ b/csharp/ql/test/library-tests/dataflow/library/FlowSummaries.expected
@@ -1683,9 +1683,9 @@ summary
| Microsoft.AspNetCore.WebSockets;WebSocketMiddleware;WebSocketMiddleware;(Microsoft.AspNetCore.Http.RequestDelegate,Microsoft.Extensions.Options.IOptions,Microsoft.Extensions.Logging.ILoggerFactory);Argument[0];Argument[0].Parameter[delegate-self];value;hq-generated |
| Microsoft.AspNetCore.WebSockets;WebSocketsDependencyInjectionExtensions;AddWebSockets;(Microsoft.Extensions.DependencyInjection.IServiceCollection,System.Action);Argument[1];Argument[1].Parameter[delegate-self];value;hq-generated |
| Microsoft.AspNetCore.WebUtilities;BufferedReadStream;FlushAsync;(System.Threading.CancellationToken);Argument[this];ReturnValue.SyntheticField[System.Threading.Tasks.Task.m_stateObject];value;dfc-generated |
-| Microsoft.AspNetCore.WebUtilities;BufferedReadStream;Read;(System.Byte[],System.Int32,System.Int32);Argument[this];Argument[0].Element;taint;manual |
-| Microsoft.AspNetCore.WebUtilities;BufferedReadStream;ReadAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);Argument[this];Argument[0].Element;taint;manual |
-| Microsoft.AspNetCore.WebUtilities;BufferedReadStream;ReadAsync;(System.Memory,System.Threading.CancellationToken);Argument[this];Argument[0].Element;taint;manual |
+| Microsoft.AspNetCore.WebUtilities;BufferedReadStream;Read;(System.Byte[],System.Int32,System.Int32);Argument[this];Argument[0];taint;manual |
+| Microsoft.AspNetCore.WebUtilities;BufferedReadStream;ReadAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);Argument[this];Argument[0];taint;manual |
+| Microsoft.AspNetCore.WebUtilities;BufferedReadStream;ReadAsync;(System.Memory,System.Threading.CancellationToken);Argument[this];Argument[0];taint;manual |
| Microsoft.AspNetCore.WebUtilities;BufferedReadStream;Write;(System.Byte[],System.Int32,System.Int32);Argument[0].Element;Argument[this];taint;manual |
| Microsoft.AspNetCore.WebUtilities;BufferedReadStream;WriteAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);Argument[0].Element;Argument[this];taint;manual |
| Microsoft.AspNetCore.WebUtilities;BufferedReadStream;WriteAsync;(System.ReadOnlyMemory,System.Threading.CancellationToken);Argument[0];Argument[this];taint;df-generated |
@@ -1696,10 +1696,10 @@ summary
| Microsoft.AspNetCore.WebUtilities;FileBufferingReadStream;DisposeAsync;();Argument[this];ReturnValue;taint;df-generated |
| Microsoft.AspNetCore.WebUtilities;FileBufferingReadStream;FileBufferingReadStream;(System.IO.Stream,System.Int32,System.Nullable,System.Func);Argument[3];Argument[3].Parameter[delegate-self];value;hq-generated |
| Microsoft.AspNetCore.WebUtilities;FileBufferingReadStream;FileBufferingReadStream;(System.IO.Stream,System.Int32,System.Nullable,System.Func,System.Buffers.ArrayPool);Argument[3];Argument[3].Parameter[delegate-self];value;hq-generated |
-| Microsoft.AspNetCore.WebUtilities;FileBufferingReadStream;Read;(System.Byte[],System.Int32,System.Int32);Argument[this];Argument[0].Element;taint;manual |
-| Microsoft.AspNetCore.WebUtilities;FileBufferingReadStream;Read;(System.Span);Argument[this];Argument[0].Element;taint;manual |
-| Microsoft.AspNetCore.WebUtilities;FileBufferingReadStream;ReadAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);Argument[this];Argument[0].Element;taint;manual |
-| Microsoft.AspNetCore.WebUtilities;FileBufferingReadStream;ReadAsync;(System.Memory,System.Threading.CancellationToken);Argument[this];Argument[0].Element;taint;manual |
+| Microsoft.AspNetCore.WebUtilities;FileBufferingReadStream;Read;(System.Byte[],System.Int32,System.Int32);Argument[this];Argument[0];taint;manual |
+| Microsoft.AspNetCore.WebUtilities;FileBufferingReadStream;Read;(System.Span);Argument[this];Argument[0];taint;manual |
+| Microsoft.AspNetCore.WebUtilities;FileBufferingReadStream;ReadAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);Argument[this];Argument[0];taint;manual |
+| Microsoft.AspNetCore.WebUtilities;FileBufferingReadStream;ReadAsync;(System.Memory,System.Threading.CancellationToken);Argument[this];Argument[0];taint;manual |
| Microsoft.AspNetCore.WebUtilities;FileBufferingReadStream;Write;(System.Byte[],System.Int32,System.Int32);Argument[0].Element;Argument[this];taint;manual |
| Microsoft.AspNetCore.WebUtilities;FileBufferingReadStream;WriteAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);Argument[0].Element;Argument[this];taint;manual |
| Microsoft.AspNetCore.WebUtilities;FileBufferingReadStream;WriteAsync;(System.ReadOnlyMemory,System.Threading.CancellationToken);Argument[0];Argument[this];taint;df-generated |
@@ -1709,9 +1709,9 @@ summary
| Microsoft.AspNetCore.WebUtilities;FileBufferingWriteStream;DisposeAsync;();Argument[this];ReturnValue;taint;df-generated |
| Microsoft.AspNetCore.WebUtilities;FileBufferingWriteStream;FileBufferingWriteStream;(System.Int32,System.Nullable,System.Func);Argument[2];Argument[2].Parameter[delegate-self];value;hq-generated |
| Microsoft.AspNetCore.WebUtilities;FileBufferingWriteStream;FlushAsync;(System.Threading.CancellationToken);Argument[this];ReturnValue.SyntheticField[System.Threading.Tasks.Task.m_stateObject];value;dfc-generated |
-| Microsoft.AspNetCore.WebUtilities;FileBufferingWriteStream;Read;(System.Byte[],System.Int32,System.Int32);Argument[this];Argument[0].Element;taint;manual |
-| Microsoft.AspNetCore.WebUtilities;FileBufferingWriteStream;ReadAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);Argument[this];Argument[0].Element;taint;manual |
-| Microsoft.AspNetCore.WebUtilities;FileBufferingWriteStream;ReadAsync;(System.Memory,System.Threading.CancellationToken);Argument[this];Argument[0].Element;taint;manual |
+| Microsoft.AspNetCore.WebUtilities;FileBufferingWriteStream;Read;(System.Byte[],System.Int32,System.Int32);Argument[this];Argument[0];taint;manual |
+| Microsoft.AspNetCore.WebUtilities;FileBufferingWriteStream;ReadAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);Argument[this];Argument[0];taint;manual |
+| Microsoft.AspNetCore.WebUtilities;FileBufferingWriteStream;ReadAsync;(System.Memory,System.Threading.CancellationToken);Argument[this];Argument[0];taint;manual |
| Microsoft.AspNetCore.WebUtilities;FileBufferingWriteStream;Write;(System.Byte[],System.Int32,System.Int32);Argument[0].Element;Argument[this];taint;manual |
| Microsoft.AspNetCore.WebUtilities;FileBufferingWriteStream;WriteAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);Argument[0].Element;Argument[this];taint;manual |
| Microsoft.AspNetCore.WebUtilities;FileBufferingWriteStream;WriteAsync;(System.ReadOnlyMemory,System.Threading.CancellationToken);Argument[0];Argument[this];taint;df-generated |
@@ -1719,10 +1719,10 @@ summary
| Microsoft.AspNetCore.WebUtilities;FileBufferingWriteStream;WriteAsync;(System.ReadOnlyMemory,System.Threading.CancellationToken);Argument[1];ReturnValue;taint;df-generated |
| Microsoft.AspNetCore.WebUtilities;FileBufferingWriteStream;WriteAsync;(System.ReadOnlyMemory,System.Threading.CancellationToken);Argument[this];ReturnValue;taint;df-generated |
| Microsoft.AspNetCore.WebUtilities;HttpRequestStreamReader;Read;();Argument[this];ReturnValue;taint;manual |
-| Microsoft.AspNetCore.WebUtilities;HttpRequestStreamReader;Read;(System.Char[],System.Int32,System.Int32);Argument[this];Argument[0].Element;taint;manual |
-| Microsoft.AspNetCore.WebUtilities;HttpRequestStreamReader;Read;(System.Span);Argument[this];Argument[0].Element;taint;manual |
-| Microsoft.AspNetCore.WebUtilities;HttpRequestStreamReader;ReadAsync;(System.Char[],System.Int32,System.Int32);Argument[this];Argument[0].Element;taint;manual |
-| Microsoft.AspNetCore.WebUtilities;HttpRequestStreamReader;ReadAsync;(System.Memory,System.Threading.CancellationToken);Argument[this];Argument[0].Element;taint;manual |
+| Microsoft.AspNetCore.WebUtilities;HttpRequestStreamReader;Read;(System.Char[],System.Int32,System.Int32);Argument[this];Argument[0];taint;manual |
+| Microsoft.AspNetCore.WebUtilities;HttpRequestStreamReader;Read;(System.Span);Argument[this];Argument[0];taint;manual |
+| Microsoft.AspNetCore.WebUtilities;HttpRequestStreamReader;ReadAsync;(System.Char[],System.Int32,System.Int32);Argument[this];Argument[0];taint;manual |
+| Microsoft.AspNetCore.WebUtilities;HttpRequestStreamReader;ReadAsync;(System.Memory,System.Threading.CancellationToken);Argument[this];Argument[0];taint;manual |
| Microsoft.AspNetCore.WebUtilities;HttpRequestStreamReader;ReadLine;();Argument[this];ReturnValue;taint;manual |
| Microsoft.AspNetCore.WebUtilities;HttpRequestStreamReader;ReadLineAsync;();Argument[this];ReturnValue;taint;manual |
| Microsoft.AspNetCore.WebUtilities;HttpRequestStreamReader;ReadToEndAsync;();Argument[this];ReturnValue;taint;manual |
@@ -5278,8 +5278,8 @@ summary
| ServiceStack.Text;NetCoreMemory;Deserialize;(System.IO.Stream,System.Type,ServiceStack.Text.Common.DeserializeStringSpanDelegate);Argument[2];Argument[2].Parameter[delegate-self];value;hq-generated |
| ServiceStack.Text;NetCoreMemory;DeserializeAsync;(System.IO.Stream,System.Type,ServiceStack.Text.Common.DeserializeStringSpanDelegate);Argument[2];Argument[2].Parameter[delegate-self];value;hq-generated |
| ServiceStack.Text;RecyclableMemoryStream;GetBuffer;();Argument[this];ReturnValue;taint;df-generated |
-| ServiceStack.Text;RecyclableMemoryStream;Read;(System.Byte[],System.Int32,System.Int32);Argument[this];Argument[0].Element;taint;manual |
-| ServiceStack.Text;RecyclableMemoryStream;Read;(System.Span);Argument[this];Argument[0].Element;taint;manual |
+| ServiceStack.Text;RecyclableMemoryStream;Read;(System.Byte[],System.Int32,System.Int32);Argument[this];Argument[0];taint;manual |
+| ServiceStack.Text;RecyclableMemoryStream;Read;(System.Span);Argument[this];Argument[0];taint;manual |
| ServiceStack.Text;RecyclableMemoryStream;TryGetBuffer;(System.ArraySegment);Argument[this];Argument[0].Element;taint;df-generated |
| ServiceStack.Text;RecyclableMemoryStream;Write;(System.Byte[],System.Int32,System.Int32);Argument[0].Element;Argument[this];taint;manual |
| ServiceStack.Text;RecyclableMemoryStream;Write;(System.ReadOnlySpan);Argument[0].Element;Argument[this];taint;manual |
@@ -10659,7 +10659,7 @@ summary
| System.Data.SqlTypes;SqlDecimal;op_UnaryNegation;(System.Data.SqlTypes.SqlDecimal);Argument[0];ReturnValue;value;dfc-generated |
| System.Data.SqlTypes;SqlDouble;ReadXml;(System.Xml.XmlReader);Argument[0];Argument[this];taint;df-generated |
| System.Data.SqlTypes;SqlDouble;WriteXml;(System.Xml.XmlWriter);Argument[this];Argument[0];taint;df-generated |
-| System.Data.SqlTypes;SqlFileStream;Read;(System.Byte[],System.Int32,System.Int32);Argument[this];Argument[0].Element;taint;manual |
+| System.Data.SqlTypes;SqlFileStream;Read;(System.Byte[],System.Int32,System.Int32);Argument[this];Argument[0];taint;manual |
| System.Data.SqlTypes;SqlFileStream;Write;(System.Byte[],System.Int32,System.Int32);Argument[0].Element;Argument[this];taint;manual |
| System.Data.SqlTypes;SqlGuid;GetObjectData;(System.Runtime.Serialization.SerializationInfo,System.Runtime.Serialization.StreamingContext);Argument[this];Argument[0];taint;df-generated |
| System.Data.SqlTypes;SqlGuid;ReadXml;(System.Xml.XmlReader);Argument[0];Argument[this];taint;df-generated |
@@ -11970,16 +11970,16 @@ summary
| System.Globalization;TextInfo;ToUpper;(System.String);Argument[0];ReturnValue;value;dfc-generated |
| System.Globalization;TextInfo;get_CultureName;();Argument[this];ReturnValue;taint;df-generated |
| System.IO.Compression;BrotliStream;BeginRead;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[3];Argument[3].Parameter[delegate-self];value;manual |
-| System.IO.Compression;BrotliStream;BeginRead;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[this];Argument[0].Element;taint;manual |
+| System.IO.Compression;BrotliStream;BeginRead;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[this];Argument[0];taint;manual |
| System.IO.Compression;BrotliStream;BeginWrite;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[0].Element;Argument[this];taint;manual |
| System.IO.Compression;BrotliStream;BeginWrite;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[3];Argument[3].Parameter[delegate-self];value;manual |
| System.IO.Compression;BrotliStream;BrotliStream;(System.IO.Stream,System.IO.Compression.CompressionMode,System.Boolean);Argument[0];Argument[this].SyntheticField[System.IO.Compression.BrotliStream._stream];value;dfc-generated |
| System.IO.Compression;BrotliStream;DisposeAsync;();Argument[this];ReturnValue;taint;df-generated |
| System.IO.Compression;BrotliStream;FlushAsync;(System.Threading.CancellationToken);Argument[this];ReturnValue.SyntheticField[System.Threading.Tasks.Task.m_stateObject];value;dfc-generated |
-| System.IO.Compression;BrotliStream;Read;(System.Byte[],System.Int32,System.Int32);Argument[this];Argument[0].Element;taint;manual |
-| System.IO.Compression;BrotliStream;Read;(System.Span);Argument[this];Argument[0].Element;taint;manual |
-| System.IO.Compression;BrotliStream;ReadAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);Argument[this];Argument[0].Element;taint;manual |
-| System.IO.Compression;BrotliStream;ReadAsync;(System.Memory,System.Threading.CancellationToken);Argument[this];Argument[0].Element;taint;manual |
+| System.IO.Compression;BrotliStream;Read;(System.Byte[],System.Int32,System.Int32);Argument[this];Argument[0];taint;manual |
+| System.IO.Compression;BrotliStream;Read;(System.Span);Argument[this];Argument[0];taint;manual |
+| System.IO.Compression;BrotliStream;ReadAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);Argument[this];Argument[0];taint;manual |
+| System.IO.Compression;BrotliStream;ReadAsync;(System.Memory,System.Threading.CancellationToken);Argument[this];Argument[0];taint;manual |
| System.IO.Compression;BrotliStream;Write;(System.Byte[],System.Int32,System.Int32);Argument[0].Element;Argument[this];taint;manual |
| System.IO.Compression;BrotliStream;Write;(System.ReadOnlySpan);Argument[0].Element;Argument[this];taint;manual |
| System.IO.Compression;BrotliStream;WriteAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);Argument[0].Element;Argument[this];taint;manual |
@@ -11989,7 +11989,7 @@ summary
| System.IO.Compression;BrotliStream;WriteAsync;(System.ReadOnlyMemory,System.Threading.CancellationToken);Argument[this];ReturnValue;taint;df-generated |
| System.IO.Compression;BrotliStream;get_BaseStream;();Argument[this].SyntheticField[System.IO.Compression.BrotliStream._stream];ReturnValue;value;dfc-generated |
| System.IO.Compression;DeflateStream;BeginRead;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[3];Argument[3].Parameter[delegate-self];value;manual |
-| System.IO.Compression;DeflateStream;BeginRead;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[this];Argument[0].Element;taint;manual |
+| System.IO.Compression;DeflateStream;BeginRead;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[this];Argument[0];taint;manual |
| System.IO.Compression;DeflateStream;BeginWrite;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[0].Element;Argument[this];taint;manual |
| System.IO.Compression;DeflateStream;BeginWrite;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[3];Argument[3].Parameter[delegate-self];value;manual |
| System.IO.Compression;DeflateStream;CopyTo;(System.IO.Stream,System.Int32);Argument[this];Argument[0];taint;manual |
@@ -12000,10 +12000,10 @@ summary
| System.IO.Compression;DeflateStream;DeflateStream;(System.IO.Stream,System.IO.Compression.CompressionMode,System.Boolean);Argument[0];Argument[this];taint;manual |
| System.IO.Compression;DeflateStream;DisposeAsync;();Argument[this];ReturnValue;taint;df-generated |
| System.IO.Compression;DeflateStream;FlushAsync;(System.Threading.CancellationToken);Argument[this];ReturnValue.SyntheticField[System.Threading.Tasks.Task.m_stateObject];value;dfc-generated |
-| System.IO.Compression;DeflateStream;Read;(System.Byte[],System.Int32,System.Int32);Argument[this];Argument[0].Element;taint;manual |
-| System.IO.Compression;DeflateStream;Read;(System.Span);Argument[this];Argument[0].Element;taint;manual |
-| System.IO.Compression;DeflateStream;ReadAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);Argument[this];Argument[0].Element;taint;manual |
-| System.IO.Compression;DeflateStream;ReadAsync;(System.Memory,System.Threading.CancellationToken);Argument[this];Argument[0].Element;taint;manual |
+| System.IO.Compression;DeflateStream;Read;(System.Byte[],System.Int32,System.Int32);Argument[this];Argument[0];taint;manual |
+| System.IO.Compression;DeflateStream;Read;(System.Span);Argument[this];Argument[0];taint;manual |
+| System.IO.Compression;DeflateStream;ReadAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);Argument[this];Argument[0];taint;manual |
+| System.IO.Compression;DeflateStream;ReadAsync;(System.Memory,System.Threading.CancellationToken);Argument[this];Argument[0];taint;manual |
| System.IO.Compression;DeflateStream;Write;(System.Byte[],System.Int32,System.Int32);Argument[0].Element;Argument[this];taint;manual |
| System.IO.Compression;DeflateStream;Write;(System.ReadOnlySpan);Argument[0].Element;Argument[this];taint;manual |
| System.IO.Compression;DeflateStream;WriteAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);Argument[0].Element;Argument[this];taint;manual |
@@ -12013,7 +12013,7 @@ summary
| System.IO.Compression;DeflateStream;WriteAsync;(System.ReadOnlyMemory,System.Threading.CancellationToken);Argument[this];ReturnValue;taint;df-generated |
| System.IO.Compression;DeflateStream;get_BaseStream;();Argument[this];ReturnValue;taint;df-generated |
| System.IO.Compression;GZipStream;BeginRead;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[3];Argument[3].Parameter[delegate-self];value;manual |
-| System.IO.Compression;GZipStream;BeginRead;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[this];Argument[0].Element;taint;manual |
+| System.IO.Compression;GZipStream;BeginRead;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[this];Argument[0];taint;manual |
| System.IO.Compression;GZipStream;BeginWrite;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[0].Element;Argument[this];taint;manual |
| System.IO.Compression;GZipStream;BeginWrite;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[3];Argument[3].Parameter[delegate-self];value;manual |
| System.IO.Compression;GZipStream;CopyTo;(System.IO.Stream,System.Int32);Argument[this];Argument[0];taint;manual |
@@ -12023,10 +12023,10 @@ summary
| System.IO.Compression;GZipStream;GZipStream;(System.IO.Stream,System.IO.Compression.CompressionLevel,System.Boolean);Argument[0];Argument[this].SyntheticField[System.IO.Compression.GZipStream._deflateStream].SyntheticField[System.IO.Compression.DeflateStream._stream];value;dfc-generated |
| System.IO.Compression;GZipStream;GZipStream;(System.IO.Stream,System.IO.Compression.CompressionMode,System.Boolean);Argument[0];Argument[this].SyntheticField[System.IO.Compression.GZipStream._deflateStream].SyntheticField[System.IO.Compression.DeflateStream._stream];value;dfc-generated |
| System.IO.Compression;GZipStream;GZipStream;(System.IO.Stream,System.IO.Compression.ZLibCompressionOptions,System.Boolean);Argument[0];Argument[this].SyntheticField[System.IO.Compression.GZipStream._deflateStream].SyntheticField[System.IO.Compression.DeflateStream._stream];value;dfc-generated |
-| System.IO.Compression;GZipStream;Read;(System.Byte[],System.Int32,System.Int32);Argument[this];Argument[0].Element;taint;manual |
-| System.IO.Compression;GZipStream;Read;(System.Span);Argument[this];Argument[0].Element;taint;manual |
-| System.IO.Compression;GZipStream;ReadAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);Argument[this];Argument[0].Element;taint;manual |
-| System.IO.Compression;GZipStream;ReadAsync;(System.Memory,System.Threading.CancellationToken);Argument[this];Argument[0].Element;taint;manual |
+| System.IO.Compression;GZipStream;Read;(System.Byte[],System.Int32,System.Int32);Argument[this];Argument[0];taint;manual |
+| System.IO.Compression;GZipStream;Read;(System.Span);Argument[this];Argument[0];taint;manual |
+| System.IO.Compression;GZipStream;ReadAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);Argument[this];Argument[0];taint;manual |
+| System.IO.Compression;GZipStream;ReadAsync;(System.Memory,System.Threading.CancellationToken);Argument[this];Argument[0];taint;manual |
| System.IO.Compression;GZipStream;Write;(System.Byte[],System.Int32,System.Int32);Argument[0].Element;Argument[this];taint;manual |
| System.IO.Compression;GZipStream;Write;(System.ReadOnlySpan);Argument[0].Element;Argument[this];taint;manual |
| System.IO.Compression;GZipStream;WriteAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);Argument[0].Element;Argument[this];taint;manual |
@@ -12036,17 +12036,17 @@ summary
| System.IO.Compression;GZipStream;WriteAsync;(System.ReadOnlyMemory,System.Threading.CancellationToken);Argument[this];ReturnValue;taint;df-generated |
| System.IO.Compression;GZipStream;get_BaseStream;();Argument[this].SyntheticField[System.IO.Compression.GZipStream._deflateStream].SyntheticField[System.IO.Compression.DeflateStream._stream];ReturnValue;value;dfc-generated |
| System.IO.Compression;ZLibStream;BeginRead;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[3];Argument[3].Parameter[delegate-self];value;manual |
-| System.IO.Compression;ZLibStream;BeginRead;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[this];Argument[0].Element;taint;manual |
+| System.IO.Compression;ZLibStream;BeginRead;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[this];Argument[0];taint;manual |
| System.IO.Compression;ZLibStream;BeginWrite;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[0].Element;Argument[this];taint;manual |
| System.IO.Compression;ZLibStream;BeginWrite;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[3];Argument[3].Parameter[delegate-self];value;manual |
| System.IO.Compression;ZLibStream;CopyTo;(System.IO.Stream,System.Int32);Argument[this];Argument[0];taint;manual |
| System.IO.Compression;ZLibStream;CopyToAsync;(System.IO.Stream,System.Int32,System.Threading.CancellationToken);Argument[this];Argument[0];taint;manual |
| System.IO.Compression;ZLibStream;DisposeAsync;();Argument[this];ReturnValue;taint;df-generated |
| System.IO.Compression;ZLibStream;FlushAsync;(System.Threading.CancellationToken);Argument[this];ReturnValue.SyntheticField[System.Threading.Tasks.Task.m_stateObject];value;dfc-generated |
-| System.IO.Compression;ZLibStream;Read;(System.Byte[],System.Int32,System.Int32);Argument[this];Argument[0].Element;taint;manual |
-| System.IO.Compression;ZLibStream;Read;(System.Span);Argument[this];Argument[0].Element;taint;manual |
-| System.IO.Compression;ZLibStream;ReadAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);Argument[this];Argument[0].Element;taint;manual |
-| System.IO.Compression;ZLibStream;ReadAsync;(System.Memory,System.Threading.CancellationToken);Argument[this];Argument[0].Element;taint;manual |
+| System.IO.Compression;ZLibStream;Read;(System.Byte[],System.Int32,System.Int32);Argument[this];Argument[0];taint;manual |
+| System.IO.Compression;ZLibStream;Read;(System.Span);Argument[this];Argument[0];taint;manual |
+| System.IO.Compression;ZLibStream;ReadAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);Argument[this];Argument[0];taint;manual |
+| System.IO.Compression;ZLibStream;ReadAsync;(System.Memory,System.Threading.CancellationToken);Argument[this];Argument[0];taint;manual |
| System.IO.Compression;ZLibStream;Write;(System.Byte[],System.Int32,System.Int32);Argument[0].Element;Argument[this];taint;manual |
| System.IO.Compression;ZLibStream;Write;(System.ReadOnlySpan);Argument[0].Element;Argument[this];taint;manual |
| System.IO.Compression;ZLibStream;WriteAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);Argument[0].Element;Argument[this];taint;manual |
@@ -12090,16 +12090,16 @@ summary
| System.IO.IsolatedStorage;IsolatedStorage;get_AssemblyIdentity;();Argument[this];ReturnValue;taint;df-generated |
| System.IO.IsolatedStorage;IsolatedStorage;get_DomainIdentity;();Argument[this];ReturnValue;taint;df-generated |
| System.IO.IsolatedStorage;IsolatedStorageFileStream;BeginRead;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[3];Argument[3].Parameter[delegate-self];value;manual |
-| System.IO.IsolatedStorage;IsolatedStorageFileStream;BeginRead;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[this];Argument[0].Element;taint;manual |
+| System.IO.IsolatedStorage;IsolatedStorageFileStream;BeginRead;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[this];Argument[0];taint;manual |
| System.IO.IsolatedStorage;IsolatedStorageFileStream;BeginWrite;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[0].Element;Argument[this];taint;manual |
| System.IO.IsolatedStorage;IsolatedStorageFileStream;BeginWrite;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[3];Argument[3].Parameter[delegate-self];value;manual |
| System.IO.IsolatedStorage;IsolatedStorageFileStream;DisposeAsync;();Argument[this];ReturnValue;taint;df-generated |
| System.IO.IsolatedStorage;IsolatedStorageFileStream;FlushAsync;(System.Threading.CancellationToken);Argument[this].SyntheticField[System.IO.FileStream._strategy].SyntheticField[System.IO.Strategies.DerivedFileStreamStrategy._fileStream];ReturnValue.SyntheticField[System.Threading.Tasks.Task.m_stateObject];value;dfc-generated |
| System.IO.IsolatedStorage;IsolatedStorageFileStream;FlushAsync;(System.Threading.CancellationToken);Argument[this];ReturnValue.SyntheticField[System.Threading.Tasks.Task.m_stateObject];value;dfc-generated |
-| System.IO.IsolatedStorage;IsolatedStorageFileStream;Read;(System.Byte[],System.Int32,System.Int32);Argument[this];Argument[0].Element;taint;manual |
-| System.IO.IsolatedStorage;IsolatedStorageFileStream;Read;(System.Span);Argument[this];Argument[0].Element;taint;manual |
-| System.IO.IsolatedStorage;IsolatedStorageFileStream;ReadAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);Argument[this];Argument[0].Element;taint;manual |
-| System.IO.IsolatedStorage;IsolatedStorageFileStream;ReadAsync;(System.Memory,System.Threading.CancellationToken);Argument[this];Argument[0].Element;taint;manual |
+| System.IO.IsolatedStorage;IsolatedStorageFileStream;Read;(System.Byte[],System.Int32,System.Int32);Argument[this];Argument[0];taint;manual |
+| System.IO.IsolatedStorage;IsolatedStorageFileStream;Read;(System.Span);Argument[this];Argument[0];taint;manual |
+| System.IO.IsolatedStorage;IsolatedStorageFileStream;ReadAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);Argument[this];Argument[0];taint;manual |
+| System.IO.IsolatedStorage;IsolatedStorageFileStream;ReadAsync;(System.Memory,System.Threading.CancellationToken);Argument[this];Argument[0];taint;manual |
| System.IO.IsolatedStorage;IsolatedStorageFileStream;Write;(System.Byte[],System.Int32,System.Int32);Argument[0].Element;Argument[this];taint;manual |
| System.IO.IsolatedStorage;IsolatedStorageFileStream;Write;(System.ReadOnlySpan);Argument[0].Element;Argument[this];taint;manual |
| System.IO.IsolatedStorage;IsolatedStorageFileStream;WriteAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);Argument[0].Element;Argument[this];taint;manual |
@@ -12150,15 +12150,15 @@ summary
| System.IO.Pipes;NamedPipeServerStream;NamedPipeServerStream;(System.IO.Pipes.PipeDirection,System.Boolean,System.Boolean,Microsoft.Win32.SafeHandles.SafePipeHandle);Argument[3];Argument[this];taint;df-generated |
| System.IO.Pipes;NamedPipeServerStream;RunAsClient;(System.IO.Pipes.PipeStreamImpersonationWorker);Argument[0];Argument[0].Parameter[delegate-self];value;hq-generated |
| System.IO.Pipes;PipeStream;BeginRead;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[3];Argument[3].Parameter[delegate-self];value;manual |
-| System.IO.Pipes;PipeStream;BeginRead;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[this];Argument[0].Element;taint;manual |
+| System.IO.Pipes;PipeStream;BeginRead;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[this];Argument[0];taint;manual |
| System.IO.Pipes;PipeStream;BeginWrite;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[0].Element;Argument[this];taint;manual |
| System.IO.Pipes;PipeStream;BeginWrite;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[3];Argument[3].Parameter[delegate-self];value;manual |
| System.IO.Pipes;PipeStream;FlushAsync;(System.Threading.CancellationToken);Argument[this];ReturnValue.SyntheticField[System.Threading.Tasks.Task.m_stateObject];value;dfc-generated |
| System.IO.Pipes;PipeStream;InitializeHandle;(Microsoft.Win32.SafeHandles.SafePipeHandle,System.Boolean,System.Boolean);Argument[0];Argument[this].SyntheticField[System.IO.Pipes.PipeStream._handle];value;dfc-generated |
-| System.IO.Pipes;PipeStream;Read;(System.Byte[],System.Int32,System.Int32);Argument[this];Argument[0].Element;taint;manual |
-| System.IO.Pipes;PipeStream;Read;(System.Span);Argument[this];Argument[0].Element;taint;manual |
-| System.IO.Pipes;PipeStream;ReadAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);Argument[this];Argument[0].Element;taint;manual |
-| System.IO.Pipes;PipeStream;ReadAsync;(System.Memory,System.Threading.CancellationToken);Argument[this];Argument[0].Element;taint;manual |
+| System.IO.Pipes;PipeStream;Read;(System.Byte[],System.Int32,System.Int32);Argument[this];Argument[0];taint;manual |
+| System.IO.Pipes;PipeStream;Read;(System.Span);Argument[this];Argument[0];taint;manual |
+| System.IO.Pipes;PipeStream;ReadAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);Argument[this];Argument[0];taint;manual |
+| System.IO.Pipes;PipeStream;ReadAsync;(System.Memory,System.Threading.CancellationToken);Argument[this];Argument[0];taint;manual |
| System.IO.Pipes;PipeStream;Write;(System.Byte[],System.Int32,System.Int32);Argument[0].Element;Argument[this];taint;manual |
| System.IO.Pipes;PipeStream;Write;(System.ReadOnlySpan);Argument[0].Element;Argument[this];taint;manual |
| System.IO.Pipes;PipeStream;WriteAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);Argument[0].Element;Argument[this];taint;manual |
@@ -12180,7 +12180,7 @@ summary
| System.IO;BinaryWriter;Write;(System.ReadOnlySpan);Argument[0];Argument[this];taint;df-generated |
| System.IO;BinaryWriter;get_BaseStream;();Argument[this].Field[System.IO.BinaryWriter.OutStream];ReturnValue;value;dfc-generated |
| System.IO;BufferedStream;BeginRead;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[3];Argument[3].Parameter[delegate-self];value;manual |
-| System.IO;BufferedStream;BeginRead;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[this];Argument[0].Element;taint;manual |
+| System.IO;BufferedStream;BeginRead;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[this];Argument[0];taint;manual |
| System.IO;BufferedStream;BeginWrite;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[0].Element;Argument[this];taint;manual |
| System.IO;BufferedStream;BeginWrite;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[3];Argument[3].Parameter[delegate-self];value;manual |
| System.IO;BufferedStream;BufferedStream;(System.IO.Stream);Argument[0];Argument[this];taint;manual |
@@ -12189,10 +12189,10 @@ summary
| System.IO;BufferedStream;CopyToAsync;(System.IO.Stream,System.Int32,System.Threading.CancellationToken);Argument[this];Argument[0];taint;manual |
| System.IO;BufferedStream;DisposeAsync;();Argument[this];ReturnValue;taint;df-generated |
| System.IO;BufferedStream;FlushAsync;(System.Threading.CancellationToken);Argument[this];ReturnValue.SyntheticField[System.Threading.Tasks.Task.m_stateObject];value;dfc-generated |
-| System.IO;BufferedStream;Read;(System.Byte[],System.Int32,System.Int32);Argument[this];Argument[0].Element;taint;manual |
-| System.IO;BufferedStream;Read;(System.Span);Argument[this];Argument[0].Element;taint;manual |
-| System.IO;BufferedStream;ReadAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);Argument[this];Argument[0].Element;taint;manual |
-| System.IO;BufferedStream;ReadAsync;(System.Memory,System.Threading.CancellationToken);Argument[this];Argument[0].Element;taint;manual |
+| System.IO;BufferedStream;Read;(System.Byte[],System.Int32,System.Int32);Argument[this];Argument[0];taint;manual |
+| System.IO;BufferedStream;Read;(System.Span);Argument[this];Argument[0];taint;manual |
+| System.IO;BufferedStream;ReadAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);Argument[this];Argument[0];taint;manual |
+| System.IO;BufferedStream;ReadAsync;(System.Memory,System.Threading.CancellationToken);Argument[this];Argument[0];taint;manual |
| System.IO;BufferedStream;Write;(System.Byte[],System.Int32,System.Int32);Argument[0].Element;Argument[this];taint;manual |
| System.IO;BufferedStream;Write;(System.ReadOnlySpan);Argument[0].Element;Argument[this];taint;manual |
| System.IO;BufferedStream;WriteAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);Argument[0].Element;Argument[this];taint;manual |
@@ -12302,7 +12302,7 @@ summary
| System.IO;FileNotFoundException;GetObjectData;(System.Runtime.Serialization.SerializationInfo,System.Runtime.Serialization.StreamingContext);Argument[this];Argument[0];taint;df-generated |
| System.IO;FileNotFoundException;get_Message;();Argument[this].SyntheticField[System.Exception._message];ReturnValue;value;dfc-generated |
| System.IO;FileStream;BeginRead;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[3];Argument[3].Parameter[delegate-self];value;manual |
-| System.IO;FileStream;BeginRead;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[this];Argument[0].Element;taint;manual |
+| System.IO;FileStream;BeginRead;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[this];Argument[0];taint;manual |
| System.IO;FileStream;BeginWrite;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[0].Element;Argument[this];taint;manual |
| System.IO;FileStream;BeginWrite;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[3];Argument[3].Parameter[delegate-self];value;manual |
| System.IO;FileStream;CopyTo;(System.IO.Stream,System.Int32);Argument[this];Argument[0];taint;manual |
@@ -12320,10 +12320,10 @@ summary
| System.IO;FileStream;FileStream;(System.String,System.IO.FileStreamOptions);Argument[this];Argument[this].SyntheticField[System.IO.FileStream._strategy].SyntheticField[System.IO.Strategies.DerivedFileStreamStrategy._fileStream];value;dfc-generated |
| System.IO;FileStream;FlushAsync;(System.Threading.CancellationToken);Argument[this].SyntheticField[System.IO.FileStream._strategy].SyntheticField[System.IO.Strategies.DerivedFileStreamStrategy._fileStream];ReturnValue.SyntheticField[System.Threading.Tasks.Task.m_stateObject];value;dfc-generated |
| System.IO;FileStream;FlushAsync;(System.Threading.CancellationToken);Argument[this];ReturnValue.SyntheticField[System.Threading.Tasks.Task.m_stateObject];value;dfc-generated |
-| System.IO;FileStream;Read;(System.Byte[],System.Int32,System.Int32);Argument[this];Argument[0].Element;taint;manual |
-| System.IO;FileStream;Read;(System.Span);Argument[this];Argument[0].Element;taint;manual |
-| System.IO;FileStream;ReadAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);Argument[this];Argument[0].Element;taint;manual |
-| System.IO;FileStream;ReadAsync;(System.Memory,System.Threading.CancellationToken);Argument[this];Argument[0].Element;taint;manual |
+| System.IO;FileStream;Read;(System.Byte[],System.Int32,System.Int32);Argument[this];Argument[0];taint;manual |
+| System.IO;FileStream;Read;(System.Span);Argument[this];Argument[0];taint;manual |
+| System.IO;FileStream;ReadAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);Argument[this];Argument[0];taint;manual |
+| System.IO;FileStream;ReadAsync;(System.Memory,System.Threading.CancellationToken);Argument[this];Argument[0];taint;manual |
| System.IO;FileStream;Write;(System.Byte[],System.Int32,System.Int32);Argument[0].Element;Argument[this];taint;manual |
| System.IO;FileStream;Write;(System.ReadOnlySpan);Argument[0].Element;Argument[this];taint;manual |
| System.IO;FileStream;WriteAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);Argument[0].Element;Argument[this];taint;manual |
@@ -12364,7 +12364,7 @@ summary
| System.IO;FileSystemWatcher;remove_Error;(System.IO.ErrorEventHandler);Argument[0];Argument[0].Parameter[delegate-self];value;hq-generated |
| System.IO;FileSystemWatcher;remove_Renamed;(System.IO.RenamedEventHandler);Argument[0];Argument[0].Parameter[delegate-self];value;hq-generated |
| System.IO;MemoryStream;BeginRead;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[3];Argument[3].Parameter[delegate-self];value;manual |
-| System.IO;MemoryStream;BeginRead;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[this];Argument[0].Element;taint;manual |
+| System.IO;MemoryStream;BeginRead;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[this];Argument[0];taint;manual |
| System.IO;MemoryStream;BeginWrite;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[0].Element;Argument[this];taint;manual |
| System.IO;MemoryStream;BeginWrite;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[3];Argument[3].Parameter[delegate-self];value;manual |
| System.IO;MemoryStream;CopyTo;(System.IO.Stream,System.Int32);Argument[this];Argument[0];taint;manual |
@@ -12376,10 +12376,10 @@ summary
| System.IO;MemoryStream;MemoryStream;(System.Byte[],System.Int32,System.Int32);Argument[0].Element;Argument[this];taint;manual |
| System.IO;MemoryStream;MemoryStream;(System.Byte[],System.Int32,System.Int32,System.Boolean);Argument[0].Element;Argument[this];taint;manual |
| System.IO;MemoryStream;MemoryStream;(System.Byte[],System.Int32,System.Int32,System.Boolean,System.Boolean);Argument[0].Element;Argument[this];taint;manual |
-| System.IO;MemoryStream;Read;(System.Byte[],System.Int32,System.Int32);Argument[this];Argument[0].Element;taint;manual |
-| System.IO;MemoryStream;Read;(System.Span);Argument[this];Argument[0].Element;taint;manual |
-| System.IO;MemoryStream;ReadAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);Argument[this];Argument[0].Element;taint;manual |
-| System.IO;MemoryStream;ReadAsync;(System.Memory,System.Threading.CancellationToken);Argument[this];Argument[0].Element;taint;manual |
+| System.IO;MemoryStream;Read;(System.Byte[],System.Int32,System.Int32);Argument[this];Argument[0];taint;manual |
+| System.IO;MemoryStream;Read;(System.Span);Argument[this];Argument[0];taint;manual |
+| System.IO;MemoryStream;ReadAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);Argument[this];Argument[0];taint;manual |
+| System.IO;MemoryStream;ReadAsync;(System.Memory,System.Threading.CancellationToken);Argument[this];Argument[0];taint;manual |
| System.IO;MemoryStream;ToArray;();Argument[this];ReturnValue;taint;manual |
| System.IO;MemoryStream;TryGetBuffer;(System.ArraySegment);Argument[this];Argument[0].Element;taint;df-generated |
| System.IO;MemoryStream;Write;(System.Byte[],System.Int32,System.Int32);Argument[0].Element;Argument[this];taint;manual |
@@ -12463,7 +12463,7 @@ summary
| System.IO;RenamedEventArgs;get_OldName;();Argument[this].SyntheticField[System.IO.RenamedEventArgs._oldName];ReturnValue;value;dfc-generated |
| System.IO;RenamedEventHandler;BeginInvoke;(System.Object,System.IO.RenamedEventArgs,System.AsyncCallback,System.Object);Argument[2];Argument[2].Parameter[delegate-self];value;hq-generated |
| System.IO;Stream;BeginRead;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[3];Argument[3].Parameter[delegate-self];value;manual |
-| System.IO;Stream;BeginRead;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[this];Argument[0].Element;taint;manual |
+| System.IO;Stream;BeginRead;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[this];Argument[0];taint;manual |
| System.IO;Stream;BeginWrite;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[0].Element;Argument[this];taint;manual |
| System.IO;Stream;BeginWrite;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[3];Argument[3].Parameter[delegate-self];value;manual |
| System.IO;Stream;CopyTo;(System.IO.Stream);Argument[this];Argument[0];taint;manual |
@@ -12475,15 +12475,15 @@ summary
| System.IO;Stream;DisposeAsync;();Argument[this];ReturnValue;taint;df-generated |
| System.IO;Stream;FlushAsync;();Argument[this];ReturnValue;taint;df-generated |
| System.IO;Stream;FlushAsync;(System.Threading.CancellationToken);Argument[this];ReturnValue.SyntheticField[System.Threading.Tasks.Task.m_stateObject];value;dfc-generated |
-| System.IO;Stream;Read;(System.Byte[],System.Int32,System.Int32);Argument[this];Argument[0].Element;taint;manual |
-| System.IO;Stream;Read;(System.Span);Argument[this];Argument[0].Element;taint;manual |
-| System.IO;Stream;ReadAsync;(System.Byte[],System.Int32,System.Int32);Argument[this];Argument[0].Element;taint;manual |
-| System.IO;Stream;ReadAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);Argument[this];Argument[0].Element;taint;manual |
-| System.IO;Stream;ReadAsync;(System.Memory,System.Threading.CancellationToken);Argument[this];Argument[0].Element;taint;manual |
-| System.IO;Stream;ReadAtLeast;(System.Span,System.Int32,System.Boolean);Argument[this];Argument[0].Element;taint;manual |
+| System.IO;Stream;Read;(System.Byte[],System.Int32,System.Int32);Argument[this];Argument[0];taint;manual |
+| System.IO;Stream;Read;(System.Span);Argument[this];Argument[0];taint;manual |
+| System.IO;Stream;ReadAsync;(System.Byte[],System.Int32,System.Int32);Argument[this];Argument[0];taint;manual |
+| System.IO;Stream;ReadAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);Argument[this];Argument[0];taint;manual |
+| System.IO;Stream;ReadAsync;(System.Memory,System.Threading.CancellationToken);Argument[this];Argument[0];taint;manual |
+| System.IO;Stream;ReadAtLeast;(System.Span,System.Int32,System.Boolean);Argument[this];Argument[0];taint;manual |
| System.IO;Stream;ReadAtLeastAsync;(System.Memory,System.Int32,System.Boolean,System.Threading.CancellationToken);Argument[this];Argument[0];taint;manual |
-| System.IO;Stream;ReadExactly;(System.Byte[],System.Int32,System.Int32);Argument[this];Argument[0].Element;taint;manual |
-| System.IO;Stream;ReadExactly;(System.Span);Argument[this];Argument[0].Element;taint;manual |
+| System.IO;Stream;ReadExactly;(System.Byte[],System.Int32,System.Int32);Argument[this];Argument[0];taint;manual |
+| System.IO;Stream;ReadExactly;(System.Span);Argument[this];Argument[0];taint;manual |
| System.IO;Stream;Synchronized;(System.IO.Stream);Argument[0];ReturnValue;value;dfc-generated |
| System.IO;Stream;Write;(System.Byte[],System.Int32,System.Int32);Argument[0].Element;Argument[this];taint;manual |
| System.IO;Stream;Write;(System.ReadOnlySpan);Argument[0].Element;Argument[this];taint;manual |
@@ -12494,14 +12494,14 @@ summary
| System.IO;Stream;WriteAsync;(System.ReadOnlyMemory,System.Threading.CancellationToken);Argument[1];ReturnValue;taint;df-generated |
| System.IO;Stream;WriteAsync;(System.ReadOnlyMemory,System.Threading.CancellationToken);Argument[this];ReturnValue;taint;df-generated |
| System.IO;StreamReader;Read;();Argument[this];ReturnValue;taint;manual |
-| System.IO;StreamReader;Read;(System.Char[],System.Int32,System.Int32);Argument[this];Argument[0].Element;taint;manual |
-| System.IO;StreamReader;Read;(System.Span);Argument[this];Argument[0].Element;taint;manual |
-| System.IO;StreamReader;ReadAsync;(System.Char[],System.Int32,System.Int32);Argument[this];Argument[0].Element;taint;manual |
-| System.IO;StreamReader;ReadAsync;(System.Memory,System.Threading.CancellationToken);Argument[this];Argument[0].Element;taint;manual |
-| System.IO;StreamReader;ReadBlock;(System.Char[],System.Int32,System.Int32);Argument[this];Argument[0].Element;taint;manual |
-| System.IO;StreamReader;ReadBlock;(System.Span);Argument[this];Argument[0].Element;taint;manual |
-| System.IO;StreamReader;ReadBlockAsync;(System.Char[],System.Int32,System.Int32);Argument[this];Argument[0].Element;taint;manual |
-| System.IO;StreamReader;ReadBlockAsync;(System.Memory,System.Threading.CancellationToken);Argument[this];Argument[0].Element;taint;manual |
+| System.IO;StreamReader;Read;(System.Char[],System.Int32,System.Int32);Argument[this];Argument[0];taint;manual |
+| System.IO;StreamReader;Read;(System.Span);Argument[this];Argument[0];taint;manual |
+| System.IO;StreamReader;ReadAsync;(System.Char[],System.Int32,System.Int32);Argument[this];Argument[0];taint;manual |
+| System.IO;StreamReader;ReadAsync;(System.Memory,System.Threading.CancellationToken);Argument[this];Argument[0];taint;manual |
+| System.IO;StreamReader;ReadBlock;(System.Char[],System.Int32,System.Int32);Argument[this];Argument[0];taint;manual |
+| System.IO;StreamReader;ReadBlock;(System.Span);Argument[this];Argument[0];taint;manual |
+| System.IO;StreamReader;ReadBlockAsync;(System.Char[],System.Int32,System.Int32);Argument[this];Argument[0];taint;manual |
+| System.IO;StreamReader;ReadBlockAsync;(System.Memory,System.Threading.CancellationToken);Argument[this];Argument[0];taint;manual |
| System.IO;StreamReader;ReadLine;();Argument[this];ReturnValue;taint;manual |
| System.IO;StreamReader;ReadLineAsync;();Argument[this];ReturnValue;taint;manual |
| System.IO;StreamReader;ReadLineAsync;(System.Threading.CancellationToken);Argument[this];ReturnValue;taint;df-generated |
@@ -12577,13 +12577,13 @@ summary
| System.IO;StreamWriter;get_BaseStream;();Argument[this].SyntheticField[System.IO.StreamWriter._stream];ReturnValue;value;dfc-generated |
| System.IO;StreamWriter;get_Encoding;();Argument[this];ReturnValue;taint;df-generated |
| System.IO;StringReader;Read;();Argument[this];ReturnValue;taint;manual |
-| System.IO;StringReader;Read;(System.Char[],System.Int32,System.Int32);Argument[this];Argument[0].Element;taint;manual |
-| System.IO;StringReader;Read;(System.Span);Argument[this];Argument[0].Element;taint;manual |
-| System.IO;StringReader;ReadAsync;(System.Char[],System.Int32,System.Int32);Argument[this];Argument[0].Element;taint;manual |
-| System.IO;StringReader;ReadAsync;(System.Memory,System.Threading.CancellationToken);Argument[this];Argument[0].Element;taint;manual |
-| System.IO;StringReader;ReadBlock;(System.Span);Argument[this];Argument[0].Element;taint;manual |
-| System.IO;StringReader;ReadBlockAsync;(System.Char[],System.Int32,System.Int32);Argument[this];Argument[0].Element;taint;manual |
-| System.IO;StringReader;ReadBlockAsync;(System.Memory,System.Threading.CancellationToken);Argument[this];Argument[0].Element;taint;manual |
+| System.IO;StringReader;Read;(System.Char[],System.Int32,System.Int32);Argument[this];Argument[0];taint;manual |
+| System.IO;StringReader;Read;(System.Span);Argument[this];Argument[0];taint;manual |
+| System.IO;StringReader;ReadAsync;(System.Char[],System.Int32,System.Int32);Argument[this];Argument[0];taint;manual |
+| System.IO;StringReader;ReadAsync;(System.Memory,System.Threading.CancellationToken);Argument[this];Argument[0];taint;manual |
+| System.IO;StringReader;ReadBlock;(System.Span);Argument[this];Argument[0];taint;manual |
+| System.IO;StringReader;ReadBlockAsync;(System.Char[],System.Int32,System.Int32);Argument[this];Argument[0];taint;manual |
+| System.IO;StringReader;ReadBlockAsync;(System.Memory,System.Threading.CancellationToken);Argument[this];Argument[0];taint;manual |
| System.IO;StringReader;ReadLine;();Argument[this];ReturnValue;taint;manual |
| System.IO;StringReader;ReadLineAsync;();Argument[this];ReturnValue;taint;manual |
| System.IO;StringReader;ReadLineAsync;(System.Threading.CancellationToken);Argument[this];ReturnValue;taint;df-generated |
@@ -12615,14 +12615,14 @@ summary
| System.IO;StringWriter;WriteLineAsync;(System.Text.StringBuilder,System.Threading.CancellationToken);Argument[0];Argument[this];taint;manual |
| System.IO;StringWriter;get_Encoding;();Argument[this];ReturnValue;taint;df-generated |
| System.IO;TextReader;Read;();Argument[this];ReturnValue;taint;manual |
-| System.IO;TextReader;Read;(System.Char[],System.Int32,System.Int32);Argument[this];Argument[0].Element;taint;manual |
-| System.IO;TextReader;Read;(System.Span);Argument[this];Argument[0].Element;taint;manual |
-| System.IO;TextReader;ReadAsync;(System.Char[],System.Int32,System.Int32);Argument[this];Argument[0].Element;taint;manual |
-| System.IO;TextReader;ReadAsync;(System.Memory,System.Threading.CancellationToken);Argument[this];Argument[0].Element;taint;manual |
-| System.IO;TextReader;ReadBlock;(System.Char[],System.Int32,System.Int32);Argument[this];Argument[0].Element;taint;manual |
-| System.IO;TextReader;ReadBlock;(System.Span);Argument[this];Argument[0].Element;taint;manual |
-| System.IO;TextReader;ReadBlockAsync;(System.Char[],System.Int32,System.Int32);Argument[this];Argument[0].Element;taint;manual |
-| System.IO;TextReader;ReadBlockAsync;(System.Memory,System.Threading.CancellationToken);Argument[this];Argument[0].Element;taint;manual |
+| System.IO;TextReader;Read;(System.Char[],System.Int32,System.Int32);Argument[this];Argument[0];taint;manual |
+| System.IO;TextReader;Read;(System.Span);Argument[this];Argument[0];taint;manual |
+| System.IO;TextReader;ReadAsync;(System.Char[],System.Int32,System.Int32);Argument[this];Argument[0];taint;manual |
+| System.IO;TextReader;ReadAsync;(System.Memory,System.Threading.CancellationToken);Argument[this];Argument[0];taint;manual |
+| System.IO;TextReader;ReadBlock;(System.Char[],System.Int32,System.Int32);Argument[this];Argument[0];taint;manual |
+| System.IO;TextReader;ReadBlock;(System.Span);Argument[this];Argument[0];taint;manual |
+| System.IO;TextReader;ReadBlockAsync;(System.Char[],System.Int32,System.Int32);Argument[this];Argument[0];taint;manual |
+| System.IO;TextReader;ReadBlockAsync;(System.Memory,System.Threading.CancellationToken);Argument[this];Argument[0];taint;manual |
| System.IO;TextReader;ReadLine;();Argument[this];ReturnValue;taint;manual |
| System.IO;TextReader;ReadLineAsync;();Argument[this];ReturnValue;taint;manual |
| System.IO;TextReader;ReadLineAsync;(System.Threading.CancellationToken);Argument[this];ReturnValue;taint;df-generated |
@@ -12707,10 +12707,10 @@ summary
| System.IO;UnmanagedMemoryStream;FlushAsync;(System.Threading.CancellationToken);Argument[this];ReturnValue.SyntheticField[System.Threading.Tasks.Task.m_stateObject];value;dfc-generated |
| System.IO;UnmanagedMemoryStream;Initialize;(System.Byte*,System.Int64,System.Int64,System.IO.FileAccess);Argument[0];Argument[this];taint;df-generated |
| System.IO;UnmanagedMemoryStream;Initialize;(System.Runtime.InteropServices.SafeBuffer,System.Int64,System.Int64,System.IO.FileAccess);Argument[0];Argument[this];taint;df-generated |
-| System.IO;UnmanagedMemoryStream;Read;(System.Byte[],System.Int32,System.Int32);Argument[this];Argument[0].Element;taint;manual |
-| System.IO;UnmanagedMemoryStream;Read;(System.Span);Argument[this];Argument[0].Element;taint;manual |
-| System.IO;UnmanagedMemoryStream;ReadAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);Argument[this];Argument[0].Element;taint;manual |
-| System.IO;UnmanagedMemoryStream;ReadAsync;(System.Memory,System.Threading.CancellationToken);Argument[this];Argument[0].Element;taint;manual |
+| System.IO;UnmanagedMemoryStream;Read;(System.Byte[],System.Int32,System.Int32);Argument[this];Argument[0];taint;manual |
+| System.IO;UnmanagedMemoryStream;Read;(System.Span);Argument[this];Argument[0];taint;manual |
+| System.IO;UnmanagedMemoryStream;ReadAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);Argument[this];Argument[0];taint;manual |
+| System.IO;UnmanagedMemoryStream;ReadAsync;(System.Memory,System.Threading.CancellationToken);Argument[this];Argument[0];taint;manual |
| System.IO;UnmanagedMemoryStream;UnmanagedMemoryStream;(System.Byte*,System.Int64);Argument[0];Argument[this];taint;df-generated |
| System.IO;UnmanagedMemoryStream;UnmanagedMemoryStream;(System.Byte*,System.Int64,System.Int64,System.IO.FileAccess);Argument[0];Argument[this];taint;df-generated |
| System.IO;UnmanagedMemoryStream;UnmanagedMemoryStream;(System.Runtime.InteropServices.SafeBuffer,System.Int64,System.Int64);Argument[0];Argument[this];taint;df-generated |
@@ -15118,15 +15118,15 @@ summary
| System.Net.Quic;QuicListener;DisposeAsync;();Argument[this];ReturnValue;taint;df-generated |
| System.Net.Quic;QuicListenerOptions;set_ConnectionOptionsCallback;(System.Func>);Argument[0];Argument[0].Parameter[delegate-self];value;hq-generated |
| System.Net.Quic;QuicStream;BeginRead;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[3];Argument[3].Parameter[delegate-self];value;manual |
-| System.Net.Quic;QuicStream;BeginRead;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[this];Argument[0].Element;taint;manual |
+| System.Net.Quic;QuicStream;BeginRead;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[this];Argument[0];taint;manual |
| System.Net.Quic;QuicStream;BeginWrite;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[0].Element;Argument[this];taint;manual |
| System.Net.Quic;QuicStream;BeginWrite;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[3];Argument[3].Parameter[delegate-self];value;manual |
| System.Net.Quic;QuicStream;DisposeAsync;();Argument[this];ReturnValue;taint;df-generated |
| System.Net.Quic;QuicStream;FlushAsync;(System.Threading.CancellationToken);Argument[this];ReturnValue.SyntheticField[System.Threading.Tasks.Task.m_stateObject];value;dfc-generated |
-| System.Net.Quic;QuicStream;Read;(System.Byte[],System.Int32,System.Int32);Argument[this];Argument[0].Element;taint;manual |
-| System.Net.Quic;QuicStream;Read;(System.Span);Argument[this];Argument[0].Element;taint;manual |
-| System.Net.Quic;QuicStream;ReadAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);Argument[this];Argument[0].Element;taint;manual |
-| System.Net.Quic;QuicStream;ReadAsync;(System.Memory,System.Threading.CancellationToken);Argument[this];Argument[0].Element;taint;manual |
+| System.Net.Quic;QuicStream;Read;(System.Byte[],System.Int32,System.Int32);Argument[this];Argument[0];taint;manual |
+| System.Net.Quic;QuicStream;Read;(System.Span);Argument[this];Argument[0];taint;manual |
+| System.Net.Quic;QuicStream;ReadAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);Argument[this];Argument[0];taint;manual |
+| System.Net.Quic;QuicStream;ReadAsync;(System.Memory,System.Threading.CancellationToken);Argument[this];Argument[0];taint;manual |
| System.Net.Quic;QuicStream;Write;(System.Byte[],System.Int32,System.Int32);Argument[0].Element;Argument[this];taint;manual |
| System.Net.Quic;QuicStream;Write;(System.ReadOnlySpan);Argument[0].Element;Argument[this];taint;manual |
| System.Net.Quic;QuicStream;WriteAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);Argument[0].Element;Argument[this];taint;manual |
@@ -15159,14 +15159,14 @@ summary
| System.Net.Security;NegotiateStream;BeginAuthenticateAsServer;(System.Net.NetworkCredential,System.Security.Authentication.ExtendedProtection.ExtendedProtectionPolicy,System.Net.Security.ProtectionLevel,System.Security.Principal.TokenImpersonationLevel,System.AsyncCallback,System.Object);Argument[4];Argument[4].Parameter[delegate-self];value;hq-generated |
| System.Net.Security;NegotiateStream;BeginAuthenticateAsServer;(System.Security.Authentication.ExtendedProtection.ExtendedProtectionPolicy,System.AsyncCallback,System.Object);Argument[1];Argument[1].Parameter[delegate-self];value;hq-generated |
| System.Net.Security;NegotiateStream;BeginRead;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[3];Argument[3].Parameter[delegate-self];value;manual |
-| System.Net.Security;NegotiateStream;BeginRead;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[this];Argument[0].Element;taint;manual |
+| System.Net.Security;NegotiateStream;BeginRead;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[this];Argument[0];taint;manual |
| System.Net.Security;NegotiateStream;BeginWrite;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[0].Element;Argument[this];taint;manual |
| System.Net.Security;NegotiateStream;BeginWrite;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[3];Argument[3].Parameter[delegate-self];value;manual |
| System.Net.Security;NegotiateStream;DisposeAsync;();Argument[this];ReturnValue;taint;df-generated |
| System.Net.Security;NegotiateStream;FlushAsync;(System.Threading.CancellationToken);Argument[this];ReturnValue.SyntheticField[System.Threading.Tasks.Task.m_stateObject];value;dfc-generated |
-| System.Net.Security;NegotiateStream;Read;(System.Byte[],System.Int32,System.Int32);Argument[this];Argument[0].Element;taint;manual |
-| System.Net.Security;NegotiateStream;ReadAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);Argument[this];Argument[0].Element;taint;manual |
-| System.Net.Security;NegotiateStream;ReadAsync;(System.Memory,System.Threading.CancellationToken);Argument[this];Argument[0].Element;taint;manual |
+| System.Net.Security;NegotiateStream;Read;(System.Byte[],System.Int32,System.Int32);Argument[this];Argument[0];taint;manual |
+| System.Net.Security;NegotiateStream;ReadAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);Argument[this];Argument[0];taint;manual |
+| System.Net.Security;NegotiateStream;ReadAsync;(System.Memory,System.Threading.CancellationToken);Argument[this];Argument[0];taint;manual |
| System.Net.Security;NegotiateStream;Write;(System.Byte[],System.Int32,System.Int32);Argument[0].Element;Argument[this];taint;manual |
| System.Net.Security;NegotiateStream;WriteAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);Argument[0].Element;Argument[this];taint;manual |
| System.Net.Security;NegotiateStream;WriteAsync;(System.ReadOnlyMemory,System.Threading.CancellationToken);Argument[0];Argument[this];taint;df-generated |
@@ -15212,14 +15212,14 @@ summary
| System.Net.Security;SslStream;BeginAuthenticateAsServer;(System.Security.Cryptography.X509Certificates.X509Certificate,System.Boolean,System.Boolean,System.AsyncCallback,System.Object);Argument[3];Argument[3].Parameter[delegate-self];value;hq-generated |
| System.Net.Security;SslStream;BeginAuthenticateAsServer;(System.Security.Cryptography.X509Certificates.X509Certificate,System.Boolean,System.Security.Authentication.SslProtocols,System.Boolean,System.AsyncCallback,System.Object);Argument[4];Argument[4].Parameter[delegate-self];value;hq-generated |
| System.Net.Security;SslStream;BeginRead;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[3];Argument[3].Parameter[delegate-self];value;manual |
-| System.Net.Security;SslStream;BeginRead;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[this];Argument[0].Element;taint;manual |
+| System.Net.Security;SslStream;BeginRead;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[this];Argument[0];taint;manual |
| System.Net.Security;SslStream;BeginWrite;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[0].Element;Argument[this];taint;manual |
| System.Net.Security;SslStream;BeginWrite;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[3];Argument[3].Parameter[delegate-self];value;manual |
| System.Net.Security;SslStream;DisposeAsync;();Argument[this];ReturnValue;taint;df-generated |
| System.Net.Security;SslStream;FlushAsync;(System.Threading.CancellationToken);Argument[this];ReturnValue.SyntheticField[System.Threading.Tasks.Task.m_stateObject];value;dfc-generated |
-| System.Net.Security;SslStream;Read;(System.Byte[],System.Int32,System.Int32);Argument[this];Argument[0].Element;taint;manual |
-| System.Net.Security;SslStream;ReadAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);Argument[this];Argument[0].Element;taint;manual |
-| System.Net.Security;SslStream;ReadAsync;(System.Memory,System.Threading.CancellationToken);Argument[this];Argument[0].Element;taint;manual |
+| System.Net.Security;SslStream;Read;(System.Byte[],System.Int32,System.Int32);Argument[this];Argument[0];taint;manual |
+| System.Net.Security;SslStream;ReadAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);Argument[this];Argument[0];taint;manual |
+| System.Net.Security;SslStream;ReadAsync;(System.Memory,System.Threading.CancellationToken);Argument[this];Argument[0];taint;manual |
| System.Net.Security;SslStream;SslStream;(System.IO.Stream,System.Boolean,System.Net.Security.RemoteCertificateValidationCallback);Argument[2];Argument[2].Parameter[delegate-self];value;hq-generated |
| System.Net.Security;SslStream;SslStream;(System.IO.Stream,System.Boolean,System.Net.Security.RemoteCertificateValidationCallback,System.Net.Security.LocalCertificateSelectionCallback);Argument[2];Argument[2].Parameter[delegate-self];value;hq-generated |
| System.Net.Security;SslStream;SslStream;(System.IO.Stream,System.Boolean,System.Net.Security.RemoteCertificateValidationCallback,System.Net.Security.LocalCertificateSelectionCallback);Argument[3];Argument[3].Parameter[delegate-self];value;hq-generated |
@@ -15247,15 +15247,15 @@ summary
| System.Net.Sockets;MulticastOption;MulticastOption;(System.Net.IPAddress,System.Net.IPAddress);Argument[0];Argument[this];taint;df-generated |
| System.Net.Sockets;MulticastOption;MulticastOption;(System.Net.IPAddress,System.Net.IPAddress);Argument[1];Argument[this];taint;df-generated |
| System.Net.Sockets;NetworkStream;BeginRead;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[3];Argument[3].Parameter[delegate-self];value;manual |
-| System.Net.Sockets;NetworkStream;BeginRead;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[this];Argument[0].Element;taint;manual |
+| System.Net.Sockets;NetworkStream;BeginRead;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[this];Argument[0];taint;manual |
| System.Net.Sockets;NetworkStream;BeginWrite;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[0].Element;Argument[this];taint;manual |
| System.Net.Sockets;NetworkStream;BeginWrite;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[3];Argument[3].Parameter[delegate-self];value;manual |
| System.Net.Sockets;NetworkStream;FlushAsync;(System.Threading.CancellationToken);Argument[this];ReturnValue.SyntheticField[System.Threading.Tasks.Task.m_stateObject];value;dfc-generated |
| System.Net.Sockets;NetworkStream;NetworkStream;(System.Net.Sockets.Socket,System.IO.FileAccess,System.Boolean);Argument[0];Argument[this].SyntheticField[System.Net.Sockets.NetworkStream._streamSocket];value;dfc-generated |
-| System.Net.Sockets;NetworkStream;Read;(System.Byte[],System.Int32,System.Int32);Argument[this];Argument[0].Element;taint;manual |
-| System.Net.Sockets;NetworkStream;Read;(System.Span);Argument[this];Argument[0].Element;taint;manual |
-| System.Net.Sockets;NetworkStream;ReadAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);Argument[this];Argument[0].Element;taint;manual |
-| System.Net.Sockets;NetworkStream;ReadAsync;(System.Memory,System.Threading.CancellationToken);Argument[this];Argument[0].Element;taint;manual |
+| System.Net.Sockets;NetworkStream;Read;(System.Byte[],System.Int32,System.Int32);Argument[this];Argument[0];taint;manual |
+| System.Net.Sockets;NetworkStream;Read;(System.Span);Argument[this];Argument[0];taint;manual |
+| System.Net.Sockets;NetworkStream;ReadAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);Argument[this];Argument[0];taint;manual |
+| System.Net.Sockets;NetworkStream;ReadAsync;(System.Memory,System.Threading.CancellationToken);Argument[this];Argument[0];taint;manual |
| System.Net.Sockets;NetworkStream;Write;(System.Byte[],System.Int32,System.Int32);Argument[0].Element;Argument[this];taint;manual |
| System.Net.Sockets;NetworkStream;Write;(System.ReadOnlySpan);Argument[0].Element;Argument[this];taint;manual |
| System.Net.Sockets;NetworkStream;WriteAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);Argument[0].Element;Argument[this];taint;manual |
@@ -17765,7 +17765,7 @@ summary
| System.Security.Cryptography;CngUIPolicy;CngUIPolicy;(System.Security.Cryptography.CngUIProtectionLevels,System.String,System.String,System.String,System.String);Argument[3];Argument[this].Property[System.Security.Cryptography.CngUIPolicy.UseContext];value;dfc-generated |
| System.Security.Cryptography;CngUIPolicy;CngUIPolicy;(System.Security.Cryptography.CngUIProtectionLevels,System.String,System.String,System.String,System.String);Argument[4];Argument[this].Property[System.Security.Cryptography.CngUIPolicy.CreationTitle];value;dfc-generated |
| System.Security.Cryptography;CryptoStream;BeginRead;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[3];Argument[3].Parameter[delegate-self];value;manual |
-| System.Security.Cryptography;CryptoStream;BeginRead;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[this];Argument[0].Element;taint;manual |
+| System.Security.Cryptography;CryptoStream;BeginRead;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[this];Argument[0];taint;manual |
| System.Security.Cryptography;CryptoStream;BeginWrite;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[0].Element;Argument[this];taint;manual |
| System.Security.Cryptography;CryptoStream;BeginWrite;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[3];Argument[3].Parameter[delegate-self];value;manual |
| System.Security.Cryptography;CryptoStream;CopyTo;(System.IO.Stream,System.Int32);Argument[this];Argument[0];taint;manual |
@@ -17774,9 +17774,9 @@ summary
| System.Security.Cryptography;CryptoStream;CryptoStream;(System.IO.Stream,System.Security.Cryptography.ICryptoTransform,System.Security.Cryptography.CryptoStreamMode,System.Boolean);Argument[1];Argument[this];taint;df-generated |
| System.Security.Cryptography;CryptoStream;DisposeAsync;();Argument[this];ReturnValue;taint;df-generated |
| System.Security.Cryptography;CryptoStream;FlushAsync;(System.Threading.CancellationToken);Argument[this];ReturnValue.SyntheticField[System.Threading.Tasks.Task.m_stateObject];value;dfc-generated |
-| System.Security.Cryptography;CryptoStream;Read;(System.Byte[],System.Int32,System.Int32);Argument[this];Argument[0].Element;taint;manual |
-| System.Security.Cryptography;CryptoStream;ReadAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);Argument[this];Argument[0].Element;taint;manual |
-| System.Security.Cryptography;CryptoStream;ReadAsync;(System.Memory,System.Threading.CancellationToken);Argument[this];Argument[0].Element;taint;manual |
+| System.Security.Cryptography;CryptoStream;Read;(System.Byte[],System.Int32,System.Int32);Argument[this];Argument[0];taint;manual |
+| System.Security.Cryptography;CryptoStream;ReadAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);Argument[this];Argument[0];taint;manual |
+| System.Security.Cryptography;CryptoStream;ReadAsync;(System.Memory,System.Threading.CancellationToken);Argument[this];Argument[0];taint;manual |
| System.Security.Cryptography;CryptoStream;Write;(System.Byte[],System.Int32,System.Int32);Argument[0].Element;Argument[this];taint;manual |
| System.Security.Cryptography;CryptoStream;WriteAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);Argument[0].Element;Argument[this];taint;manual |
| System.Security.Cryptography;CryptoStream;WriteAsync;(System.ReadOnlyMemory,System.Threading.CancellationToken);Argument[0];Argument[this];taint;df-generated |
@@ -21887,15 +21887,15 @@ summary
| System;Convert;ChangeType;(System.Object,System.Type,System.IFormatProvider);Argument[0];ReturnValue;taint;manual |
| System;Convert;ChangeType;(System.Object,System.TypeCode);Argument[0];ReturnValue;taint;manual |
| System;Convert;ChangeType;(System.Object,System.TypeCode,System.IFormatProvider);Argument[0];ReturnValue;taint;manual |
-| System;Convert;FromBase64CharArray;(System.Char[],System.Int32,System.Int32);Argument[0].Element;ReturnValue.Element;taint;manual |
-| System;Convert;FromBase64String;(System.String);Argument[0];ReturnValue.Element;taint;manual |
-| System;Convert;FromHexString;(System.ReadOnlySpan);Argument[0].Element;ReturnValue.Element;taint;manual |
-| System;Convert;FromHexString;(System.String);Argument[0];ReturnValue.Element;taint;manual |
+| System;Convert;FromBase64CharArray;(System.Char[],System.Int32,System.Int32);Argument[0].Element;ReturnValue;taint;manual |
+| System;Convert;FromBase64String;(System.String);Argument[0];ReturnValue;taint;manual |
+| System;Convert;FromHexString;(System.ReadOnlySpan);Argument[0].Element;ReturnValue;taint;manual |
+| System;Convert;FromHexString;(System.String);Argument[0];ReturnValue;taint;manual |
| System;Convert;GetTypeCode;(System.Object);Argument[0];ReturnValue;taint;manual |
| System;Convert;IsDBNull;(System.Object);Argument[0];ReturnValue;taint;manual |
-| System;Convert;ToBase64CharArray;(System.Byte[],System.Int32,System.Int32,System.Char[],System.Int32);Argument[0].Element;Argument[3].Element;taint;manual |
+| System;Convert;ToBase64CharArray;(System.Byte[],System.Int32,System.Int32,System.Char[],System.Int32);Argument[0].Element;Argument[3];taint;manual |
| System;Convert;ToBase64CharArray;(System.Byte[],System.Int32,System.Int32,System.Char[],System.Int32);Argument[0].Element;ReturnValue;taint;manual |
-| System;Convert;ToBase64CharArray;(System.Byte[],System.Int32,System.Int32,System.Char[],System.Int32,System.Base64FormattingOptions);Argument[0].Element;Argument[3].Element;taint;manual |
+| System;Convert;ToBase64CharArray;(System.Byte[],System.Int32,System.Int32,System.Char[],System.Int32,System.Base64FormattingOptions);Argument[0].Element;Argument[3];taint;manual |
| System;Convert;ToBase64CharArray;(System.Byte[],System.Int32,System.Int32,System.Char[],System.Int32,System.Base64FormattingOptions);Argument[0].Element;ReturnValue;taint;manual |
| System;Convert;ToBase64String;(System.Byte[]);Argument[0].Element;ReturnValue;taint;manual |
| System;Convert;ToBase64String;(System.Byte[],System.Base64FormattingOptions);Argument[0].Element;ReturnValue;taint;manual |
@@ -22201,13 +22201,13 @@ summary
| System;Convert;ToUInt64;(System.UInt16);Argument[0];ReturnValue;taint;manual |
| System;Convert;ToUInt64;(System.UInt32);Argument[0];ReturnValue;taint;manual |
| System;Convert;ToUInt64;(System.UInt64);Argument[0];ReturnValue;taint;manual |
-| System;Convert;TryFromBase64Chars;(System.ReadOnlySpan,System.Span,System.Int32);Argument[0].Element;Argument[1].Element;taint;manual |
+| System;Convert;TryFromBase64Chars;(System.ReadOnlySpan,System.Span,System.Int32);Argument[0].Element;Argument[1];taint;manual |
| System;Convert;TryFromBase64Chars;(System.ReadOnlySpan,System.Span,System.Int32);Argument[0].Element;Argument[2];taint;manual |
| System;Convert;TryFromBase64Chars;(System.ReadOnlySpan,System.Span,System.Int32);Argument[0].Element;ReturnValue;taint;manual |
-| System;Convert;TryFromBase64String;(System.String,System.Span,System.Int32);Argument[0];Argument[1].Element;taint;manual |
+| System;Convert;TryFromBase64String;(System.String,System.Span,System.Int32);Argument[0];Argument[1];taint;manual |
| System;Convert;TryFromBase64String;(System.String,System.Span,System.Int32);Argument[0];Argument[2];taint;manual |
| System;Convert;TryFromBase64String;(System.String,System.Span,System.Int32);Argument[0];ReturnValue;taint;manual |
-| System;Convert;TryToBase64Chars;(System.ReadOnlySpan,System.Span,System.Int32,System.Base64FormattingOptions);Argument[0].Element;Argument[1].Element;taint;manual |
+| System;Convert;TryToBase64Chars;(System.ReadOnlySpan,System.Span,System.Int32,System.Base64FormattingOptions);Argument[0].Element;Argument[1];taint;manual |
| System;Convert;TryToBase64Chars;(System.ReadOnlySpan,System.Span,System.Int32,System.Base64FormattingOptions);Argument[0].Element;Argument[2];taint;manual |
| System;Convert;TryToBase64Chars;(System.ReadOnlySpan,System.Span,System.Int32,System.Base64FormattingOptions);Argument[0].Element;ReturnValue;taint;manual |
| System;Converter;BeginInvoke;(TInput,System.AsyncCallback,System.Object);Argument[1];Argument[1].Parameter[delegate-self];value;hq-generated |
diff --git a/csharp/ql/test/library-tests/dataflow/library/FlowSummariesFiltered.expected b/csharp/ql/test/library-tests/dataflow/library/FlowSummariesFiltered.expected
index faf716f4d7be..ef56fb2f1e28 100644
--- a/csharp/ql/test/library-tests/dataflow/library/FlowSummariesFiltered.expected
+++ b/csharp/ql/test/library-tests/dataflow/library/FlowSummariesFiltered.expected
@@ -9285,7 +9285,7 @@
| System.IO;RenamedEventArgs;get_OldName;();Argument[this].SyntheticField[System.IO.RenamedEventArgs._oldName];ReturnValue;value;dfc-generated |
| System.IO;RenamedEventHandler;BeginInvoke;(System.Object,System.IO.RenamedEventArgs,System.AsyncCallback,System.Object);Argument[2];Argument[2].Parameter[delegate-self];value;hq-generated |
| System.IO;Stream;BeginRead;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[3];Argument[3].Parameter[delegate-self];value;manual |
-| System.IO;Stream;BeginRead;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[this];Argument[0].Element;taint;manual |
+| System.IO;Stream;BeginRead;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[this];Argument[0];taint;manual |
| System.IO;Stream;BeginWrite;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[0].Element;Argument[this];taint;manual |
| System.IO;Stream;BeginWrite;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);Argument[3];Argument[3].Parameter[delegate-self];value;manual |
| System.IO;Stream;CopyTo;(System.IO.Stream);Argument[this];Argument[0];taint;manual |
@@ -9296,15 +9296,15 @@
| System.IO;Stream;CopyToAsync;(System.IO.Stream,System.Threading.CancellationToken);Argument[this];Argument[0];taint;manual |
| System.IO;Stream;FlushAsync;();Argument[this];ReturnValue;taint;df-generated |
| System.IO;Stream;FlushAsync;(System.Threading.CancellationToken);Argument[this];ReturnValue.SyntheticField[System.Threading.Tasks.Task.m_stateObject];value;dfc-generated |
-| System.IO;Stream;Read;(System.Byte[],System.Int32,System.Int32);Argument[this];Argument[0].Element;taint;manual |
-| System.IO;Stream;Read;(System.Span);Argument[this];Argument[0].Element;taint;manual |
-| System.IO;Stream;ReadAsync;(System.Byte[],System.Int32,System.Int32);Argument[this];Argument[0].Element;taint;manual |
-| System.IO;Stream;ReadAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);Argument[this];Argument[0].Element;taint;manual |
-| System.IO;Stream;ReadAsync;(System.Memory,System.Threading.CancellationToken);Argument[this];Argument[0].Element;taint;manual |
-| System.IO;Stream;ReadAtLeast;(System.Span,System.Int32,System.Boolean);Argument[this];Argument[0].Element;taint;manual |
+| System.IO;Stream;Read;(System.Byte[],System.Int32,System.Int32);Argument[this];Argument[0];taint;manual |
+| System.IO;Stream;Read;(System.Span);Argument[this];Argument[0];taint;manual |
+| System.IO;Stream;ReadAsync;(System.Byte[],System.Int32,System.Int32);Argument[this];Argument[0];taint;manual |
+| System.IO;Stream;ReadAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);Argument[this];Argument[0];taint;manual |
+| System.IO;Stream;ReadAsync;(System.Memory,System.Threading.CancellationToken);Argument[this];Argument[0];taint;manual |
+| System.IO;Stream;ReadAtLeast;(System.Span,System.Int32,System.Boolean);Argument[this];Argument[0];taint;manual |
| System.IO;Stream;ReadAtLeastAsync;(System.Memory,System.Int32,System.Boolean,System.Threading.CancellationToken);Argument[this];Argument[0];taint;manual |
-| System.IO;Stream;ReadExactly;(System.Byte[],System.Int32,System.Int32);Argument[this];Argument[0].Element;taint;manual |
-| System.IO;Stream;ReadExactly;(System.Span);Argument[this];Argument[0].Element;taint;manual |
+| System.IO;Stream;ReadExactly;(System.Byte[],System.Int32,System.Int32);Argument[this];Argument[0];taint;manual |
+| System.IO;Stream;ReadExactly;(System.Span);Argument[this];Argument[0];taint;manual |
| System.IO;Stream;Synchronized;(System.IO.Stream);Argument[0];ReturnValue;value;dfc-generated |
| System.IO;Stream;Write;(System.Byte[],System.Int32,System.Int32);Argument[0].Element;Argument[this];taint;manual |
| System.IO;Stream;Write;(System.ReadOnlySpan);Argument[0].Element;Argument[this];taint;manual |
@@ -9336,14 +9336,14 @@
| System.IO;StringWriter;StringWriter;(System.Text.StringBuilder,System.IFormatProvider);Argument[0];Argument[this];taint;manual |
| System.IO;StringWriter;ToString;();Argument[this];ReturnValue;taint;manual |
| System.IO;TextReader;Read;();Argument[this];ReturnValue;taint;manual |
-| System.IO;TextReader;Read;(System.Char[],System.Int32,System.Int32);Argument[this];Argument[0].Element;taint;manual |
-| System.IO;TextReader;Read;(System.Span);Argument[this];Argument[0].Element;taint;manual |
-| System.IO;TextReader;ReadAsync;(System.Char[],System.Int32,System.Int32);Argument[this];Argument[0].Element;taint;manual |
-| System.IO;TextReader;ReadAsync;(System.Memory,System.Threading.CancellationToken);Argument[this];Argument[0].Element;taint;manual |
-| System.IO;TextReader;ReadBlock;(System.Char[],System.Int32,System.Int32);Argument[this];Argument[0].Element;taint;manual |
-| System.IO;TextReader;ReadBlock;(System.Span);Argument[this];Argument[0].Element;taint;manual |
-| System.IO;TextReader;ReadBlockAsync;(System.Char[],System.Int32,System.Int32);Argument[this];Argument[0].Element;taint;manual |
-| System.IO;TextReader;ReadBlockAsync;(System.Memory,System.Threading.CancellationToken);Argument[this];Argument[0].Element;taint;manual |
+| System.IO;TextReader;Read;(System.Char[],System.Int32,System.Int32);Argument[this];Argument[0];taint;manual |
+| System.IO;TextReader;Read;(System.Span);Argument[this];Argument[0];taint;manual |
+| System.IO;TextReader;ReadAsync;(System.Char[],System.Int32,System.Int32);Argument[this];Argument[0];taint;manual |
+| System.IO;TextReader;ReadAsync;(System.Memory,System.Threading.CancellationToken);Argument[this];Argument[0];taint;manual |
+| System.IO;TextReader;ReadBlock;(System.Char[],System.Int32,System.Int32);Argument[this];Argument[0];taint;manual |
+| System.IO;TextReader;ReadBlock;(System.Span);Argument[this];Argument[0];taint;manual |
+| System.IO;TextReader;ReadBlockAsync;(System.Char[],System.Int32,System.Int32);Argument[this];Argument[0];taint;manual |
+| System.IO;TextReader;ReadBlockAsync;(System.Memory,System.Threading.CancellationToken);Argument[this];Argument[0];taint;manual |
| System.IO;TextReader;ReadLine;();Argument[this];ReturnValue;taint;manual |
| System.IO;TextReader;ReadLineAsync;();Argument[this];ReturnValue;taint;manual |
| System.IO;TextReader;ReadLineAsync;(System.Threading.CancellationToken);Argument[this];ReturnValue;taint;df-generated |
@@ -16908,15 +16908,15 @@
| System;Convert;ChangeType;(System.Object,System.Type,System.IFormatProvider);Argument[0];ReturnValue;taint;manual |
| System;Convert;ChangeType;(System.Object,System.TypeCode);Argument[0];ReturnValue;taint;manual |
| System;Convert;ChangeType;(System.Object,System.TypeCode,System.IFormatProvider);Argument[0];ReturnValue;taint;manual |
-| System;Convert;FromBase64CharArray;(System.Char[],System.Int32,System.Int32);Argument[0].Element;ReturnValue.Element;taint;manual |
-| System;Convert;FromBase64String;(System.String);Argument[0];ReturnValue.Element;taint;manual |
-| System;Convert;FromHexString;(System.ReadOnlySpan);Argument[0].Element;ReturnValue.Element;taint;manual |
-| System;Convert;FromHexString;(System.String);Argument[0];ReturnValue.Element;taint;manual |
+| System;Convert;FromBase64CharArray;(System.Char[],System.Int32,System.Int32);Argument[0].Element;ReturnValue;taint;manual |
+| System;Convert;FromBase64String;(System.String);Argument[0];ReturnValue;taint;manual |
+| System;Convert;FromHexString;(System.ReadOnlySpan);Argument[0].Element;ReturnValue;taint;manual |
+| System;Convert;FromHexString;(System.String);Argument[0];ReturnValue;taint;manual |
| System;Convert;GetTypeCode;(System.Object);Argument[0];ReturnValue;taint;manual |
| System;Convert;IsDBNull;(System.Object);Argument[0];ReturnValue;taint;manual |
-| System;Convert;ToBase64CharArray;(System.Byte[],System.Int32,System.Int32,System.Char[],System.Int32);Argument[0].Element;Argument[3].Element;taint;manual |
+| System;Convert;ToBase64CharArray;(System.Byte[],System.Int32,System.Int32,System.Char[],System.Int32);Argument[0].Element;Argument[3];taint;manual |
| System;Convert;ToBase64CharArray;(System.Byte[],System.Int32,System.Int32,System.Char[],System.Int32);Argument[0].Element;ReturnValue;taint;manual |
-| System;Convert;ToBase64CharArray;(System.Byte[],System.Int32,System.Int32,System.Char[],System.Int32,System.Base64FormattingOptions);Argument[0].Element;Argument[3].Element;taint;manual |
+| System;Convert;ToBase64CharArray;(System.Byte[],System.Int32,System.Int32,System.Char[],System.Int32,System.Base64FormattingOptions);Argument[0].Element;Argument[3];taint;manual |
| System;Convert;ToBase64CharArray;(System.Byte[],System.Int32,System.Int32,System.Char[],System.Int32,System.Base64FormattingOptions);Argument[0].Element;ReturnValue;taint;manual |
| System;Convert;ToBase64String;(System.Byte[]);Argument[0].Element;ReturnValue;taint;manual |
| System;Convert;ToBase64String;(System.Byte[],System.Base64FormattingOptions);Argument[0].Element;ReturnValue;taint;manual |
@@ -17222,13 +17222,13 @@
| System;Convert;ToUInt64;(System.UInt16);Argument[0];ReturnValue;taint;manual |
| System;Convert;ToUInt64;(System.UInt32);Argument[0];ReturnValue;taint;manual |
| System;Convert;ToUInt64;(System.UInt64);Argument[0];ReturnValue;taint;manual |
-| System;Convert;TryFromBase64Chars;(System.ReadOnlySpan,System.Span,System.Int32);Argument[0].Element;Argument[1].Element;taint;manual |
+| System;Convert;TryFromBase64Chars;(System.ReadOnlySpan,System.Span,System.Int32);Argument[0].Element;Argument[1];taint;manual |
| System;Convert;TryFromBase64Chars;(System.ReadOnlySpan,System.Span,System.Int32);Argument[0].Element;Argument[2];taint;manual |
| System;Convert;TryFromBase64Chars;(System.ReadOnlySpan,System.Span,System.Int32);Argument[0].Element;ReturnValue;taint;manual |
-| System;Convert;TryFromBase64String;(System.String,System.Span,System.Int32);Argument[0];Argument[1].Element;taint;manual |
+| System;Convert;TryFromBase64String;(System.String,System.Span,System.Int32);Argument[0];Argument[1];taint;manual |
| System;Convert;TryFromBase64String;(System.String,System.Span,System.Int32);Argument[0];Argument[2];taint;manual |
| System;Convert;TryFromBase64String;(System.String,System.Span,System.Int32);Argument[0];ReturnValue;taint;manual |
-| System;Convert;TryToBase64Chars;(System.ReadOnlySpan,System.Span,System.Int32,System.Base64FormattingOptions);Argument[0].Element;Argument[1].Element;taint;manual |
+| System;Convert;TryToBase64Chars;(System.ReadOnlySpan,System.Span,System.Int32,System.Base64FormattingOptions);Argument[0].Element;Argument[1];taint;manual |
| System;Convert;TryToBase64Chars;(System.ReadOnlySpan,System.Span,System.Int32,System.Base64FormattingOptions);Argument[0].Element;Argument[2];taint;manual |
| System;Convert;TryToBase64Chars;(System.ReadOnlySpan,System.Span,System.Int32,System.Base64FormattingOptions);Argument[0].Element;ReturnValue;taint;manual |
| System;Converter;BeginInvoke;(TInput,System.AsyncCallback,System.Object);Argument[1];Argument[1].Parameter[delegate-self];value;hq-generated |
diff --git a/csharp/ql/test/library-tests/dataflow/threat-models/threat-models-flowtest1.expected b/csharp/ql/test/library-tests/dataflow/threat-models/threat-models-flowtest1.expected
index a3850dd73ebd..124caa4e69e4 100644
--- a/csharp/ql/test/library-tests/dataflow/threat-models/threat-models-flowtest1.expected
+++ b/csharp/ql/test/library-tests/dataflow/threat-models/threat-models-flowtest1.expected
@@ -1,30 +1,30 @@
models
| 1 | Sink: System.Data.SqlClient; SqlCommand; false; SqlCommand; (System.String,System.Data.SqlClient.SqlConnection); ; Argument[0]; sql-injection; manual |
| 2 | Source: System.Net.Sockets; TcpClient; false; GetStream; ; ; ReturnValue; remote; manual |
-| 3 | Summary: System.IO; Stream; true; Read; (System.Byte[],System.Int32,System.Int32); ; Argument[this]; Argument[0].Element; taint; manual |
+| 3 | Summary: System.IO; Stream; true; Read; (System.Byte[],System.Int32,System.Int32); ; Argument[this]; Argument[0]; taint; manual |
| 4 | Summary: System.Text; Encoding; true; GetString; (System.Byte[]); ; Argument[0].Element; ReturnValue; taint; manual |
edges
-| Test.cs:12:45:12:49 | bytes : Byte[] [element] : Object | Test.cs:15:56:15:60 | access to parameter bytes : Byte[] [element] : Object | provenance | |
-| Test.cs:15:56:15:60 | access to parameter bytes : Byte[] [element] : Object | Test.cs:15:20:15:61 | call to method GetString : String | provenance | MaD:4 |
+| Test.cs:12:45:12:49 | bytes : Byte[] | Test.cs:15:56:15:60 | access to parameter bytes : Byte[] | provenance | |
+| Test.cs:15:56:15:60 | access to parameter bytes : Byte[] | Test.cs:15:20:15:61 | call to method GetString : String | provenance | MaD:4 |
| Test.cs:23:33:23:38 | access to local variable stream : NetworkStream | Test.cs:25:29:25:34 | access to local variable stream : NetworkStream | provenance | |
| Test.cs:23:42:23:59 | call to method GetStream : NetworkStream | Test.cs:23:33:23:38 | access to local variable stream : NetworkStream | provenance | Src:MaD:2 |
-| Test.cs:25:29:25:34 | access to local variable stream : NetworkStream | Test.cs:25:41:25:46 | [post] access to local variable buffer : Byte[] [element] : Object | provenance | MaD:3 |
-| Test.cs:25:41:25:46 | [post] access to local variable buffer : Byte[] [element] : Object | Test.cs:28:99:28:104 | access to local variable buffer : Byte[] [element] : Object | provenance | |
+| Test.cs:25:29:25:34 | access to local variable stream : NetworkStream | Test.cs:25:41:25:46 | [post] access to local variable buffer : Byte[] | provenance | MaD:3 |
+| Test.cs:25:41:25:46 | [post] access to local variable buffer : Byte[] | Test.cs:28:99:28:104 | access to local variable buffer : Byte[] | provenance | |
| Test.cs:28:85:28:105 | call to method BytesToString : String | Test.cs:28:42:28:111 | ... + ... | provenance | Sink:MaD:1 |
-| Test.cs:28:99:28:104 | access to local variable buffer : Byte[] [element] : Object | Test.cs:12:45:12:49 | bytes : Byte[] [element] : Object | provenance | |
-| Test.cs:28:99:28:104 | access to local variable buffer : Byte[] [element] : Object | Test.cs:28:85:28:105 | call to method BytesToString : String | provenance | MaD:4 |
+| Test.cs:28:99:28:104 | access to local variable buffer : Byte[] | Test.cs:12:45:12:49 | bytes : Byte[] | provenance | |
+| Test.cs:28:99:28:104 | access to local variable buffer : Byte[] | Test.cs:28:85:28:105 | call to method BytesToString : String | provenance | MaD:4 |
nodes
-| Test.cs:12:45:12:49 | bytes : Byte[] [element] : Object | semmle.label | bytes : Byte[] [element] : Object |
+| Test.cs:12:45:12:49 | bytes : Byte[] | semmle.label | bytes : Byte[] |
| Test.cs:15:20:15:61 | call to method GetString : String | semmle.label | call to method GetString : String |
-| Test.cs:15:56:15:60 | access to parameter bytes : Byte[] [element] : Object | semmle.label | access to parameter bytes : Byte[] [element] : Object |
+| Test.cs:15:56:15:60 | access to parameter bytes : Byte[] | semmle.label | access to parameter bytes : Byte[] |
| Test.cs:23:33:23:38 | access to local variable stream : NetworkStream | semmle.label | access to local variable stream : NetworkStream |
| Test.cs:23:42:23:59 | call to method GetStream : NetworkStream | semmle.label | call to method GetStream : NetworkStream |
| Test.cs:25:29:25:34 | access to local variable stream : NetworkStream | semmle.label | access to local variable stream : NetworkStream |
-| Test.cs:25:41:25:46 | [post] access to local variable buffer : Byte[] [element] : Object | semmle.label | [post] access to local variable buffer : Byte[] [element] : Object |
+| Test.cs:25:41:25:46 | [post] access to local variable buffer : Byte[] | semmle.label | [post] access to local variable buffer : Byte[] |
| Test.cs:28:42:28:111 | ... + ... | semmle.label | ... + ... |
| Test.cs:28:85:28:105 | call to method BytesToString : String | semmle.label | call to method BytesToString : String |
-| Test.cs:28:99:28:104 | access to local variable buffer : Byte[] [element] : Object | semmle.label | access to local variable buffer : Byte[] [element] : Object |
+| Test.cs:28:99:28:104 | access to local variable buffer : Byte[] | semmle.label | access to local variable buffer : Byte[] |
subpaths
-| Test.cs:28:99:28:104 | access to local variable buffer : Byte[] [element] : Object | Test.cs:12:45:12:49 | bytes : Byte[] [element] : Object | Test.cs:15:20:15:61 | call to method GetString : String | Test.cs:28:85:28:105 | call to method BytesToString : String |
+| Test.cs:28:99:28:104 | access to local variable buffer : Byte[] | Test.cs:12:45:12:49 | bytes : Byte[] | Test.cs:15:20:15:61 | call to method GetString : String | Test.cs:28:85:28:105 | call to method BytesToString : String |
#select
| Test.cs:23:42:23:59 | call to method GetStream : NetworkStream | Test.cs:28:42:28:111 | ... + ... |
diff --git a/csharp/ql/test/library-tests/dataflow/threat-models/threat-models-flowtest2.expected b/csharp/ql/test/library-tests/dataflow/threat-models/threat-models-flowtest2.expected
index 9b1b32b57fda..d3ae7cc363d3 100644
--- a/csharp/ql/test/library-tests/dataflow/threat-models/threat-models-flowtest2.expected
+++ b/csharp/ql/test/library-tests/dataflow/threat-models/threat-models-flowtest2.expected
@@ -2,36 +2,36 @@ models
| 1 | Sink: System.Data.SqlClient; SqlCommand; false; SqlCommand; (System.String,System.Data.SqlClient.SqlConnection); ; Argument[0]; sql-injection; manual |
| 2 | Source: My.Qltest; TestSources; false; ExecuteQuery; (System.String); ; ReturnValue; database; manual |
| 3 | Source: System.Net.Sockets; TcpClient; false; GetStream; ; ; ReturnValue; remote; manual |
-| 4 | Summary: System.IO; Stream; true; Read; (System.Byte[],System.Int32,System.Int32); ; Argument[this]; Argument[0].Element; taint; manual |
+| 4 | Summary: System.IO; Stream; true; Read; (System.Byte[],System.Int32,System.Int32); ; Argument[this]; Argument[0]; taint; manual |
| 5 | Summary: System.Text; Encoding; true; GetString; (System.Byte[]); ; Argument[0].Element; ReturnValue; taint; manual |
edges
-| Test.cs:12:45:12:49 | bytes : Byte[] [element] : Object | Test.cs:15:56:15:60 | access to parameter bytes : Byte[] [element] : Object | provenance | |
-| Test.cs:15:56:15:60 | access to parameter bytes : Byte[] [element] : Object | Test.cs:15:20:15:61 | call to method GetString : String | provenance | MaD:5 |
+| Test.cs:12:45:12:49 | bytes : Byte[] | Test.cs:15:56:15:60 | access to parameter bytes : Byte[] | provenance | |
+| Test.cs:15:56:15:60 | access to parameter bytes : Byte[] | Test.cs:15:20:15:61 | call to method GetString : String | provenance | MaD:5 |
| Test.cs:23:33:23:38 | access to local variable stream : NetworkStream | Test.cs:25:29:25:34 | access to local variable stream : NetworkStream | provenance | |
| Test.cs:23:42:23:59 | call to method GetStream : NetworkStream | Test.cs:23:33:23:38 | access to local variable stream : NetworkStream | provenance | Src:MaD:3 |
-| Test.cs:25:29:25:34 | access to local variable stream : NetworkStream | Test.cs:25:41:25:46 | [post] access to local variable buffer : Byte[] [element] : Object | provenance | MaD:4 |
-| Test.cs:25:41:25:46 | [post] access to local variable buffer : Byte[] [element] : Object | Test.cs:28:99:28:104 | access to local variable buffer : Byte[] [element] : Object | provenance | |
+| Test.cs:25:29:25:34 | access to local variable stream : NetworkStream | Test.cs:25:41:25:46 | [post] access to local variable buffer : Byte[] | provenance | MaD:4 |
+| Test.cs:25:41:25:46 | [post] access to local variable buffer : Byte[] | Test.cs:28:99:28:104 | access to local variable buffer : Byte[] | provenance | |
| Test.cs:28:85:28:105 | call to method BytesToString : String | Test.cs:28:42:28:111 | ... + ... | provenance | Sink:MaD:1 |
-| Test.cs:28:99:28:104 | access to local variable buffer : Byte[] [element] : Object | Test.cs:12:45:12:49 | bytes : Byte[] [element] : Object | provenance | |
-| Test.cs:28:99:28:104 | access to local variable buffer : Byte[] [element] : Object | Test.cs:28:85:28:105 | call to method BytesToString : String | provenance | MaD:5 |
+| Test.cs:28:99:28:104 | access to local variable buffer : Byte[] | Test.cs:12:45:12:49 | bytes : Byte[] | provenance | |
+| Test.cs:28:99:28:104 | access to local variable buffer : Byte[] | Test.cs:28:85:28:105 | call to method BytesToString : String | provenance | MaD:5 |
| Test.cs:34:20:34:25 | access to local variable result : String | Test.cs:37:42:37:96 | ... + ... | provenance | Sink:MaD:1 |
| Test.cs:34:29:34:69 | call to method ExecuteQuery : String | Test.cs:34:20:34:25 | access to local variable result : String | provenance | Src:MaD:2 |
nodes
-| Test.cs:12:45:12:49 | bytes : Byte[] [element] : Object | semmle.label | bytes : Byte[] [element] : Object |
+| Test.cs:12:45:12:49 | bytes : Byte[] | semmle.label | bytes : Byte[] |
| Test.cs:15:20:15:61 | call to method GetString : String | semmle.label | call to method GetString : String |
-| Test.cs:15:56:15:60 | access to parameter bytes : Byte[] [element] : Object | semmle.label | access to parameter bytes : Byte[] [element] : Object |
+| Test.cs:15:56:15:60 | access to parameter bytes : Byte[] | semmle.label | access to parameter bytes : Byte[] |
| Test.cs:23:33:23:38 | access to local variable stream : NetworkStream | semmle.label | access to local variable stream : NetworkStream |
| Test.cs:23:42:23:59 | call to method GetStream : NetworkStream | semmle.label | call to method GetStream : NetworkStream |
| Test.cs:25:29:25:34 | access to local variable stream : NetworkStream | semmle.label | access to local variable stream : NetworkStream |
-| Test.cs:25:41:25:46 | [post] access to local variable buffer : Byte[] [element] : Object | semmle.label | [post] access to local variable buffer : Byte[] [element] : Object |
+| Test.cs:25:41:25:46 | [post] access to local variable buffer : Byte[] | semmle.label | [post] access to local variable buffer : Byte[] |
| Test.cs:28:42:28:111 | ... + ... | semmle.label | ... + ... |
| Test.cs:28:85:28:105 | call to method BytesToString : String | semmle.label | call to method BytesToString : String |
-| Test.cs:28:99:28:104 | access to local variable buffer : Byte[] [element] : Object | semmle.label | access to local variable buffer : Byte[] [element] : Object |
+| Test.cs:28:99:28:104 | access to local variable buffer : Byte[] | semmle.label | access to local variable buffer : Byte[] |
| Test.cs:34:20:34:25 | access to local variable result : String | semmle.label | access to local variable result : String |
| Test.cs:34:29:34:69 | call to method ExecuteQuery : String | semmle.label | call to method ExecuteQuery : String |
| Test.cs:37:42:37:96 | ... + ... | semmle.label | ... + ... |
subpaths
-| Test.cs:28:99:28:104 | access to local variable buffer : Byte[] [element] : Object | Test.cs:12:45:12:49 | bytes : Byte[] [element] : Object | Test.cs:15:20:15:61 | call to method GetString : String | Test.cs:28:85:28:105 | call to method BytesToString : String |
+| Test.cs:28:99:28:104 | access to local variable buffer : Byte[] | Test.cs:12:45:12:49 | bytes : Byte[] | Test.cs:15:20:15:61 | call to method GetString : String | Test.cs:28:85:28:105 | call to method BytesToString : String |
#select
| Test.cs:23:42:23:59 | call to method GetStream : NetworkStream | Test.cs:28:42:28:111 | ... + ... |
| Test.cs:34:29:34:69 | call to method ExecuteQuery : String | Test.cs:37:42:37:96 | ... + ... |
diff --git a/csharp/ql/test/library-tests/dataflow/threat-models/threat-models-flowtest3.expected b/csharp/ql/test/library-tests/dataflow/threat-models/threat-models-flowtest3.expected
index ee8d0615b2d4..ea0ab7943d25 100644
--- a/csharp/ql/test/library-tests/dataflow/threat-models/threat-models-flowtest3.expected
+++ b/csharp/ql/test/library-tests/dataflow/threat-models/threat-models-flowtest3.expected
@@ -4,18 +4,18 @@ models
| 3 | Source: My.Qltest; TestSources; false; GetCliArg; (System.Int32); ; ReturnValue; commandargs; manual |
| 4 | Source: My.Qltest; TestSources; false; ReadEnv; (System.String); ; ReturnValue; environment; manual |
| 5 | Source: System.Net.Sockets; TcpClient; false; GetStream; ; ; ReturnValue; remote; manual |
-| 6 | Summary: System.IO; Stream; true; Read; (System.Byte[],System.Int32,System.Int32); ; Argument[this]; Argument[0].Element; taint; manual |
+| 6 | Summary: System.IO; Stream; true; Read; (System.Byte[],System.Int32,System.Int32); ; Argument[this]; Argument[0]; taint; manual |
| 7 | Summary: System.Text; Encoding; true; GetString; (System.Byte[]); ; Argument[0].Element; ReturnValue; taint; manual |
edges
-| Test.cs:12:45:12:49 | bytes : Byte[] [element] : Object | Test.cs:15:56:15:60 | access to parameter bytes : Byte[] [element] : Object | provenance | |
-| Test.cs:15:56:15:60 | access to parameter bytes : Byte[] [element] : Object | Test.cs:15:20:15:61 | call to method GetString : String | provenance | MaD:7 |
+| Test.cs:12:45:12:49 | bytes : Byte[] | Test.cs:15:56:15:60 | access to parameter bytes : Byte[] | provenance | |
+| Test.cs:15:56:15:60 | access to parameter bytes : Byte[] | Test.cs:15:20:15:61 | call to method GetString : String | provenance | MaD:7 |
| Test.cs:23:33:23:38 | access to local variable stream : NetworkStream | Test.cs:25:29:25:34 | access to local variable stream : NetworkStream | provenance | |
| Test.cs:23:42:23:59 | call to method GetStream : NetworkStream | Test.cs:23:33:23:38 | access to local variable stream : NetworkStream | provenance | Src:MaD:5 |
-| Test.cs:25:29:25:34 | access to local variable stream : NetworkStream | Test.cs:25:41:25:46 | [post] access to local variable buffer : Byte[] [element] : Object | provenance | MaD:6 |
-| Test.cs:25:41:25:46 | [post] access to local variable buffer : Byte[] [element] : Object | Test.cs:28:99:28:104 | access to local variable buffer : Byte[] [element] : Object | provenance | |
+| Test.cs:25:29:25:34 | access to local variable stream : NetworkStream | Test.cs:25:41:25:46 | [post] access to local variable buffer : Byte[] | provenance | MaD:6 |
+| Test.cs:25:41:25:46 | [post] access to local variable buffer : Byte[] | Test.cs:28:99:28:104 | access to local variable buffer : Byte[] | provenance | |
| Test.cs:28:85:28:105 | call to method BytesToString : String | Test.cs:28:42:28:111 | ... + ... | provenance | Sink:MaD:1 |
-| Test.cs:28:99:28:104 | access to local variable buffer : Byte[] [element] : Object | Test.cs:12:45:12:49 | bytes : Byte[] [element] : Object | provenance | |
-| Test.cs:28:99:28:104 | access to local variable buffer : Byte[] [element] : Object | Test.cs:28:85:28:105 | call to method BytesToString : String | provenance | MaD:7 |
+| Test.cs:28:99:28:104 | access to local variable buffer : Byte[] | Test.cs:12:45:12:49 | bytes : Byte[] | provenance | |
+| Test.cs:28:99:28:104 | access to local variable buffer : Byte[] | Test.cs:28:85:28:105 | call to method BytesToString : String | provenance | MaD:7 |
| Test.cs:34:20:34:25 | access to local variable result : String | Test.cs:37:42:37:96 | ... + ... | provenance | Sink:MaD:1 |
| Test.cs:34:29:34:69 | call to method ExecuteQuery : String | Test.cs:34:20:34:25 | access to local variable result : String | provenance | Src:MaD:2 |
| Test.cs:43:20:43:25 | access to local variable result : String | Test.cs:46:42:46:96 | ... + ... | provenance | Sink:MaD:1 |
@@ -23,16 +23,16 @@ edges
| Test.cs:62:20:62:25 | access to local variable result : String | Test.cs:65:42:65:96 | ... + ... | provenance | Sink:MaD:1 |
| Test.cs:62:29:62:48 | call to method GetCliArg : String | Test.cs:62:20:62:25 | access to local variable result : String | provenance | Src:MaD:3 |
nodes
-| Test.cs:12:45:12:49 | bytes : Byte[] [element] : Object | semmle.label | bytes : Byte[] [element] : Object |
+| Test.cs:12:45:12:49 | bytes : Byte[] | semmle.label | bytes : Byte[] |
| Test.cs:15:20:15:61 | call to method GetString : String | semmle.label | call to method GetString : String |
-| Test.cs:15:56:15:60 | access to parameter bytes : Byte[] [element] : Object | semmle.label | access to parameter bytes : Byte[] [element] : Object |
+| Test.cs:15:56:15:60 | access to parameter bytes : Byte[] | semmle.label | access to parameter bytes : Byte[] |
| Test.cs:23:33:23:38 | access to local variable stream : NetworkStream | semmle.label | access to local variable stream : NetworkStream |
| Test.cs:23:42:23:59 | call to method GetStream : NetworkStream | semmle.label | call to method GetStream : NetworkStream |
| Test.cs:25:29:25:34 | access to local variable stream : NetworkStream | semmle.label | access to local variable stream : NetworkStream |
-| Test.cs:25:41:25:46 | [post] access to local variable buffer : Byte[] [element] : Object | semmle.label | [post] access to local variable buffer : Byte[] [element] : Object |
+| Test.cs:25:41:25:46 | [post] access to local variable buffer : Byte[] | semmle.label | [post] access to local variable buffer : Byte[] |
| Test.cs:28:42:28:111 | ... + ... | semmle.label | ... + ... |
| Test.cs:28:85:28:105 | call to method BytesToString : String | semmle.label | call to method BytesToString : String |
-| Test.cs:28:99:28:104 | access to local variable buffer : Byte[] [element] : Object | semmle.label | access to local variable buffer : Byte[] [element] : Object |
+| Test.cs:28:99:28:104 | access to local variable buffer : Byte[] | semmle.label | access to local variable buffer : Byte[] |
| Test.cs:34:20:34:25 | access to local variable result : String | semmle.label | access to local variable result : String |
| Test.cs:34:29:34:69 | call to method ExecuteQuery : String | semmle.label | call to method ExecuteQuery : String |
| Test.cs:37:42:37:96 | ... + ... | semmle.label | ... + ... |
@@ -43,7 +43,7 @@ nodes
| Test.cs:62:29:62:48 | call to method GetCliArg : String | semmle.label | call to method GetCliArg : String |
| Test.cs:65:42:65:96 | ... + ... | semmle.label | ... + ... |
subpaths
-| Test.cs:28:99:28:104 | access to local variable buffer : Byte[] [element] : Object | Test.cs:12:45:12:49 | bytes : Byte[] [element] : Object | Test.cs:15:20:15:61 | call to method GetString : String | Test.cs:28:85:28:105 | call to method BytesToString : String |
+| Test.cs:28:99:28:104 | access to local variable buffer : Byte[] | Test.cs:12:45:12:49 | bytes : Byte[] | Test.cs:15:20:15:61 | call to method GetString : String | Test.cs:28:85:28:105 | call to method BytesToString : String |
#select
| Test.cs:23:42:23:59 | call to method GetStream : NetworkStream | Test.cs:28:42:28:111 | ... + ... |
| Test.cs:34:29:34:69 | call to method ExecuteQuery : String | Test.cs:37:42:37:96 | ... + ... |
diff --git a/csharp/ql/test/library-tests/dataflow/threat-models/threat-models-flowtest4.expected b/csharp/ql/test/library-tests/dataflow/threat-models/threat-models-flowtest4.expected
index cac7f178b409..9648aa5e5eb7 100644
--- a/csharp/ql/test/library-tests/dataflow/threat-models/threat-models-flowtest4.expected
+++ b/csharp/ql/test/library-tests/dataflow/threat-models/threat-models-flowtest4.expected
@@ -5,18 +5,18 @@ models
| 4 | Source: My.Qltest; TestSources; false; GetCustom; (System.String); ; ReturnValue; custom; manual |
| 5 | Source: My.Qltest; TestSources; false; ReadEnv; (System.String); ; ReturnValue; environment; manual |
| 6 | Source: System.Net.Sockets; TcpClient; false; GetStream; ; ; ReturnValue; remote; manual |
-| 7 | Summary: System.IO; Stream; true; Read; (System.Byte[],System.Int32,System.Int32); ; Argument[this]; Argument[0].Element; taint; manual |
+| 7 | Summary: System.IO; Stream; true; Read; (System.Byte[],System.Int32,System.Int32); ; Argument[this]; Argument[0]; taint; manual |
| 8 | Summary: System.Text; Encoding; true; GetString; (System.Byte[]); ; Argument[0].Element; ReturnValue; taint; manual |
edges
-| Test.cs:12:45:12:49 | bytes : Byte[] [element] : Object | Test.cs:15:56:15:60 | access to parameter bytes : Byte[] [element] : Object | provenance | |
-| Test.cs:15:56:15:60 | access to parameter bytes : Byte[] [element] : Object | Test.cs:15:20:15:61 | call to method GetString : String | provenance | MaD:8 |
+| Test.cs:12:45:12:49 | bytes : Byte[] | Test.cs:15:56:15:60 | access to parameter bytes : Byte[] | provenance | |
+| Test.cs:15:56:15:60 | access to parameter bytes : Byte[] | Test.cs:15:20:15:61 | call to method GetString : String | provenance | MaD:8 |
| Test.cs:23:33:23:38 | access to local variable stream : NetworkStream | Test.cs:25:29:25:34 | access to local variable stream : NetworkStream | provenance | |
| Test.cs:23:42:23:59 | call to method GetStream : NetworkStream | Test.cs:23:33:23:38 | access to local variable stream : NetworkStream | provenance | Src:MaD:6 |
-| Test.cs:25:29:25:34 | access to local variable stream : NetworkStream | Test.cs:25:41:25:46 | [post] access to local variable buffer : Byte[] [element] : Object | provenance | MaD:7 |
-| Test.cs:25:41:25:46 | [post] access to local variable buffer : Byte[] [element] : Object | Test.cs:28:99:28:104 | access to local variable buffer : Byte[] [element] : Object | provenance | |
+| Test.cs:25:29:25:34 | access to local variable stream : NetworkStream | Test.cs:25:41:25:46 | [post] access to local variable buffer : Byte[] | provenance | MaD:7 |
+| Test.cs:25:41:25:46 | [post] access to local variable buffer : Byte[] | Test.cs:28:99:28:104 | access to local variable buffer : Byte[] | provenance | |
| Test.cs:28:85:28:105 | call to method BytesToString : String | Test.cs:28:42:28:111 | ... + ... | provenance | Sink:MaD:1 |
-| Test.cs:28:99:28:104 | access to local variable buffer : Byte[] [element] : Object | Test.cs:12:45:12:49 | bytes : Byte[] [element] : Object | provenance | |
-| Test.cs:28:99:28:104 | access to local variable buffer : Byte[] [element] : Object | Test.cs:28:85:28:105 | call to method BytesToString : String | provenance | MaD:8 |
+| Test.cs:28:99:28:104 | access to local variable buffer : Byte[] | Test.cs:12:45:12:49 | bytes : Byte[] | provenance | |
+| Test.cs:28:99:28:104 | access to local variable buffer : Byte[] | Test.cs:28:85:28:105 | call to method BytesToString : String | provenance | MaD:8 |
| Test.cs:34:20:34:25 | access to local variable result : String | Test.cs:37:42:37:96 | ... + ... | provenance | Sink:MaD:1 |
| Test.cs:34:29:34:69 | call to method ExecuteQuery : String | Test.cs:34:20:34:25 | access to local variable result : String | provenance | Src:MaD:2 |
| Test.cs:43:20:43:25 | access to local variable result : String | Test.cs:46:42:46:96 | ... + ... | provenance | Sink:MaD:1 |
@@ -26,16 +26,16 @@ edges
| Test.cs:62:20:62:25 | access to local variable result : String | Test.cs:65:42:65:96 | ... + ... | provenance | Sink:MaD:1 |
| Test.cs:62:29:62:48 | call to method GetCliArg : String | Test.cs:62:20:62:25 | access to local variable result : String | provenance | Src:MaD:3 |
nodes
-| Test.cs:12:45:12:49 | bytes : Byte[] [element] : Object | semmle.label | bytes : Byte[] [element] : Object |
+| Test.cs:12:45:12:49 | bytes : Byte[] | semmle.label | bytes : Byte[] |
| Test.cs:15:20:15:61 | call to method GetString : String | semmle.label | call to method GetString : String |
-| Test.cs:15:56:15:60 | access to parameter bytes : Byte[] [element] : Object | semmle.label | access to parameter bytes : Byte[] [element] : Object |
+| Test.cs:15:56:15:60 | access to parameter bytes : Byte[] | semmle.label | access to parameter bytes : Byte[] |
| Test.cs:23:33:23:38 | access to local variable stream : NetworkStream | semmle.label | access to local variable stream : NetworkStream |
| Test.cs:23:42:23:59 | call to method GetStream : NetworkStream | semmle.label | call to method GetStream : NetworkStream |
| Test.cs:25:29:25:34 | access to local variable stream : NetworkStream | semmle.label | access to local variable stream : NetworkStream |
-| Test.cs:25:41:25:46 | [post] access to local variable buffer : Byte[] [element] : Object | semmle.label | [post] access to local variable buffer : Byte[] [element] : Object |
+| Test.cs:25:41:25:46 | [post] access to local variable buffer : Byte[] | semmle.label | [post] access to local variable buffer : Byte[] |
| Test.cs:28:42:28:111 | ... + ... | semmle.label | ... + ... |
| Test.cs:28:85:28:105 | call to method BytesToString : String | semmle.label | call to method BytesToString : String |
-| Test.cs:28:99:28:104 | access to local variable buffer : Byte[] [element] : Object | semmle.label | access to local variable buffer : Byte[] [element] : Object |
+| Test.cs:28:99:28:104 | access to local variable buffer : Byte[] | semmle.label | access to local variable buffer : Byte[] |
| Test.cs:34:20:34:25 | access to local variable result : String | semmle.label | access to local variable result : String |
| Test.cs:34:29:34:69 | call to method ExecuteQuery : String | semmle.label | call to method ExecuteQuery : String |
| Test.cs:37:42:37:96 | ... + ... | semmle.label | ... + ... |
@@ -49,7 +49,7 @@ nodes
| Test.cs:62:29:62:48 | call to method GetCliArg : String | semmle.label | call to method GetCliArg : String |
| Test.cs:65:42:65:96 | ... + ... | semmle.label | ... + ... |
subpaths
-| Test.cs:28:99:28:104 | access to local variable buffer : Byte[] [element] : Object | Test.cs:12:45:12:49 | bytes : Byte[] [element] : Object | Test.cs:15:20:15:61 | call to method GetString : String | Test.cs:28:85:28:105 | call to method BytesToString : String |
+| Test.cs:28:99:28:104 | access to local variable buffer : Byte[] | Test.cs:12:45:12:49 | bytes : Byte[] | Test.cs:15:20:15:61 | call to method GetString : String | Test.cs:28:85:28:105 | call to method BytesToString : String |
#select
| Test.cs:23:42:23:59 | call to method GetStream : NetworkStream | Test.cs:28:42:28:111 | ... + ... |
| Test.cs:34:29:34:69 | call to method ExecuteQuery : String | Test.cs:37:42:37:96 | ... + ... |
diff --git a/csharp/ql/test/library-tests/dataflow/threat-models/threat-models-flowtest5.expected b/csharp/ql/test/library-tests/dataflow/threat-models/threat-models-flowtest5.expected
index b0e7142693f9..b13812650b84 100644
--- a/csharp/ql/test/library-tests/dataflow/threat-models/threat-models-flowtest5.expected
+++ b/csharp/ql/test/library-tests/dataflow/threat-models/threat-models-flowtest5.expected
@@ -3,33 +3,33 @@ models
| 2 | Source: My.Qltest; TestSources; false; GetCliArg; (System.Int32); ; ReturnValue; commandargs; manual |
| 3 | Source: My.Qltest; TestSources; false; ReadEnv; (System.String); ; ReturnValue; environment; manual |
| 4 | Source: System.Net.Sockets; TcpClient; false; GetStream; ; ; ReturnValue; remote; manual |
-| 5 | Summary: System.IO; Stream; true; Read; (System.Byte[],System.Int32,System.Int32); ; Argument[this]; Argument[0].Element; taint; manual |
+| 5 | Summary: System.IO; Stream; true; Read; (System.Byte[],System.Int32,System.Int32); ; Argument[this]; Argument[0]; taint; manual |
| 6 | Summary: System.Text; Encoding; true; GetString; (System.Byte[]); ; Argument[0].Element; ReturnValue; taint; manual |
edges
-| Test.cs:12:45:12:49 | bytes : Byte[] [element] : Object | Test.cs:15:56:15:60 | access to parameter bytes : Byte[] [element] : Object | provenance | |
-| Test.cs:15:56:15:60 | access to parameter bytes : Byte[] [element] : Object | Test.cs:15:20:15:61 | call to method GetString : String | provenance | MaD:6 |
+| Test.cs:12:45:12:49 | bytes : Byte[] | Test.cs:15:56:15:60 | access to parameter bytes : Byte[] | provenance | |
+| Test.cs:15:56:15:60 | access to parameter bytes : Byte[] | Test.cs:15:20:15:61 | call to method GetString : String | provenance | MaD:6 |
| Test.cs:23:33:23:38 | access to local variable stream : NetworkStream | Test.cs:25:29:25:34 | access to local variable stream : NetworkStream | provenance | |
| Test.cs:23:42:23:59 | call to method GetStream : NetworkStream | Test.cs:23:33:23:38 | access to local variable stream : NetworkStream | provenance | Src:MaD:4 |
-| Test.cs:25:29:25:34 | access to local variable stream : NetworkStream | Test.cs:25:41:25:46 | [post] access to local variable buffer : Byte[] [element] : Object | provenance | MaD:5 |
-| Test.cs:25:41:25:46 | [post] access to local variable buffer : Byte[] [element] : Object | Test.cs:28:99:28:104 | access to local variable buffer : Byte[] [element] : Object | provenance | |
+| Test.cs:25:29:25:34 | access to local variable stream : NetworkStream | Test.cs:25:41:25:46 | [post] access to local variable buffer : Byte[] | provenance | MaD:5 |
+| Test.cs:25:41:25:46 | [post] access to local variable buffer : Byte[] | Test.cs:28:99:28:104 | access to local variable buffer : Byte[] | provenance | |
| Test.cs:28:85:28:105 | call to method BytesToString : String | Test.cs:28:42:28:111 | ... + ... | provenance | Sink:MaD:1 |
-| Test.cs:28:99:28:104 | access to local variable buffer : Byte[] [element] : Object | Test.cs:12:45:12:49 | bytes : Byte[] [element] : Object | provenance | |
-| Test.cs:28:99:28:104 | access to local variable buffer : Byte[] [element] : Object | Test.cs:28:85:28:105 | call to method BytesToString : String | provenance | MaD:6 |
+| Test.cs:28:99:28:104 | access to local variable buffer : Byte[] | Test.cs:12:45:12:49 | bytes : Byte[] | provenance | |
+| Test.cs:28:99:28:104 | access to local variable buffer : Byte[] | Test.cs:28:85:28:105 | call to method BytesToString : String | provenance | MaD:6 |
| Test.cs:43:20:43:25 | access to local variable result : String | Test.cs:46:42:46:96 | ... + ... | provenance | Sink:MaD:1 |
| Test.cs:43:29:43:50 | call to method ReadEnv : String | Test.cs:43:20:43:25 | access to local variable result : String | provenance | Src:MaD:3 |
| Test.cs:62:20:62:25 | access to local variable result : String | Test.cs:65:42:65:96 | ... + ... | provenance | Sink:MaD:1 |
| Test.cs:62:29:62:48 | call to method GetCliArg : String | Test.cs:62:20:62:25 | access to local variable result : String | provenance | Src:MaD:2 |
nodes
-| Test.cs:12:45:12:49 | bytes : Byte[] [element] : Object | semmle.label | bytes : Byte[] [element] : Object |
+| Test.cs:12:45:12:49 | bytes : Byte[] | semmle.label | bytes : Byte[] |
| Test.cs:15:20:15:61 | call to method GetString : String | semmle.label | call to method GetString : String |
-| Test.cs:15:56:15:60 | access to parameter bytes : Byte[] [element] : Object | semmle.label | access to parameter bytes : Byte[] [element] : Object |
+| Test.cs:15:56:15:60 | access to parameter bytes : Byte[] | semmle.label | access to parameter bytes : Byte[] |
| Test.cs:23:33:23:38 | access to local variable stream : NetworkStream | semmle.label | access to local variable stream : NetworkStream |
| Test.cs:23:42:23:59 | call to method GetStream : NetworkStream | semmle.label | call to method GetStream : NetworkStream |
| Test.cs:25:29:25:34 | access to local variable stream : NetworkStream | semmle.label | access to local variable stream : NetworkStream |
-| Test.cs:25:41:25:46 | [post] access to local variable buffer : Byte[] [element] : Object | semmle.label | [post] access to local variable buffer : Byte[] [element] : Object |
+| Test.cs:25:41:25:46 | [post] access to local variable buffer : Byte[] | semmle.label | [post] access to local variable buffer : Byte[] |
| Test.cs:28:42:28:111 | ... + ... | semmle.label | ... + ... |
| Test.cs:28:85:28:105 | call to method BytesToString : String | semmle.label | call to method BytesToString : String |
-| Test.cs:28:99:28:104 | access to local variable buffer : Byte[] [element] : Object | semmle.label | access to local variable buffer : Byte[] [element] : Object |
+| Test.cs:28:99:28:104 | access to local variable buffer : Byte[] | semmle.label | access to local variable buffer : Byte[] |
| Test.cs:43:20:43:25 | access to local variable result : String | semmle.label | access to local variable result : String |
| Test.cs:43:29:43:50 | call to method ReadEnv : String | semmle.label | call to method ReadEnv : String |
| Test.cs:46:42:46:96 | ... + ... | semmle.label | ... + ... |
@@ -37,7 +37,7 @@ nodes
| Test.cs:62:29:62:48 | call to method GetCliArg : String | semmle.label | call to method GetCliArg : String |
| Test.cs:65:42:65:96 | ... + ... | semmle.label | ... + ... |
subpaths
-| Test.cs:28:99:28:104 | access to local variable buffer : Byte[] [element] : Object | Test.cs:12:45:12:49 | bytes : Byte[] [element] : Object | Test.cs:15:20:15:61 | call to method GetString : String | Test.cs:28:85:28:105 | call to method BytesToString : String |
+| Test.cs:28:99:28:104 | access to local variable buffer : Byte[] | Test.cs:12:45:12:49 | bytes : Byte[] | Test.cs:15:20:15:61 | call to method GetString : String | Test.cs:28:85:28:105 | call to method BytesToString : String |
#select
| Test.cs:23:42:23:59 | call to method GetStream : NetworkStream | Test.cs:28:42:28:111 | ... + ... |
| Test.cs:43:29:43:50 | call to method ReadEnv : String | Test.cs:46:42:46:96 | ... + ... |
diff --git a/csharp/ql/test/library-tests/dataflow/threat-models/threat-models-flowtest6.expected b/csharp/ql/test/library-tests/dataflow/threat-models/threat-models-flowtest6.expected
index ae9fccfab806..ccaa28dde3e5 100644
--- a/csharp/ql/test/library-tests/dataflow/threat-models/threat-models-flowtest6.expected
+++ b/csharp/ql/test/library-tests/dataflow/threat-models/threat-models-flowtest6.expected
@@ -3,33 +3,33 @@ models
| 2 | Source: My.Qltest; TestSources; false; ExecuteQuery; (System.String); ; ReturnValue; database; manual |
| 3 | Source: My.Qltest; TestSources; false; GetCliArg; (System.Int32); ; ReturnValue; commandargs; manual |
| 4 | Source: System.Net.Sockets; TcpClient; false; GetStream; ; ; ReturnValue; remote; manual |
-| 5 | Summary: System.IO; Stream; true; Read; (System.Byte[],System.Int32,System.Int32); ; Argument[this]; Argument[0].Element; taint; manual |
+| 5 | Summary: System.IO; Stream; true; Read; (System.Byte[],System.Int32,System.Int32); ; Argument[this]; Argument[0]; taint; manual |
| 6 | Summary: System.Text; Encoding; true; GetString; (System.Byte[]); ; Argument[0].Element; ReturnValue; taint; manual |
edges
-| Test.cs:12:45:12:49 | bytes : Byte[] [element] : Object | Test.cs:15:56:15:60 | access to parameter bytes : Byte[] [element] : Object | provenance | |
-| Test.cs:15:56:15:60 | access to parameter bytes : Byte[] [element] : Object | Test.cs:15:20:15:61 | call to method GetString : String | provenance | MaD:6 |
+| Test.cs:12:45:12:49 | bytes : Byte[] | Test.cs:15:56:15:60 | access to parameter bytes : Byte[] | provenance | |
+| Test.cs:15:56:15:60 | access to parameter bytes : Byte[] | Test.cs:15:20:15:61 | call to method GetString : String | provenance | MaD:6 |
| Test.cs:23:33:23:38 | access to local variable stream : NetworkStream | Test.cs:25:29:25:34 | access to local variable stream : NetworkStream | provenance | |
| Test.cs:23:42:23:59 | call to method GetStream : NetworkStream | Test.cs:23:33:23:38 | access to local variable stream : NetworkStream | provenance | Src:MaD:4 |
-| Test.cs:25:29:25:34 | access to local variable stream : NetworkStream | Test.cs:25:41:25:46 | [post] access to local variable buffer : Byte[] [element] : Object | provenance | MaD:5 |
-| Test.cs:25:41:25:46 | [post] access to local variable buffer : Byte[] [element] : Object | Test.cs:28:99:28:104 | access to local variable buffer : Byte[] [element] : Object | provenance | |
+| Test.cs:25:29:25:34 | access to local variable stream : NetworkStream | Test.cs:25:41:25:46 | [post] access to local variable buffer : Byte[] | provenance | MaD:5 |
+| Test.cs:25:41:25:46 | [post] access to local variable buffer : Byte[] | Test.cs:28:99:28:104 | access to local variable buffer : Byte[] | provenance | |
| Test.cs:28:85:28:105 | call to method BytesToString : String | Test.cs:28:42:28:111 | ... + ... | provenance | Sink:MaD:1 |
-| Test.cs:28:99:28:104 | access to local variable buffer : Byte[] [element] : Object | Test.cs:12:45:12:49 | bytes : Byte[] [element] : Object | provenance | |
-| Test.cs:28:99:28:104 | access to local variable buffer : Byte[] [element] : Object | Test.cs:28:85:28:105 | call to method BytesToString : String | provenance | MaD:6 |
+| Test.cs:28:99:28:104 | access to local variable buffer : Byte[] | Test.cs:12:45:12:49 | bytes : Byte[] | provenance | |
+| Test.cs:28:99:28:104 | access to local variable buffer : Byte[] | Test.cs:28:85:28:105 | call to method BytesToString : String | provenance | MaD:6 |
| Test.cs:34:20:34:25 | access to local variable result : String | Test.cs:37:42:37:96 | ... + ... | provenance | Sink:MaD:1 |
| Test.cs:34:29:34:69 | call to method ExecuteQuery : String | Test.cs:34:20:34:25 | access to local variable result : String | provenance | Src:MaD:2 |
| Test.cs:62:20:62:25 | access to local variable result : String | Test.cs:65:42:65:96 | ... + ... | provenance | Sink:MaD:1 |
| Test.cs:62:29:62:48 | call to method GetCliArg : String | Test.cs:62:20:62:25 | access to local variable result : String | provenance | Src:MaD:3 |
nodes
-| Test.cs:12:45:12:49 | bytes : Byte[] [element] : Object | semmle.label | bytes : Byte[] [element] : Object |
+| Test.cs:12:45:12:49 | bytes : Byte[] | semmle.label | bytes : Byte[] |
| Test.cs:15:20:15:61 | call to method GetString : String | semmle.label | call to method GetString : String |
-| Test.cs:15:56:15:60 | access to parameter bytes : Byte[] [element] : Object | semmle.label | access to parameter bytes : Byte[] [element] : Object |
+| Test.cs:15:56:15:60 | access to parameter bytes : Byte[] | semmle.label | access to parameter bytes : Byte[] |
| Test.cs:23:33:23:38 | access to local variable stream : NetworkStream | semmle.label | access to local variable stream : NetworkStream |
| Test.cs:23:42:23:59 | call to method GetStream : NetworkStream | semmle.label | call to method GetStream : NetworkStream |
| Test.cs:25:29:25:34 | access to local variable stream : NetworkStream | semmle.label | access to local variable stream : NetworkStream |
-| Test.cs:25:41:25:46 | [post] access to local variable buffer : Byte[] [element] : Object | semmle.label | [post] access to local variable buffer : Byte[] [element] : Object |
+| Test.cs:25:41:25:46 | [post] access to local variable buffer : Byte[] | semmle.label | [post] access to local variable buffer : Byte[] |
| Test.cs:28:42:28:111 | ... + ... | semmle.label | ... + ... |
| Test.cs:28:85:28:105 | call to method BytesToString : String | semmle.label | call to method BytesToString : String |
-| Test.cs:28:99:28:104 | access to local variable buffer : Byte[] [element] : Object | semmle.label | access to local variable buffer : Byte[] [element] : Object |
+| Test.cs:28:99:28:104 | access to local variable buffer : Byte[] | semmle.label | access to local variable buffer : Byte[] |
| Test.cs:34:20:34:25 | access to local variable result : String | semmle.label | access to local variable result : String |
| Test.cs:34:29:34:69 | call to method ExecuteQuery : String | semmle.label | call to method ExecuteQuery : String |
| Test.cs:37:42:37:96 | ... + ... | semmle.label | ... + ... |
@@ -37,7 +37,7 @@ nodes
| Test.cs:62:29:62:48 | call to method GetCliArg : String | semmle.label | call to method GetCliArg : String |
| Test.cs:65:42:65:96 | ... + ... | semmle.label | ... + ... |
subpaths
-| Test.cs:28:99:28:104 | access to local variable buffer : Byte[] [element] : Object | Test.cs:12:45:12:49 | bytes : Byte[] [element] : Object | Test.cs:15:20:15:61 | call to method GetString : String | Test.cs:28:85:28:105 | call to method BytesToString : String |
+| Test.cs:28:99:28:104 | access to local variable buffer : Byte[] | Test.cs:12:45:12:49 | bytes : Byte[] | Test.cs:15:20:15:61 | call to method GetString : String | Test.cs:28:85:28:105 | call to method BytesToString : String |
#select
| Test.cs:23:42:23:59 | call to method GetStream : NetworkStream | Test.cs:28:42:28:111 | ... + ... |
| Test.cs:34:29:34:69 | call to method ExecuteQuery : String | Test.cs:37:42:37:96 | ... + ... |
diff --git a/csharp/ql/test/library-tests/frameworks/microsoft/aspnetcore/blazor/Xss.expected b/csharp/ql/test/library-tests/frameworks/microsoft/aspnetcore/blazor/Xss.expected
index 3b9a54fafb3d..476875a279e5 100644
--- a/csharp/ql/test/library-tests/frameworks/microsoft/aspnetcore/blazor/Xss.expected
+++ b/csharp/ql/test/library-tests/frameworks/microsoft/aspnetcore/blazor/Xss.expected
@@ -1,6 +1,13 @@
+#select
+| Components_Pages_TestPage_razor.g.cs:138:15:138:22 | access to property UrlParam | Components_Pages_TestPage_razor.g.cs:138:15:138:22 | access to property UrlParam | Components_Pages_TestPage_razor.g.cs:138:15:138:22 | access to property UrlParam | $@ flows to here and is written to HTML or JavaScript. | Components_Pages_TestPage_razor.g.cs:138:15:138:22 | access to property UrlParam | User-provided value |
+| Components_Pages_TestPage_razor.g.cs:188:18:188:27 | access to property QueryParam | Components_Pages_TestPage_razor.g.cs:188:18:188:27 | access to property QueryParam | Components_Pages_TestPage_razor.g.cs:188:18:188:27 | access to property QueryParam | $@ flows to here and is written to HTML or JavaScript. | Components_Pages_TestPage_razor.g.cs:188:18:188:27 | access to property QueryParam | User-provided value |
+| Name.cs:13:53:13:59 | access to property TheName | NameList2.cs:31:57:31:60 | access to property Name : String | Name.cs:13:53:13:59 | access to property TheName | $@ flows to here and is written to HTML or JavaScript. | NameList2.cs:31:57:31:60 | access to property Name : String | User-provided value |
+| Name.cs:13:53:13:59 | access to property TheName | NameList.cs:31:99:31:102 | access to property Name : String | Name.cs:13:53:13:59 | access to property TheName | $@ flows to here and is written to HTML or JavaScript. | NameList.cs:31:99:31:102 | access to property Name : String | User-provided value |
edges
-| NameList2.cs:31:57:31:60 | access to property Name : String | Name.cs:13:53:13:59 | access to property TheName | provenance | Sink:MaD:149 |
-| NameList.cs:31:99:31:102 | access to property Name : String | Name.cs:13:53:13:59 | access to property TheName | provenance | Sink:MaD:149 |
+| NameList2.cs:31:57:31:60 | access to property Name : String | Name.cs:13:53:13:59 | access to property TheName | provenance | Sink:MaD:1 |
+| NameList.cs:31:99:31:102 | access to property Name : String | Name.cs:13:53:13:59 | access to property TheName | provenance | Sink:MaD:1 |
+models
+| 1 | Sink: Microsoft.AspNetCore.Components; MarkupString; false; op_Explicit; (System.String); ; Argument[0]; html-injection; manual |
nodes
| Components_Pages_TestPage_razor.g.cs:138:15:138:22 | access to property UrlParam | semmle.label | access to property UrlParam |
| Components_Pages_TestPage_razor.g.cs:188:18:188:27 | access to property QueryParam | semmle.label | access to property QueryParam |
@@ -8,8 +15,3 @@ nodes
| NameList2.cs:31:57:31:60 | access to property Name : String | semmle.label | access to property Name : String |
| NameList.cs:31:99:31:102 | access to property Name : String | semmle.label | access to property Name : String |
subpaths
-#select
-| Components_Pages_TestPage_razor.g.cs:138:15:138:22 | access to property UrlParam | Components_Pages_TestPage_razor.g.cs:138:15:138:22 | access to property UrlParam | Components_Pages_TestPage_razor.g.cs:138:15:138:22 | access to property UrlParam | $@ flows to here and is written to HTML or JavaScript. | Components_Pages_TestPage_razor.g.cs:138:15:138:22 | access to property UrlParam | User-provided value |
-| Components_Pages_TestPage_razor.g.cs:188:18:188:27 | access to property QueryParam | Components_Pages_TestPage_razor.g.cs:188:18:188:27 | access to property QueryParam | Components_Pages_TestPage_razor.g.cs:188:18:188:27 | access to property QueryParam | $@ flows to here and is written to HTML or JavaScript. | Components_Pages_TestPage_razor.g.cs:188:18:188:27 | access to property QueryParam | User-provided value |
-| Name.cs:13:53:13:59 | access to property TheName | NameList2.cs:31:57:31:60 | access to property Name : String | Name.cs:13:53:13:59 | access to property TheName | $@ flows to here and is written to HTML or JavaScript. | NameList2.cs:31:57:31:60 | access to property Name : String | User-provided value |
-| Name.cs:13:53:13:59 | access to property TheName | NameList.cs:31:99:31:102 | access to property Name : String | Name.cs:13:53:13:59 | access to property TheName | $@ flows to here and is written to HTML or JavaScript. | NameList.cs:31:99:31:102 | access to property Name : String | User-provided value |
diff --git a/csharp/ql/test/library-tests/frameworks/microsoft/aspnetcore/blazor/Xss.qlref b/csharp/ql/test/library-tests/frameworks/microsoft/aspnetcore/blazor/Xss.qlref
index faad1d6403c1..89b5b951bdb6 100644
--- a/csharp/ql/test/library-tests/frameworks/microsoft/aspnetcore/blazor/Xss.qlref
+++ b/csharp/ql/test/library-tests/frameworks/microsoft/aspnetcore/blazor/Xss.qlref
@@ -1 +1,2 @@
-Security Features/CWE-079/XSS.ql
\ No newline at end of file
+query: Security Features/CWE-079/XSS.ql
+postprocess: utils/test/PrettyPrintModels.ql
diff --git a/csharp/ql/test/library-tests/tainttracking/collections/CollectionTaintTracking.cs b/csharp/ql/test/library-tests/tainttracking/collections/CollectionTaintTracking.cs
new file mode 100644
index 000000000000..d4177a576616
--- /dev/null
+++ b/csharp/ql/test/library-tests/tainttracking/collections/CollectionTaintTracking.cs
@@ -0,0 +1,13 @@
+public class CollectionTaintTracking
+{
+ public void ImplicitCollectionReadAtSink()
+ {
+ var tainted = Source(1);
+ var arr = new object[] { tainted };
+ Sink(arr); // $ hasTaintFlow=1
+ }
+
+ static T Source(object source) => throw null;
+
+ public static void Sink(T t) { }
+}
diff --git a/csharp/ql/test/library-tests/tainttracking/collections/CollectionTaintTracking.expected b/csharp/ql/test/library-tests/tainttracking/collections/CollectionTaintTracking.expected
new file mode 100644
index 000000000000..6d93e7f5ef9f
--- /dev/null
+++ b/csharp/ql/test/library-tests/tainttracking/collections/CollectionTaintTracking.expected
@@ -0,0 +1,18 @@
+models
+edges
+| CollectionTaintTracking.cs:5:13:5:19 | access to local variable tainted : Object | CollectionTaintTracking.cs:6:34:6:40 | access to local variable tainted : Object | provenance | |
+| CollectionTaintTracking.cs:5:23:5:39 | call to method Source : Object | CollectionTaintTracking.cs:5:13:5:19 | access to local variable tainted : Object | provenance | |
+| CollectionTaintTracking.cs:6:13:6:15 | access to local variable arr : null [element] : Object | CollectionTaintTracking.cs:7:14:7:16 | access to local variable arr | provenance | |
+| CollectionTaintTracking.cs:6:32:6:42 | { ..., ... } : null [element] : Object | CollectionTaintTracking.cs:6:13:6:15 | access to local variable arr : null [element] : Object | provenance | |
+| CollectionTaintTracking.cs:6:34:6:40 | access to local variable tainted : Object | CollectionTaintTracking.cs:6:32:6:42 | { ..., ... } : null [element] : Object | provenance | |
+nodes
+| CollectionTaintTracking.cs:5:13:5:19 | access to local variable tainted : Object | semmle.label | access to local variable tainted : Object |
+| CollectionTaintTracking.cs:5:23:5:39 | call to method Source : Object | semmle.label | call to method Source : Object |
+| CollectionTaintTracking.cs:6:13:6:15 | access to local variable arr : null [element] : Object | semmle.label | access to local variable arr : null [element] : Object |
+| CollectionTaintTracking.cs:6:32:6:42 | { ..., ... } : null [element] : Object | semmle.label | { ..., ... } : null [element] : Object |
+| CollectionTaintTracking.cs:6:34:6:40 | access to local variable tainted : Object | semmle.label | access to local variable tainted : Object |
+| CollectionTaintTracking.cs:7:14:7:16 | access to local variable arr | semmle.label | access to local variable arr |
+subpaths
+testFailures
+#select
+| CollectionTaintTracking.cs:7:14:7:16 | access to local variable arr | CollectionTaintTracking.cs:5:23:5:39 | call to method Source : Object | CollectionTaintTracking.cs:7:14:7:16 | access to local variable arr | $@ | CollectionTaintTracking.cs:5:23:5:39 | call to method Source : Object | call to method Source : Object |
diff --git a/csharp/ql/test/library-tests/tainttracking/collections/CollectionTaintTracking.ql b/csharp/ql/test/library-tests/tainttracking/collections/CollectionTaintTracking.ql
new file mode 100644
index 000000000000..0af8971a13b2
--- /dev/null
+++ b/csharp/ql/test/library-tests/tainttracking/collections/CollectionTaintTracking.ql
@@ -0,0 +1,12 @@
+/**
+ * @kind path-problem
+ */
+
+import csharp
+import utils.test.InlineFlowTest
+import TaintFlowTest
+import PathGraph
+
+from PathNode source, PathNode sink
+where flowPath(source, sink)
+select sink, source, sink, "$@", source, source.toString()
diff --git a/csharp/ql/test/library-tests/tainttracking/collections/options b/csharp/ql/test/library-tests/tainttracking/collections/options
new file mode 100644
index 000000000000..75c39b4541ba
--- /dev/null
+++ b/csharp/ql/test/library-tests/tainttracking/collections/options
@@ -0,0 +1,2 @@
+semmle-extractor-options: /nostdlib /noconfig
+semmle-extractor-options: --load-sources-from-project:${testdir}/../../../resources/stubs/_frameworks/Microsoft.NETCore.App/Microsoft.NETCore.App.csproj
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserializationUntrustedInput/UnsafeDeserializationUntrustedInput.expected b/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserializationUntrustedInput/UnsafeDeserializationUntrustedInput.expected
index c3377fcb04f0..88d0baa49432 100644
--- a/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserializationUntrustedInput/UnsafeDeserializationUntrustedInput.expected
+++ b/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserializationUntrustedInput/UnsafeDeserializationUntrustedInput.expected
@@ -11,9 +11,9 @@ edges
| BinaryFormatterUntrustedInputBad.cs:13:48:13:83 | call to method GetBytes : Byte[] | BinaryFormatterUntrustedInputBad.cs:13:31:13:84 | object creation of type MemoryStream | provenance | MaD:1 |
| BinaryFormatterUntrustedInputBad.cs:13:71:13:77 | access to parameter textBox : TextBox | BinaryFormatterUntrustedInputBad.cs:13:71:13:82 | access to property Text : String | provenance | MaD:3 |
| BinaryFormatterUntrustedInputBad.cs:13:71:13:82 | access to property Text : String | BinaryFormatterUntrustedInputBad.cs:13:48:13:83 | call to method GetBytes : Byte[] | provenance | MaD:2 |
-| BinaryFormatterUntrustedInputBad.cs:23:48:23:82 | call to method FromBase64String : Byte[] [element] : Object | BinaryFormatterUntrustedInputBad.cs:23:31:23:83 | object creation of type MemoryStream | provenance | MaD:1 |
+| BinaryFormatterUntrustedInputBad.cs:23:48:23:82 | call to method FromBase64String : Byte[] | BinaryFormatterUntrustedInputBad.cs:23:31:23:83 | object creation of type MemoryStream | provenance | MaD:1 |
| BinaryFormatterUntrustedInputBad.cs:23:73:23:76 | access to parameter data : TextBox | BinaryFormatterUntrustedInputBad.cs:23:73:23:81 | access to property Text : String | provenance | MaD:3 |
-| BinaryFormatterUntrustedInputBad.cs:23:73:23:81 | access to property Text : String | BinaryFormatterUntrustedInputBad.cs:23:48:23:82 | call to method FromBase64String : Byte[] [element] : Object | provenance | MaD:4 |
+| BinaryFormatterUntrustedInputBad.cs:23:73:23:81 | access to property Text : String | BinaryFormatterUntrustedInputBad.cs:23:48:23:82 | call to method FromBase64String : Byte[] | provenance | MaD:4 |
| DataContractJsonSerializerUntrustedInputBad.cs:13:47:13:79 | call to method GetBytes : Byte[] | DataContractJsonSerializerUntrustedInputBad.cs:13:30:13:80 | object creation of type MemoryStream | provenance | MaD:1 |
| DataContractJsonSerializerUntrustedInputBad.cs:13:70:13:73 | access to parameter data : TextBox | DataContractJsonSerializerUntrustedInputBad.cs:13:70:13:78 | access to property Text : String | provenance | MaD:3 |
| DataContractJsonSerializerUntrustedInputBad.cs:13:70:13:78 | access to property Text : String | DataContractJsonSerializerUntrustedInputBad.cs:13:47:13:79 | call to method GetBytes : Byte[] | provenance | MaD:2 |
@@ -34,14 +34,14 @@ models
| 1 | Summary: System.IO; MemoryStream; false; MemoryStream; (System.Byte[]); ; Argument[0].Element; Argument[this]; taint; manual |
| 2 | Summary: System.Text; Encoding; true; GetBytes; (System.String); ; Argument[0]; ReturnValue; taint; manual |
| 3 | Summary: System.Web.UI.WebControls; TextBox; false; get_Text; (); ; Argument[this]; ReturnValue; taint; manual |
-| 4 | Summary: System; Convert; false; FromBase64String; (System.String); ; Argument[0]; ReturnValue.Element; taint; manual |
+| 4 | Summary: System; Convert; false; FromBase64String; (System.String); ; Argument[0]; ReturnValue; taint; manual |
nodes
| BinaryFormatterUntrustedInputBad.cs:13:31:13:84 | object creation of type MemoryStream | semmle.label | object creation of type MemoryStream |
| BinaryFormatterUntrustedInputBad.cs:13:48:13:83 | call to method GetBytes : Byte[] | semmle.label | call to method GetBytes : Byte[] |
| BinaryFormatterUntrustedInputBad.cs:13:71:13:77 | access to parameter textBox : TextBox | semmle.label | access to parameter textBox : TextBox |
| BinaryFormatterUntrustedInputBad.cs:13:71:13:82 | access to property Text : String | semmle.label | access to property Text : String |
| BinaryFormatterUntrustedInputBad.cs:23:31:23:83 | object creation of type MemoryStream | semmle.label | object creation of type MemoryStream |
-| BinaryFormatterUntrustedInputBad.cs:23:48:23:82 | call to method FromBase64String : Byte[] [element] : Object | semmle.label | call to method FromBase64String : Byte[] [element] : Object |
+| BinaryFormatterUntrustedInputBad.cs:23:48:23:82 | call to method FromBase64String : Byte[] | semmle.label | call to method FromBase64String : Byte[] |
| BinaryFormatterUntrustedInputBad.cs:23:73:23:76 | access to parameter data : TextBox | semmle.label | access to parameter data : TextBox |
| BinaryFormatterUntrustedInputBad.cs:23:73:23:81 | access to property Text : String | semmle.label | access to property Text : String |
| DataContractJsonSerializerUntrustedInputBad.cs:13:30:13:80 | object creation of type MemoryStream | semmle.label | object creation of type MemoryStream |
diff --git a/docs/codeql/codeql-for-visual-studio-code/setting-up-codeql-in-visual-studio-code.rst b/docs/codeql/codeql-for-visual-studio-code/setting-up-codeql-in-visual-studio-code.rst
index 94b291a69b83..3c2f44fcf15d 100644
--- a/docs/codeql/codeql-for-visual-studio-code/setting-up-codeql-in-visual-studio-code.rst
+++ b/docs/codeql/codeql-for-visual-studio-code/setting-up-codeql-in-visual-studio-code.rst
@@ -74,7 +74,7 @@ To use the starter workspace:
* Make sure you include the submodules, either by using ``git clone --recursive``, or using by ``git submodule update --init --remote`` after cloning.
* Use ``git submodule update --remote`` regularly to keep the submodules up to date.
-#. In VS Code, use the **File** > **Open Workspace** option to open the ``vscode-codeql-starter.code-workspace`` file from your checkout of the workspace repository.
+#. In VS Code, use the **File** > **Open Workspace from File** option to open the ``vscode-codeql-starter.code-workspace`` file from your checkout of the workspace repository.
Remember to update the ``ql`` submodule in the starter workspace periodically to ensure that it remains compatible with newer versions of the VS Code extension and the CodeQL CLI.
diff --git a/docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.22.4.rst b/docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.22.4.rst
new file mode 100644
index 000000000000..97dc83d41dab
--- /dev/null
+++ b/docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.22.4.rst
@@ -0,0 +1,108 @@
+.. _codeql-cli-2.22.4:
+
+==========================
+CodeQL 2.22.4 (2025-08-21)
+==========================
+
+.. contents:: Contents
+ :depth: 2
+ :local:
+ :backlinks: none
+
+This is an overview of changes in the CodeQL CLI and relevant CodeQL query and library packs. For additional updates on changes to the CodeQL code scanning experience, check out the `code scanning section on the GitHub blog `__, `relevant GitHub Changelog updates `__, `changes in the CodeQL extension for Visual Studio Code `__, and the `CodeQL Action changelog `__.
+
+Security Coverage
+-----------------
+
+CodeQL 2.22.4 runs a total of 478 security queries when configured with the Default suite (covering 169 CWE). The Extended suite enables an additional 130 queries (covering 32 more CWE). 2 security queries have been added with this release.
+
+CodeQL CLI
+----------
+
+There are no user-facing CLI changes in this release.
+
+Query Packs
+-----------
+
+Minor Analysis Improvements
+~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+C/C++
+"""""
+
+* The :code:`cpp/short-global-name` query will no longer give alerts for instantiations of template variables, only for the template itself.
+* Fixed a false positive in :code:`cpp/overflow-buffer` when the type of the destination buffer is a reference to a class/struct type.
+
+Golang
+""""""
+
+* Go 1.25 is now supported.
+
+JavaScript/TypeScript
+"""""""""""""""""""""
+
+* The :code:`js/regex-injection` query no longer considers environment variables as sources by default. Environment variables can be re-enabled as sources by setting the threat model to include the "environment" category.
+
+New Queries
+~~~~~~~~~~~
+
+Rust
+""""
+
+* Added a new query, :code:`rust/cleartext-storage-database`, for detecting cases where sensitive information is stored non-encrypted in a database.
+
+Language Libraries
+------------------
+
+Bug Fixes
+~~~~~~~~~
+
+Ruby
+""""
+
+* Made the following changes to :code:`NetHttpRequest`
+
+ * Adds :code:`connectionNode`, like other Ruby HTTP clients
+ * Makes :code:`requestNode` and :code:`connectionNode` public so subclasses can use them
+ * Adds detection of :code:`Net::HTTP.start`, a common way to make HTTP requests in Ruby
+
+Major Analysis Improvements
+~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Java/Kotlin
+"""""""""""
+
+* Added library models for the relevant method calls under :code:`jakarta.servlet.ServletRequest` and :code:`jakarta.servlet.http.HttpServletRequest` as remote flow sources.
+
+Minor Analysis Improvements
+~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+C/C++
+"""""
+
+* The guards libraries (:code:`semmle.code.cpp.controlflow.Guards` and :code:`semmle.code.cpp.controlflow.IRGuards`) have been improved to recognize more guards.
+* Improved dataflow through global variables in the new dataflow library (:code:`semmle.code.cpp.dataflow.new.DataFlow` and :code:`semmle.code.cpp.dataflow.new.TaintTracking`). Queries based on these libraries will produce more results on codebases with many global variables.
+* The global value numbering library (:code:`semmle.code.cpp.valuenumbering.GlobalValueNumbering` and :code:`semmle.code.cpp.ir.ValueNumbering`) has been improved so more expressions are assigned the same value number.
+
+Java/Kotlin
+"""""""""""
+
+* Guard implication logic involving wrapper methods has been improved. In particular, this means fewer false positives for :code:`java/dereferenced-value-may-be-null`.
+
+JavaScript/TypeScript
+"""""""""""""""""""""
+
+* Improved modeling of command-line argument parsing libraries `arg `__, `args `__, `command-line-args `__ and `commander `__
+
+Rust
+""""
+
+* |link-code-let-chains-in-code-if-and-code-while-1|_ are now supported, as well as |link-code-if-let-guards-in-code-match-expressions-2|_.
+* Added more detail to models of :code:`postgres`, :code:`rusqlite`, :code:`sqlx` and :code:`tokio-postgres`. This may improve query results, particularly for :code:`rust/sql-injection` and :code:`rust/cleartext-storage-database`.
+
+.. |link-code-let-chains-in-code-if-and-code-while-1| replace:: :code:`let` chains in :code:`if` and :code:`while`\
+.. _link-code-let-chains-in-code-if-and-code-while-1: https://doc.rust-lang.org/edition-guide/rust-2024/let-chains.html
+
+.. |link-code-if-let-guards-in-code-match-expressions-2| replace:: :code:`if let` guards in :code:`match` expressions
+.. _link-code-if-let-guards-in-code-match-expressions-2: https://rust-lang.github.io/rfcs/2294-if-let-guard.html
+
diff --git a/docs/codeql/codeql-overview/codeql-changelog/index.rst b/docs/codeql/codeql-overview/codeql-changelog/index.rst
index dcf6c7bcba02..c47ae0a688e4 100644
--- a/docs/codeql/codeql-overview/codeql-changelog/index.rst
+++ b/docs/codeql/codeql-overview/codeql-changelog/index.rst
@@ -11,6 +11,7 @@ A list of queries for each suite and language `is available here `, ambiguity between aliases from
for the same module/type/predicate is allowed, but ambiguity between between aliases from distinct **strong**
alias definitions is invalid QL.
Likewise, for the purpose of applicative instantiation of :ref:`parameterised modules `
-and `:ref:`parameterised module signatures `, aliases from **weak** alias
+and :ref:`parameterised module signatures `, aliases from **weak** alias
definitions for instantiation arguments do not result in separate instantiations, but aliases from **strong**
alias definitions for instantiation arguments do.
diff --git a/go/extractor/go.mod b/go/extractor/go.mod
index 8ec7ec72fc27..a23183400d0e 100644
--- a/go/extractor/go.mod
+++ b/go/extractor/go.mod
@@ -9,8 +9,8 @@ toolchain go1.25.0
// when adding or removing dependencies, run
// bazel mod tidy
require (
- golang.org/x/mod v0.26.0
- golang.org/x/tools v0.35.0
+ golang.org/x/mod v0.27.0
+ golang.org/x/tools v0.36.0
)
require golang.org/x/sync v0.16.0 // indirect
diff --git a/go/extractor/go.sum b/go/extractor/go.sum
index 58f0d0b933bb..e1a8435ba51c 100644
--- a/go/extractor/go.sum
+++ b/go/extractor/go.sum
@@ -1,8 +1,8 @@
github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-golang.org/x/mod v0.26.0 h1:EGMPT//Ezu+ylkCijjPc+f4Aih7sZvaAr+O3EHBxvZg=
-golang.org/x/mod v0.26.0/go.mod h1:/j6NAhSk8iQ723BGAUyoAcn7SlD7s15Dp9Nd/SfeaFQ=
+golang.org/x/mod v0.27.0 h1:kb+q2PyFnEADO2IEF935ehFUXlWiNjJWtRNgBLSfbxQ=
+golang.org/x/mod v0.27.0/go.mod h1:rWI627Fq0DEoudcK+MBkNkCe0EetEaDSwJJkCcjpazc=
golang.org/x/sync v0.16.0 h1:ycBJEhp9p4vXvUZNszeOq0kGTPghopOL8q0fq3vstxw=
golang.org/x/sync v0.16.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
-golang.org/x/tools v0.35.0 h1:mBffYraMEf7aa0sB+NuKnuCy8qI/9Bughn8dC2Gu5r0=
-golang.org/x/tools v0.35.0/go.mod h1:NKdj5HkL/73byiZSJjqJgKn3ep7KjFkBOkR/Hps3VPw=
+golang.org/x/tools v0.36.0 h1:kWS0uv/zsvHEle1LbV5LE8QujrxB3wfQyxHfhOk0Qkg=
+golang.org/x/tools v0.36.0/go.mod h1:WBDiHKJK8YgLHlcQPYQzNCkUxUypCaa5ZegCVutKm+s=
diff --git a/go/ql/consistency-queries/qlpack.yml b/go/ql/consistency-queries/qlpack.yml
index ccfc15b01972..2cac181bfb5d 100644
--- a/go/ql/consistency-queries/qlpack.yml
+++ b/go/ql/consistency-queries/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql-go-consistency-queries
-version: 1.0.29
+version: 1.0.30-dev
groups:
- go
- queries
diff --git a/go/ql/lib/qlpack.yml b/go/ql/lib/qlpack.yml
index 7799e61ca856..2658d54432fb 100644
--- a/go/ql/lib/qlpack.yml
+++ b/go/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/go-all
-version: 4.3.2
+version: 4.3.3-dev
groups: go
dbscheme: go.dbscheme
extractor: go
diff --git a/go/ql/src/qlpack.yml b/go/ql/src/qlpack.yml
index d468ea88ecad..8c8c36a4fc70 100644
--- a/go/ql/src/qlpack.yml
+++ b/go/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/go-queries
-version: 1.4.3
+version: 1.4.4-dev
groups:
- go
- queries
diff --git a/java/documentation/library-coverage/coverage.csv b/java/documentation/library-coverage/coverage.csv
index 7ec0b4c5f0fc..1d1f9a1545ec 100644
--- a/java/documentation/library-coverage/coverage.csv
+++ b/java/documentation/library-coverage/coverage.csv
@@ -76,7 +76,7 @@ jakarta.activation,2,,2,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,1,,,,,,,,,,,,,,,,2,
jakarta.faces.context,4,7,,,,,,,,,,,,,,2,,,,,,,,,,,2,,,,,,,,,,,,,,,,,,,,,,,,7,,
jakarta.json,,,123,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,100,23
jakarta.persistence,2,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,,,,,,1,
-jakarta.servlet,2,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,1,,
+jakarta.servlet,2,19,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,19,,
jakarta.ws.rs.client,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,
jakarta.ws.rs.container,,9,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,9,,
jakarta.ws.rs.core,2,,149,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,94,55
diff --git a/java/documentation/library-coverage/coverage.rst b/java/documentation/library-coverage/coverage.rst
index aa6a3f2c1713..d70f9c2f463d 100644
--- a/java/documentation/library-coverage/coverage.rst
+++ b/java/documentation/library-coverage/coverage.rst
@@ -19,9 +19,9 @@ Java framework & library support
JBoss Logging,``org.jboss.logging``,,,324,,,,,,
`JSON-java `_,``org.json``,,236,,,,,,,
Java Standard Library,``java.*``,10,4621,260,99,,9,,,26
- Java extensions,"``javax.*``, ``jakarta.*``",69,4159,90,10,4,2,1,1,4
+ Java extensions,"``javax.*``, ``jakarta.*``",87,4159,90,10,4,2,1,1,4
Kotlin Standard Library,``kotlin*``,,1849,16,14,,,,,2
`Spring `_,``org.springframework.*``,38,486,143,26,,28,14,,35
Others,"``actions.osgi``, ``antlr``, ``ch.ethz.ssh2``, ``cn.hutool.core.codec``, ``com.alibaba.com.caucho.hessian.io``, ``com.alibaba.druid.sql``, ``com.alibaba.fastjson2``, ``com.amazonaws.auth``, ``com.auth0.jwt.algorithms``, ``com.azure.identity``, ``com.caucho.burlap.io``, ``com.caucho.hessian.io``, ``com.cedarsoftware.util.io``, ``com.esotericsoftware.kryo.io``, ``com.esotericsoftware.kryo5.io``, ``com.esotericsoftware.yamlbeans``, ``com.fasterxml.jackson.core``, ``com.fasterxml.jackson.databind``, ``com.google.gson``, ``com.hubspot.jinjava``, ``com.jcraft.jsch``, ``com.microsoft.sqlserver.jdbc``, ``com.mitchellbosecke.pebble``, ``com.mongodb``, ``com.opensymphony.xwork2``, ``com.rabbitmq.client``, ``com.sshtools.j2ssh.authentication``, ``com.sun.crypto.provider``, ``com.sun.jndi.ldap``, ``com.sun.net.httpserver``, ``com.sun.net.ssl``, ``com.sun.rowset``, ``com.sun.security.auth.module``, ``com.sun.security.ntlm``, ``com.sun.security.sasl.digest``, ``com.thoughtworks.xstream``, ``com.trilead.ssh2``, ``com.unboundid.ldap.sdk``, ``com.zaxxer.hikari``, ``flexjson``, ``freemarker.cache``, ``freemarker.template``, ``groovy.lang``, ``groovy.text``, ``groovy.util``, ``hudson``, ``io.jsonwebtoken``, ``io.netty.bootstrap``, ``io.netty.buffer``, ``io.netty.channel``, ``io.netty.handler.codec``, ``io.netty.handler.ssl``, ``io.netty.handler.stream``, ``io.netty.resolver``, ``io.netty.util``, ``io.undertow.server.handlers.resource``, ``javafx.scene.web``, ``jenkins``, ``jodd.json``, ``liquibase.database.jvm``, ``liquibase.statement.core``, ``net.lingala.zip4j``, ``net.schmizz.sshj``, ``net.sf.json``, ``net.sf.saxon.s9api``, ``ognl``, ``okhttp3``, ``org.acegisecurity``, ``org.antlr.runtime``, ``org.apache.commons.codec``, ``org.apache.commons.compress.archivers.tar``, ``org.apache.commons.exec``, ``org.apache.commons.httpclient.util``, ``org.apache.commons.jelly``, ``org.apache.commons.jexl2``, ``org.apache.commons.jexl3``, ``org.apache.commons.lang``, ``org.apache.commons.logging``, ``org.apache.commons.net``, ``org.apache.commons.ognl``, ``org.apache.cxf.catalog``, ``org.apache.cxf.common.classloader``, ``org.apache.cxf.common.jaxb``, ``org.apache.cxf.common.logging``, ``org.apache.cxf.configuration.jsse``, ``org.apache.cxf.helpers``, ``org.apache.cxf.resource``, ``org.apache.cxf.staxutils``, ``org.apache.cxf.tools.corba.utils``, ``org.apache.cxf.tools.util``, ``org.apache.cxf.transform``, ``org.apache.directory.ldap.client.api``, ``org.apache.hadoop.fs``, ``org.apache.hadoop.hive.metastore``, ``org.apache.hadoop.hive.ql.exec``, ``org.apache.hadoop.hive.ql.metadata``, ``org.apache.hc.client5.http.async.methods``, ``org.apache.hc.client5.http.classic.methods``, ``org.apache.hc.client5.http.fluent``, ``org.apache.hive.hcatalog.templeton``, ``org.apache.ibatis.jdbc``, ``org.apache.ibatis.mapping``, ``org.apache.log4j``, ``org.apache.shiro.authc``, ``org.apache.shiro.codec``, ``org.apache.shiro.jndi``, ``org.apache.shiro.mgt``, ``org.apache.sshd.client.session``, ``org.apache.struts.beanvalidation.validation.interceptor``, ``org.apache.struts2``, ``org.apache.tools.ant``, ``org.apache.tools.zip``, ``org.apache.velocity.app``, ``org.apache.velocity.runtime``, ``org.codehaus.cargo.container.installer``, ``org.codehaus.groovy.control``, ``org.dom4j``, ``org.eclipse.jetty.client``, ``org.exolab.castor.xml``, ``org.fusesource.leveldbjni``, ``org.geogebra.web.full.main``, ``org.gradle.api.file``, ``org.hibernate``, ``org.ho.yaml``, ``org.influxdb``, ``org.jabsorb``, ``org.jboss.vfs``, ``org.jdbi.v3.core``, ``org.jenkins.ui.icon``, ``org.jenkins.ui.symbol``, ``org.jooq``, ``org.keycloak.models.map.storage``, ``org.kohsuke.stapler``, ``org.lastaflute.web``, ``org.mvel2``, ``org.openjdk.jmh.runner.options``, ``org.owasp.esapi``, ``org.pac4j.jwt.config.encryption``, ``org.pac4j.jwt.config.signature``, ``org.scijava.log``, ``org.slf4j``, ``org.thymeleaf``, ``org.xml.sax``, ``org.xmlpull.v1``, ``org.yaml.snakeyaml``, ``play.libs.ws``, ``play.mvc``, ``ratpack.core.form``, ``ratpack.core.handling``, ``ratpack.core.http``, ``ratpack.exec``, ``ratpack.form``, ``ratpack.func``, ``ratpack.handling``, ``ratpack.http``, ``ratpack.util``, ``retrofit2``, ``software.amazon.awssdk.transfer.s3.model``, ``sun.jvmstat.perfdata.monitor.protocol.local``, ``sun.jvmstat.perfdata.monitor.protocol.rmi``, ``sun.misc``, ``sun.net.ftp``, ``sun.net.www.protocol.http``, ``sun.security.acl``, ``sun.security.jgss.krb5``, ``sun.security.krb5``, ``sun.security.pkcs``, ``sun.security.pkcs11``, ``sun.security.provider``, ``sun.security.ssl``, ``sun.security.x509``, ``sun.tools.jconsole``",133,10525,927,140,6,22,18,,208
- Totals,,312,26328,2656,404,16,128,33,1,409
+ Totals,,330,26328,2656,404,16,128,33,1,409
diff --git a/java/ql/integration-tests/java/query-suite/java-code-quality-extended.qls.expected b/java/ql/integration-tests/java/query-suite/java-code-quality-extended.qls.expected
index 7a1a986b2aa1..852389b950b5 100644
--- a/java/ql/integration-tests/java/query-suite/java-code-quality-extended.qls.expected
+++ b/java/ql/integration-tests/java/query-suite/java-code-quality-extended.qls.expected
@@ -73,6 +73,7 @@ ql/java/ql/src/Violations of Best Practice/Exception Handling/IgnoreExceptionalR
ql/java/ql/src/Violations of Best Practice/Exception Handling/NumberFormatException.ql
ql/java/ql/src/Violations of Best Practice/Implementation Hiding/AbstractToConcreteCollection.ql
ql/java/ql/src/Violations of Best Practice/Implementation Hiding/ExposeRepresentation.ql
+ql/java/ql/src/Violations of Best Practice/Implementation Hiding/VisibleForTestingAbuse.ql
ql/java/ql/src/Violations of Best Practice/Naming Conventions/AmbiguousOuterSuper.ql
ql/java/ql/src/Violations of Best Practice/Naming Conventions/ConfusingMethodNames.ql
ql/java/ql/src/Violations of Best Practice/Naming Conventions/ConfusingOverloading.ql
@@ -80,7 +81,10 @@ ql/java/ql/src/Violations of Best Practice/Naming Conventions/LocalShadowsFieldC
ql/java/ql/src/Violations of Best Practice/Naming Conventions/SameNameAsSuper.ql
ql/java/ql/src/Violations of Best Practice/Records/IgnoredSerializationMembersOfRecordClass.ql
ql/java/ql/src/Violations of Best Practice/SpecialCharactersInLiterals/NonExplicitControlAndWhitespaceCharsInLiterals.ql
+ql/java/ql/src/Violations of Best Practice/Testing/ExcessivePublicMethodMocking.ql
+ql/java/ql/src/Violations of Best Practice/Undesirable Calls/CallsToRunFinalizersOnExit.ql
ql/java/ql/src/Violations of Best Practice/Undesirable Calls/CallsToStringToString.ql
+ql/java/ql/src/Violations of Best Practice/Undesirable Calls/CallsToSystemExit.ql
ql/java/ql/src/Violations of Best Practice/Undesirable Calls/DefaultToString.ql
ql/java/ql/src/Violations of Best Practice/Undesirable Calls/DoNotCallFinalize.ql
ql/java/ql/src/Violations of Best Practice/Undesirable Calls/PrintLnArray.ql
diff --git a/java/ql/integration-tests/java/query-suite/java-code-quality.qls.expected b/java/ql/integration-tests/java/query-suite/java-code-quality.qls.expected
index 17253dbe0f89..eb502feb6bac 100644
--- a/java/ql/integration-tests/java/query-suite/java-code-quality.qls.expected
+++ b/java/ql/integration-tests/java/query-suite/java-code-quality.qls.expected
@@ -71,6 +71,7 @@ ql/java/ql/src/Violations of Best Practice/Exception Handling/IgnoreExceptionalR
ql/java/ql/src/Violations of Best Practice/Exception Handling/NumberFormatException.ql
ql/java/ql/src/Violations of Best Practice/Implementation Hiding/AbstractToConcreteCollection.ql
ql/java/ql/src/Violations of Best Practice/Implementation Hiding/ExposeRepresentation.ql
+ql/java/ql/src/Violations of Best Practice/Implementation Hiding/VisibleForTestingAbuse.ql
ql/java/ql/src/Violations of Best Practice/Naming Conventions/AmbiguousOuterSuper.ql
ql/java/ql/src/Violations of Best Practice/Naming Conventions/ConfusingMethodNames.ql
ql/java/ql/src/Violations of Best Practice/Naming Conventions/ConfusingOverloading.ql
@@ -78,6 +79,7 @@ ql/java/ql/src/Violations of Best Practice/Naming Conventions/LocalShadowsFieldC
ql/java/ql/src/Violations of Best Practice/Naming Conventions/SameNameAsSuper.ql
ql/java/ql/src/Violations of Best Practice/Records/IgnoredSerializationMembersOfRecordClass.ql
ql/java/ql/src/Violations of Best Practice/SpecialCharactersInLiterals/NonExplicitControlAndWhitespaceCharsInLiterals.ql
+ql/java/ql/src/Violations of Best Practice/Testing/ExcessivePublicMethodMocking.ql
ql/java/ql/src/Violations of Best Practice/Undesirable Calls/CallsToStringToString.ql
ql/java/ql/src/Violations of Best Practice/Undesirable Calls/DefaultToString.ql
ql/java/ql/src/Violations of Best Practice/Undesirable Calls/DoNotCallFinalize.ql
diff --git a/java/ql/integration-tests/java/query-suite/java-code-scanning.qls.expected b/java/ql/integration-tests/java/query-suite/java-code-scanning.qls.expected
index 3290e0d84b0e..afa6cebba311 100644
--- a/java/ql/integration-tests/java/query-suite/java-code-scanning.qls.expected
+++ b/java/ql/integration-tests/java/query-suite/java-code-scanning.qls.expected
@@ -27,6 +27,7 @@ ql/java/ql/src/Security/CWE/CWE-113/ResponseSplitting.ql
ql/java/ql/src/Security/CWE/CWE-1204/StaticInitializationVector.ql
ql/java/ql/src/Security/CWE/CWE-134/ExternallyControlledFormatString.ql
ql/java/ql/src/Security/CWE/CWE-200/SpringBootActuators.ql
+ql/java/ql/src/Security/CWE/CWE-200/SpringBootActuatorsConfig/SpringBootActuatorsConfig.ql
ql/java/ql/src/Security/CWE/CWE-209/SensitiveDataExposureThroughErrorMessage.ql
ql/java/ql/src/Security/CWE/CWE-209/StackTraceExposure.ql
ql/java/ql/src/Security/CWE/CWE-266/IntentUriPermissionManipulation.ql
diff --git a/java/ql/integration-tests/java/query-suite/java-security-and-quality.qls.expected b/java/ql/integration-tests/java/query-suite/java-security-and-quality.qls.expected
index f4317f8e2a5c..f5470c463c30 100644
--- a/java/ql/integration-tests/java/query-suite/java-security-and-quality.qls.expected
+++ b/java/ql/integration-tests/java/query-suite/java-security-and-quality.qls.expected
@@ -143,6 +143,7 @@ ql/java/ql/src/Security/CWE/CWE-200/AndroidSensitiveTextField.ql
ql/java/ql/src/Security/CWE/CWE-200/AndroidWebViewSettingsAllowsContentAccess.ql
ql/java/ql/src/Security/CWE/CWE-200/AndroidWebViewSettingsFileAccess.ql
ql/java/ql/src/Security/CWE/CWE-200/SpringBootActuators.ql
+ql/java/ql/src/Security/CWE/CWE-200/SpringBootActuatorsConfig/SpringBootActuatorsConfig.ql
ql/java/ql/src/Security/CWE/CWE-200/TempDirLocalInformationDisclosure.ql
ql/java/ql/src/Security/CWE/CWE-209/SensitiveDataExposureThroughErrorMessage.ql
ql/java/ql/src/Security/CWE/CWE-209/StackTraceExposure.ql
diff --git a/java/ql/integration-tests/java/query-suite/java-security-extended.qls.expected b/java/ql/integration-tests/java/query-suite/java-security-extended.qls.expected
index 209777cf4d98..a3ebc029d287 100644
--- a/java/ql/integration-tests/java/query-suite/java-security-extended.qls.expected
+++ b/java/ql/integration-tests/java/query-suite/java-security-extended.qls.expected
@@ -46,6 +46,7 @@ ql/java/ql/src/Security/CWE/CWE-200/AndroidSensitiveTextField.ql
ql/java/ql/src/Security/CWE/CWE-200/AndroidWebViewSettingsAllowsContentAccess.ql
ql/java/ql/src/Security/CWE/CWE-200/AndroidWebViewSettingsFileAccess.ql
ql/java/ql/src/Security/CWE/CWE-200/SpringBootActuators.ql
+ql/java/ql/src/Security/CWE/CWE-200/SpringBootActuatorsConfig/SpringBootActuatorsConfig.ql
ql/java/ql/src/Security/CWE/CWE-200/TempDirLocalInformationDisclosure.ql
ql/java/ql/src/Security/CWE/CWE-209/SensitiveDataExposureThroughErrorMessage.ql
ql/java/ql/src/Security/CWE/CWE-209/StackTraceExposure.ql
diff --git a/java/ql/integration-tests/java/query-suite/not_included_in_qls.expected b/java/ql/integration-tests/java/query-suite/not_included_in_qls.expected
index 1f58e51ad800..3a1cd4e1adbc 100644
--- a/java/ql/integration-tests/java/query-suite/not_included_in_qls.expected
+++ b/java/ql/integration-tests/java/query-suite/not_included_in_qls.expected
@@ -66,7 +66,6 @@ ql/java/ql/src/Frameworks/Spring/XML Configuration Errors/MissingSetters.ql
ql/java/ql/src/Language Abuse/CastThisToTypeParameter.ql
ql/java/ql/src/Language Abuse/DubiousDowncastOfThis.ql
ql/java/ql/src/Language Abuse/DubiousTypeTestOfThis.ql
-ql/java/ql/src/Language Abuse/EmptyStatement.ql
ql/java/ql/src/Language Abuse/EnumIdentifier.ql
ql/java/ql/src/Language Abuse/ImplementsAnnotation.ql
ql/java/ql/src/Language Abuse/MissedTernaryOpportunity.ql
@@ -187,7 +186,6 @@ ql/java/ql/src/Violations of Best Practice/Magic Constants/MagicNumbersUseConsta
ql/java/ql/src/Violations of Best Practice/Magic Constants/MagicStringsUseConstant.ql
ql/java/ql/src/Violations of Best Practice/Naming Conventions/ConfusingOverridesNames.ql
ql/java/ql/src/Violations of Best Practice/Naming Conventions/LocalShadowsField.ql
-ql/java/ql/src/Violations of Best Practice/Undesirable Calls/CallsToSystemExit.ql
ql/java/ql/src/Violations of Best Practice/Undesirable Calls/GarbageCollection.ql
ql/java/ql/src/Violations of Best Practice/legacy/AutoBoxing.ql
ql/java/ql/src/Violations of Best Practice/legacy/FinallyMayNotComplete.ql
@@ -196,7 +194,6 @@ ql/java/ql/src/Violations of Best Practice/legacy/ParameterAssignment.ql
ql/java/ql/src/Violations of Best Practice/legacy/UnnecessaryCast.ql
ql/java/ql/src/Violations of Best Practice/legacy/UnnecessaryImport.ql
ql/java/ql/src/definitions.ql
-ql/java/ql/src/experimental/Security/CWE/CWE-016/InsecureSpringActuatorConfig.ql
ql/java/ql/src/experimental/Security/CWE/CWE-020/Log4jJndiInjection.ql
ql/java/ql/src/experimental/Security/CWE/CWE-036/OpenStream.ql
ql/java/ql/src/experimental/Security/CWE/CWE-073/FilePathInjection.ql
diff --git a/java/ql/lib/qlpack.yml b/java/ql/lib/qlpack.yml
index 6d89a227eb68..93be64692021 100644
--- a/java/ql/lib/qlpack.yml
+++ b/java/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/java-all
-version: 7.6.0
+version: 7.6.1-dev
groups: java
dbscheme: config/semmlecode.dbscheme
extractor: java
diff --git a/java/ql/lib/semmle/code/configfiles/ConfigFiles.qll b/java/ql/lib/semmle/code/configfiles/ConfigFiles.qll
index 0c69f45c56fa..1655ed2d6484 100644
--- a/java/ql/lib/semmle/code/configfiles/ConfigFiles.qll
+++ b/java/ql/lib/semmle/code/configfiles/ConfigFiles.qll
@@ -70,7 +70,12 @@ class ConfigValue extends @configValue, ConfigLocatable {
override string toString() { result = this.getValue() }
}
+/** A `.properties` file. */
+class PropertiesFile extends File {
+ PropertiesFile() { this.getExtension() = "properties" }
+}
+
/** A Java property is a name-value pair in a `.properties` file. */
class JavaProperty extends ConfigPair {
- JavaProperty() { this.getFile().getExtension() = "properties" }
+ JavaProperty() { this.getFile() instanceof PropertiesFile }
}
diff --git a/java/ql/lib/semmle/code/java/controlflow/Guards.qll b/java/ql/lib/semmle/code/java/controlflow/Guards.qll
index 778ebe6e8789..a3cffbae459c 100644
--- a/java/ql/lib/semmle/code/java/controlflow/Guards.qll
+++ b/java/ql/lib/semmle/code/java/controlflow/Guards.qll
@@ -141,6 +141,7 @@ private predicate isNonFallThroughPredecessor(SwitchCase sc, ControlFlowNode pre
private module GuardsInput implements SharedGuards::InputSig {
private import java as J
+ private import semmle.code.java.dataflow.internal.BaseSSA
private import semmle.code.java.dataflow.NullGuards as NullGuards
import SuccessorType
@@ -216,6 +217,12 @@ private module GuardsInput implements SharedGuards::InputSig {
f.isFinal() and
f.getInitializer() = NullGuards::baseNotNullExpr()
)
+ or
+ exists(CatchClause cc, LocalVariableDeclExpr decl, BaseSsaUpdate v |
+ decl = cc.getVariable() and
+ decl = v.getDefiningExpr() and
+ this = v.getAUse()
+ )
}
}
diff --git a/java/ql/lib/semmle/code/java/dataflow/Nullness.qll b/java/ql/lib/semmle/code/java/dataflow/Nullness.qll
index 02f228d17dbe..756c5d1ae9f7 100644
--- a/java/ql/lib/semmle/code/java/dataflow/Nullness.qll
+++ b/java/ql/lib/semmle/code/java/dataflow/Nullness.qll
@@ -653,7 +653,7 @@ private Expr trackingVarGuard(
result = integerGuard(trackvar.getAnAccess(), branch, k, isA)
or
exists(int k2 |
- result = integerGuard(trackvar.getAnAccess(), branch.booleanNot(), k2, true) and
+ result = integerGuard(trackvar.getAnAccess(), branch, k2, true) and
isA = false and
k2 != k
)
diff --git a/java/ql/lib/semmle/code/java/security/SpringBootActuatorsConfigQuery.qll b/java/ql/lib/semmle/code/java/security/SpringBootActuatorsConfigQuery.qll
new file mode 100644
index 000000000000..163cd46d5d86
--- /dev/null
+++ b/java/ql/lib/semmle/code/java/security/SpringBootActuatorsConfigQuery.qll
@@ -0,0 +1,128 @@
+/** Provides classes and predicates to reason about Spring Boot actuators exposed in configuration files. */
+overlay[local?]
+module;
+
+import java
+private import semmle.code.configfiles.ConfigFiles
+private import semmle.code.xml.MavenPom
+
+/** The parent node of the `org.springframework.boot` group. */
+private class SpringBootParent extends Parent {
+ SpringBootParent() { this.getGroup().getValue() = "org.springframework.boot" }
+}
+
+/** A `Pom` with a Spring Boot parent node. */
+private class SpringBootPom extends Pom {
+ SpringBootPom() { this.getParentElement() instanceof SpringBootParent }
+
+ /** Holds if the Spring Boot Security module is used in the project. */
+ predicate isSpringBootSecurityUsed() {
+ this.getADependency().getArtifact().getValue() = "spring-boot-starter-security"
+ }
+}
+
+/** A dependency with artifactId `spring-boot-starter-actuator`. */
+class SpringBootStarterActuatorDependency extends Dependency {
+ SpringBootStarterActuatorDependency() {
+ this.getArtifact().getValue() = "spring-boot-starter-actuator"
+ }
+}
+
+/** The Spring Boot configuration property `management.security.enabled`. */
+private class ManagementSecurityEnabledProperty extends JavaProperty {
+ ManagementSecurityEnabledProperty() {
+ this.getNameElement().getName() = "management.security.enabled"
+ }
+
+ /** Gets the whitespace-trimmed value of this property. */
+ string getValue() { result = this.getValueElement().getValue().trim() }
+
+ /** Holds if `management.security.enabled` is set to `false`. */
+ predicate hasSecurityDisabled() { this.getValue() = "false" }
+}
+
+/**
+ * The Spring Boot configuration property `management.endpoints.web.exposure.include`
+ * or `management.endpoints.web.expose`.
+ */
+private class ManagementEndpointsExposeProperty extends JavaProperty {
+ ManagementEndpointsExposeProperty() {
+ this.getNameElement().getName() = "management.endpoints.web." + ["exposure.include", "expose"]
+ }
+
+ /** Gets the whitespace-trimmed value of this property. */
+ string getValue() { result = this.getValueElement().getValue().trim() }
+}
+
+private newtype TOption =
+ TNone() or
+ TSome(JavaProperty jp)
+
+/**
+ * An option type that is either a singleton `None` or a `Some` wrapping
+ * the `JavaProperty` type.
+ */
+class JavaPropertyOption extends TOption {
+ /** Gets a textual representation of this element. */
+ string toString() {
+ this = TNone() and result = "(none)"
+ or
+ result = this.asSome().toString()
+ }
+
+ /** Gets the location of this element. */
+ Location getLocation() { result = this.asSome().getLocation() }
+
+ /** Gets the wrapped element, if any. */
+ JavaProperty asSome() { this = TSome(result) }
+
+ /** Holds if this option is the singleton `None`. */
+ predicate isNone() { this = TNone() }
+}
+
+/**
+ * Holds if `JavaPropertyOption` jpOption of a repository using `SpringBootStarterActuatorDependency`
+ * d exposes sensitive Spring Boot Actuator endpoints.
+ */
+predicate exposesSensitiveEndpoint(
+ SpringBootStarterActuatorDependency d, JavaPropertyOption jpOption
+) {
+ exists(PropertiesFile propFile, SpringBootPom pom |
+ d = pom.getADependency() and
+ not pom.isSpringBootSecurityUsed() and
+ propFile
+ .getParentContainer()
+ .getAbsolutePath()
+ .matches(pom.getFile().getParentContainer().getAbsolutePath() + "%") and // in the same sub-directory
+ exists(string springBootVersion |
+ springBootVersion = pom.getParentElement().getVersionString()
+ |
+ springBootVersion.regexpMatch("1\\.[0-4].*") and // version 1.0, 1.1, ..., 1.4
+ not exists(ManagementSecurityEnabledProperty ep | ep.getFile() = propFile) and
+ jpOption.isNone()
+ or
+ springBootVersion.regexpMatch("1\\.[0-5].*") and // version 1.0, 1.1, ..., 1.5
+ exists(ManagementSecurityEnabledProperty ep |
+ ep.hasSecurityDisabled() and ep.getFile() = propFile and ep = jpOption.asSome()
+ )
+ or
+ springBootVersion.matches(["2.%", "3.%"]) and //version 2.x and 3.x
+ exists(ManagementEndpointsExposeProperty ep |
+ ep.getFile() = propFile and
+ ep = jpOption.asSome() and
+ (
+ // all endpoints are exposed
+ ep.getValue() = "*"
+ or
+ // version 2.x: exposes health and info only by default
+ springBootVersion.matches("2.%") and
+ not ep.getValue() = ["health", "info"]
+ or
+ // version 3.x: exposes health only by default
+ springBootVersion.matches("3.%") and
+ not ep.getValue() = "health"
+ )
+ )
+ )
+ )
+}
diff --git a/java/ql/src/Language Abuse/EmptyStatement.java b/java/ql/src/Language Abuse/EmptyStatement.java
deleted file mode 100644
index 4f9b462a38fa..000000000000
--- a/java/ql/src/Language Abuse/EmptyStatement.java
+++ /dev/null
@@ -1,8 +0,0 @@
-public class Cart {
- // AVOID: Empty statement
- List- items = new ArrayList
();;
- public void applyDiscount(float discount) {
- // AVOID: Empty statement as loop body
- for (int i = 0; i < items.size(); items.get(i++).applyDiscount(discount));
- }
-}
\ No newline at end of file
diff --git a/java/ql/src/Language Abuse/EmptyStatement.qhelp b/java/ql/src/Language Abuse/EmptyStatement.qhelp
deleted file mode 100644
index 700bd488dfce..000000000000
--- a/java/ql/src/Language Abuse/EmptyStatement.qhelp
+++ /dev/null
@@ -1,39 +0,0 @@
-
-
-
-
-
-An empty statement is a single semicolon ;
that does not
-terminate another statement. Such a statement hinders readability and has no effect on its own.
-
-
-
-
-Avoid empty statements. If a loop is intended to have an empty body, it is better
-to mark that fact explicitly by using a pair of braces {}
containing an explanatory comment
-for the body, rather than a single semicolon.
-
-
-
-
-In the following example, there is an empty statement on line 3, where an additional semicolon is
-used. On line 6, the for
statement has an empty body because the condition is
-immediately followed by a semicolon. In this case, it is better to include a pair of braces {}
containing
-an explanatory comment for the body instead.
-
-
-
-
-
-
-
-
-Help - Eclipse Platform:
-Java Compiler Errors/Warnings Preferences .
-
-
-
-
-
diff --git a/java/ql/src/Language Abuse/EmptyStatement.ql b/java/ql/src/Language Abuse/EmptyStatement.ql
deleted file mode 100644
index 36f61b862ac9..000000000000
--- a/java/ql/src/Language Abuse/EmptyStatement.ql
+++ /dev/null
@@ -1,19 +0,0 @@
-/**
- * @name Empty statement
- * @description An empty statement hinders readability.
- * @kind problem
- * @problem.severity recommendation
- * @precision low
- * @id java/empty-statement
- * @tags maintainability
- * useless-code
- */
-
-import java
-
-from EmptyStmt empty, string action
-where
- if exists(LoopStmt l | l.getBody() = empty)
- then action = "turned into '{}'"
- else action = "deleted"
-select empty, "This empty statement should be " + action + "."
diff --git a/java/ql/src/Security/CWE/CWE-200/SpringBootActuatorsConfig/SpringBootActuatorsConfig.qhelp b/java/ql/src/Security/CWE/CWE-200/SpringBootActuatorsConfig/SpringBootActuatorsConfig.qhelp
new file mode 100644
index 000000000000..d3e79e88ed75
--- /dev/null
+++ b/java/ql/src/Security/CWE/CWE-200/SpringBootActuatorsConfig/SpringBootActuatorsConfig.qhelp
@@ -0,0 +1,39 @@
+
+
+
+ Spring Boot includes features called actuators that let you monitor and interact with your web
+ application. Exposing unprotected actuator endpoints through configuration files can lead to
+ information disclosure or even to remote code execution.
+
+
+
+ Since actuator endpoints may contain sensitive information, carefully consider when to expose them,
+ and secure them as you would any sensitive URL. If you need to expose actuator endpoints, use Spring
+ Security, which secures actuators by default, or define a custom security configuration.
+
+
+
+
+ The following examples show application.properties
configurations that expose sensitive
+ actuator endpoints.
+
+
+ The below configurations ensure that sensitive actuator endpoints are not exposed.
+
+
+ To use Spring Security, which secures actuators by default, add the spring-boot-starter-security
+ dependency in your Maven pom.xml
file.
+
+
+
+
+
+ Spring Boot Reference Documentation:
+ Endpoints .
+
+
+ HackerOne Report:
+ Spring Actuator endpoints publicly available, leading to account takeover
+
+
+
diff --git a/java/ql/src/Security/CWE/CWE-200/SpringBootActuatorsConfig/SpringBootActuatorsConfig.ql b/java/ql/src/Security/CWE/CWE-200/SpringBootActuatorsConfig/SpringBootActuatorsConfig.ql
new file mode 100644
index 000000000000..562298257a7d
--- /dev/null
+++ b/java/ql/src/Security/CWE/CWE-200/SpringBootActuatorsConfig/SpringBootActuatorsConfig.ql
@@ -0,0 +1,20 @@
+/**
+ * @name Exposed Spring Boot actuators in configuration file
+ * @description Exposing Spring Boot actuators through configuration files may lead to information leak from
+ * the internal application, or even to remote code execution.
+ * @kind problem
+ * @problem.severity error
+ * @security-severity 6.5
+ * @precision high
+ * @id java/spring-boot-exposed-actuators-config
+ * @tags security
+ * external/cwe/cwe-200
+ */
+
+import java
+import semmle.code.xml.MavenPom
+import semmle.code.java.security.SpringBootActuatorsConfigQuery
+
+from SpringBootStarterActuatorDependency d, JavaPropertyOption jpOption
+where exposesSensitiveEndpoint(d, jpOption)
+select d, "Insecure Spring Boot actuator $@ exposes sensitive endpoints.", jpOption, "configuration"
diff --git a/java/ql/src/Security/CWE/CWE-200/SpringBootActuatorsConfig/application_bad.properties b/java/ql/src/Security/CWE/CWE-200/SpringBootActuatorsConfig/application_bad.properties
new file mode 100644
index 000000000000..ccf1cb678813
--- /dev/null
+++ b/java/ql/src/Security/CWE/CWE-200/SpringBootActuatorsConfig/application_bad.properties
@@ -0,0 +1,10 @@
+# vulnerable configuration (Spring Boot 1.0 - 1.4): exposes endpoints by default
+
+# vulnerable configuration (Spring Boot 1.5): false value exposes endpoints
+management.security.enabled=false
+
+# vulnerable configuration (Spring Boot 2.x): exposes all endpoints
+management.endpoints.web.exposure.include=*
+
+# vulnerable configuration (Spring Boot 3.x): exposes all endpoints
+management.endpoints.web.exposure.include=*
diff --git a/java/ql/src/Security/CWE/CWE-200/SpringBootActuatorsConfig/application_good.properties b/java/ql/src/Security/CWE/CWE-200/SpringBootActuatorsConfig/application_good.properties
new file mode 100644
index 000000000000..1af2b7b0228a
--- /dev/null
+++ b/java/ql/src/Security/CWE/CWE-200/SpringBootActuatorsConfig/application_good.properties
@@ -0,0 +1,11 @@
+# safe configuration (Spring Boot 1.0 - 1.4)
+management.security.enabled=true
+
+# safe configuration (Spring Boot 1.5+)
+management.security.enabled=true
+
+# safe configuration (Spring Boot 2.x): exposes health and info only by default
+management.endpoints.web.exposure.include=health,info
+
+# safe configuration (Spring Boot 3.x): exposes health only by default
+management.endpoints.web.exposure.include=health
diff --git a/java/ql/src/Security/CWE/CWE-200/SpringBootActuatorsConfig/pom_good.xml b/java/ql/src/Security/CWE/CWE-200/SpringBootActuatorsConfig/pom_good.xml
new file mode 100644
index 000000000000..32fad44591e5
--- /dev/null
+++ b/java/ql/src/Security/CWE/CWE-200/SpringBootActuatorsConfig/pom_good.xml
@@ -0,0 +1,12 @@
+...
+
+ org.springframework.boot
+ spring-boot-starter-actuator
+
+
+
+
+ org.springframework.boot
+ spring-boot-starter-security
+
+...
diff --git a/java/ql/src/Violations of Best Practice/Implementation Hiding/VisibleForTestingAbuse.md b/java/ql/src/Violations of Best Practice/Implementation Hiding/VisibleForTestingAbuse.md
new file mode 100644
index 000000000000..bcf10901549e
--- /dev/null
+++ b/java/ql/src/Violations of Best Practice/Implementation Hiding/VisibleForTestingAbuse.md
@@ -0,0 +1,36 @@
+## Overview
+
+Accessing class members annotated with `@VisibleForTesting` from production code goes against the intention of the annotation and may indicate programmer error.
+
+The `@VisibleForTesting` annotation serves to increase visibility of methods, fields or classes for the purposes of testing. Accessing these annotated elements in production code (not test code) abuses the intention of the annotation.
+
+## Recommendation
+
+Only access methods, fields or classes annotated with `@VisibleForTesting` from test code. If the visibility of the methods, fields or classes should generally be relaxed, use Java language access modifiers.
+
+## Example
+
+```java
+public class Annotated {
+ @VisibleForTesting static int f() { return 42; }
+}
+
+/* src/test/java/Test.java */
+int i = Annotated.f(); // COMPLIANT
+
+/* src/main/Source.java */
+int i = Annotated.f(); // NON_COMPLIANT
+```
+
+## Implementation notes
+
+This rule alerts on any implementation of the annotation `VisibleForTesting`, regardless of where it is provided from.
+
+The rule also uses the following logic to determine what an abuse of the annotation is:
+
+ 1. If a public or protected member/type is annotated with `@VisibleForTesting`, it's assumed that package-private access is enough for production code. Therefore the rule alerts when a public or protected member/type annotated with `@VisibleForTesting` is used outside of its declaring package.
+ 2. If a package-private member/type is annotated with `@VisibleForTesting`, it's assumed that private access is enough for production code. Therefore the rule alerts when a package-private member/type annotated with `@VisibleForTesting` is used outside its declaring class.
+
+## References
+- Javadoc: [AssertJ VisibleForTesting](https://javadoc.io/doc/org.assertj/assertj-core/latest/org.assertj.core/org/assertj/core/util/VisibleForTesting.html).
+- Javadoc: [JetBrains VisibleForTesting](https://javadoc.io/doc/org.jetbrains/annotations/22.0.0/org/jetbrains/annotations/VisibleForTesting.html).
diff --git a/java/ql/src/Violations of Best Practice/Implementation Hiding/VisibleForTestingAbuse.ql b/java/ql/src/Violations of Best Practice/Implementation Hiding/VisibleForTestingAbuse.ql
new file mode 100644
index 000000000000..c882d3f629bb
--- /dev/null
+++ b/java/ql/src/Violations of Best Practice/Implementation Hiding/VisibleForTestingAbuse.ql
@@ -0,0 +1,112 @@
+/**
+ * @id java/visible-for-testing-abuse
+ * @name Use of VisibleForTesting in production code
+ * @description Accessing methods, fields or classes annotated with `@VisibleForTesting` from
+ * production code goes against the intention of the annotation and may indicate
+ * programmer error.
+ * @kind problem
+ * @precision high
+ * @problem.severity warning
+ * @tags quality
+ * maintainability
+ * readability
+ */
+
+import java
+
+/**
+ * Holds if a `Callable` is within the same type hierarchy as `RefType`
+ * (including through lambdas, inner classes, and outer classes).
+ */
+predicate isWithinType(Callable c, RefType t) {
+ // Either the callable is in the target type, or they share a common enclosing type
+ c.getDeclaringType().getEnclosingType*() = t.getEnclosingType*()
+}
+
+/**
+ * Holds if `e` is within the same package as `t`.
+ */
+predicate isWithinPackage(Expr e, RefType t) {
+ e.getCompilationUnit().getPackage() = t.getPackage()
+}
+
+/**
+ * Holds if a callable or any of its enclosing callables is annotated with @VisibleForTesting.
+ */
+predicate isWithinVisibleForTestingContext(Callable c) {
+ c.getAnAnnotation().getType().hasName("VisibleForTesting")
+ or
+ isWithinVisibleForTestingContext(c.getEnclosingCallable())
+}
+
+/**
+ * Holds if `e` is within a test method context, including lambda expressions
+ * within test methods and nested lambdas.
+ */
+private predicate isWithinTest(Expr e) {
+ e.getEnclosingCallable() instanceof LikelyTestMethod
+ or
+ exists(Method lambda, LambdaExpr lambdaExpr |
+ lambda = lambdaExpr.asMethod() and
+ lambda.getEnclosingCallable*() instanceof LikelyTestMethod and
+ e.getEnclosingCallable() = lambda
+ )
+}
+
+from Annotatable annotated, Expr e
+where
+ annotated.getAnAnnotation().getType().hasName("VisibleForTesting") and
+ (
+ // field access
+ e =
+ any(FieldAccess v |
+ v.getField() = annotated and
+ // depending on the visibility of the field, using the annotation to abuse the visibility may/may not be occurring
+ (
+ // if its package protected report when its used outside its class because it should have been private (class only permitted)
+ v.getField().isPackageProtected() and
+ not isWithinType(v.getEnclosingCallable(), v.getField().getDeclaringType())
+ or
+ // if public or protected report when its used outside its package because package protected should have been enough (package only permitted)
+ (v.getField().isPublic() or v.getField().isProtected()) and
+ not isWithinPackage(v, v.getField().getDeclaringType())
+ )
+ )
+ or
+ // method access
+ e =
+ any(MethodCall c |
+ c.getMethod() = annotated and
+ // depending on the visibility of the method, using the annotation to abuse the visibility may/may not be occurring
+ (
+ // if its package protected report when its used outside its class because it should have been private (class only permitted)
+ c.getMethod().isPackageProtected() and
+ not isWithinType(c.getEnclosingCallable(), c.getMethod().getDeclaringType())
+ or
+ // if public or protected report when its used outside its package because package protected should have been enough (package only permitted)
+ (c.getMethod().isPublic() or c.getMethod().isProtected()) and
+ not isWithinPackage(c, c.getMethod().getDeclaringType())
+ )
+ )
+ or
+ // Class instantiation - report if used outside appropriate scope
+ e =
+ any(ClassInstanceExpr c |
+ c.getConstructedType() = annotated and
+ (
+ c.getConstructedType().isPublic() and not isWithinPackage(c, c.getConstructedType())
+ or
+ c.getConstructedType().hasNoModifier() and
+ c.getConstructedType() instanceof NestedClass and
+ not isWithinType(c.getEnclosingCallable(), c.getConstructedType())
+ )
+ )
+ ) and
+ // not in a test where use is appropriate
+ not isWithinTest(e) and
+ // not when the accessing method or any enclosing method is @VisibleForTesting (test-to-test communication)
+ not isWithinVisibleForTestingContext(e.getEnclosingCallable()) and
+ // not when used in annotation contexts
+ not e.getParent*() instanceof Annotation
+select e, "Access of $@ annotated with VisibleForTesting found in production code.", annotated,
+ "element"
diff --git a/java/ql/src/Violations of Best Practice/Testing/ExcessivePublicMethodMocking.md b/java/ql/src/Violations of Best Practice/Testing/ExcessivePublicMethodMocking.md
new file mode 100644
index 000000000000..d932df251163
--- /dev/null
+++ b/java/ql/src/Violations of Best Practice/Testing/ExcessivePublicMethodMocking.md
@@ -0,0 +1,52 @@
+## Overview
+
+Mocking methods of a class is necessary for unit tests to run without overhead caused by expensive I/O operations. However, when a unit test ends up mocking all public methods of a class, it may indicate that the test is too complicated, possibly because it is trying to test multiple things at once. Such extensive mocking is likely a signal that the scope of the unit test is reaching beyond a single unit of functionality.
+
+## Recommendation
+
+It is best to contain the scope of a single unit test to a single unit of functionality. For example, a unit test may aim to test a series of data-transforming functions that depend on an ORM class. Even though the functions may be semantically related with one another, it is better to create a unit test for each function.
+
+## Example
+
+The following example mocks all methods of an ORM class named `EmployeeRecord`, and tests four functions against them. Since the scope of the unit test harbors all four of them, all of the methods provided by the class are mocked.
+
+```java
+public class EmployeeRecord {
+ public int add(Employee employee) { ... }
+
+ public Employee get(String name) { ... }
+
+ public int update(Employee employee, String newName) { ... }
+
+ public int delete(Employee employee) { ... }
+}
+
+public class TestORM {
+ @Test
+ public void nonCompliant() {
+ Employee sampleEmployee = new Employee("John Doe");
+ EmployeeRecord employeeRecordMock = mock(EmployeeRecord.class); // NON_COMPLIANT: Mocked class has all of its public methods used in the test
+ when(employeeRecordMock.add(sampleEmployee)).thenReturn(0); // Mocked EmployeeRecord.add
+ when(employeeRecordMock.get("John Doe")).thenReturn(sampleEmployee); // Mocked EmployeeRecord.get
+ when(employeeRecordMock.update(sampleEmployee, "Jane Doe")).thenReturn(0); // Mocked EmployeeRecord.update
+ when(employeeRecordMock.delete(sampleEmployee)).thenReturn(0); // Mocked EmployeeRecord.delete
+ }
+
+ @Test
+ public void compliant() {
+ Employee sampleEmployee = new Employee("John Doe");
+ EmployeeRecord employeeRecordMock = mock(EmployeeRecord.class); // COMPLIANT: Only some of the public methods belonging to the mocked object are used
+ when(employeeRecordMock.add(sampleEmployee)).thenReturn(0); // Mocked EmployeeRecord.add
+ when(employeeRecordMock.update(sampleEmployee, "Jane Doe")).thenReturn(0); // Mocked EmployeeRecord.update
+ }
+
+}
+```
+
+## Implementation Notes
+
+JUnit provides two different ways of mocking a method call: `when(mockedObject.methodToMock(...)).thenReturn(...)` and `doReturn(...).when(mockedObject).methodToMock(...)`. Both forms are taken into account by the query.
+
+## References
+
+- Baeldung: [Best Practices for Unit Testing in Java](https://www.baeldung.com/java-unit-testing-best-practices).
diff --git a/java/ql/src/Violations of Best Practice/Testing/ExcessivePublicMethodMocking.ql b/java/ql/src/Violations of Best Practice/Testing/ExcessivePublicMethodMocking.ql
new file mode 100644
index 000000000000..a566d6162d21
--- /dev/null
+++ b/java/ql/src/Violations of Best Practice/Testing/ExcessivePublicMethodMocking.ql
@@ -0,0 +1,80 @@
+/**
+ * @id java/excessive-public-method-mocking
+ * @previous-id java/mocking-all-non-private-methods-means-unit-test-is-too-big
+ * @name Mocking all public methods of a class may indicate the unit test is testing too much
+ * @description Mocking all public methods provided by a class might indicate the unit test
+ * aims to test too many things.
+ * @kind problem
+ * @precision high
+ * @problem.severity recommendation
+ * @tags quality
+ * maintainability
+ * readability
+ */
+
+import java
+
+/**
+ * A call to Mockito's `mock` method.
+ */
+class MockitoMockCall extends MethodCall {
+ MockitoMockCall() { this.getMethod().hasQualifiedName("org.mockito", "Mockito", "mock") }
+
+ /**
+ * Gets the type that this call intends to mock. For example:
+ * ```java
+ * EmployeeRecord employeeRecordMock = mock(EmployeeRecord.class);
+ * ```
+ * This predicate gets the class `EmployeeRecord` in the above example.
+ */
+ Type getMockedType() { result = this.getAnArgument().(TypeLiteral).getReferencedType() }
+}
+
+/**
+ * A method call that mocks a target method in a JUnit test. For example:
+ * ```java
+ * EmployeeRecord employeeRecordMock = mock(EmployeeRecord.class);
+ * when(employeeRecordMock.add(sampleEmployee)).thenReturn(0); // Mocked EmployeeRecord.add
+ * doReturn(0).when(employeeRecordMock).add(sampleEmployee); // Mocked EmployeeRecord.add
+ * ```
+ * This class captures the call to `add` which mocks the equivalent method of the class `EmployeeRecord`.
+ */
+class MockitoMockingMethodCall extends MethodCall {
+ MockitoMockCall mockCall;
+
+ MockitoMockingMethodCall() {
+ /* 1. The qualifier originates from the mock call. */
+ this.getQualifier().getControlFlowNode().getAPredecessor+() = mockCall.getControlFlowNode() and
+ /* 2. The mocked method can be found in the class being mocked with the mock call. */
+ mockCall.getMockedType().(ClassOrInterface).getAMethod() = this.getMethod()
+ }
+
+ /**
+ * Gets the call to Mockito's `mock` from which the qualifier, the mocked object, originates.
+ */
+ MockitoMockCall getMockitoMockCall() { result = mockCall }
+}
+
+/*
+ * The following from-where-select embodies this pseudocode:
+ * - Find a JUnit4TestMethod which:
+ * - for a class that it mocks with a call to `mock`,
+ * - for all methods that the class has, there is a method that this test method mocks.
+ */
+
+from JUnit4TestMethod testMethod, ClassOrInterface mockedClassOrInterface
+where
+ exists(MockitoMockCall mockCall |
+ mockCall.getEnclosingCallable() = testMethod and
+ mockedClassOrInterface = mockCall.getMockedType() and
+ // Only flag classes with multiple public methods (2 or more)
+ strictcount(Method m | m = mockedClassOrInterface.getAMethod() and m.isPublic()) > 1 and
+ forex(Method method | method = mockedClassOrInterface.getAMethod() and method.isPublic() |
+ exists(MockitoMockingMethodCall mockedMethod |
+ mockedMethod.getMockitoMockCall() = mockCall and
+ mockedMethod.getMethod() = method
+ )
+ )
+ )
+select testMethod, "This test method mocks all public methods of a $@.", mockedClassOrInterface,
+ "class or an interface"
diff --git a/java/ql/src/Violations of Best Practice/Undesirable Calls/CallsToRunFinalizersOnExit.ql b/java/ql/src/Violations of Best Practice/Undesirable Calls/CallsToRunFinalizersOnExit.ql
index c2ffe45b5209..568be1805e66 100644
--- a/java/ql/src/Violations of Best Practice/Undesirable Calls/CallsToRunFinalizersOnExit.ql
+++ b/java/ql/src/Violations of Best Practice/Undesirable Calls/CallsToRunFinalizersOnExit.ql
@@ -7,8 +7,11 @@
* @problem.severity error
* @precision medium
* @id java/run-finalizers-on-exit
- * @tags reliability
- * maintainability
+ * @previous-id java/do-not-use-finalizers
+ * @tags quality
+ * reliability
+ * correctness
+ * performance
*/
import java
diff --git a/java/ql/src/Violations of Best Practice/Undesirable Calls/CallsToSystemExit.java b/java/ql/src/Violations of Best Practice/Undesirable Calls/CallsToSystemExit.java
index da7277aa25c3..50e0fb1cbda0 100644
--- a/java/ql/src/Violations of Best Practice/Undesirable Calls/CallsToSystemExit.java
+++ b/java/ql/src/Violations of Best Practice/Undesirable Calls/CallsToSystemExit.java
@@ -4,7 +4,7 @@ boolean write(String[] s) {
try {
output.write(s.getBytes());
} catch (IOException e) {
- System.exit(1);
+ System.exit(1); // BAD: Should handle or propagate error instead of exiting
}
return true;
}
@@ -16,9 +16,30 @@ public void run() {
// ...
// Perform tasks ...
// ...
- System.exit(0);
+ System.exit(0); // BAD: Should return status or throw exception
}
public static void main(String[] args) {
- new Action(args).run();
+ new Action().run();
}
-}
\ No newline at end of file
+}
+
+// Good example: Proper error handling
+class BetterAction {
+ public int run() throws Exception {
+ // ...
+ // Perform tasks ...
+ // ...
+ return 0; // Return status instead of calling System.exit
+ }
+
+ public static void main(String[] args) {
+ try {
+ BetterAction action = new BetterAction();
+ int exitCode = action.run();
+ System.exit(exitCode); // GOOD: Exit from main method
+ } catch (Exception e) {
+ System.err.println("Error: " + e.getMessage());
+ System.exit(1); // GOOD: Exit from main method on error
+ }
+ }
+}
diff --git a/java/ql/src/Violations of Best Practice/Undesirable Calls/CallsToSystemExit.qhelp b/java/ql/src/Violations of Best Practice/Undesirable Calls/CallsToSystemExit.qhelp
index e4d4fa7a7f0e..6992a734607c 100644
--- a/java/ql/src/Violations of Best Practice/Undesirable Calls/CallsToSystemExit.qhelp
+++ b/java/ql/src/Violations of Best Practice/Undesirable Calls/CallsToSystemExit.qhelp
@@ -13,17 +13,20 @@ program state from being written to disk consistently.
It is sometimes considered acceptable to call System.exit
from a program's main
method in order to indicate the overall exit status
-of the program. Such calls are an exception to this rule.
+of the program. The main
method should be the primary place
+where exit conditions are handled, as it represents the natural termination point
+of the application. Such calls are an exception to this rule.
-It is usually preferable to use a different mechanism for reporting
-failure conditions. Consider returning a special value (perhaps
-null
) that users of the current method check for and
-recover from appropriately. Alternatively, throw a suitable exception, which
-unwinds the stack and allows properly written code to clean up after itself,
-while leaving other threads undisturbed.
+Instead of calling System.exit
from non-main methods, prefer to propagate
+errors upward to the main
method where they can be handled appropriately.
+Consider returning a special value (perhaps null
) that users of the current
+method check for and recover from appropriately. Alternatively, throw a suitable exception,
+which unwinds the stack and allows properly written code to clean up after itself,
+while leaving other threads undisturbed. The main
method can then catch
+these exceptions and decide whether to exit the program and with what exit code.
@@ -38,12 +41,14 @@ upwards and be handled by a method that knows how to recover.
Problem 2 is more subtle. In this example, there is just one entry point to
the program (the main
method), which constructs an
Action
and performs it. Action.run
calls
-System.exit
to indicate successful completion. Consider,
-however, how this code might be integrated in an application server that
-constructs Action
instances and calls
+System.exit
to indicate successful completion. Instead, the
+run
method should return a status code or throw an exception
+on failure, allowing the main
method to decide whether to exit
+and with what exit code. Consider how this code might be integrated in an
+application server that constructs Action
instances and calls
run
on them without going through main
.
The fact that run
terminates the JVM instead of returning its
-exit code as an integer makes that use-case impossible.
+exit code makes that use-case impossible.
diff --git a/java/ql/src/Violations of Best Practice/Undesirable Calls/CallsToSystemExit.ql b/java/ql/src/Violations of Best Practice/Undesirable Calls/CallsToSystemExit.ql
index 93d7911694cf..52f82218c332 100644
--- a/java/ql/src/Violations of Best Practice/Undesirable Calls/CallsToSystemExit.ql
+++ b/java/ql/src/Violations of Best Practice/Undesirable Calls/CallsToSystemExit.ql
@@ -4,26 +4,80 @@
* reuse and prevent important cleanup steps from running.
* @kind problem
* @problem.severity warning
- * @precision low
+ * @precision medium
* @id java/jvm-exit
- * @tags reliability
- * maintainability
+ * @previous-id java/jvm-exit-prevents-cleanup-and-reuse
+ * @tags quality
+ * reliability
+ * correctness
* external/cwe/cwe-382
*/
import java
-from Method m, MethodCall sysexitCall, Method sysexit, Class system
-where
- sysexitCall = m.getACallSite(sysexit) and
- (sysexit.hasName("exit") or sysexit.hasName("halt")) and
- sysexit.getDeclaringType() = system and
- (
- system.hasQualifiedName("java.lang", "System") or
- system.hasQualifiedName("java.lang", "Runtime")
- ) and
- m.fromSource() and
- not m instanceof MainMethod
-select sysexitCall,
- "Avoid calls to " + sysexit.getDeclaringType().getName() + "." + sysexit.getName() +
- "() as this makes code harder to reuse."
+/**
+ * A `Method` which, when called, causes the JVM to exit or halt.
+ *
+ * Explicitly includes these methods from the java standard library:
+ * - `java.lang.System.exit`
+ * - `java.lang.Runtime.halt`
+ * - `java.lang.Runtime.exit`
+ */
+class ExitOrHaltMethod extends Method {
+ ExitOrHaltMethod() {
+ exists(Class system | this.getDeclaringType() = system |
+ this.hasName("exit") and
+ system.hasQualifiedName("java.lang", ["System", "Runtime"])
+ or
+ this.hasName("halt") and
+ system.hasQualifiedName("java.lang", "Runtime")
+ )
+ }
+}
+
+/** A `MethodCall` to an `ExitOrHaltMethod`, which causes the JVM to exit abruptly. */
+class ExitOrHaltMethodCall extends MethodCall {
+ ExitOrHaltMethodCall() {
+ exists(ExitOrHaltMethod exitMethod | this.getMethod() = exitMethod |
+ exists(SourceMethodNotMainOrTest srcMethod | this = srcMethod.getACallSite(exitMethod))
+ )
+ }
+}
+
+/**
+ * An intentional `MethodCall` to a system or runtime "exit" method, such as for
+ * functions which exist for the purpose of exiting the program. Assumes that an exit method
+ * call within a method is intentional if the exit code is passed from a parameter of the
+ * enclosing method.
+ */
+class IntentionalExitMethodCall extends ExitOrHaltMethodCall {
+ IntentionalExitMethodCall() {
+ this.getMethod().hasName("exit") and
+ this.getAnArgument() = this.getEnclosingCallable().getAParameter().getAnAccess()
+ }
+}
+
+/**
+ * A `Method` that is defined in source code and is not a `MainMethod` or a `LikelyTestMethod`.
+ */
+class SourceMethodNotMainOrTest extends Method {
+ SourceMethodNotMainOrTest() {
+ this.fromSource() and
+ not this instanceof MainMethod and
+ not (
+ this.getEnclosingCallable*() instanceof LikelyTestMethod
+ or
+ this.getDeclaringType()
+ .getEnclosingType*()
+ .(LocalClassOrInterface)
+ .getLocalTypeDeclStmt()
+ .getEnclosingCallable() instanceof LikelyTestMethod
+ )
+ }
+}
+
+from ExitOrHaltMethodCall mc
+where not mc instanceof IntentionalExitMethodCall
+select mc,
+ "Avoid calls to " + mc.getMethod().getDeclaringType().getName() + "." + mc.getMethod().getName() +
+ "() as this prevents runtime cleanup and makes code harder to reuse."
diff --git a/java/ql/src/Violations of Best Practice/Undesirable Calls/GarbageCollection.ql b/java/ql/src/Violations of Best Practice/Undesirable Calls/GarbageCollection.ql
index 1067bdcb6dce..620177cc58c6 100644
--- a/java/ql/src/Violations of Best Practice/Undesirable Calls/GarbageCollection.ql
+++ b/java/ql/src/Violations of Best Practice/Undesirable Calls/GarbageCollection.ql
@@ -6,8 +6,10 @@
* @problem.severity recommendation
* @precision low
* @id java/garbage-collection
- * @tags reliability
- * maintainability
+ * @previous-id java/do-not-use-finalizers
+ * @tags quality
+ * reliability
+ * correctness
*/
import java
diff --git a/java/ql/src/change-notes/2024-10-03-remove-java-query.md b/java/ql/src/change-notes/2024-10-03-remove-java-query.md
new file mode 100644
index 000000000000..e9f3e4910cb5
--- /dev/null
+++ b/java/ql/src/change-notes/2024-10-03-remove-java-query.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Removed the `java/empty-statement` query that was subsumed by the `java/empty-block` query.
\ No newline at end of file
diff --git a/java/ql/src/change-notes/2025-07-17-spring-actuators-config-promo.md b/java/ql/src/change-notes/2025-07-17-spring-actuators-config-promo.md
new file mode 100644
index 000000000000..733017f71319
--- /dev/null
+++ b/java/ql/src/change-notes/2025-07-17-spring-actuators-config-promo.md
@@ -0,0 +1,4 @@
+---
+category: newQuery
+---
+* The query `java/insecure-spring-actuator-config` has been promoted from experimental to the main query pack as `java/spring-boot-exposed-actuators-config`. Its results will now appear by default. This query detects exposure of Spring Boot actuators through configuration files. It was originally submitted as an experimental query [by @luchua-bc](https://github.com/github/codeql/pull/5384).
diff --git a/java/ql/src/change-notes/2025-07-19-adjust-tags.md b/java/ql/src/change-notes/2025-07-19-adjust-tags.md
new file mode 100644
index 000000000000..0067adebdaf7
--- /dev/null
+++ b/java/ql/src/change-notes/2025-07-19-adjust-tags.md
@@ -0,0 +1,5 @@
+---
+category: queryMetadata
+---
+* The tag `maintainability` has been removed from `java/run-finalizers-on-exit` and the tags `quality`, `correctness`, and `performance` have been added.
+* The tag `maintainability` has been removed from `java/garbage-collection` and the tags `quality` and `correctness` have been added.
diff --git a/java/ql/src/change-notes/2025-08-22-nullness-fn.md b/java/ql/src/change-notes/2025-08-22-nullness-fn.md
new file mode 100644
index 000000000000..d8d77a470f68
--- /dev/null
+++ b/java/ql/src/change-notes/2025-08-22-nullness-fn.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Fixed a bug that was causing false negatives in rare cases in the query `java/dereferenced-value-may-be-null`.
diff --git a/java/ql/src/experimental/Security/CWE/CWE-016/InsecureSpringActuatorConfig.qhelp b/java/ql/src/experimental/Security/CWE/CWE-016/InsecureSpringActuatorConfig.qhelp
deleted file mode 100644
index e201156728a4..000000000000
--- a/java/ql/src/experimental/Security/CWE/CWE-016/InsecureSpringActuatorConfig.qhelp
+++ /dev/null
@@ -1,47 +0,0 @@
-
-
-
- Spring Boot is a popular framework that facilitates the development of stand-alone applications
-and micro services. Spring Boot Actuator helps to expose production-ready support features against
-Spring Boot applications.
-
- Endpoints of Spring Boot Actuator allow to monitor and interact with a Spring Boot application.
-Exposing unprotected actuator endpoints through configuration files can lead to information disclosure
-or even remote code execution vulnerability.
-
- Rather than programmatically permitting endpoint requests or enforcing access control, frequently
-developers simply leave management endpoints publicly accessible in the application configuration file
-application.properties
without enforcing access control through Spring Security.
-
-
-
- Declare the Spring Boot Starter Security module in XML configuration or programmatically enforce
-security checks on management endpoints using Spring Security. Otherwise accessing management endpoints
-on a different HTTP port other than the port that the web application is listening on also helps to
-improve the security.
-
-
-
- The following examples show both 'BAD' and 'GOOD' configurations. In the 'BAD' configuration,
-no security module is declared and sensitive management endpoints are exposed. In the 'GOOD' configuration,
-security is enforced and only endpoints requiring exposure are exposed.
-
-
-
-
-
-
-
- Spring Boot documentation:
- Spring Boot Actuator: Production-ready Features
-
-
- VERACODE Blog:
- Exploiting Spring Boot Actuators
-
-
- HackerOne Report:
- Spring Actuator endpoints publicly available, leading to account takeover
-
-
-
diff --git a/java/ql/src/experimental/Security/CWE/CWE-016/InsecureSpringActuatorConfig.ql b/java/ql/src/experimental/Security/CWE/CWE-016/InsecureSpringActuatorConfig.ql
deleted file mode 100644
index b21aa82e8baf..000000000000
--- a/java/ql/src/experimental/Security/CWE/CWE-016/InsecureSpringActuatorConfig.ql
+++ /dev/null
@@ -1,121 +0,0 @@
-/**
- * @name Insecure Spring Boot Actuator Configuration
- * @description Exposed Spring Boot Actuator through configuration files without declarative or procedural
- * security enforcement leads to information leak or even remote code execution.
- * @kind problem
- * @problem.severity error
- * @precision high
- * @id java/insecure-spring-actuator-config
- * @tags security
- * experimental
- * external/cwe/cwe-016
- */
-
-/*
- * Note this query requires properties files to be indexed before it can produce results.
- * If creating your own database with the CodeQL CLI, you should run
- * `codeql database index-files --language=properties ...`
- * If using lgtm.com, you should add `properties_files: true` to the index block of your
- * lgtm.yml file (see https://lgtm.com/help/lgtm/java-extraction)
- */
-
-import java
-import semmle.code.configfiles.ConfigFiles
-import semmle.code.xml.MavenPom
-
-/** The parent node of the `org.springframework.boot` group. */
-class SpringBootParent extends Parent {
- SpringBootParent() { this.getGroup().getValue() = "org.springframework.boot" }
-}
-
-/** Class of Spring Boot dependencies. */
-class SpringBootPom extends Pom {
- SpringBootPom() { this.getParentElement() instanceof SpringBootParent }
-
- /** Holds if the Spring Boot Actuator module `spring-boot-starter-actuator` is used in the project. */
- predicate isSpringBootActuatorUsed() {
- this.getADependency().getArtifact().getValue() = "spring-boot-starter-actuator"
- }
-
- /**
- * Holds if the Spring Boot Security module is used in the project, which brings in other security
- * related libraries.
- */
- predicate isSpringBootSecurityUsed() {
- this.getADependency().getArtifact().getValue() = "spring-boot-starter-security"
- }
-}
-
-/** The properties file `application.properties`. */
-class ApplicationProperties extends ConfigPair {
- ApplicationProperties() { this.getFile().getBaseName() = "application.properties" }
-}
-
-/** The configuration property `management.security.enabled`. */
-class ManagementSecurityConfig extends ApplicationProperties {
- ManagementSecurityConfig() { this.getNameElement().getName() = "management.security.enabled" }
-
- /** Gets the whitespace-trimmed value of this property. */
- string getValue() { result = this.getValueElement().getValue().trim() }
-
- /** Holds if `management.security.enabled` is set to `false`. */
- predicate hasSecurityDisabled() { this.getValue() = "false" }
-
- /** Holds if `management.security.enabled` is set to `true`. */
- predicate hasSecurityEnabled() { this.getValue() = "true" }
-}
-
-/** The configuration property `management.endpoints.web.exposure.include`. */
-class ManagementEndPointInclude extends ApplicationProperties {
- ManagementEndPointInclude() {
- this.getNameElement().getName() = "management.endpoints.web.exposure.include"
- }
-
- /** Gets the whitespace-trimmed value of this property. */
- string getValue() { result = this.getValueElement().getValue().trim() }
-}
-
-/**
- * Holds if `ApplicationProperties` ap of a repository managed by `SpringBootPom` pom
- * has a vulnerable configuration of Spring Boot Actuator management endpoints.
- */
-predicate hasConfidentialEndPointExposed(SpringBootPom pom, ApplicationProperties ap) {
- pom.isSpringBootActuatorUsed() and
- not pom.isSpringBootSecurityUsed() and
- ap.getFile()
- .getParentContainer()
- .getAbsolutePath()
- .matches(pom.getFile().getParentContainer().getAbsolutePath() + "%") and // in the same sub-directory
- exists(string springBootVersion | springBootVersion = pom.getParentElement().getVersionString() |
- springBootVersion.regexpMatch("1\\.[0-4].*") and // version 1.0, 1.1, ..., 1.4
- not exists(ManagementSecurityConfig me |
- me.hasSecurityEnabled() and me.getFile() = ap.getFile()
- )
- or
- springBootVersion.matches("1.5%") and // version 1.5
- exists(ManagementSecurityConfig me | me.hasSecurityDisabled() and me.getFile() = ap.getFile())
- or
- springBootVersion.matches("2.%") and //version 2.x
- exists(ManagementEndPointInclude mi |
- mi.getFile() = ap.getFile() and
- (
- mi.getValue() = "*" // all endpoints are enabled
- or
- mi.getValue()
- .matches([
- "%dump%", "%trace%", "%logfile%", "%shutdown%", "%startup%", "%mappings%", "%env%",
- "%beans%", "%sessions%"
- ]) // confidential endpoints to check although all endpoints apart from '/health' and '/info' are considered sensitive by Spring
- )
- )
- )
-}
-
-deprecated query predicate problems(Dependency d, string message) {
- exists(SpringBootPom pom |
- hasConfidentialEndPointExposed(pom, _) and
- d = pom.getADependency() and
- d.getArtifact().getValue() = "spring-boot-starter-actuator"
- ) and
- message = "Insecure configuration of Spring Boot Actuator exposes sensitive endpoints."
-}
diff --git a/java/ql/src/experimental/Security/CWE/CWE-016/application.properties b/java/ql/src/experimental/Security/CWE/CWE-016/application.properties
deleted file mode 100644
index 4f5defdd948e..000000000000
--- a/java/ql/src/experimental/Security/CWE/CWE-016/application.properties
+++ /dev/null
@@ -1,22 +0,0 @@
-#management.endpoints.web.base-path=/admin
-
-
-#### BAD: All management endpoints are accessible ####
-# vulnerable configuration (spring boot 1.0 - 1.4): exposes actuators by default
-
-# vulnerable configuration (spring boot 1.5+): requires value false to expose sensitive actuators
-management.security.enabled=false
-
-# vulnerable configuration (spring boot 2+): exposes health and info only by default, here overridden to expose everything
-management.endpoints.web.exposure.include=*
-
-
-#### GOOD: All management endpoints have access control ####
-# safe configuration (spring boot 1.0 - 1.4): exposes actuators by default
-management.security.enabled=true
-
-# safe configuration (spring boot 1.5+): requires value false to expose sensitive actuators
-management.security.enabled=true
-
-# safe configuration (spring boot 2+): exposes health and info only by default, here overridden to expose one additional endpoint which we assume is intentional and safe.
-management.endpoints.web.exposure.include=beans,info,health
diff --git a/java/ql/src/qlpack.yml b/java/ql/src/qlpack.yml
index e7a63231064f..ec081681c2b3 100644
--- a/java/ql/src/qlpack.yml
+++ b/java/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/java-queries
-version: 1.6.3
+version: 1.6.4-dev
groups:
- java
- queries
diff --git a/java/ql/test/experimental/query-tests/security/CWE-016/InsecureSpringActuatorConfig.expected b/java/ql/test/experimental/query-tests/security/CWE-016/InsecureSpringActuatorConfig.expected
deleted file mode 100644
index 486302939857..000000000000
--- a/java/ql/test/experimental/query-tests/security/CWE-016/InsecureSpringActuatorConfig.expected
+++ /dev/null
@@ -1 +0,0 @@
-| pom.xml:29:9:32:22 | dependency | Insecure configuration of Spring Boot Actuator exposes sensitive endpoints. |
diff --git a/java/ql/test/experimental/query-tests/security/CWE-016/InsecureSpringActuatorConfig.qlref b/java/ql/test/experimental/query-tests/security/CWE-016/InsecureSpringActuatorConfig.qlref
deleted file mode 100644
index 9cd12d5e4fb1..000000000000
--- a/java/ql/test/experimental/query-tests/security/CWE-016/InsecureSpringActuatorConfig.qlref
+++ /dev/null
@@ -1 +0,0 @@
-experimental/Security/CWE/CWE-016/InsecureSpringActuatorConfig.ql
\ No newline at end of file
diff --git a/java/ql/test/experimental/query-tests/security/CWE-016/SensitiveInfo.java b/java/ql/test/experimental/query-tests/security/CWE-016/SensitiveInfo.java
deleted file mode 100644
index a3ff69c1b817..000000000000
--- a/java/ql/test/experimental/query-tests/security/CWE-016/SensitiveInfo.java
+++ /dev/null
@@ -1,13 +0,0 @@
-import org.springframework.stereotype.Controller;
-import org.springframework.web.bind.annotation.RequestParam;
-import org.springframework.web.bind.annotation.RequestMapping;
-
-@Controller
-public class SensitiveInfo {
- @RequestMapping
- public void handleLogin(@RequestParam String username, @RequestParam String password) throws Exception {
- if (!username.equals("") && password.equals("")) {
- //Blank processing
- }
- }
-}
\ No newline at end of file
diff --git a/java/ql/test/experimental/query-tests/security/CWE-016/application.properties b/java/ql/test/experimental/query-tests/security/CWE-016/application.properties
deleted file mode 100644
index 797906a3ca3b..000000000000
--- a/java/ql/test/experimental/query-tests/security/CWE-016/application.properties
+++ /dev/null
@@ -1,14 +0,0 @@
-#management.endpoints.web.base-path=/admin
-
-# vulnerable configuration (spring boot 1.0 - 1.4): exposes actuators by default
-
-# vulnerable configuration (spring boot 1.5+): requires value false to expose sensitive actuators
-management.security.enabled=false
-
-# vulnerable configuration (spring boot 2+): exposes health and info only by default, here overridden to expose everything
-management.endpoints.web.exposure.include=*
-management.endpoints.web.exposure.exclude=beans
-
-management.endpoint.shutdown.enabled=true
-
-management.endpoint.health.show-details=when_authorized
\ No newline at end of file
diff --git a/java/ql/test/query-tests/CallsToSystemExit/CallsToSystemExit.expected b/java/ql/test/query-tests/CallsToSystemExit/CallsToSystemExit.expected
new file mode 100644
index 000000000000..cad6d0097c7b
--- /dev/null
+++ b/java/ql/test/query-tests/CallsToSystemExit/CallsToSystemExit.expected
@@ -0,0 +1,6 @@
+| ExampleRuntimeExit.java:22:17:22:44 | exit(...) | Avoid calls to Runtime.exit() as this prevents runtime cleanup and makes code harder to reuse. |
+| ExampleRuntimeExit.java:25:17:25:44 | exit(...) | Avoid calls to Runtime.exit() as this prevents runtime cleanup and makes code harder to reuse. |
+| ExampleRuntimeHalt.java:18:17:18:44 | halt(...) | Avoid calls to Runtime.halt() as this prevents runtime cleanup and makes code harder to reuse. |
+| ExampleRuntimeHalt.java:21:17:21:44 | halt(...) | Avoid calls to Runtime.halt() as this prevents runtime cleanup and makes code harder to reuse. |
+| ExampleSystemExit.java:22:17:22:30 | exit(...) | Avoid calls to System.exit() as this prevents runtime cleanup and makes code harder to reuse. |
+| ExampleSystemExit.java:25:17:25:30 | exit(...) | Avoid calls to System.exit() as this prevents runtime cleanup and makes code harder to reuse. |
diff --git a/java/ql/test/query-tests/CallsToSystemExit/CallsToSystemExit.qlref b/java/ql/test/query-tests/CallsToSystemExit/CallsToSystemExit.qlref
new file mode 100644
index 000000000000..4561fcfcfd04
--- /dev/null
+++ b/java/ql/test/query-tests/CallsToSystemExit/CallsToSystemExit.qlref
@@ -0,0 +1,2 @@
+query: Violations of Best Practice/Undesirable Calls/CallsToSystemExit.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql
diff --git a/java/ql/test/query-tests/CallsToSystemExit/ExampleRuntimeExit.java b/java/ql/test/query-tests/CallsToSystemExit/ExampleRuntimeExit.java
new file mode 100644
index 000000000000..13fd53b11419
--- /dev/null
+++ b/java/ql/test/query-tests/CallsToSystemExit/ExampleRuntimeExit.java
@@ -0,0 +1,37 @@
+import java.io.FileOutputStream;
+import java.io.IOException;
+
+public class ExampleRuntimeExit {
+
+ public static void main(String[] args) {
+ Action action = new Action();
+ try {
+ action.run();
+ } catch (Exception e) {
+ printUsageAndExit(e.getMessage(), 1);
+ }
+ Runtime.getRuntime().exit(0); // COMPLIANT
+ }
+
+ static class Action {
+ public void run() {
+ try {
+ FileOutputStream fos = new FileOutputStream("output.txt");
+ fos.write("Hello, World!".getBytes());
+ fos.close();
+ Runtime.getRuntime().exit(0); // $ Alert
+ } catch (IOException e) {
+ e.printStackTrace();
+ Runtime.getRuntime().exit(1); // $ Alert
+ } catch (Exception e) {
+ // re-throw the exception
+ throw e;
+ }
+ }
+ }
+
+ protected static void printUsageAndExit(final String message, final int exitCode) {
+ System.err.println("Usage: : " + message);
+ Runtime.getRuntime().exit(exitCode); // COMPLIANT
+ }
+}
diff --git a/java/ql/test/query-tests/CallsToSystemExit/ExampleRuntimeHalt.java b/java/ql/test/query-tests/CallsToSystemExit/ExampleRuntimeHalt.java
new file mode 100644
index 000000000000..b1d4be04f201
--- /dev/null
+++ b/java/ql/test/query-tests/CallsToSystemExit/ExampleRuntimeHalt.java
@@ -0,0 +1,25 @@
+import java.io.FileOutputStream;
+import java.io.IOException;
+
+public class ExampleRuntimeHalt {
+
+ public static void main(String[] args) {
+ Action action = new Action();
+ action.run();
+ Runtime.getRuntime().halt(0); // COMPLIANT
+ }
+
+ static class Action {
+ public void run() {
+ try {
+ FileOutputStream fos = new FileOutputStream("output.txt");
+ fos.write("Hello, World!".getBytes());
+ fos.close();
+ Runtime.getRuntime().halt(0); // $ Alert
+ } catch (IOException e) {
+ e.printStackTrace();
+ Runtime.getRuntime().halt(1); // $ Alert
+ }
+ }
+ }
+}
diff --git a/java/ql/test/query-tests/CallsToSystemExit/ExampleSystemExit.java b/java/ql/test/query-tests/CallsToSystemExit/ExampleSystemExit.java
new file mode 100644
index 000000000000..dece6e689ba1
--- /dev/null
+++ b/java/ql/test/query-tests/CallsToSystemExit/ExampleSystemExit.java
@@ -0,0 +1,37 @@
+import java.io.FileOutputStream;
+import java.io.IOException;
+
+public class ExampleSystemExit {
+
+ public static void main(String[] args) {
+ Action action = new Action();
+ try {
+ action.run();
+ } catch (Exception e) {
+ printUsageAndExit(e.getMessage(), 1);
+ }
+ System.exit(0); // COMPLIANT
+ }
+
+ static class Action {
+ public void run() {
+ try {
+ FileOutputStream fos = new FileOutputStream("output.txt");
+ fos.write("Hello, World!".getBytes());
+ fos.close();
+ System.exit(0); // $ Alert
+ } catch (IOException e) {
+ e.printStackTrace();
+ System.exit(1); // $ Alert
+ } catch (Exception e) {
+ // re-throw the exception
+ throw e;
+ }
+ }
+ }
+
+ protected static void printUsageAndExit(final String message, final int exitCode) {
+ System.err.println("Usage: : " + message);
+ System.exit(exitCode); // COMPLIANT
+ }
+}
diff --git a/java/ql/test/query-tests/CallsToSystemExit/LocalClassInTestMethod.java b/java/ql/test/query-tests/CallsToSystemExit/LocalClassInTestMethod.java
new file mode 100644
index 000000000000..459f944d7985
--- /dev/null
+++ b/java/ql/test/query-tests/CallsToSystemExit/LocalClassInTestMethod.java
@@ -0,0 +1,26 @@
+public class LocalClassInTestMethod {
+ public void testNestedCase() {
+ class OuterLocalClass {
+ void func() {
+ class NestedLocalClass {
+ void nestedMethod() {
+ System.exit(4);
+ Runtime.getRuntime().halt(5);
+ }
+ }
+ }
+ }
+ OuterLocalClass outer = new OuterLocalClass();
+ outer.func();
+ }
+ public void testNestedCase2() {
+ class OuterLocalClass {
+ class NestedLocalClass {
+ void nestedMethod() {
+ System.exit(4);
+ Runtime.getRuntime().halt(5);
+ }
+ }
+ }
+ }
+}
\ No newline at end of file
diff --git a/java/ql/test/query-tests/ExcessivePublicMethodMocking/Employee.java b/java/ql/test/query-tests/ExcessivePublicMethodMocking/Employee.java
new file mode 100644
index 000000000000..70a0091ec370
--- /dev/null
+++ b/java/ql/test/query-tests/ExcessivePublicMethodMocking/Employee.java
@@ -0,0 +1,10 @@
+/**
+ * Underlying data type of the ORM class and functions.
+ */
+public class Employee {
+ Employee(String name) {
+ this.name = name;
+ }
+
+ String name;
+}
diff --git a/java/ql/test/query-tests/ExcessivePublicMethodMocking/EmployeeRecord.java b/java/ql/test/query-tests/ExcessivePublicMethodMocking/EmployeeRecord.java
new file mode 100644
index 000000000000..4aa40d97ec37
--- /dev/null
+++ b/java/ql/test/query-tests/ExcessivePublicMethodMocking/EmployeeRecord.java
@@ -0,0 +1,26 @@
+/**
+ * Sample ORM class for the type `Employee`.
+ */
+public class EmployeeRecord {
+ public int add(Employee employee) {
+ return 1;
+ }
+
+ public Employee get(String name) {
+ return new Employee("Sample");
+ }
+
+ public int update(Employee employee, String newName) {
+ return 1;
+ }
+
+ public int delete(Employee employee) {
+ return 1;
+ }
+
+ private void f() { }
+
+ private void g() { }
+
+ private void h() { }
+}
diff --git a/java/ql/test/query-tests/ExcessivePublicMethodMocking/EmployeeStatus.java b/java/ql/test/query-tests/ExcessivePublicMethodMocking/EmployeeStatus.java
new file mode 100644
index 000000000000..3b581bb39ef8
--- /dev/null
+++ b/java/ql/test/query-tests/ExcessivePublicMethodMocking/EmployeeStatus.java
@@ -0,0 +1,9 @@
+/**
+ * Simple class with a single public method to test the edge case.
+ * When this single method is mocked, it means ALL public methods are mocked.
+ */
+public class EmployeeStatus {
+ public String getStatus() {
+ return "active";
+ }
+}
diff --git a/java/ql/test/query-tests/ExcessivePublicMethodMocking/ExcessivePublicMethodMocking.expected b/java/ql/test/query-tests/ExcessivePublicMethodMocking/ExcessivePublicMethodMocking.expected
new file mode 100644
index 000000000000..d3e95329380f
--- /dev/null
+++ b/java/ql/test/query-tests/ExcessivePublicMethodMocking/ExcessivePublicMethodMocking.expected
@@ -0,0 +1,2 @@
+| TestORM.java:34:15:34:27 | nonCompliant1 | This test method mocks all public methods of a $@. | EmployeeRecord.java:4:14:4:27 | EmployeeRecord | class or an interface |
+| TestORM.java:47:15:47:27 | nonCompliant2 | This test method mocks all public methods of a $@. | EmployeeRecord.java:4:14:4:27 | EmployeeRecord | class or an interface |
diff --git a/java/ql/test/query-tests/ExcessivePublicMethodMocking/ExcessivePublicMethodMocking.qlref b/java/ql/test/query-tests/ExcessivePublicMethodMocking/ExcessivePublicMethodMocking.qlref
new file mode 100644
index 000000000000..81a949135180
--- /dev/null
+++ b/java/ql/test/query-tests/ExcessivePublicMethodMocking/ExcessivePublicMethodMocking.qlref
@@ -0,0 +1,2 @@
+query: Violations of Best Practice/Testing/ExcessivePublicMethodMocking.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql
diff --git a/java/ql/test/query-tests/ExcessivePublicMethodMocking/TestORM.java b/java/ql/test/query-tests/ExcessivePublicMethodMocking/TestORM.java
new file mode 100644
index 000000000000..eadf01515067
--- /dev/null
+++ b/java/ql/test/query-tests/ExcessivePublicMethodMocking/TestORM.java
@@ -0,0 +1,65 @@
+import org.junit.Test;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+import static org.mockito.Mockito.doReturn;
+
+public class TestORM {
+ /**
+ * Test of form `when(mockedObject.methodToBeMocked()).thenReturn(someVal)`.
+ */
+ @Test
+ public void compliant1() {
+ Employee sampleEmployee = new Employee("John Doe");
+ EmployeeRecord employeeRecordMock = mock(EmployeeRecord.class); // COMPLIANT: Only some of the public methods belonging to the mocked object are used
+ when(employeeRecordMock.add(sampleEmployee)).thenReturn(0); // Mocked EmployeeRecord.add
+ when(employeeRecordMock.update(sampleEmployee, "Jane Doe")).thenReturn(0); // Mocked EmployeeRecord.update
+ }
+
+ /**
+ * Test of form `doReturn(someVal).when(mockedObject).methodToBeMocked()`.
+ */
+ @Test
+ public void compliant2() {
+ Employee sampleEmployee = new Employee("John Doe");
+ EmployeeRecord employeeRecordMock = mock(EmployeeRecord.class); // COMPLIANT: Only some of the public methods belonging to the mocked object are used
+ doReturn(0).when(employeeRecordMock).add(sampleEmployee); // Mocked EmployeeRecord.add
+ doReturn(0).when(employeeRecordMock).get("John Doe"); // Mocked EmployeeRecord.get
+ doReturn(0).when(employeeRecordMock).delete(sampleEmployee); // Mocked EmployeeRecord.delete
+ }
+
+ /**
+ * Test of form `when(mockedObject.methodToBeMocked()).thenReturn(someVal)`.
+ */
+ @Test
+ public void nonCompliant1() { // $ Alert
+ Employee sampleEmployee = new Employee("John Doe");
+ EmployeeRecord employeeRecordMock = mock(EmployeeRecord.class); // NON_COMPLIANT: All public methods of the mocked object are used
+ when(employeeRecordMock.add(sampleEmployee)).thenReturn(0); // Mocked EmployeeRecord.add
+ when(employeeRecordMock.get("John Doe")).thenReturn(sampleEmployee); // Mocked EmployeeRecord.get
+ when(employeeRecordMock.update(sampleEmployee, "Jane Doe")).thenReturn(0); // Mocked EmployeeRecord.update
+ when(employeeRecordMock.delete(sampleEmployee)).thenReturn(0); // Mocked EmployeeRecord.delete
+ }
+
+ /**
+ * Test of form `doReturn(someVal).when(mockedObject).methodToBeMocked()`.
+ */
+ @Test
+ public void nonCompliant2() { // $ Alert
+ Employee sampleEmployee = new Employee("John Doe");
+ EmployeeRecord employeeRecordMock = mock(EmployeeRecord.class); // NON_COMPLIANT: All public methods of the mocked object are used
+ doReturn(0).when(employeeRecordMock).add(sampleEmployee); // Mocked EmployeeRecord.add
+ doReturn(0).when(employeeRecordMock).get("John Doe"); // Mocked EmployeeRecord.get
+ doReturn(0).when(employeeRecordMock).update(sampleEmployee, "Jane Doe"); // Mocked EmployeeRecord.update
+ doReturn(0).when(employeeRecordMock).delete(sampleEmployee); // Mocked EmployeeRecord.delete
+ }
+
+ /**
+ * Edge case: Class with single public method - should NOT be flagged.
+ * When there's only one public method, mocking it doesn't indicate a "too big" test.
+ */
+ @Test
+ public void compliantSingleMethod() {
+ EmployeeStatus statusMock = mock(EmployeeStatus.class); // COMPLIANT: Single public method, no choice but to mock it if needed
+ when(statusMock.getStatus()).thenReturn("inactive"); // Mocked EmployeeStatus.getStatus (the only public method, but that's OK)
+ }
+}
diff --git a/java/ql/test/query-tests/ExcessivePublicMethodMocking/options b/java/ql/test/query-tests/ExcessivePublicMethodMocking/options
new file mode 100644
index 000000000000..8dbd14d41c15
--- /dev/null
+++ b/java/ql/test/query-tests/ExcessivePublicMethodMocking/options
@@ -0,0 +1 @@
+//semmle-extractor-options: --javac-args -cp ${testdir}/../../stubs/junit-4.13:${testdir}/../../stubs/mockito-5.14
diff --git a/java/ql/test/query-tests/Nullness/B.java b/java/ql/test/query-tests/Nullness/B.java
index 99bd6f4a1bae..b21d581535df 100644
--- a/java/ql/test/query-tests/Nullness/B.java
+++ b/java/ql/test/query-tests/Nullness/B.java
@@ -436,4 +436,83 @@ public void corrCondLoop2(boolean a[]) {
}
}
}
+
+ public void loopCorrTest1(int[] a) {
+ boolean ready = a.length > 7;
+ Object x = new Object();
+ for (int i = 0; i < a.length; i++) {
+ // condition correlates with itself through iterations when ready isn't updated
+ if (!ready) {
+ x = null;
+ } else {
+ x.hashCode(); // Spurious NPE - false positive
+ }
+ if ((a[i] & 1) != 0) {
+ ready = (a[i] & 2) != 0;
+ x = new Object();
+ }
+ }
+ }
+
+ public void loopCorrTest2(boolean[] a) {
+ Object x = new Object();
+ boolean cur = a[0];
+ for (int i = 1; i < a.length; i++) {
+ boolean prev = cur;
+ cur = a[i];
+ if (!prev) {
+ // correctly guarded by !cur from the _previous_ iteration
+ x.hashCode(); // Spurious NPE - false positive
+ } else {
+ x = new Object();
+ }
+ if (cur) {
+ x = null;
+ }
+ }
+ }
+
+ public void loopCorrTest3(String[] ss) {
+ Object x = null;
+ Object t = null;
+ for (String s : ss) {
+ if (t == null) {
+ t = s;
+ } else {
+ if (t instanceof String) {
+ x = new Object();
+ t = new Object();
+ }
+ // correctly guarded by t: null -> String -> Object
+ x.hashCode(); // Spurious NPE - false positive
+ }
+ }
+ }
+
+ public void initCorr(boolean b) {
+ Object o2 = b ? null : "";
+ if (b)
+ o2 = "";
+ else
+ o2.hashCode(); // OK
+ }
+
+ public void complexLoopTest(int[] xs, int[] ys) {
+ int len = ys != null ? ys.length : 0;
+ for (int i = 0, j = 0; i < xs.length; i++) {
+ if (j < len && ys[j] == 42) { // OK
+ j++;
+ } else if (j > 0) {
+ ys[0]++; // OK
+ }
+ }
+ }
+
+ public void trackTest(Object o, int n) {
+ boolean isnull = o == null;
+ int c = -1;
+ if (maybe) { }
+ if (c == 100) { return; }
+ o.hashCode(); // NPE
+ }
}
diff --git a/java/ql/test/query-tests/Nullness/NullMaybe.expected b/java/ql/test/query-tests/Nullness/NullMaybe.expected
index 9f2920293b07..f0d671d58bd0 100644
--- a/java/ql/test/query-tests/Nullness/NullMaybe.expected
+++ b/java/ql/test/query-tests/Nullness/NullMaybe.expected
@@ -18,6 +18,10 @@
| B.java:279:7:279:7 | a | Variable $@ may be null at this access because of $@ assignment. | B.java:276:5:276:19 | int[] a | a | B.java:276:11:276:18 | a | this |
| B.java:292:7:292:7 | b | Variable $@ may be null at this access because of $@ assignment. | B.java:287:5:287:44 | int[] b | b | B.java:287:11:287:43 | b | this |
| B.java:408:7:408:7 | x | Variable $@ may be null at this access as suggested by $@ null guard. | B.java:374:23:374:30 | x | x | B.java:375:23:375:31 | ... != ... | this |
+| B.java:448:9:448:9 | x | Variable $@ may be null at this access because of $@ assignment. | B.java:442:5:442:28 | Object x | x | B.java:446:9:446:16 | ...=... | this |
+| B.java:465:9:465:9 | x | Variable $@ may be null at this access because of $@ assignment. | B.java:458:5:458:28 | Object x | x | B.java:470:9:470:16 | ...=... | this |
+| B.java:487:9:487:9 | x | Variable $@ may be null at this access because of $@ assignment. | B.java:476:5:476:20 | Object x | x | B.java:476:12:476:19 | x | this |
+| B.java:516:5:516:5 | o | Variable $@ may be null at this access as suggested by $@ null guard. | B.java:511:25:511:32 | o | o | B.java:512:22:512:30 | ... == ... | this |
| C.java:9:44:9:45 | a2 | Variable $@ may be null at this access as suggested by $@ null guard. | C.java:6:5:6:23 | long[][] a2 | a2 | C.java:7:34:7:54 | ... != ... | this |
| C.java:9:44:9:45 | a2 | Variable $@ may be null at this access because of $@ assignment. | C.java:6:5:6:23 | long[][] a2 | a2 | C.java:6:14:6:22 | a2 | this |
| C.java:10:17:10:18 | a3 | Variable $@ may be null at this access as suggested by $@ null guard. | C.java:8:5:8:21 | long[] a3 | a3 | C.java:9:38:9:58 | ... != ... | this |
diff --git a/java/ql/test/query-tests/VisibleForTestingAbuse/VisibleForTestingAbuse.expected b/java/ql/test/query-tests/VisibleForTestingAbuse/VisibleForTestingAbuse.expected
new file mode 100644
index 000000000000..61f5b0ffc579
--- /dev/null
+++ b/java/ql/test/query-tests/VisibleForTestingAbuse/VisibleForTestingAbuse.expected
@@ -0,0 +1,17 @@
+| packageone/SourcePackage.java:9:21:9:32 | Annotated.m1 | Access of $@ annotated with VisibleForTesting found in production code. | packagetwo/Annotated.java:9:29:9:30 | m1 | element |
+| packageone/SourcePackage.java:10:21:10:32 | Annotated.m2 | Access of $@ annotated with VisibleForTesting found in production code. | packagetwo/Annotated.java:11:26:11:27 | m2 | element |
+| packageone/SourcePackage.java:16:18:16:36 | fPublic(...) | Access of $@ annotated with VisibleForTesting found in production code. | packagetwo/Annotated.java:26:23:26:29 | fPublic | element |
+| packageone/SourcePackage.java:17:18:17:39 | fProtected(...) | Access of $@ annotated with VisibleForTesting found in production code. | packagetwo/Annotated.java:31:26:31:35 | fProtected | element |
+| packageone/SourcePackage.java:25:31:25:42 | Annotated.m1 | Access of $@ annotated with VisibleForTesting found in production code. | packagetwo/Annotated.java:9:29:9:30 | m1 | element |
+| packageone/SourcePackage.java:26:31:26:42 | Annotated.m2 | Access of $@ annotated with VisibleForTesting found in production code. | packagetwo/Annotated.java:11:26:11:27 | m2 | element |
+| packageone/SourcePackage.java:29:28:29:46 | fPublic(...) | Access of $@ annotated with VisibleForTesting found in production code. | packagetwo/Annotated.java:26:23:26:29 | fPublic | element |
+| packageone/SourcePackage.java:30:28:30:49 | fProtected(...) | Access of $@ annotated with VisibleForTesting found in production code. | packagetwo/Annotated.java:31:26:31:35 | fProtected | element |
+| packageone/SourcePackage.java:34:23:34:34 | Annotated.m1 | Access of $@ annotated with VisibleForTesting found in production code. | packagetwo/Annotated.java:9:29:9:30 | m1 | element |
+| packageone/SourcePackage.java:35:30:35:41 | Annotated.m1 | Access of $@ annotated with VisibleForTesting found in production code. | packagetwo/Annotated.java:9:29:9:30 | m1 | element |
+| packageone/SourcePackage.java:36:31:36:42 | Annotated.m1 | Access of $@ annotated with VisibleForTesting found in production code. | packagetwo/Annotated.java:9:29:9:30 | m1 | element |
+| packageone/SourcePackage.java:37:33:37:44 | Annotated.m1 | Access of $@ annotated with VisibleForTesting found in production code. | packagetwo/Annotated.java:9:29:9:30 | m1 | element |
+| packagetwo/Source.java:8:20:8:30 | Annotated.m | Access of $@ annotated with VisibleForTesting found in production code. | packagetwo/Annotated.java:7:19:7:19 | m | element |
+| packagetwo/Source.java:14:17:14:29 | f(...) | Access of $@ annotated with VisibleForTesting found in production code. | packagetwo/Annotated.java:16:16:16:16 | f | element |
+| packagetwo/Source.java:20:28:20:47 | new AnnotatedClass(...) | Access of $@ annotated with VisibleForTesting found in production code. | packageone/AnnotatedClass.java:4:14:4:27 | AnnotatedClass | element |
+| packagetwo/Source.java:24:30:24:40 | Annotated.m | Access of $@ annotated with VisibleForTesting found in production code. | packagetwo/Annotated.java:7:19:7:19 | m | element |
+| packagetwo/Source.java:28:27:28:39 | f(...) | Access of $@ annotated with VisibleForTesting found in production code. | packagetwo/Annotated.java:16:16:16:16 | f | element |
\ No newline at end of file
diff --git a/java/ql/test/query-tests/VisibleForTestingAbuse/VisibleForTestingAbuse.qlref b/java/ql/test/query-tests/VisibleForTestingAbuse/VisibleForTestingAbuse.qlref
new file mode 100644
index 000000000000..57947f804319
--- /dev/null
+++ b/java/ql/test/query-tests/VisibleForTestingAbuse/VisibleForTestingAbuse.qlref
@@ -0,0 +1,2 @@
+query: Violations of Best Practice/Implementation Hiding/VisibleForTestingAbuse.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql
diff --git a/java/ql/test/query-tests/VisibleForTestingAbuse/packageone/AnnotatedClass.java b/java/ql/test/query-tests/VisibleForTestingAbuse/packageone/AnnotatedClass.java
new file mode 100644
index 000000000000..1fdbea1571e2
--- /dev/null
+++ b/java/ql/test/query-tests/VisibleForTestingAbuse/packageone/AnnotatedClass.java
@@ -0,0 +1,6 @@
+package packageone;
+
+@VisibleForTesting
+public class AnnotatedClass {
+ public AnnotatedClass() {}
+}
diff --git a/java/ql/test/query-tests/VisibleForTestingAbuse/packageone/SourcePackage.java b/java/ql/test/query-tests/VisibleForTestingAbuse/packageone/SourcePackage.java
new file mode 100644
index 000000000000..7826f5e1ee0e
--- /dev/null
+++ b/java/ql/test/query-tests/VisibleForTestingAbuse/packageone/SourcePackage.java
@@ -0,0 +1,38 @@
+package packageone;
+
+import packagetwo.Annotated;
+
+public class SourcePackage extends Annotated {
+ void f() {
+ // Fields - cross-package access (only accessible ones)
+ // String s = Annotated.m; // Cannot access package-private from different package
+ String s1 = Annotated.m1; // $ Alert
+ String s2 = Annotated.m2; // $ Alert
+ // String s3 = Annotated.m3; // Cannot access private field
+
+ // Methods - cross-package access (only accessible ones)
+ // int i = Annotated.f(); // Cannot access package-private from different package
+ // int i1 = Annotated.fPrivate(); // Cannot access private method
+ int i2 = Annotated.fPublic(); // $ Alert
+ int i3 = Annotated.fProtected(); // $ Alert
+
+ // Same package class
+ AnnotatedClass a = new AnnotatedClass(); // COMPLIANT - same package
+
+ // Lambda usage - cross-package (only accessible members)
+ Runnable lambda = () -> {
+ // String lambdaS = Annotated.m; // Cannot access package-private
+ String lambdaS1 = Annotated.m1; // $ Alert
+ String lambdaS2 = Annotated.m2; // $ Alert
+
+ // int lambdaI = Annotated.f(); // Cannot access package-private
+ int lambdaI2 = Annotated.fPublic(); // $ Alert
+ int lambdaI3 = Annotated.fProtected(); // $ Alert
+ };
+ lambda.run();
+ }
+ String myField1 = Annotated.m1; // $ Alert
+ public String myField2 = Annotated.m1; // $ Alert
+ private String myField3 = Annotated.m1; // $ Alert
+ protected String myField4 = Annotated.m1; // $ Alert
+}
diff --git a/java/ql/test/query-tests/VisibleForTestingAbuse/packageone/SourcePackage1.java b/java/ql/test/query-tests/VisibleForTestingAbuse/packageone/SourcePackage1.java
new file mode 100644
index 000000000000..d47aa167b46c
--- /dev/null
+++ b/java/ql/test/query-tests/VisibleForTestingAbuse/packageone/SourcePackage1.java
@@ -0,0 +1,22 @@
+package packageone;
+
+import packagetwo.Annotated;
+
+public class SourcePackage1 extends Annotated {
+ @VisibleForTesting
+ public void f() {
+
+ String s1 = Annotated.m1;
+ String s2 = Annotated.m2;
+
+ int i2 = Annotated.fPublic();
+ int i3 = Annotated.fProtected();
+
+ Runnable lambda = () -> {
+ String lambdaS1 = Annotated.m1;
+ String lambdaS2 = Annotated.m2;
+ int lambdaI2 = Annotated.fPublic();
+ int lambdaI3 = Annotated.fProtected();
+ };
+ }
+}
diff --git a/java/ql/test/query-tests/VisibleForTestingAbuse/packageone/VisibleForTesting.java b/java/ql/test/query-tests/VisibleForTestingAbuse/packageone/VisibleForTesting.java
new file mode 100644
index 000000000000..28aedbf4e539
--- /dev/null
+++ b/java/ql/test/query-tests/VisibleForTestingAbuse/packageone/VisibleForTesting.java
@@ -0,0 +1,4 @@
+package packageone;
+
+public @interface VisibleForTesting {
+}
diff --git a/java/ql/test/query-tests/VisibleForTestingAbuse/packagetwo/Annotated.java b/java/ql/test/query-tests/VisibleForTestingAbuse/packagetwo/Annotated.java
new file mode 100644
index 000000000000..ad5dbed3f9b6
--- /dev/null
+++ b/java/ql/test/query-tests/VisibleForTestingAbuse/packagetwo/Annotated.java
@@ -0,0 +1,92 @@
+package packagetwo;
+
+import packageone.*;
+
+public class Annotated {
+ @VisibleForTesting
+ static String m;
+ @VisibleForTesting
+ static protected String m1;
+ @VisibleForTesting
+ static public String m2;
+ @VisibleForTesting
+ static private String m3;
+
+ @VisibleForTesting
+ static int f() {
+ return 1;
+ }
+
+ @VisibleForTesting
+ static private int fPrivate() {
+ return 1;
+ }
+
+ @VisibleForTesting
+ static public int fPublic() {
+ return 1;
+ }
+
+ @VisibleForTesting
+ static protected int fProtected() {
+ return 1;
+ }
+
+ private static void resetPriorities() {
+ String priority = m;
+ String priority1 = m1;
+ String priority2 = m2;
+ String priority3 = m3;
+
+ int result = f();
+ int resultPrivate = fPrivate();
+ int resultPublic = fPublic();
+ int resultProtected = fProtected();
+ }
+
+ private static void resetPriorities2() {
+ Runnable task = () -> {
+ String priority = m;
+ String priority1 = m1;
+ String priority2 = m2;
+ String priority3 = m3;
+
+ int result = f();
+ int resultPrivate = fPrivate();
+ int resultPublic = fPublic();
+ int resultProtected = fProtected();
+ };
+ task.run();
+ }
+
+ private static class InnerClass {
+ void useVisibleForMembers() {
+ String field = m;
+ String field1 = m1;
+ String field2 = m2;
+ String field3 = m3;
+
+ int method = f();
+ int methodPrivate = fPrivate();
+ int methodPublic = fPublic();
+ int methodProtected = fProtected();
+ }
+ }
+
+ @VisibleForTesting
+ static class InnerTestClass {
+ @VisibleForTesting
+ int getSize() {
+ return 42;
+ }
+
+ @VisibleForTesting
+ private String data;
+ }
+
+ private void useInnerClass() {
+ InnerTestClass inner = new InnerTestClass();
+ int size = inner.getSize();
+ String value = inner.data;
+ }
+}
diff --git a/java/ql/test/query-tests/VisibleForTestingAbuse/packagetwo/Source.java b/java/ql/test/query-tests/VisibleForTestingAbuse/packagetwo/Source.java
new file mode 100644
index 000000000000..94a5cccfd43b
--- /dev/null
+++ b/java/ql/test/query-tests/VisibleForTestingAbuse/packagetwo/Source.java
@@ -0,0 +1,34 @@
+package packagetwo;
+
+import packageone.*;
+
+public class Source {
+ void f() {
+ // Fields
+ String s = Annotated.m; // $ Alert
+ String s1 = Annotated.m1; // COMPLIANT - same package
+ String s2 = Annotated.m2;
+ // String s3 = Annotated.m3; // Cannot access private field
+
+ // Methods
+ int i = Annotated.f(); // $ Alert
+ // int i1 = Annotated.fPrivate(); // Cannot access private method
+ int i2 = Annotated.fPublic();
+ int i3 = Annotated.fProtected();
+
+ // Other class
+ AnnotatedClass a = new AnnotatedClass(); // $ Alert
+
+ // Lambda usage
+ Runnable lambda = () -> {
+ String lambdaS = Annotated.m; // $ Alert
+ String lambdaS1 = Annotated.m1;
+ String lambdaS2 = Annotated.m2;
+
+ int lambdaI = Annotated.f(); // $ Alert
+ int lambdaI2 = Annotated.fPublic();
+ int lambdaI3 = Annotated.fProtected();
+ };
+ lambda.run();
+ }
+}
diff --git a/java/ql/test/query-tests/VisibleForTestingAbuse/packagetwo/Test.java b/java/ql/test/query-tests/VisibleForTestingAbuse/packagetwo/Test.java
new file mode 100644
index 000000000000..b861d921e9a3
--- /dev/null
+++ b/java/ql/test/query-tests/VisibleForTestingAbuse/packagetwo/Test.java
@@ -0,0 +1,34 @@
+package packagetwo;
+
+import packageone.*;
+
+public class Test {
+ void f() {
+ // Fields
+ String s = Annotated.m; // COMPLIANT
+ String s1 = Annotated.m1; // COMPLIANT
+ String s2 = Annotated.m2; // COMPLIANT
+ // String s3 = Annotated.m3; // Cannot access private field
+
+ // Methods
+ int i = Annotated.f(); // COMPLIANT
+ // int i1 = Annotated.fPrivate(); // Cannot access private method
+ int i2 = Annotated.fPublic(); // COMPLIANT
+ int i3 = Annotated.fProtected(); // COMPLIANT
+
+ // Other class
+ AnnotatedClass a = new AnnotatedClass(); // COMPLIANT
+
+ // Lambda usage
+ Runnable lambda = () -> {
+ String lambdaS = Annotated.m; // COMPLIANT
+ String lambdaS1 = Annotated.m1; // COMPLIANT
+ String lambdaS2 = Annotated.m2; // COMPLIANT
+
+ int lambdaI = Annotated.f(); // COMPLIANT
+ int lambdaI2 = Annotated.fPublic(); // COMPLIANT
+ int lambdaI3 = Annotated.fProtected(); // COMPLIANT
+ };
+ lambda.run();
+ }
+}
diff --git a/java/ql/test/query-tests/VisibleForTestingAbuse/packagetwo/UseWithinAnnotation.java b/java/ql/test/query-tests/VisibleForTestingAbuse/packagetwo/UseWithinAnnotation.java
new file mode 100644
index 000000000000..f6cdb32d53c7
--- /dev/null
+++ b/java/ql/test/query-tests/VisibleForTestingAbuse/packagetwo/UseWithinAnnotation.java
@@ -0,0 +1,18 @@
+package packagetwo;
+
+import packageone.*;
+
+@interface Range {
+ int min() default 0;
+ int max() default 100;
+}
+
+public class UseWithinAnnotation {
+ @VisibleForTesting
+ static final int MAX_LISTING_LENGTH_MIN = 1;
+ @VisibleForTesting
+ static final int MAX_LISTING_LENGTH_MAX = 1000;
+
+ @Range(min = MAX_LISTING_LENGTH_MIN, max = MAX_LISTING_LENGTH_MAX)
+ private int maxListingLength = MAX_LISTING_LENGTH_MAX;
+}
diff --git a/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/SpringBootActuatorsConfig.expected b/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/SpringBootActuatorsConfig.expected
new file mode 100644
index 000000000000..8845d970df2a
--- /dev/null
+++ b/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/SpringBootActuatorsConfig.expected
@@ -0,0 +1,8 @@
+| Version1.0.x-1.4.x/bad/default/pom.xml:29:9:32:22 | dependency | Insecure Spring Boot actuator $@ exposes sensitive endpoints. | file://:0:0:0:0 | (none) | configuration |
+| Version1.0.x-1.4.x/bad/false/pom.xml:29:9:32:22 | dependency | Insecure Spring Boot actuator $@ exposes sensitive endpoints. | Version1.0.x-1.4.x/bad/false/application.properties:2:1:2:33 | management.security.enabled=false | configuration |
+| Version1.5.x/bad/pom.xml:29:9:32:22 | dependency | Insecure Spring Boot actuator $@ exposes sensitive endpoints. | Version1.5.x/bad/application.properties:2:1:2:33 | management.security.enabled=false | configuration |
+| Version2.x/bad/expose/pom.xml:29:9:32:22 | dependency | Insecure Spring Boot actuator $@ exposes sensitive endpoints. | Version2.x/bad/expose/application.properties:2:1:2:33 | management.endpoints.web.expose=* | configuration |
+| Version2.x/bad/exposure-include/all-exposed/pom.xml:29:9:32:22 | dependency | Insecure Spring Boot actuator $@ exposes sensitive endpoints. | Version2.x/bad/exposure-include/all-exposed/application.properties:2:1:2:43 | management.endpoints.web.exposure.include=* | configuration |
+| Version2.x/bad/exposure-include/some-exposed/pom.xml:29:9:32:22 | dependency | Insecure Spring Boot actuator $@ exposes sensitive endpoints. | Version2.x/bad/exposure-include/some-exposed/application.properties:2:1:2:59 | management.endpoints.web.exposure.include=health,info,beans | configuration |
+| Version3.x/bad/all-exposed/pom.xml:29:9:32:22 | dependency | Insecure Spring Boot actuator $@ exposes sensitive endpoints. | Version3.x/bad/all-exposed/application.properties:2:1:2:43 | management.endpoints.web.exposure.include=* | configuration |
+| Version3.x/bad/some-exposed/pom.xml:29:9:32:22 | dependency | Insecure Spring Boot actuator $@ exposes sensitive endpoints. | Version3.x/bad/some-exposed/application.properties:2:1:2:59 | management.endpoints.web.exposure.include=health,info,beans | configuration |
diff --git a/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/SpringBootActuatorsConfig.qlref b/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/SpringBootActuatorsConfig.qlref
new file mode 100644
index 000000000000..eec8ba18ae18
--- /dev/null
+++ b/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/SpringBootActuatorsConfig.qlref
@@ -0,0 +1,2 @@
+query: Security/CWE/CWE-200/SpringBootActuatorsConfig/SpringBootActuatorsConfig.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql
diff --git a/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version1.0.x-1.4.x/bad/default/application.properties b/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version1.0.x-1.4.x/bad/default/application.properties
new file mode 100644
index 000000000000..a41bbc9fdca3
--- /dev/null
+++ b/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version1.0.x-1.4.x/bad/default/application.properties
@@ -0,0 +1 @@
+# vulnerable configuration (spring boot 1.0 - 1.4): exposes actuators by default
\ No newline at end of file
diff --git a/java/ql/src/experimental/Security/CWE/CWE-016/pom_bad.xml b/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version1.0.x-1.4.x/bad/default/pom.xml
similarity index 93%
rename from java/ql/src/experimental/Security/CWE/CWE-016/pom_bad.xml
rename to java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version1.0.x-1.4.x/bad/default/pom.xml
index 9dd5c9c188b4..83c7d2685f37 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-016/pom_bad.xml
+++ b/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version1.0.x-1.4.x/bad/default/pom.xml
@@ -17,7 +17,7 @@
org.springframework.boot
spring-boot-starter-parent
- 2.3.8.RELEASE
+ 1.2.6.RELEASE
@@ -29,18 +29,15 @@
org.springframework.boot
spring-boot-starter-actuator
-
+
org.springframework.boot
spring-boot-devtools
-
-
-
org.springframework.boot
spring-boot-test
diff --git a/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version1.0.x-1.4.x/bad/false/application.properties b/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version1.0.x-1.4.x/bad/false/application.properties
new file mode 100644
index 000000000000..621b859214cb
--- /dev/null
+++ b/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version1.0.x-1.4.x/bad/false/application.properties
@@ -0,0 +1,2 @@
+# vulnerable configuration (spring boot 1.0 - 1.4): exposes actuators by default
+management.security.enabled=false
\ No newline at end of file
diff --git a/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version1.0.x-1.4.x/bad/false/pom.xml b/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version1.0.x-1.4.x/bad/false/pom.xml
new file mode 100644
index 000000000000..83c7d2685f37
--- /dev/null
+++ b/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version1.0.x-1.4.x/bad/false/pom.xml
@@ -0,0 +1,47 @@
+
+
+ 4.0.0
+
+ spring-boot-actuator-app
+ spring-boot-actuator-app
+ 1.0-SNAPSHOT
+
+
+ UTF-8
+ 1.8
+ 1.8
+
+
+
+ org.springframework.boot
+ spring-boot-starter-parent
+ 1.2.6.RELEASE
+
+
+
+
+
+ org.springframework.boot
+ spring-boot-starter-web
+
+
+ org.springframework.boot
+ spring-boot-starter-actuator
+
+
+ org.springframework.boot
+ spring-boot-devtools
+
+
+
+ org.springframework.boot
+ spring-boot-test
+
+
+
+
\ No newline at end of file
diff --git a/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version1.0.x-1.4.x/good/application.properties b/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version1.0.x-1.4.x/good/application.properties
new file mode 100644
index 000000000000..6cadc4c756d1
--- /dev/null
+++ b/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version1.0.x-1.4.x/good/application.properties
@@ -0,0 +1,2 @@
+# safe configuration (spring boot 1.0 - 1.4): exposes actuators by default
+management.security.enabled=true
\ No newline at end of file
diff --git a/java/ql/src/experimental/Security/CWE/CWE-016/pom_good.xml b/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version1.0.x-1.4.x/good/pom.xml
similarity index 94%
rename from java/ql/src/experimental/Security/CWE/CWE-016/pom_good.xml
rename to java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version1.0.x-1.4.x/good/pom.xml
index 89f577f21e59..452d4b69c354 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-016/pom_good.xml
+++ b/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version1.0.x-1.4.x/good/pom.xml
@@ -17,7 +17,7 @@
org.springframework.boot
spring-boot-starter-parent
- 2.3.8.RELEASE
+ 1.2.6.RELEASE
@@ -34,13 +34,10 @@
org.springframework.boot
spring-boot-devtools
-
-
org.springframework.boot
spring-boot-starter-security
-
org.springframework.boot
spring-boot-test
diff --git a/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version1.5.x/bad/application.properties b/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version1.5.x/bad/application.properties
new file mode 100644
index 000000000000..f1e8f6587d05
--- /dev/null
+++ b/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version1.5.x/bad/application.properties
@@ -0,0 +1,2 @@
+# safe configuration (spring boot 1.5+): requires value false to expose sensitive actuators
+management.security.enabled=false
\ No newline at end of file
diff --git a/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version1.5.x/bad/pom.xml b/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version1.5.x/bad/pom.xml
new file mode 100644
index 000000000000..aa1a4bcaf056
--- /dev/null
+++ b/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version1.5.x/bad/pom.xml
@@ -0,0 +1,47 @@
+
+
+ 4.0.0
+
+ spring-boot-actuator-app
+ spring-boot-actuator-app
+ 1.0-SNAPSHOT
+
+
+ UTF-8
+ 1.8
+ 1.8
+
+
+
+ org.springframework.boot
+ spring-boot-starter-parent
+ 1.5.6.RELEASE
+
+
+
+
+
+ org.springframework.boot
+ spring-boot-starter-web
+
+
+ org.springframework.boot
+ spring-boot-starter-actuator
+
+
+ org.springframework.boot
+ spring-boot-devtools
+
+
+
+ org.springframework.boot
+ spring-boot-test
+
+
+
+
\ No newline at end of file
diff --git a/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version1.5.x/good/application.properties b/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version1.5.x/good/application.properties
new file mode 100644
index 000000000000..bec45a22b82d
--- /dev/null
+++ b/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version1.5.x/good/application.properties
@@ -0,0 +1,2 @@
+# vulnerable configuration (spring boot 1.5+): requires value false to expose sensitive actuators
+management.security.enabled=true
\ No newline at end of file
diff --git a/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version1.5.x/good/pom.xml b/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version1.5.x/good/pom.xml
new file mode 100644
index 000000000000..39b46bef7e48
--- /dev/null
+++ b/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version1.5.x/good/pom.xml
@@ -0,0 +1,47 @@
+
+
+ 4.0.0
+
+ spring-boot-actuator-app
+ spring-boot-actuator-app
+ 1.0-SNAPSHOT
+
+
+ UTF-8
+ 1.8
+ 1.8
+
+
+
+ org.springframework.boot
+ spring-boot-starter-parent
+ 1.5.6.RELEASE
+
+
+
+
+
+ org.springframework.boot
+ spring-boot-starter-web
+
+
+ org.springframework.boot
+ spring-boot-starter-actuator
+
+
+ org.springframework.boot
+ spring-boot-devtools
+
+
+ org.springframework.boot
+ spring-boot-starter-security
+
+
+ org.springframework.boot
+ spring-boot-test
+
+
+
+
\ No newline at end of file
diff --git a/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version2.x/bad/expose/application.properties b/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version2.x/bad/expose/application.properties
new file mode 100644
index 000000000000..338b1fb3a9c1
--- /dev/null
+++ b/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version2.x/bad/expose/application.properties
@@ -0,0 +1,2 @@
+# vulnerable configuration (spring boot 2.0.0.RC1): exposes health and info only by default, here overridden to expose everything
+management.endpoints.web.expose=*
\ No newline at end of file
diff --git a/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version2.x/bad/expose/pom.xml b/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version2.x/bad/expose/pom.xml
new file mode 100644
index 000000000000..c22f08d7e7ec
--- /dev/null
+++ b/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version2.x/bad/expose/pom.xml
@@ -0,0 +1,47 @@
+
+
+ 4.0.0
+
+ spring-boot-actuator-app
+ spring-boot-actuator-app
+ 1.0-SNAPSHOT
+
+
+ UTF-8
+ 1.8
+ 1.8
+
+
+
+ org.springframework.boot
+ spring-boot-starter-parent
+ 2.2.6.RELEASE
+
+
+
+
+
+ org.springframework.boot
+ spring-boot-starter-web
+
+
+ org.springframework.boot
+ spring-boot-starter-actuator
+
+
+ org.springframework.boot
+ spring-boot-devtools
+
+
+
+ org.springframework.boot
+ spring-boot-test
+
+
+
+
\ No newline at end of file
diff --git a/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version2.x/bad/exposure-include/all-exposed/application.properties b/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version2.x/bad/exposure-include/all-exposed/application.properties
new file mode 100644
index 000000000000..bbc1915b05e1
--- /dev/null
+++ b/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version2.x/bad/exposure-include/all-exposed/application.properties
@@ -0,0 +1,2 @@
+# vulnerable configuration (spring boot 2+): exposes health and info only by default, here overridden to expose everything
+management.endpoints.web.exposure.include=*
\ No newline at end of file
diff --git a/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version2.x/bad/exposure-include/all-exposed/pom.xml b/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version2.x/bad/exposure-include/all-exposed/pom.xml
new file mode 100644
index 000000000000..c22f08d7e7ec
--- /dev/null
+++ b/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version2.x/bad/exposure-include/all-exposed/pom.xml
@@ -0,0 +1,47 @@
+
+
+ 4.0.0
+
+ spring-boot-actuator-app
+ spring-boot-actuator-app
+ 1.0-SNAPSHOT
+
+
+ UTF-8
+ 1.8
+ 1.8
+
+
+
+ org.springframework.boot
+ spring-boot-starter-parent
+ 2.2.6.RELEASE
+
+
+
+
+
+ org.springframework.boot
+ spring-boot-starter-web
+
+
+ org.springframework.boot
+ spring-boot-starter-actuator
+
+
+ org.springframework.boot
+ spring-boot-devtools
+
+
+
+ org.springframework.boot
+ spring-boot-test
+
+
+
+
\ No newline at end of file
diff --git a/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version2.x/bad/exposure-include/some-exposed/application.properties b/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version2.x/bad/exposure-include/some-exposed/application.properties
new file mode 100644
index 000000000000..1f29407c1923
--- /dev/null
+++ b/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version2.x/bad/exposure-include/some-exposed/application.properties
@@ -0,0 +1,2 @@
+# vulnerable configuration (spring boot 2+): exposes health and info only by default, here overridden to also expose beans
+management.endpoints.web.exposure.include=health,info,beans
\ No newline at end of file
diff --git a/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version2.x/bad/exposure-include/some-exposed/pom.xml b/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version2.x/bad/exposure-include/some-exposed/pom.xml
new file mode 100644
index 000000000000..c22f08d7e7ec
--- /dev/null
+++ b/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version2.x/bad/exposure-include/some-exposed/pom.xml
@@ -0,0 +1,47 @@
+
+
+ 4.0.0
+
+ spring-boot-actuator-app
+ spring-boot-actuator-app
+ 1.0-SNAPSHOT
+
+
+ UTF-8
+ 1.8
+ 1.8
+
+
+
+ org.springframework.boot
+ spring-boot-starter-parent
+ 2.2.6.RELEASE
+
+
+
+
+
+ org.springframework.boot
+ spring-boot-starter-web
+
+
+ org.springframework.boot
+ spring-boot-starter-actuator
+
+
+ org.springframework.boot
+ spring-boot-devtools
+
+
+
+ org.springframework.boot
+ spring-boot-test
+
+
+
+
\ No newline at end of file
diff --git a/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version2.x/good/application.properties b/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version2.x/good/application.properties
new file mode 100644
index 000000000000..f7e0c1b43ac3
--- /dev/null
+++ b/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version2.x/good/application.properties
@@ -0,0 +1,2 @@
+# safe configuration (spring boot 2+): exposes health and info only by default
+management.endpoints.web.exposure.include=info,health
\ No newline at end of file
diff --git a/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version2.x/good/pom.xml b/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version2.x/good/pom.xml
new file mode 100644
index 000000000000..e65ebf04701a
--- /dev/null
+++ b/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version2.x/good/pom.xml
@@ -0,0 +1,47 @@
+
+
+ 4.0.0
+
+ spring-boot-actuator-app
+ spring-boot-actuator-app
+ 1.0-SNAPSHOT
+
+
+ UTF-8
+ 1.8
+ 1.8
+
+
+
+ org.springframework.boot
+ spring-boot-starter-parent
+ 2.2.6.RELEASE
+
+
+
+
+
+ org.springframework.boot
+ spring-boot-starter-web
+
+
+ org.springframework.boot
+ spring-boot-starter-actuator
+
+
+ org.springframework.boot
+ spring-boot-devtools
+
+
+ org.springframework.boot
+ spring-boot-starter-security
+
+
+ org.springframework.boot
+ spring-boot-test
+
+
+
+
\ No newline at end of file
diff --git a/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version3.x/bad/all-exposed/application.properties b/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version3.x/bad/all-exposed/application.properties
new file mode 100644
index 000000000000..c5570065bae5
--- /dev/null
+++ b/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version3.x/bad/all-exposed/application.properties
@@ -0,0 +1,2 @@
+# vulnerable configuration (spring boot 3+): exposes health only by default, here overridden to expose everything
+management.endpoints.web.exposure.include=*
\ No newline at end of file
diff --git a/java/ql/test/experimental/query-tests/security/CWE-016/pom.xml b/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version3.x/bad/all-exposed/pom.xml
similarity index 95%
rename from java/ql/test/experimental/query-tests/security/CWE-016/pom.xml
rename to java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version3.x/bad/all-exposed/pom.xml
index a9d5fa920c84..12dab1d9421a 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-016/pom.xml
+++ b/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version3.x/bad/all-exposed/pom.xml
@@ -17,7 +17,7 @@
org.springframework.boot
spring-boot-starter-parent
- 2.3.8.RELEASE
+ 3.3.5
@@ -29,7 +29,7 @@
org.springframework.boot
spring-boot-starter-actuator
-
+
org.springframework.boot
spring-boot-devtools
diff --git a/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version3.x/bad/some-exposed/application.properties b/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version3.x/bad/some-exposed/application.properties
new file mode 100644
index 000000000000..27d08eac74f6
--- /dev/null
+++ b/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version3.x/bad/some-exposed/application.properties
@@ -0,0 +1,2 @@
+# vulnerable configuration (spring boot 3+): exposes health only by default, here overridden to also expose info and beans
+management.endpoints.web.exposure.include=health,info,beans
\ No newline at end of file
diff --git a/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version3.x/bad/some-exposed/pom.xml b/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version3.x/bad/some-exposed/pom.xml
new file mode 100644
index 000000000000..12dab1d9421a
--- /dev/null
+++ b/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version3.x/bad/some-exposed/pom.xml
@@ -0,0 +1,47 @@
+
+
+ 4.0.0
+
+ spring-boot-actuator-app
+ spring-boot-actuator-app
+ 1.0-SNAPSHOT
+
+
+ UTF-8
+ 1.8
+ 1.8
+
+
+
+ org.springframework.boot
+ spring-boot-starter-parent
+ 3.3.5
+
+
+
+
+
+ org.springframework.boot
+ spring-boot-starter-web
+
+
+ org.springframework.boot
+ spring-boot-starter-actuator
+
+
+ org.springframework.boot
+ spring-boot-devtools
+
+
+
+ org.springframework.boot
+ spring-boot-test
+
+
+
+
\ No newline at end of file
diff --git a/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version3.x/good/application.properties b/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version3.x/good/application.properties
new file mode 100644
index 000000000000..8ba56eadc351
--- /dev/null
+++ b/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version3.x/good/application.properties
@@ -0,0 +1,2 @@
+# safe configuration (spring boot 3+): exposes health only by default.
+management.endpoints.web.exposure.include=health
\ No newline at end of file
diff --git a/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version3.x/good/pom.xml b/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version3.x/good/pom.xml
new file mode 100644
index 000000000000..a8103e681e4c
--- /dev/null
+++ b/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/Version3.x/good/pom.xml
@@ -0,0 +1,47 @@
+
+
+ 4.0.0
+
+ spring-boot-actuator-app
+ spring-boot-actuator-app
+ 1.0-SNAPSHOT
+
+
+ UTF-8
+ 1.8
+ 1.8
+
+
+
+ org.springframework.boot
+ spring-boot-starter-parent
+ 3.3.5
+
+
+
+
+
+ org.springframework.boot
+ spring-boot-starter-web
+
+
+ org.springframework.boot
+ spring-boot-starter-actuator
+
+
+ org.springframework.boot
+ spring-boot-devtools
+
+
+ org.springframework.boot
+ spring-boot-starter-security
+
+
+ org.springframework.boot
+ spring-boot-test
+
+
+
+
\ No newline at end of file
diff --git a/java/ql/test/experimental/query-tests/security/CWE-016/options b/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/options
similarity index 62%
rename from java/ql/test/experimental/query-tests/security/CWE-016/options
rename to java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/options
index 2ce7a4743cd3..ab29fd4e46fa 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-016/options
+++ b/java/ql/test/query-tests/security/CWE-200/semmle/tests/SpringBootActuatorsConfig/options
@@ -1 +1 @@
-//semmle-extractor-options: --javac-args -cp ${testdir}/../../../../stubs/springframework-5.8.x
+//semmle-extractor-options: --javac-args -cp ${testdir}/../../../../../../stubs/springframework-5.8.x
diff --git a/java/ql/test/stubs/junit-4.13/LICENSE-junit.txt b/java/ql/test/stubs/junit-4.13/LICENSE-junit.txt
new file mode 100644
index 000000000000..fb686291a055
--- /dev/null
+++ b/java/ql/test/stubs/junit-4.13/LICENSE-junit.txt
@@ -0,0 +1,214 @@
+JUnit
+
+Eclipse Public License - v 1.0
+
+THE ACCOMPANYING PROGRAM IS PROVIDED UNDER THE TERMS OF THIS ECLIPSE PUBLIC
+LICENSE ("AGREEMENT"). ANY USE, REPRODUCTION OR DISTRIBUTION OF THE PROGRAM
+CONSTITUTES RECIPIENT'S ACCEPTANCE OF THIS AGREEMENT.
+
+1. DEFINITIONS
+
+"Contribution" means:
+
+ a) in the case of the initial Contributor, the initial code and
+ documentation distributed under this Agreement, and
+ b) in the case of each subsequent Contributor:
+
+ i) changes to the Program, and
+
+ ii) additions to the Program;
+
+ where such changes and/or additions to the Program originate from and are
+distributed by that particular Contributor. A Contribution 'originates' from a
+Contributor if it was added to the Program by such Contributor itself or anyone
+acting on such Contributor's behalf. Contributions do not include additions to
+the Program which: (i) are separate modules of software distributed in
+conjunction with the Program under their own license agreement, and (ii) are
+not derivative works of the Program.
+
+"Contributor" means any person or entity that distributes the Program.
+
+"Licensed Patents " mean patent claims licensable by a Contributor which are
+necessarily infringed by the use or sale of its Contribution alone or when
+combined with the Program.
+
+"Program" means the Contributions distributed in accordance with this Agreement.
+
+"Recipient" means anyone who receives the Program under this Agreement,
+including all Contributors.
+
+2. GRANT OF RIGHTS
+
+ a) Subject to the terms of this Agreement, each Contributor hereby grants
+Recipient a non-exclusive, worldwide, royalty-free copyright license to
+reproduce, prepare derivative works of, publicly display, publicly perform,
+distribute and sublicense the Contribution of such Contributor, if any, and
+such derivative works, in source code and object code form.
+
+ b) Subject to the terms of this Agreement, each Contributor hereby grants
+Recipient a non-exclusive, worldwide, royalty-free patent license under
+Licensed Patents to make, use, sell, offer to sell, import and otherwise
+transfer the Contribution of such Contributor, if any, in source code and
+object code form. This patent license shall apply to the combination of the
+Contribution and the Program if, at the time the Contribution is added by the
+Contributor, such addition of the Contribution causes such combination to be
+covered by the Licensed Patents. The patent license shall not apply to any
+other combinations which include the Contribution. No hardware per se is
+licensed hereunder.
+
+ c) Recipient understands that although each Contributor grants the
+licenses to its Contributions set forth herein, no assurances are provided by
+any Contributor that the Program does not infringe the patent or other
+intellectual property rights of any other entity. Each Contributor disclaims
+any liability to Recipient for claims brought by any other entity based on
+infringement of intellectual property rights or otherwise. As a condition to
+exercising the rights and licenses granted hereunder, each Recipient hereby
+assumes sole responsibility to secure any other intellectual property rights
+needed, if any. For example, if a third party patent license is required to
+allow Recipient to distribute the Program, it is Recipient's responsibility to
+acquire that license before distributing the Program.
+
+ d) Each Contributor represents that to its knowledge it has sufficient
+copyright rights in its Contribution, if any, to grant the copyright license
+set forth in this Agreement.
+
+3. REQUIREMENTS
+
+A Contributor may choose to distribute the Program in object code form under
+its own license agreement, provided that:
+
+ a) it complies with the terms and conditions of this Agreement; and
+
+ b) its license agreement:
+
+ i) effectively disclaims on behalf of all Contributors all warranties and
+conditions, express and implied, including warranties or conditions of title
+and non-infringement, and implied warranties or conditions of merchantability
+and fitness for a particular purpose;
+
+ ii) effectively excludes on behalf of all Contributors all liability for
+damages, including direct, indirect, special, incidental and consequential
+damages, such as lost profits;
+
+ iii) states that any provisions which differ from this Agreement are
+offered by that Contributor alone and not by any other party; and
+
+ iv) states that source code for the Program is available from such
+Contributor, and informs licensees how to obtain it in a reasonable manner on
+or through a medium customarily used for software exchange.
+
+When the Program is made available in source code form:
+
+ a) it must be made available under this Agreement; and
+
+ b) a copy of this Agreement must be included with each copy of the
+Program.
+
+Contributors may not remove or alter any copyright notices contained within the
+Program.
+
+Each Contributor must identify itself as the originator of its Contribution, if
+any, in a manner that reasonably allows subsequent Recipients to identify the
+originator of the Contribution.
+
+4. COMMERCIAL DISTRIBUTION
+
+Commercial distributors of software may accept certain responsibilities with
+respect to end users, business partners and the like. While this license is
+intended to facilitate the commercial use of the Program, the Contributor who
+includes the Program in a commercial product offering should do so in a manner
+which does not create potential liability for other Contributors. Therefore, if
+a Contributor includes the Program in a commercial product offering, such
+Contributor ("Commercial Contributor") hereby agrees to defend and indemnify
+every other Contributor ("Indemnified Contributor") against any losses, damages
+and costs (collectively "Losses") arising from claims, lawsuits and other legal
+actions brought by a third party against the Indemnified Contributor to the
+extent caused by the acts or omissions of such Commercial Contributor in
+connection with its distribution of the Program in a commercial product
+offering. The obligations in this section do not apply to any claims or Losses
+relating to any actual or alleged intellectual property infringement. In order
+to qualify, an Indemnified Contributor must: a) promptly notify the Commercial
+Contributor in writing of such claim, and b) allow the Commercial Contributor
+to control, and cooperate with the Commercial Contributor in, the defense and
+any related settlement negotiations. The Indemnified Contributor may
+participate in any such claim at its own expense.
+
+For example, a Contributor might include the Program in a commercial product
+offering, Product X. That Contributor is then a Commercial Contributor. If that
+Commercial Contributor then makes performance claims, or offers warranties
+related to Product X, those performance claims and warranties are such
+Commercial Contributor's responsibility alone. Under this section, the
+Commercial Contributor would have to defend claims against the other
+Contributors related to those performance claims and warranties, and if a court
+requires any other Contributor to pay any damages as a result, the Commercial
+Contributor must pay those damages.
+
+5. NO WARRANTY
+
+EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, THE PROGRAM IS PROVIDED ON AN
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, EITHER EXPRESS OR
+IMPLIED INCLUDING, WITHOUT LIMITATION, ANY WARRANTIES OR CONDITIONS OF TITLE,
+NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Each
+Recipient is solely responsible for determining the appropriateness of using
+and distributing the Program and assumes all risks associated with its exercise
+of rights under this Agreement, including but not limited to the risks and
+costs of program errors, compliance with applicable laws, damage to or loss of
+data, programs or equipment, and unavailability or interruption of operations.
+
+6. DISCLAIMER OF LIABILITY
+
+EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, NEITHER RECIPIENT NOR ANY
+CONTRIBUTORS SHALL HAVE ANY LIABILITY FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING WITHOUT LIMITATION LOST
+PROFITS), HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY
+WAY OUT OF THE USE OR DISTRIBUTION OF THE PROGRAM OR THE EXERCISE OF ANY RIGHTS
+GRANTED HEREUNDER, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
+
+7. GENERAL
+
+If any provision of this Agreement is invalid or unenforceable under applicable
+law, it shall not affect the validity or enforceability of the remainder of the
+terms of this Agreement, and without further action by the parties hereto, such
+provision shall be reformed to the minimum extent necessary to make such
+provision valid and enforceable.
+
+If Recipient institutes patent litigation against any
+entity (including a cross-claim or counterclaim in a lawsuit) alleging that the
+Program itself (excluding combinations of the Program with other software or
+hardware) infringes such Recipient's patent(s), then such Recipient's rights
+granted under Section 2(b) shall terminate as of the date such litigation is
+filed.
+
+All Recipient's rights under this Agreement shall terminate if it fails to
+comply with any of the material terms or conditions of this Agreement and does
+not cure such failure in a reasonable period of time after becoming aware of
+such noncompliance. If all Recipient's rights under this Agreement terminate,
+Recipient agrees to cease use and distribution of the Program as soon as
+reasonably practicable. However, Recipient's obligations under this Agreement
+and any licenses granted by Recipient relating to the Program shall continue
+and survive.
+
+Everyone is permitted to copy and distribute copies of this Agreement, but in
+order to avoid inconsistency the Agreement is copyrighted and may only be
+modified in the following manner. The Agreement Steward reserves the right to
+publish new versions (including revisions) of this Agreement from time to time.
+No one other than the Agreement Steward has the right to modify this Agreement.
+The Eclipse Foundation is the initial Agreement Steward. The Eclipse Foundation may assign the responsibility to
+serve as the Agreement Steward to a suitable separate entity. Each new version
+of the Agreement will be given a distinguishing version number. The Program
+(including Contributions) may always be distributed subject to the version of
+the Agreement under which it was received. In addition, after a new version of
+the Agreement is published, Contributor may elect to distribute the Program
+(including its Contributions) under the new version. Except as expressly stated
+in Sections 2(a) and 2(b) above, Recipient receives no rights or licenses to
+the intellectual property of any Contributor under this Agreement, whether
+expressly, by implication, estoppel or otherwise. All rights in the Program not
+expressly granted under this Agreement are reserved.
+
+This Agreement is governed by the laws of the State of New York and the
+intellectual property laws of the United States of America. No party to this
+Agreement will bring a legal action under this Agreement more than one year
+after the cause of action arose. Each party waives its rights to a jury trial
+in any resulting litigation.
+
diff --git a/java/ql/test/stubs/junit-4.13/org/junit/Assert.java b/java/ql/test/stubs/junit-4.13/org/junit/Assert.java
new file mode 100644
index 000000000000..cbd86acdb81c
--- /dev/null
+++ b/java/ql/test/stubs/junit-4.13/org/junit/Assert.java
@@ -0,0 +1,472 @@
+package org.junit;
+
+import org.junit.function.ThrowingRunnable;
+
+//BSD License
+//
+//Copyright (c) 2000-2006, www.hamcrest.org
+//All rights reserved.
+//
+//Redistribution and use in source and binary forms, with or without
+//modification, are permitted provided that the following conditions are met:
+//
+//Redistributions of source code must retain the above copyright notice, this list of
+//conditions and the following disclaimer. Redistributions in binary form must reproduce
+//the above copyright notice, this list of conditions and the following disclaimer in
+//the documentation and/or other materials provided with the distribution.
+//
+//Neither the name of Hamcrest nor the names of its contributors may be used to endorse
+//or promote products derived from this software without specific prior written
+//permission.
+//
+//THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY
+//EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+//OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT
+//SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+//INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
+//TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+//BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+//CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY
+//WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+//DAMAGE.
+
+/*
+ * MODIFIED version of JUnit 4.13 as available at
+ * https://search.maven.org/remotecontent?filepath=junit/junit/4.13/junit-4.13-sources.jar
+ * Only parts of this file have been retained for test purposes.
+ */
+
+public class Assert {
+ /**
+ * Asserts that a condition is true. If it isn't it throws an
+ * {@link AssertionError} with the given message.
+ *
+ * @param message the identifying message for the {@link AssertionError}
+ * (null
+ * okay)
+ * @param condition condition to be checked
+ */
+ static public void assertTrue(String message, boolean condition) {
+ return;
+ }
+
+ /**
+ * Asserts that a condition is true. If it isn't it throws an
+ * {@link AssertionError} without a message.
+ *
+ * @param condition condition to be checked
+ */
+ static public void assertTrue(boolean condition) {
+ return;
+ }
+
+ /**
+ * Asserts that a condition is false. If it isn't it throws an
+ * {@link AssertionError} with the given message.
+ *
+ * @param message the identifying message for the {@link AssertionError}
+ * (null
+ * okay)
+ * @param condition condition to be checked
+ */
+ static public void assertFalse(String message, boolean condition) {
+ return;
+ }
+
+ /**
+ * Asserts that a condition is false. If it isn't it throws an
+ * {@link AssertionError} without a message.
+ *
+ * @param condition condition to be checked
+ */
+ static public void assertFalse(boolean condition) {
+ return;
+ }
+
+ /**
+ * Fails a test with the given message.
+ *
+ * @param message the identifying message for the {@link AssertionError}
+ * (null
+ * okay)
+ * @see AssertionError
+ */
+ static public void fail(String message) {
+ if (message == null) {
+ throw new AssertionError();
+ }
+ throw new AssertionError(message);
+ }
+
+ /**
+ * Asserts that an object isn't null. If it is an {@link AssertionError} is
+ * thrown with the given message.
+ *
+ * @param message the identifying message for the {@link AssertionError}
+ * (null
+ * okay)
+ * @param object Object to check or null
+ */
+ static public void assertNotNull(String message, Object object) {
+ return;
+ }
+
+ /**
+ * Asserts that an object isn't null. If it is an {@link AssertionError} is
+ * thrown.
+ *
+ * @param object Object to check or null
+ */
+ static public void assertNotNull(Object object) {
+ return;
+ }
+
+ /**
+ * Asserts that an object is null. If it is not, an {@link AssertionError}
+ * is thrown with the given message.
+ *
+ * @param message the identifying message for the {@link AssertionError}
+ * (null
+ * okay)
+ * @param object Object to check or null
+ */
+ static public void assertNull(String message, Object object) {
+ return;
+ }
+
+ /**
+ * Asserts that an object is null. If it isn't an {@link AssertionError} is
+ * thrown.
+ *
+ * @param object Object to check or null
+ */
+ static public void assertNull(Object object) {
+ return;
+ }
+
+ private static boolean equalsRegardingNull(Object expected, Object actual) {
+ if (expected == null) {
+ return actual == null;
+ }
+
+ return isEquals(expected, actual);
+ }
+
+ private static boolean isEquals(Object expected, Object actual) {
+ return expected.equals(actual);
+ }
+
+ /**
+ * Asserts that two doubles are equal to within a positive delta.
+ * If they are not, an {@link AssertionError} is thrown with the given
+ * message. If the expected value is infinity then the delta value is
+ * ignored. NaNs are considered equal:
+ * assertEquals(Double.NaN, Double.NaN, *)
passes
+ *
+ * @param message the identifying message for the {@link AssertionError}
+ * (null
+ * okay)
+ * @param expected expected value
+ * @param actual the value to check against expected
+ * @param delta the maximum delta between expected
and
+ * actual
for which both numbers are still
+ * considered equal.
+ */
+ public static void assertEquals(String message, double expected,
+ double actual, double delta) {
+ return;
+ }
+
+ private static void failNotEquals(String message, Object expected,
+ Object actual) {
+ fail(format(message, expected, actual));
+ }
+
+ static String format(String message, Object expected, Object actual) {
+ String formatted = "";
+ if (message != null && !"".equals(message)) {
+ formatted = message + " ";
+ }
+ String expectedString = String.valueOf(expected);
+ String actualString = String.valueOf(actual);
+ if (equalsRegardingNull(expectedString, actualString)) {
+ return formatted + "expected: "
+ + formatClassAndValue(expected, expectedString)
+ + " but was: " + formatClassAndValue(actual, actualString);
+ } else {
+ return formatted + "expected:<" + expectedString + "> but was:<"
+ + actualString + ">";
+ }
+ }
+
+ private static String formatClass(Class> value) {
+ String className = value.getCanonicalName();
+ return className == null ? value.getName() : className;
+ }
+
+ private static String formatClassAndValue(Object value, String valueString) {
+ String className = value == null ? "null" : value.getClass().getName();
+ return className + "<" + valueString + ">";
+ }
+
+ /**
+ * Asserts that two floats are equal to within a positive delta.
+ * If they are not, an {@link AssertionError} is thrown with the given
+ * message. If the expected value is infinity then the delta value is
+ * ignored. NaNs are considered equal:
+ * assertEquals(Float.NaN, Float.NaN, *)
passes
+ *
+ * @param message the identifying message for the {@link AssertionError}
+ * (null
+ * okay)
+ * @param expected expected value
+ * @param actual the value to check against expected
+ * @param delta the maximum delta between expected
and
+ * actual
for which both numbers are still
+ * considered equal.
+ */
+ public static void assertEquals(String message, float expected, float actual,
+ float delta) {
+ if (floatIsDifferent(expected, actual, delta)) {
+ failNotEquals(message, Float.valueOf(expected), Float.valueOf(actual));
+ }
+ }
+
+ private static boolean doubleIsDifferent(double d1, double d2, double delta) {
+ if (Double.compare(d1, d2) == 0) {
+ return false;
+ }
+ if ((Math.abs(d1 - d2) <= delta)) {
+ return false;
+ }
+
+ return true;
+ }
+
+ private static boolean floatIsDifferent(float f1, float f2, float delta) {
+ if (Float.compare(f1, f2) == 0) {
+ return false;
+ }
+ if ((Math.abs(f1 - f2) <= delta)) {
+ return false;
+ }
+
+ return true;
+ }
+
+ /**
+ * Asserts that two longs are equal. If they are not, an
+ * {@link AssertionError} is thrown.
+ *
+ * @param expected expected long value.
+ * @param actual actual long value
+ */
+ public static void assertEquals(long expected, long actual) {
+ assertEquals(null, expected, actual);
+ }
+
+ /**
+ * Asserts that two longs are equal. If they are not, an
+ * {@link AssertionError} is thrown with the given message.
+ *
+ * @param message the identifying message for the {@link AssertionError}
+ * (null
+ * okay)
+ * @param expected long expected value.
+ * @param actual long actual value
+ */
+ public static void assertEquals(String message, long expected, long actual) {
+ if (expected != actual) {
+ failNotEquals(message, Long.valueOf(expected), Long.valueOf(actual));
+ }
+ }
+
+ /**
+ * @deprecated Use
+ * assertEquals(double expected, double actual, double
+ * delta)
instead
+ */
+ @Deprecated
+ public static void assertEquals(double expected, double actual) {
+ assertEquals(null, expected, actual);
+ }
+
+ /**
+ * @deprecated Use
+ * assertEquals(String message, double expected, double
+ * actual, double delta)
instead
+ */
+ @Deprecated
+ public static void assertEquals(String message, double expected,
+ double actual) {
+ fail("Use assertEquals(expected, actual, delta) to compare " +
+ "floating-point numbers");
+ }
+
+ /**
+ * Asserts that two doubles are equal to within a positive delta.
+ * If they are not, an {@link AssertionError} is thrown. If the expected
+ * value is infinity then the delta value is ignored.NaNs are considered
+ * equal: assertEquals(Double.NaN, Double.NaN, *)
passes
+ *
+ * @param expected expected value
+ * @param actual the value to check against expected
+ * @param delta the maximum delta between expected
and
+ * actual
for which both numbers are still
+ * considered equal.
+ */
+ public static void assertEquals(double expected, double actual,
+ double delta) {
+ assertEquals(null, expected, actual, delta);
+ }
+
+ /**
+ * Asserts that two floats are equal to within a positive delta.
+ * If they are not, an {@link AssertionError} is thrown. If the expected
+ * value is infinity then the delta value is ignored. NaNs are considered
+ * equal: assertEquals(Float.NaN, Float.NaN, *)
passes
+ *
+ * @param expected expected value
+ * @param actual the value to check against expected
+ * @param delta the maximum delta between expected
and
+ * actual
for which both numbers are still
+ * considered equal.
+ */
+ public static void assertEquals(float expected, float actual, float delta) {
+ assertEquals(null, expected, actual, delta);
+ }
+
+ /**
+ * Asserts that two objects are equal. If they are not, an
+ * {@link AssertionError} without a message is thrown. If
+ * expected
and actual
are null
,
+ * they are considered equal.
+ *
+ * @param expected expected value
+ * @param actual the value to check against expected
+ */
+ public static void assertEquals(Object expected, Object actual) {
+ assertEquals(null, expected, actual);
+ }
+
+ public static void assertEquals(String message, Object expected,
+ Object actual) {
+ }
+
+ public static void assertNotEquals(String message, Object unexpected, Object actual) {
+ return;
+ }
+
+ public static void assertNotEquals(Object unexpected, Object actual) {
+ assertNotEquals(null, unexpected, actual);
+ }
+
+ public static void assertNotEquals(String message, long unexpected, long actual) {
+ return;
+ }
+
+ public static void assertNotEquals(long unexpected, long actual) {
+ assertNotEquals(null, unexpected, actual);
+ }
+
+ public static void assertNotEquals(String message, double unexpected, double actual, double delta) {
+ return;
+ }
+
+ public static void assertNotEquals(double unexpected, double actual, double delta) {
+ assertNotEquals(null, unexpected, actual, delta);
+ }
+
+ public static void assertNotEquals(String message, float unexpected, float actual, float delta) {
+ return;
+ }
+
+ public static void assertNotEquals(float unexpected, float actual, float delta) {
+ assertNotEquals(null, unexpected, actual, delta);
+ }
+
+ public static void assertNotSame(String message, Object unexpected, Object actual) {
+ return;
+ }
+
+ public static void assertNotSame(Object unexpected, Object actual) {
+ assertNotSame(null, unexpected, actual);
+ }
+
+ public static void assertSame(String message, Object expected, Object actual) {
+ return;
+ }
+
+ public static void assertSame(Object expected, Object actual) {
+ assertSame(null, expected, actual);
+ }
+
+ /**
+ * Asserts that {@code runnable} throws an exception of type {@code expectedThrowable} when
+ * executed. If it does, the exception object is returned. If it does not throw an exception, an
+ * {@link AssertionError} is thrown. If it throws the wrong type of exception, an {@code
+ * AssertionError} is thrown describing the mismatch; the exception that was actually thrown can
+ * be obtained by calling {@link AssertionError#getCause}.
+ *
+ * @param expectedThrowable the expected type of the exception
+ * @param runnable a function that is expected to throw an exception when executed
+ * @return the exception thrown by {@code runnable}
+ * @since 4.13
+ */
+ public static T assertThrows(Class expectedThrowable,
+ ThrowingRunnable runnable) {
+ return assertThrows(null, expectedThrowable, runnable);
+ }
+
+ /**
+ * Asserts that {@code runnable} throws an exception of type {@code expectedThrowable} when
+ * executed. If it does, the exception object is returned. If it does not throw an exception, an
+ * {@link AssertionError} is thrown. If it throws the wrong type of exception, an {@code
+ * AssertionError} is thrown describing the mismatch; the exception that was actually thrown can
+ * be obtained by calling {@link AssertionError#getCause}.
+ *
+ * @param message the identifying message for the {@link AssertionError} (null
+ * okay)
+ * @param expectedThrowable the expected type of the exception
+ * @param runnable a function that is expected to throw an exception when executed
+ * @return the exception thrown by {@code runnable}
+ * @since 4.13
+ */
+ public static T assertThrows(String message, Class expectedThrowable,
+ ThrowingRunnable runnable) {
+ try {
+ runnable.run();
+ } catch (Throwable actualThrown) {
+ if (expectedThrowable.isInstance(actualThrown)) {
+ @SuppressWarnings("unchecked") T retVal = (T) actualThrown;
+ return retVal;
+ } else {
+ String expected = formatClass(expectedThrowable);
+ Class extends Throwable> actualThrowable = actualThrown.getClass();
+ String actual = formatClass(actualThrowable);
+ if (expected.equals(actual)) {
+ // There must be multiple class loaders. Add the identity hash code so the message
+ // doesn't say "expected: java.lang.String ..."
+ expected += "@" + Integer.toHexString(System.identityHashCode(expectedThrowable));
+ actual += "@" + Integer.toHexString(System.identityHashCode(actualThrowable));
+ }
+ String mismatchMessage = buildPrefix(message)
+ + format("unexpected exception type thrown;", expected, actual);
+
+ // The AssertionError(String, Throwable) ctor is only available on JDK7.
+ AssertionError assertionError = new AssertionError(mismatchMessage);
+ assertionError.initCause(actualThrown);
+ throw assertionError;
+ }
+ }
+ String notThrownMessage = buildPrefix(message) + String
+ .format("expected %s to be thrown, but nothing was thrown",
+ formatClass(expectedThrowable));
+ throw new AssertionError(notThrownMessage);
+ }
+
+ private static String buildPrefix(String message) {
+ return message != null && message.length() != 0 ? message + ": " : "";
+ }
+
+}
diff --git a/java/ql/test/stubs/junit-4.13/org/junit/Test.java b/java/ql/test/stubs/junit-4.13/org/junit/Test.java
new file mode 100644
index 000000000000..8356b546d792
--- /dev/null
+++ b/java/ql/test/stubs/junit-4.13/org/junit/Test.java
@@ -0,0 +1,28 @@
+/*
+ * Copyright 2015-2018 the original author or authors.
+ *
+ * All rights reserved. This program and the accompanying materials are
+ * made available under the terms of the Eclipse Public License v2.0 which
+ * accompanies this distribution and is available at
+ *
+ * http://www.eclipse.org/legal/epl-v20.html
+ */
+
+/*
+ * MODIFIED version of junit-jupiter-api 5.2.0 as available at
+ * https://search.maven.org/classic/remotecontent?filepath=org/junit/jupiter/junit-jupiter-api/5.2.0/junit-jupiter-api-5.2.0-sources.jar
+ * Only parts of this file have been retained for test purposes.
+ */
+
+package org.junit;
+
+import java.lang.annotation.Documented;
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+@Target({ElementType.ANNOTATION_TYPE, ElementType.METHOD})
+@Retention(RetentionPolicy.RUNTIME)
+@Documented
+public @interface Test {}
diff --git a/java/ql/test/stubs/junit-4.13/org/junit/function/ThrowingRunnable.java b/java/ql/test/stubs/junit-4.13/org/junit/function/ThrowingRunnable.java
new file mode 100644
index 000000000000..d0eb782ccd30
--- /dev/null
+++ b/java/ql/test/stubs/junit-4.13/org/junit/function/ThrowingRunnable.java
@@ -0,0 +1,14 @@
+package org.junit.function;
+
+/**
+ * This interface facilitates the use of
+ * {@link org.junit.Assert#assertThrows(Class, ThrowingRunnable)} from Java 8. It allows method
+ * references to void methods (that declare checked exceptions) to be passed directly into
+ * {@code assertThrows}
+ * without wrapping. It is not meant to be implemented directly.
+ *
+ * @since 4.13
+ */
+public interface ThrowingRunnable {
+ void run() throws Throwable;
+}
diff --git a/java/ql/test/stubs/mockito-5.14/org/mockito/ArgumentMatchers.java b/java/ql/test/stubs/mockito-5.14/org/mockito/ArgumentMatchers.java
new file mode 100644
index 000000000000..84004de2ac3d
--- /dev/null
+++ b/java/ql/test/stubs/mockito-5.14/org/mockito/ArgumentMatchers.java
@@ -0,0 +1,4 @@
+package org.mockito;
+
+public class ArgumentMatchers {
+}
diff --git a/java/ql/test/stubs/mockito-5.14/org/mockito/MockSettings.java b/java/ql/test/stubs/mockito-5.14/org/mockito/MockSettings.java
new file mode 100644
index 000000000000..f6e46d610e71
--- /dev/null
+++ b/java/ql/test/stubs/mockito-5.14/org/mockito/MockSettings.java
@@ -0,0 +1,10 @@
+/*
+ * Copyright (c) 2007 Mockito contributors
+ * This program is made available under the terms of the MIT License.
+ */
+package org.mockito;
+
+import java.io.Serializable;
+
+public interface MockSettings extends Serializable {
+}
\ No newline at end of file
diff --git a/java/ql/test/stubs/mockito-5.14/org/mockito/Mockito.java b/java/ql/test/stubs/mockito-5.14/org/mockito/Mockito.java
new file mode 100644
index 000000000000..e4d5a06a247c
--- /dev/null
+++ b/java/ql/test/stubs/mockito-5.14/org/mockito/Mockito.java
@@ -0,0 +1,216 @@
+/*
+ * Copyright (c) 2007 Mockito contributors
+ * This program is made available under the terms of the MIT License.
+ */
+package org.mockito;
+
+import org.mockito.ArgumentMatchers;
+import org.mockito.MockSettings;
+import org.mockito.internal.creation.MockSettingsImpl;
+import org.mockito.stubbing.Answer;
+import org.mockito.stubbing.OngoingStubbing;
+import org.mockito.internal.MockitoCore;
+import org.mockito.MockSettings;
+import org.mockito.stubbing.Stubber;
+
+public class Mockito extends ArgumentMatchers {
+ static final MockitoCore MOCKITO_CORE = new MockitoCore();
+
+ public static MockSettings withSettings() {
+ return new MockSettings() {
+ };
+ }
+
+ /**
+ * Creates a mock object of the requested class or interface.
+ *
+ * See examples in javadoc for the {@link Mockito} class.
+ *
+ * @param reified don't pass any values to it. It's a trick to detect the
+ * class/interface you
+ * want to mock.
+ * @return the mock object.
+ * @since 4.10.0
+ */
+ @SafeVarargs
+ public static T mock(T... reified) {
+ return mock(withSettings(), reified);
+ }
+
+ /**
+ * Creates a mock object of the requested class or interface with the given
+ * default answer.
+ *
+ * See examples in javadoc for the {@link Mockito} class.
+ *
+ * @param defaultAnswer the default answer to use.
+ * @param reified don't pass any values to it. It's a trick to detect the
+ * class/interface you
+ * want to mock.
+ * @return the mock object.
+ * @since 5.1.0
+ */
+ @SafeVarargs
+ public static T mock(@SuppressWarnings("rawtypes") Answer defaultAnswer, T... reified) {
+ return mock(new Answer() {
+ }, reified);
+ }
+
+ /**
+ * Creates a mock object of the requested class or interface with the given
+ * name.
+ *
+ * See examples in javadoc for the {@link Mockito} class.
+ *
+ * @param name the mock name to use.
+ * @param reified don't pass any values to it. It's a trick to detect the
+ * class/interface you
+ * want to mock.
+ * @return the mock object.
+ * @since 5.1.0
+ */
+ @SafeVarargs
+ public static T mock(String name, T... reified) {
+ return mock(withSettings(), reified);
+ }
+
+ /**
+ * Creates a mock object of the requested class or interface with the given
+ * settings.
+ *
+ * See examples in javadoc for the {@link Mockito} class.
+ *
+ * @param settings the mock settings to use.
+ * @param reified don't pass any values to it. It's a trick to detect the
+ * class/interface you
+ * want to mock.
+ * @return the mock object.
+ * @since 5.1.0
+ */
+ @SafeVarargs
+ public static T mock(MockSettings settings, T... reified) {
+ if (reified == null || reified.length > 0) {
+ throw new IllegalArgumentException(
+ "Please don't pass any values here. Java will detect class automagically.");
+ }
+
+ return mock(getClassOf(reified), settings);
+ }
+
+ /**
+ * Creates mock object of given class or interface.
+ *
+ * See examples in javadoc for {@link Mockito} class
+ *
+ * @param classToMock class or interface to mock
+ * @return mock object
+ */
+ public static T mock(Class classToMock) {
+ return mock(classToMock, withSettings());
+ }
+
+ /**
+ * Specifies mock name. Naming mocks can be helpful for debugging - the name is
+ * used in all verification errors.
+ *
+ * Beware that naming mocks is not a solution for complex code which uses too
+ * many mocks or collaborators.
+ * If you have too many mocks then refactor the code so that it's easy to
+ * test/debug without necessity of naming mocks.
+ *
+ * If you use