Merge branch 'main' into ts-54

2026-04-24 00:05:14 +02:00 · 2024-02-25 21:20:43 +01:00
parent 083f56921c 2683e40038
commit 0056067a17
1315 changed files with 80439 additions and 48696 deletions
--- a/.bazelrc
+++ b/.bazelrc
@@ -1,4 +1,12 @@
 common --enable_platform_specific_config
+common --enable_bzlmod
+# because we use --override_module with `%workspace%`, the lock file is not stable
+common --lockfile_mode=off
+
+# when building from this repository in isolation, the internal repository will not be found at ..
+# where `MODULE.bazel` looks for it. The following will get us past the module loading phase, so
+# that we can build things that do not rely on that
+common --override_module=semmle_code=%workspace%/misc/bazel/semmle_code_stub

 build --repo_env=CC=clang --repo_env=CXX=clang++

--- a/.bazelversion
+++ b/.bazelversion
@@ -1 +1 @@
-6.3.1
+7.0.2
--- a/.github/workflows/check-change-note.yml
+++ b/.github/workflows/check-change-note.yml
@@ -1,5 +1,8 @@
 name: Check change note

+permissions:
+  pull-requests: read
+
 on:
  pull_request_target:
    types: [labeled, unlabeled, opened, synchronize, reopened, ready_for_review]
--- a/.github/workflows/check-implicit-this.yml
+++ b/.github/workflows/check-implicit-this.yml
@@ -9,6 +9,9 @@ on:
      - main
      - "rc/*"

+permissions:
+  contents: read
+
 jobs:
  check:
    runs-on: ubuntu-latest
--- a/.github/workflows/check-qldoc.yml
+++ b/.github/workflows/check-qldoc.yml
@@ -10,6 +10,9 @@ on:
      - main
      - "rc/*"

+permissions:
+  contents: read
+
 jobs:
  qldoc:
    runs-on: ubuntu-latest
--- a/.github/workflows/check-query-ids.yml
+++ b/.github/workflows/check-query-ids.yml
@@ -11,6 +11,9 @@ on:
      - "rc/*"
  workflow_dispatch:

+permissions:
+  contents: read
+
 jobs:
  check:
    name: Check query IDs
--- a/.github/workflows/close-stale.yml
+++ b/.github/workflows/close-stale.yml
@@ -5,6 +5,9 @@ on:
  schedule:
    - cron: "30 1 * * *"

+permissions:
+  issues: write
+
 jobs:
  stale:
    if: github.repository == 'github/codeql'
--- a/.github/workflows/compile-queries.yml
+++ b/.github/workflows/compile-queries.yml
@@ -8,8 +8,12 @@ on:
      - "codeql-cli-*"
  pull_request:

+permissions:
+  contents: read
+
 jobs:
  compile-queries:
+    if: github.repository_owner == 'github'
    runs-on: ubuntu-latest-xl

    steps:
--- a/.github/workflows/csharp-qltest.yml
+++ b/.github/workflows/csharp-qltest.yml
@@ -25,6 +25,9 @@ defaults:
  run:
    working-directory: csharp

+permissions:
+  contents: read
+
 jobs:
  qlupgrade:
    runs-on: ubuntu-latest
@@ -46,6 +49,7 @@ jobs:
           xargs codeql execute upgrades testdb
          diff -q testdb/semmlecode.csharp.dbscheme downgrades/initial/semmlecode.csharp.dbscheme
  qltest:
+    if: github.repository_owner == 'github'
    runs-on: ubuntu-latest-xl
    strategy:
      fail-fast: false
--- a/.github/workflows/csv-coverage-metrics.yml
+++ b/.github/workflows/csv-coverage-metrics.yml
@@ -14,6 +14,10 @@ on:
      - ".github/workflows/csv-coverage-metrics.yml"
      - ".github/actions/fetch-codeql/action.yml"

+permissions:
+  contents: read
+  security-events: write
+
 jobs:
  publish-java:
    runs-on: ubuntu-latest
--- a/.github/workflows/csv-coverage-pr-artifacts.yml
+++ b/.github/workflows/csv-coverage-pr-artifacts.yml
@@ -19,6 +19,10 @@ on:
      - main
      - "rc/*"

+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
  generate:
    name: Generate framework coverage artifacts
--- a/.github/workflows/csv-coverage-pr-comment.yml
+++ b/.github/workflows/csv-coverage-pr-comment.yml
@@ -6,6 +6,10 @@ on:
    types:
      - completed

+permissions:
+  contents: read
+  pull-requests: write
+
 jobs:
  check:
    name: Check framework coverage differences and comment
--- a/.github/workflows/csv-coverage-timeseries.yml
+++ b/.github/workflows/csv-coverage-timeseries.yml
@@ -3,6 +3,9 @@ name: Build framework coverage timeseries reports
 on:
  workflow_dispatch:

+permissions:
+  contents: read
+
 jobs:
  build:
    runs-on: ubuntu-latest
--- a/.github/workflows/csv-coverage-update.yml
+++ b/.github/workflows/csv-coverage-update.yml
@@ -5,6 +5,10 @@ on:
  schedule:
    - cron: "0 0 * * *"

+permissions:
+  contents: write
+  pull-requests: write
+
 jobs:
  update:
    name: Update framework coverage report
--- a/.github/workflows/csv-coverage.yml
+++ b/.github/workflows/csv-coverage.yml
@@ -7,6 +7,9 @@ on:
        description: "github/codeql repo SHA used for looking up the CSV models"
        required: false

+permissions:
+  contents: read
+
 jobs:
  build:
    runs-on: ubuntu-latest
--- a/.github/workflows/fast-forward.yml
+++ b/.github/workflows/fast-forward.yml
@@ -7,13 +7,14 @@ name: Fast-forward tracking branch for selected CodeQL version
 on:
  workflow_dispatch:

+permissions:
+  contents: write
+
 jobs:
  fast-forward:
    name: Fast-forward tracking branch for selected CodeQL version
    runs-on: ubuntu-latest
    if: github.repository == 'github/codeql'
-    permissions:
-      contents: write
    env:
      BRANCH_NAME: 'lgtm.com'
    steps:
--- a/.github/workflows/go-tests-other-os.yml
+++ b/.github/workflows/go-tests-other-os.yml
@@ -8,7 +8,11 @@ on:
      - .github/actions/**
      - codeql-workspace.yml
 env:
-  GO_VERSION: '~1.21.0'
+  GO_VERSION: '~1.22.0'
+
+permissions:
+  contents: read
+
 jobs:
  test-mac:
    name: Test MacOS
@@ -18,6 +22,7 @@ jobs:
        uses: actions/setup-go@v5
        with:
          go-version: ${{ env.GO_VERSION }}
+          cache: false
        id: go

      - name: Check out code
@@ -46,6 +51,7 @@ jobs:
          make test cache="${{ steps.query-cache.outputs.cache-dir }}"

  test-win:
+    if: github.repository_owner == 'github'
    name: Test Windows
    runs-on: windows-latest-xl
    steps:
@@ -53,6 +59,7 @@ jobs:
        uses: actions/setup-go@v5
        with:
          go-version: ${{ env.GO_VERSION }}
+          cache: false
        id: go

      - name: Check out code
--- a/.github/workflows/go-tests.yml
+++ b/.github/workflows/go-tests.yml
@@ -15,10 +15,16 @@ on:
      - .github/workflows/go-tests.yml
      - .github/actions/**
      - codeql-workspace.yml
+
 env:
-  GO_VERSION: '~1.21.0'
+  GO_VERSION: '~1.22.0'
+
+permissions:
+  contents: read
+
 jobs:
  test-linux:
+    if: github.repository_owner == 'github'
    name: Test Linux (Ubuntu)
    runs-on: ubuntu-latest-xl
    steps:
@@ -26,6 +32,7 @@ jobs:
        uses: actions/setup-go@v5
        with:
          go-version: ${{ env.GO_VERSION }}
+          cache: false
        id: go

      - name: Check out code
--- a/.github/workflows/labeler.yml
+++ b/.github/workflows/labeler.yml
@@ -2,11 +2,12 @@ name: "Pull Request Labeler"
 on:
 - pull_request_target

+permissions:
+  contents: read
+  pull-requests: write
+
 jobs:
  triage:
-    permissions:
-      contents: read
-      pull-requests: write
    runs-on: ubuntu-latest
    steps:
    - uses: actions/labeler@v4
--- a/.github/workflows/mad_regenerate-models.yml
+++ b/.github/workflows/mad_regenerate-models.yml
@@ -11,6 +11,9 @@ on:
      - ".github/workflows/mad_regenerate-models.yml"
      - ".github/actions/fetch-codeql/action.yml"

+permissions:
+  contents: read
+
 jobs:
  regenerate-models:
    runs-on: ubuntu-latest
--- a/.github/workflows/qhelp-pr-preview.yml
+++ b/.github/workflows/qhelp-pr-preview.yml
@@ -77,7 +77,7 @@ jobs:
          done < "${RUNNER_TEMP}/paths.txt" >> comment_body.txt
          exit "${EXIT_CODE}"

-      - if: always()
+      - if: ${{ !cancelled() }}
        uses: actions/upload-artifact@v3
        with:
          name: comment
--- a/.github/workflows/ql-for-ql-build.yml
+++ b/.github/workflows/ql-for-ql-build.yml
@@ -9,8 +9,13 @@ on:
 env:
  CARGO_TERM_COLOR: always

+permissions:
+  contents: read
+  security-events: write
+
 jobs:
  analyze:
+    if: github.repository_owner == 'github'
    runs-on: ubuntu-latest-xl
    steps:
      ### Build the queries ###
@@ -19,7 +24,7 @@ jobs:
          fetch-depth: 0
      - name: Find codeql
        id: find-codeql
-        uses: github/codeql-action/init@v2
+        uses: github/codeql-action/init@main
        with:
          languages: javascript # does not matter
      - uses: ./.github/actions/os-version
@@ -65,7 +70,7 @@ jobs:
            exclude:*/ql/lib/upgrades/
            exclude:java/ql/integration-tests
      - name: Upload sarif to code-scanning
-        uses: github/codeql-action/upload-sarif@v2
+        uses: github/codeql-action/upload-sarif@main
        with:
          sarif_file: ql-for-ql.sarif
          category: ql-for-ql
--- a/.github/workflows/ql-for-ql-dataset_measure.yml
+++ b/.github/workflows/ql-for-ql-dataset_measure.yml
@@ -11,6 +11,10 @@ on:
      - ql/ql/src/ql.dbscheme
  workflow_dispatch:

+permissions:
+  contents: read
+  security-events: read
+
 jobs:
  measure:
    env:
@@ -25,7 +29,7 @@ jobs:

      - name: Find codeql
        id: find-codeql
-        uses: github/codeql-action/init@v2
+        uses: github/codeql-action/init@main
        with:
          languages: javascript # does not matter
      - uses: ./.github/actions/os-version
--- a/.github/workflows/ql-for-ql-tests.yml
+++ b/.github/workflows/ql-for-ql-tests.yml
@@ -17,6 +17,9 @@ on:
 env:
  CARGO_TERM_COLOR: always

+permissions:
+  contents: read
+
 jobs:
  qltest:
    runs-on: ubuntu-latest
@@ -24,7 +27,7 @@ jobs:
      - uses: actions/checkout@v4
      - name: Find codeql
        id: find-codeql
-        uses: github/codeql-action/init@v2
+        uses: github/codeql-action/init@main
        with:
          languages: javascript # does not matter
      - uses: ./.github/actions/os-version
@@ -69,7 +72,7 @@ jobs:
          echo "/usr/local/opt/gnu-tar/libexec/gnubin" >> $GITHUB_PATH
      - name: Find codeql
        id: find-codeql
-        uses: github/codeql-action/init@v2
+        uses: github/codeql-action/init@main
        with:
          languages: javascript # does not matter
      - uses: ./.github/actions/os-version
--- a/.github/workflows/query-list.yml
+++ b/.github/workflows/query-list.yml
@@ -13,6 +13,9 @@ on:
      - '.github/actions/fetch-codeql/action.yml'
      - 'misc/scripts/generate-code-scanning-query-list.py'

+permissions:
+  contents: read
+
 jobs:
  build:

--- a/.github/workflows/ruby-build.yml
+++ b/.github/workflows/ruby-build.yml
@@ -32,6 +32,9 @@ defaults:
  run:
    working-directory: ruby

+permissions:
+  contents: read
+
 jobs:
  build:
    strategy:
@@ -111,6 +114,7 @@ jobs:
            ruby/extractor/target/release/codeql-extractor-ruby.exe
          retention-days: 1
  compile-queries:
+    if: github.repository_owner == 'github'
    runs-on: ubuntu-latest-xl
    steps:
      - uses: actions/checkout@v4
--- a/.github/workflows/ruby-dataset-measure.yml
+++ b/.github/workflows/ruby-dataset-measure.yml
@@ -17,6 +17,9 @@ on:
      - .github/workflows/ruby-dataset-measure.yml
  workflow_dispatch:

+permissions:
+  contents: read
+
 jobs:
  measure:
    env:
--- a/.github/workflows/ruby-qltest.yml
+++ b/.github/workflows/ruby-qltest.yml
@@ -29,6 +29,9 @@ defaults:
  run:
    working-directory: ruby

+permissions:
+  contents: read
+
 jobs:
  qlupgrade:
    runs-on: ubuntu-latest
@@ -50,6 +53,7 @@ jobs:
           xargs codeql execute upgrades testdb
          diff -q testdb/ruby.dbscheme downgrades/initial/ruby.dbscheme
  qltest:
+    if: github.repository_owner == 'github'
    runs-on: ubuntu-latest-xl
    strategy:
      fail-fast: false
--- a/.github/workflows/swift.yml
+++ b/.github/workflows/swift.yml
@@ -33,40 +33,47 @@ on:
      - rc/*
      - codeql-cli-*

+permissions:
+  contents: read
+
 jobs:
  # not using a matrix as you cannot depend on a specific job in a matrix, and we want to start linux checks
  # without waiting for the macOS build
  build-and-test-macos:
+    if: github.repository_owner == 'github'
    runs-on: macos-12-xl
    steps:
      - uses: actions/checkout@v4
      - uses: ./swift/actions/build-and-test
  build-and-test-linux:
+    if: github.repository_owner == 'github'
    runs-on: ubuntu-latest-xl
    steps:
      - uses: actions/checkout@v4
      - uses: ./swift/actions/build-and-test
  qltests-linux:
+    if: github.repository_owner == 'github'
    needs: build-and-test-linux
    runs-on: ubuntu-latest-xl
    steps:
      - uses: actions/checkout@v4
      - uses: ./swift/actions/run-ql-tests
  qltests-macos:
-    if : ${{ github.event_name == 'pull_request' }}
+    if: ${{ github.repository_owner == 'github' && github.event_name == 'pull_request' }}
    needs: build-and-test-macos
    runs-on: macos-12-xl
    steps:
      - uses: actions/checkout@v4
      - uses: ./swift/actions/run-ql-tests
  integration-tests-linux:
+    if: github.repository_owner == 'github'
    needs: build-and-test-linux
    runs-on: ubuntu-latest-xl
    steps:
      - uses: actions/checkout@v4
      - uses: ./swift/actions/run-integration-tests
  integration-tests-macos:
-    if : ${{ github.event_name == 'pull_request' }}
+    if: ${{ github.repository_owner == 'github' && github.event_name == 'pull_request' }}
    needs: build-and-test-macos
    runs-on: macos-12-xl
    timeout-minutes: 60
--- a/.github/workflows/sync-files.yml
+++ b/.github/workflows/sync-files.yml
@@ -10,6 +10,9 @@ on:
      - main
      - 'rc/*'

+permissions:
+  contents: read
+
 jobs:
  sync:
    runs-on: ubuntu-latest
--- a/.github/workflows/tree-sitter-extractor-test.yml
+++ b/.github/workflows/tree-sitter-extractor-test.yml
@@ -23,6 +23,9 @@ defaults:
  run:
    working-directory: shared/tree-sitter-extractor

+permissions:
+  contents: read
+
 jobs:
  test:
    runs-on: ubuntu-latest
--- a/.github/workflows/validate-change-notes.yml
+++ b/.github/workflows/validate-change-notes.yml
@@ -15,6 +15,9 @@ on:
      - ".github/workflows/validate-change-notes.yml"
      - ".github/actions/fetch-codeql/action.yml"

+permissions:
+  contents: read
+
 jobs:
  check-change-note:
    runs-on: ubuntu-latest
--- a/1
+++ b/1
@@ -25,6 +25,7 @@

 # Bazel (excluding BUILD.bazel files)
 WORKSPACE.bazel @github/codeql-ci-reviewers
+MODULE.bazel @github/codeql-ci-reviewers
 .bazelversion @github/codeql-ci-reviewers
 .bazelrc @github/codeql-ci-reviewers
 **/*.bzl @github/codeql-ci-reviewers
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -0,0 +1,53 @@
+module(
+    name = "codeql",
+    version = "0.0",
+)
+
+# this points to our internal repository when `codeql` is checked out as a submodule thereof
+# when building things from `codeql` independently this is stubbed out in `.bazelrc`
+bazel_dep(name = "semmle_code", version = "0.0")
+local_path_override(
+    module_name = "semmle_code",
+    path = "..",
+)
+
+# see https://registry.bazel.build/ for a list of available packages
+
+bazel_dep(name = "platforms", version = "0.0.8")
+bazel_dep(name = "rules_pkg", version = "0.9.1")
+bazel_dep(name = "rules_nodejs", version = "6.0.3")
+bazel_dep(name = "rules_python", version = "0.31.0")
+bazel_dep(name = "bazel_skylib", version = "1.5.0")
+bazel_dep(name = "abseil-cpp", version = "20240116.0", repo_name = "absl")
+bazel_dep(name = "nlohmann_json", version = "3.11.3", repo_name = "json")
+bazel_dep(name = "fmt", version = "10.0.0")
+
+pip = use_extension("@rules_python//python/extensions:pip.bzl", "pip")
+pip.parse(
+    hub_name = "codegen_deps",
+    python_version = "3.11",
+    requirements_lock = "//misc/codegen:requirements_lock.txt",
+)
+use_repo(pip, "codegen_deps")
+
+swift_deps = use_extension("//swift/third_party:load.bzl", "swift_deps")
+use_repo(
+    swift_deps,
+    "binlog",
+    "picosha2",
+    "swift_prebuilt_darwin_x86_64",
+    "swift_prebuilt_linux",
+    "swift_toolchain_linux",
+    "swift_toolchain_macos",
+)
+
+node = use_extension("@rules_nodejs//nodejs:extensions.bzl", "node")
+node.toolchain(
+    name = "nodejs",
+    node_version = "18.15.0",
+)
+use_repo(node, "nodejs", "nodejs_toolchains")
+
+register_toolchains(
+    "@nodejs_toolchains//:all",
+)
--- a/WORKSPACE.bazel
+++ b/WORKSPACE.bazel
@@ -1,12 +1,2 @@
-# Please notice that any bazel targets and definitions in this repository are currently experimental
-# and for internal use only.
-
-workspace(name = "codeql")
-
-load("//misc/bazel:workspace.bzl", "codeql_workspace")
-
-codeql_workspace()
-
-load("//misc/bazel:workspace_deps.bzl", "codeql_workspace_deps")
-
-codeql_workspace_deps()
+# please use MODULE.bazel to add dependencies
+# this empty file is required by internal repositories, don't remove it
--- a/config/identical-files.json
+++ b/config/identical-files.json
@@ -431,13 +431,6 @@
    "java/ql/src/experimental/Security/CWE/CWE-400/LocalThreadResourceAbuse.qhelp",
    "java/ql/src/experimental/Security/CWE/CWE-400/ThreadResourceAbuse.qhelp"
  ],
-  "IDE Contextual Queries": [
-    "cpp/ql/lib/IDEContextual.qll",
-    "csharp/ql/lib/IDEContextual.qll",
-    "java/ql/lib/IDEContextual.qll",
-    "javascript/ql/lib/IDEContextual.qll",
-    "python/ql/lib/analysis/IDEContextual.qll"
-  ],
  "CryptoAlgorithms Python/JS/Ruby": [
    "javascript/ql/lib/semmle/javascript/security/CryptoAlgorithms.qll",
    "python/ql/lib/semmle/python/concepts/CryptoAlgorithms.qll",
--- a/cpp/downgrades/298438feb146335af824002589cd6d4e96e5dbf9/exprparents.ql
+++ b/cpp/downgrades/298438feb146335af824002589cd6d4e96e5dbf9/exprparents.ql
@@ -0,0 +1,19 @@
+class Element extends @element {
+  string toString() { none() }
+}
+
+class Expr extends @expr {
+  string toString() { none() }
+}
+
+class Stmt extends @stmt {
+  string toString() { none() }
+}
+
+predicate isStmtWithInitializer(Stmt stmt) { exists(int kind | stmts(stmt, kind, _) | kind = 29) }
+
+from Expr child, int index, int index_new, Element parent
+where
+  exprparents(child, index, parent) and
+  if isStmtWithInitializer(parent) then index_new = index - 1 else index_new = index
+select child, index_new, parent
--- a/cpp/downgrades/298438feb146335af824002589cd6d4e96e5dbf9/for_initialization.ql
+++ b/cpp/downgrades/298438feb146335af824002589cd6d4e96e5dbf9/for_initialization.ql
@@ -0,0 +1,9 @@
+class Stmt extends @stmt {
+  string toString() { none() }
+}
+
+from Stmt f, Stmt i
+where
+  for_initialization(f, i) and
+  f instanceof @stmt_for
+select f, i
--- a/cpp/downgrades/298438feb146335af824002589cd6d4e96e5dbf9/old.dbscheme
+++ b/cpp/downgrades/298438feb146335af824002589cd6d4e96e5dbf9/old.dbscheme
--- a/cpp/downgrades/298438feb146335af824002589cd6d4e96e5dbf9/semmlecode.cpp.dbscheme
+++ b/cpp/downgrades/298438feb146335af824002589cd6d4e96e5dbf9/semmlecode.cpp.dbscheme
--- a/cpp/downgrades/298438feb146335af824002589cd6d4e96e5dbf9/stmtparents.ql
+++ b/cpp/downgrades/298438feb146335af824002589cd6d4e96e5dbf9/stmtparents.ql
@@ -0,0 +1,20 @@
+class Element extends @element {
+  string toString() { none() }
+}
+
+class Stmt extends @stmt {
+  string toString() { none() }
+}
+
+predicate isStmtWithInitializer(Stmt stmt) { exists(int kind | stmts(stmt, kind, _) | kind = 29) }
+
+from Stmt child, int index, int index_new, Element parent
+where
+  stmtparents(child, index, parent) and
+  (
+    not isStmtWithInitializer(parent)
+    or
+    index > 0
+  ) and
+  if isStmtWithInitializer(parent) then index_new = index - 1 else index_new = index
+select child, index_new, parent
--- a/cpp/downgrades/298438feb146335af824002589cd6d4e96e5dbf9/upgrade.properties
+++ b/cpp/downgrades/298438feb146335af824002589cd6d4e96e5dbf9/upgrade.properties
@@ -0,0 +1,5 @@
+description: Support C++20 range-based for initializers
+compatibility: partial
+exprparents.rel: run exprparents.qlo
+stmtparents.rel: run stmtparents.qlo
+for_initialization.rel: run for_initialization.qlo
--- a/cpp/ql/lib/CHANGELOG.md
+++ b/cpp/ql/lib/CHANGELOG.md
@@ -1,3 +1,16 @@
+## 0.12.6
+
+### New Features
+
+* A `getInitialization` predicate was added to the `RangeBasedForStmt` class that yields the C++20-style initializer of the range-based `for` statement when it exists.
+
+## 0.12.5
+
+### New Features
+
+* Added the `PreprocBlock.qll` library to this repository.  This library offers a view of `#if`, `#elif`, `#else` and similar directives as a tree with navigable parent-child relationships.
+* Added a new `ThrowingFunction` abstract class that can be used to model an external function that may throw an exception.
+
 ## 0.12.4

 ### Minor Analysis Improvements
--- a/cpp/ql/lib/IDEContextual.qll
+++ b/cpp/ql/lib/IDEContextual.qll
@@ -3,6 +3,7 @@
 */

 import semmle.files.FileSystem
+private import codeql.util.FileSystem

 /**
 * Returns the `File` matching the given source file name as encoded by the VS
@@ -10,13 +11,5 @@ import semmle.files.FileSystem
 */
 cached
 File getFileBySourceArchiveName(string name) {
-  // The name provided for a file in the source archive by the VS Code extension
-  // has some differences from the absolute path in the database:
-  // 1. colons are replaced by underscores
-  // 2. there's a leading slash, even for Windows paths: "C:/foo/bar" ->
-  //    "/C_/foo/bar"
-  // 3. double slashes in UNC prefixes are replaced with a single slash
-  // We can handle 2 and 3 together by unconditionally adding a leading slash
-  // before replacing double slashes.
-  name = ("/" + result.getAbsolutePath().replaceAll(":", "_")).replaceAll("//", "/")
+  result = IdeContextual<File>::getFileBySourceArchiveName(name)
 }
--- a/cpp/ql/lib/change-notes/2024-01-30-throwing-model.md
+++ b/cpp/ql/lib/change-notes/2024-01-30-throwing-model.md
@@ -1,4 +0,0 @@
---
-category: feature
---
-* Added a new `ThrowingFunction` abstract class that can be used to model an external function that may throw an exception.
--- a/cpp/ql/lib/change-notes/released/0.12.5.md
+++ b/cpp/ql/lib/change-notes/released/0.12.5.md
@@ -0,0 +1,6 @@
+## 0.12.5
+
+### New Features
+
+* Added the `PreprocBlock.qll` library to this repository.  This library offers a view of `#if`, `#elif`, `#else` and similar directives as a tree with navigable parent-child relationships.
+* Added a new `ThrowingFunction` abstract class that can be used to model an external function that may throw an exception.
--- a/cpp/ql/lib/change-notes/released/0.12.6.md
+++ b/cpp/ql/lib/change-notes/released/0.12.6.md
@@ -0,0 +1,5 @@
+## 0.12.6
+
+### New Features
+
+* A `getInitialization` predicate was added to the `RangeBasedForStmt` class that yields the C++20-style initializer of the range-based `for` statement when it exists.
--- a/cpp/ql/lib/codeql-pack.release.yml
+++ b/cpp/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.12.4
+lastReleaseVersion: 0.12.6
--- a/cpp/ql/lib/qlpack.yml
+++ b/cpp/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/cpp-all
-version: 0.12.5-dev
+version: 0.12.7-dev
 groups: cpp
 dbscheme: semmlecode.cpp.dbscheme
 extractor: cpp
--- a/cpp/ql/lib/semmle/code/cpp/PrintAST.qll
+++ b/cpp/ql/lib/semmle/code/cpp/PrintAST.qll
@@ -735,7 +735,9 @@ private predicate namedStmtChildPredicates(Locatable s, Element e, string pred)
    or
    s.(ForStmt).getStmt() = e and pred = "getStmt()"
    or
-    s.(RangeBasedForStmt).getChild(0) = e and pred = "getChild(0)"
+    s.(RangeBasedForStmt).getInitialization() = e and pred = "getInitialization()"
+    or
+    s.(RangeBasedForStmt).getChild(1) = e and pred = "getChild(1)"
    or
    s.(RangeBasedForStmt).getBeginEndDeclaration() = e and pred = "getBeginEndDeclaration()"
    or
@@ -743,7 +745,7 @@ private predicate namedStmtChildPredicates(Locatable s, Element e, string pred)
    or
    s.(RangeBasedForStmt).getUpdate() = e and pred = "getUpdate()"
    or
-    s.(RangeBasedForStmt).getChild(4) = e and pred = "getChild(4)"
+    s.(RangeBasedForStmt).getChild(5) = e and pred = "getChild(5)"
    or
    s.(RangeBasedForStmt).getStmt() = e and pred = "getStmt()"
    or
@@ -835,7 +837,11 @@ private predicate namedExprChildPredicates(Expr expr, Element ele, string pred)
    or
    expr.(OverloadedArrayExpr).getArrayOffset() = ele and pred = "getArrayOffset()"
    or
-    expr.(OverloadedPointerDereferenceExpr).getExpr() = ele and pred = "getExpr()"
+    // OverloadedPointerDereferenceExpr::getExpr/0 also considers qualifiers, which are already handled above for all Call classes.
+    not expr.(OverloadedPointerDereferenceExpr).getQualifier() =
+      expr.(OverloadedPointerDereferenceExpr).getExpr() and
+    expr.(OverloadedPointerDereferenceExpr).getExpr() = ele and
+    pred = "getExpr()"
    or
    expr.(CommaExpr).getLeftOperand() = ele and pred = "getLeftOperand()"
    or
--- a/cpp/ql/lib/semmle/code/cpp/Variable.qll
+++ b/cpp/ql/lib/semmle/code/cpp/Variable.qll
@@ -234,7 +234,16 @@ class VariableDeclarationEntry extends DeclarationEntry, @var_decl {
   * int f(int y) { return y; }
   * ```
   */
-  override string getName() { var_decls(underlyingElement(this), _, _, result, _) and result != "" }
+  override string getName() {
+    exists(string name |
+      var_decls(underlyingElement(this), _, _, name, _) and
+      (
+        name != "" and result = name
+        or
+        name = "" and result = this.getVariable().(LocalVariable).getName()
+      )
+    )
+  }

  /**
   * Gets the type of the variable which is being declared or defined.
--- a/cpp/ql/lib/semmle/code/cpp/controlflow/IRGuards.qll
+++ b/cpp/ql/lib/semmle/code/cpp/controlflow/IRGuards.qll
@@ -203,30 +203,42 @@ private class GuardConditionFromIR extends GuardCondition {
   * `&&` and `||`. See the detailed explanation on predicate `controls`.
   */
  private predicate controlsBlock(BasicBlock controlled, boolean testIsTrue) {
-    exists(IRBlock irb, Instruction instr |
+    exists(IRBlock irb |
      ir.controls(irb, testIsTrue) and
-      instr = irb.getAnInstruction() and
-      instr.getAst().(ControlFlowNode).getBasicBlock() = controlled and
-      not isUnreachedBlock(irb) and
-      not this.excludeAsControlledInstruction(instr)
+      nonExcludedIRAndBasicBlock(irb, controlled) and
+      not isUnreachedBlock(irb)
    )
  }
+}

-  private predicate excludeAsControlledInstruction(Instruction instr) {
-    // Exclude the temporaries generated by a ternary expression.
-    exists(TranslatedConditionalExpr tce |
-      instr = tce.getInstruction(ConditionValueFalseStoreTag())
-      or
-      instr = tce.getInstruction(ConditionValueTrueStoreTag())
-      or
-      instr = tce.getInstruction(ConditionValueTrueTempAddressTag())
-      or
-      instr = tce.getInstruction(ConditionValueFalseTempAddressTag())
-    )
+private predicate excludeAsControlledInstruction(Instruction instr) {
+  // Exclude the temporaries generated by a ternary expression.
+  exists(TranslatedConditionalExpr tce |
+    instr = tce.getInstruction(ConditionValueFalseStoreTag())
    or
-    // Exclude unreached instructions, as their AST is the whole function and not a block.
-    instr instanceof UnreachedInstruction
-  }
+    instr = tce.getInstruction(ConditionValueTrueStoreTag())
+    or
+    instr = tce.getInstruction(ConditionValueTrueTempAddressTag())
+    or
+    instr = tce.getInstruction(ConditionValueFalseTempAddressTag())
+  )
+  or
+  // Exclude unreached instructions, as their AST is the whole function and not a block.
+  instr instanceof UnreachedInstruction
+}
+
+/**
+ * Holds if `irb` is the `IRBlock` corresponding to the AST basic block
+ * `controlled`, and `irb` does not contain any instruction(s) that should make
+ * the `irb` be ignored.
+ */
+pragma[nomagic]
+private predicate nonExcludedIRAndBasicBlock(IRBlock irb, BasicBlock controlled) {
+  exists(Instruction instr |
+    instr = irb.getAnInstruction() and
+    instr.getAst().(ControlFlowNode).getBasicBlock() = controlled and
+    not excludeAsControlledInstruction(instr)
+  )
 }

 /**
--- a/cpp/ql/lib/semmle/code/cpp/controlflow/internal/CFG.qll
+++ b/cpp/ql/lib/semmle/code/cpp/controlflow/internal/CFG.qll
@@ -637,8 +637,10 @@ private predicate straightLineSparse(Node scope, int i, Node ni, Spec spec) {
    any(RangeBasedForStmt for |
      i = -1 and ni = for and spec.isAt()
      or
+      i = 0 and ni = for.getInitialization() and spec.isAround()
+      or
      exists(DeclStmt s | s.getADeclaration() = for.getRangeVariable() |
-        i = 0 and ni = s and spec.isAround()
+        i = 1 and ni = s and spec.isAround()
      )
      or
      exists(DeclStmt s |
@@ -649,22 +651,22 @@ private predicate straightLineSparse(Node scope, int i, Node ni, Spec spec) {
        // DeclStmt in that case.
        exists(s.getADeclaration())
      |
-        i = 1 and ni = s and spec.isAround()
+        i = 2 and ni = s and spec.isAround()
      )
      or
-      i = 2 and ni = for.getCondition() and spec.isBefore()
+      i = 3 and ni = for.getCondition() and spec.isBefore()
      or
-      i = 3 and /* BARRIER */ ni = for and spec.isBarrier()
+      i = 4 and /* BARRIER */ ni = for and spec.isBarrier()
      or
      exists(DeclStmt declStmt | declStmt.getADeclaration() = for.getVariable() |
-        i = 4 and ni = declStmt and spec.isAfter()
+        i = 5 and ni = declStmt and spec.isAfter()
      )
      or
-      i = 5 and ni = for.getStmt() and spec.isAround()
+      i = 6 and ni = for.getStmt() and spec.isAround()
      or
-      i = 6 and ni = for.getUpdate() and spec.isAround()
+      i = 7 and ni = for.getUpdate() and spec.isAround()
      or
-      i = 7 and ni = for.getCondition() and spec.isBefore()
+      i = 8 and ni = for.getCondition() and spec.isBefore()
    )
  or
  scope =
--- a/cpp/ql/lib/semmle/code/cpp/exprs/Assignment.qll
+++ b/cpp/ql/lib/semmle/code/cpp/exprs/Assignment.qll
@@ -244,9 +244,15 @@ class ConditionDeclExpr extends Expr, @condition_decl {

  /**
   * Gets the compiler-generated variable access that conceptually occurs after
-   * the initialization of the declared variable.
+   * the initialization of the declared variable, if any.
   */
-  VariableAccess getVariableAccess() { result = this.getChild(0) }
+  VariableAccess getVariableAccess() { result = this.getExpr() }
+
+  /**
+   * Gets the expression that is evaluated after the initialization of the declared
+   * variable.
+   */
+  Expr getExpr() { result = this.getChild(0) }

  /**
   * Gets the expression that initializes the declared variable. This predicate
--- a/cpp/ql/lib/semmle/code/cpp/headers/PreprocBlock.qll
+++ b/cpp/ql/lib/semmle/code/cpp/headers/PreprocBlock.qll
@@ -0,0 +1,160 @@
+/**
+ * This library offers a view of preprocessor branches (`#if`, `#ifdef`,
+ * `#ifndef`, `#elif` and `#else`) as blocks of code between the opening and
+ * closing directives, with navigable parent-child relationships to other
+ * blocks. The main class is `PreprocessorBlock`.
+ */
+
+import cpp
+
+/**
+ * Gets the line of the `ix`th `PreprocessorBranchDirective` in file `f`.
+ */
+private int getPreprocLineFromIndex(File f, int ix) {
+  result =
+    rank[ix](PreprocessorBranchDirective g | g.getFile() = f | g.getLocation().getStartLine())
+}
+
+/**
+ * Gets the `ix`th `PreprocessorBranchDirective` in file `f`.
+ */
+private PreprocessorBranchDirective getPreprocFromIndex(File f, int ix) {
+  result.getFile() = f and
+  result.getLocation().getStartLine() = getPreprocLineFromIndex(f, ix)
+}
+
+/**
+ * Get the index of a `PreprocessorBranchDirective` in its `file`.
+ */
+private int getPreprocIndex(PreprocessorBranchDirective directive) {
+  directive = getPreprocFromIndex(directive.getFile(), result)
+}
+
+/**
+ * A chunk of code from one preprocessor branch (`#if`, `#ifdef`,
+ * `#ifndef`, `#elif` or `#else`) to the directive that closes it
+ * (`#elif`, `#else` or `#endif`).  The `getParent()` method
+ * allows these blocks to be navigated as a tree, with the root
+ * being the entire file.
+ */
+class PreprocessorBlock extends @element {
+  PreprocessorBlock() {
+    mkElement(this) instanceof File or
+    mkElement(this) instanceof PreprocessorBranch or
+    mkElement(this) instanceof PreprocessorElse
+  }
+
+  /**
+   * Holds if this element is at the specified location.
+   * The location spans column `startcolumn` of line `startline` to
+   * column `endcolumn` of line `endline` in file `filepath`.
+   * For more information, see
+   * [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
+   */
+  predicate hasLocationInfo(
+    string filepath, int startline, int startcolumn, int endline, int endcolumn
+  ) {
+    filepath = this.getFile().toString() and
+    startline = this.getStartLine() and
+    startcolumn = 0 and
+    endline = this.getEndLine() and
+    endcolumn = 0
+  }
+
+  /**
+   * Gets a textual representation of this element.
+   */
+  string toString() { result = mkElement(this).toString() }
+
+  /**
+   * Gets the file this `PreprocessorBlock` is located in.
+   */
+  File getFile() { result = mkElement(this).getFile() }
+
+  /**
+   * Gets the start line number of this `PreprocessorBlock`.
+   */
+  int getStartLine() { result = mkElement(this).getLocation().getStartLine() }
+
+  /**
+   * Gets the end line number of this `PreprocessorBlock`.
+   */
+  int getEndLine() {
+    result = mkElement(this).(File).getMetrics().getNumberOfLines() or
+    result =
+      mkElement(this).(PreprocessorBranchDirective).getNext().getLocation().getStartLine() - 1
+  }
+
+  private PreprocessorBlock getParentInternal() {
+    // find the `#ifdef` corresponding to this block and the
+    // PreprocessorBranchDirective `prev` that came directly
+    // before it in the source.
+    exists(int ix, PreprocessorBranchDirective prev |
+      ix = getPreprocIndex(mkElement(this).(PreprocessorBranchDirective).getIf()) and
+      prev = getPreprocFromIndex(this.getFile(), ix - 1)
+    |
+      if prev instanceof PreprocessorEndif
+      then
+        // if we follow an #endif, we have the same parent
+        // as its corresponding `#if` has.
+        result = unresolveElement(prev.getIf()).(PreprocessorBlock).getParentInternal()
+      else
+        // otherwise we directly follow an #if / #ifdef / #ifndef /
+        // #elif / #else that must be a level above and our parent
+        // block.
+        mkElement(result) = prev
+    )
+  }
+
+  /**
+   * Gets the `PreprocessorBlock` that's directly surrounding this one.
+   * Has no result if this is a file.
+   */
+  PreprocessorBlock getParent() {
+    not mkElement(this) instanceof File and
+    (
+      if exists(this.getParentInternal())
+      then
+        // found parent directive
+        result = this.getParentInternal()
+      else
+        // top level directive
+        mkElement(result) = this.getFile()
+    )
+  }
+
+  /**
+   * Gets a `PreprocessorBlock` that's directly inside this one.
+   */
+  PreprocessorBlock getAChild() { result.getParent() = this }
+
+  private Include getAnEnclosedInclude() {
+    result.getFile() = this.getFile() and
+    result.getLocation().getStartLine() > this.getStartLine() and
+    result.getLocation().getStartLine() <= this.getEndLine()
+  }
+
+  /**
+   * Gets an include directive that is directly in this
+   * `PreprocessorBlock`.
+   */
+  Include getAnInclude() {
+    result = this.getAnEnclosedInclude() and
+    not result = this.getAChild().getAnEnclosedInclude()
+  }
+
+  private Macro getAnEnclosedMacro() {
+    result.getFile() = this.getFile() and
+    result.getLocation().getStartLine() > this.getStartLine() and
+    result.getLocation().getStartLine() <= this.getEndLine()
+  }
+
+  /**
+   * Gets a macro definition that is directly in this
+   * `PreprocessorBlock`.
+   */
+  Macro getAMacro() {
+    result = this.getAnEnclosedMacro() and
+    not result = this.getAChild().getAnEnclosedMacro()
+  }
+}
--- a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll
@@ -7,6 +7,9 @@ private import SsaInternals as Ssa
 private import DataFlowImplCommon as DataFlowImplCommon
 private import codeql.util.Unit
 private import Node0ToString
+private import ModelUtil
+private import semmle.code.cpp.models.interfaces.FunctionInputsAndOutputs as IO
+private import semmle.code.cpp.models.interfaces.DataFlow as DF

 cached
 private module Cached {
@@ -1178,6 +1181,19 @@ private int countNumberOfBranchesUsingParameter(SwitchInstruction switch, Parame
  )
 }

+pragma[nomagic]
+private predicate isInputOutput(
+  DF::DataFlowFunction target, Node node1, Node node2, IO::FunctionInput input,
+  IO::FunctionOutput output
+) {
+  exists(CallInstruction call |
+    node1 = callInput(call, input) and
+    node2 = callOutput(call, output) and
+    call.getStaticCallTarget() = target and
+    target.hasDataFlow(input, output)
+  )
+}
+
 /**
 * Holds if the data-flow step from `node1` to `node2` can be used to
 * determine where side-effects may return from a callable.
@@ -1189,6 +1205,11 @@ private int countNumberOfBranchesUsingParameter(SwitchInstruction switch, Parame
 * int x = *p;
 * ```
 * does not preserve the identity of `*p`.
+ *
+ * Similarly, a function that copies the contents of a string into a new location
+ * does not also preserve the identity. For example, `strdup(p)` does not
+ * preserve the identity of `*p` (since it allocates new storage and copies
+ * the string into the new storage).
 */
 bindingset[node1, node2]
 pragma[inline_late]
@@ -1225,7 +1246,16 @@ predicate validParameterAliasStep(Node node1, Node node2) {
  not exists(Operand operand |
    node1.asOperand() = operand and
    node2.asInstruction().(StoreInstruction).getSourceValueOperand() = operand
+  ) and
+  (
+    // Either this is not a modeled flow.
+    not isInputOutput(_, node1, node2, _, _)
+    or
+    exists(DF::DataFlowFunction target, IO::FunctionInput input, IO::FunctionOutput output |
+      // Or it is a modeled flow and there's `*input` to `*output` flow
+      isInputOutput(target, node1, node2, input.getIndirectionInput(), output.getIndirectionOutput()) and
+      // and in that case there should also be `input` to `output` flow
+      target.hasDataFlow(input, output)
+    )
  )
-  // TODO: Also block flow through models that don't preserve identity such
-  // as `strdup`.
 }
--- a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
@@ -55,29 +55,12 @@ private newtype TIRDataFlowNode =
  TFinalParameterNode(Parameter p, int indirectionIndex) {
    exists(Ssa::FinalParameterUse use |
      use.getParameter() = p and
-      use.getIndirectionIndex() = indirectionIndex and
-      parameterIsRedefined(p)
+      use.getIndirectionIndex() = indirectionIndex
    )
  } or
  TFinalGlobalValue(Ssa::GlobalUse globalUse) or
  TInitialGlobalValue(Ssa::GlobalDef globalUse)

-/**
- * Holds if the value of `*p` (or `**p`, `***p`, etc.) is redefined somewhere in the body
- * of the enclosing function of `p`.
- *
- * Only parameters satisfying this predicate will generate a `FinalParameterNode` transferring
- * flow out of the function.
- */
-private predicate parameterIsRedefined(Parameter p) {
-  exists(Ssa::Def def |
-    def.getSourceVariable().getBaseVariable().(Ssa::BaseIRVariable).getIRVariable().getAst() = p and
-    def.getIndirectionIndex() = 0 and
-    def.getIndirection() > 1 and
-    not def.getValue().asInstruction() instanceof InitializeParameterInstruction
-  )
-}
-
 /**
 * An operand that is defined by a `FieldAddressInstruction`.
 */
@@ -709,7 +692,7 @@ class FinalGlobalValue extends Node, TFinalGlobalValue {
  override DataFlowType getType() {
    exists(int indirectionIndex |
      indirectionIndex = globalUse.getIndirectionIndex() and
-      result = getTypeImpl(globalUse.getUnspecifiedType(), indirectionIndex - 1)
+      result = getTypeImpl(globalUse.getUnderlyingType(), indirectionIndex - 1)
    )
  }

@@ -740,7 +723,7 @@ class InitialGlobalValue extends Node, TInitialGlobalValue {

  override DataFlowType getType() {
    exists(DataFlowType type |
-      type = globalDef.getUnspecifiedType() and
+      type = globalDef.getUnderlyingType() and
      if this.isGLValue()
      then result = type
      else result = getTypeImpl(type, globalDef.getIndirectionIndex() - 1)
@@ -943,10 +926,13 @@ private Type getTypeImpl0(Type t, int indirectionIndex) {
  indirectionIndex > 0 and
  exists(Type stripped |
    stripped = stripPointer(t.stripTopLevelSpecifiers()) and
-    // We need to avoid the case where `stripPointer(t) = t` (which can happen on
-    // iterators that specify a `value_type` that is the iterator itself). Such a type
-    // would create an infinite loop otherwise. For these cases we simply don't produce
-    // a result for `getTypeImpl`.
+    // We need to avoid the case where `stripPointer(t) = t` (which can happen
+    // on iterators that specify a `value_type` that is the iterator itself).
+    // Such a type would create an infinite loop otherwise. For these cases we
+    // simply don't produce a result for `getTypeImpl`.
+    // To be on the safe side, we check whether the _unspecified_ type has
+    // changed since this also prevents an infinite loop when `stripped` and
+    // `t` only differ by const'ness or volatile'ness.
    stripped.getUnspecifiedType() != t.getUnspecifiedType() and
    result = getTypeImpl0(stripped, indirectionIndex - 1)
  )
@@ -996,12 +982,14 @@ private module RawIndirectNodes {

    override Declaration getEnclosingCallable() { result = this.getFunction() }

+    override predicate isGLValue() { this.getOperand().isGLValue() }
+
    override DataFlowType getType() {
      exists(int sub, DataFlowType type, boolean isGLValue |
        type = getOperandType(this.getOperand(), isGLValue) and
        if isGLValue = true then sub = 1 else sub = 0
      |
-        result = getTypeImpl(type.getUnspecifiedType(), indirectionIndex - sub)
+        result = getTypeImpl(type.getUnderlyingType(), indirectionIndex - sub)
      )
    }

@@ -1038,12 +1026,14 @@ private module RawIndirectNodes {

    override Declaration getEnclosingCallable() { result = this.getFunction() }

+    override predicate isGLValue() { this.getInstruction().isGLValue() }
+
    override DataFlowType getType() {
      exists(int sub, DataFlowType type, boolean isGLValue |
        type = getInstructionType(this.getInstruction(), isGLValue) and
        if isGLValue = true then sub = 1 else sub = 0
      |
-        result = getTypeImpl(type.getUnspecifiedType(), indirectionIndex - sub)
+        result = getTypeImpl(type.getUnderlyingType(), indirectionIndex - sub)
      )
    }

@@ -1136,7 +1126,7 @@ class FinalParameterNode extends Node, TFinalParameterNode {

  override Declaration getEnclosingCallable() { result = this.getFunction() }

-  override DataFlowType getType() { result = getTypeImpl(p.getUnspecifiedType(), indirectionIndex) }
+  override DataFlowType getType() { result = getTypeImpl(p.getUnderlyingType(), indirectionIndex) }

  final override Location getLocationImpl() {
    // Parameters can have multiple locations. When there's a unique location we use
@@ -1789,7 +1779,7 @@ class VariableNode extends Node, TVariableNode {
  }

  override DataFlowType getType() {
-    result = getTypeImpl(v.getUnspecifiedType(), indirectionIndex - 1)
+    result = getTypeImpl(v.getUnderlyingType(), indirectionIndex - 1)
  }

  final override Location getLocationImpl() {
--- a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/ProductFlow.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/ProductFlow.qll
@@ -507,13 +507,13 @@ module ProductFlow {
    private predicate pathSuccPlus(TNodePair n1, TNodePair n2) = fastTC(pathSucc/2)(n1, n2)

    private predicate localPathStep1(Flow1::PathNode pred, Flow1::PathNode succ) {
-      Flow1::PathGraph::edges(pred, succ) and
+      Flow1::PathGraph::edges(pred, succ, _, _) and
      pragma[only_bind_out](pred.getNode().getEnclosingCallable()) =
        pragma[only_bind_out](succ.getNode().getEnclosingCallable())
    }

    private predicate localPathStep2(Flow2::PathNode pred, Flow2::PathNode succ) {
-      Flow2::PathGraph::edges(pred, succ) and
+      Flow2::PathGraph::edges(pred, succ, _, _) and
      pragma[only_bind_out](pred.getNode().getEnclosingCallable()) =
        pragma[only_bind_out](succ.getNode().getEnclosingCallable())
    }
@@ -530,7 +530,7 @@ module ProductFlow {
      TJump()

    private predicate intoImpl1(Flow1::PathNode pred1, Flow1::PathNode succ1, DataFlowCall call) {
-      Flow1::PathGraph::edges(pred1, succ1) and
+      Flow1::PathGraph::edges(pred1, succ1, _, _) and
      pred1.getNode().(ArgumentNode).getCall() = call and
      succ1.getNode() instanceof ParameterNode
    }
@@ -543,7 +543,7 @@ module ProductFlow {
    }

    private predicate outImpl1(Flow1::PathNode pred1, Flow1::PathNode succ1, DataFlowCall call) {
-      Flow1::PathGraph::edges(pred1, succ1) and
+      Flow1::PathGraph::edges(pred1, succ1, _, _) and
      exists(ReturnKindExt returnKind |
        succ1.getNode() = returnKind.getAnOutNode(call) and
        pred1.getNode().(ReturnNodeExt).getKind() = returnKind
@@ -558,7 +558,7 @@ module ProductFlow {
    }

    private predicate intoImpl2(Flow2::PathNode pred2, Flow2::PathNode succ2, DataFlowCall call) {
-      Flow2::PathGraph::edges(pred2, succ2) and
+      Flow2::PathGraph::edges(pred2, succ2, _, _) and
      pred2.getNode().(ArgumentNode).getCall() = call and
      succ2.getNode() instanceof ParameterNode
    }
@@ -571,7 +571,7 @@ module ProductFlow {
    }

    private predicate outImpl2(Flow2::PathNode pred2, Flow2::PathNode succ2, DataFlowCall call) {
-      Flow2::PathGraph::edges(pred2, succ2) and
+      Flow2::PathGraph::edges(pred2, succ2, _, _) and
      exists(ReturnKindExt returnKind |
        succ2.getNode() = returnKind.getAnOutNode(call) and
        pred2.getNode().(ReturnNodeExt).getKind() = returnKind
@@ -590,7 +590,7 @@ module ProductFlow {
      Declaration predDecl, Declaration succDecl, Flow1::PathNode pred1, Flow1::PathNode succ1,
      TKind kind
    ) {
-      Flow1::PathGraph::edges(pred1, succ1) and
+      Flow1::PathGraph::edges(pred1, succ1, _, _) and
      predDecl != succDecl and
      pred1.getNode().getEnclosingCallable() = predDecl and
      succ1.getNode().getEnclosingCallable() = succDecl and
@@ -610,7 +610,7 @@ module ProductFlow {
      Declaration predDecl, Declaration succDecl, Flow2::PathNode pred2, Flow2::PathNode succ2,
      TKind kind
    ) {
-      Flow2::PathGraph::edges(pred2, succ2) and
+      Flow2::PathGraph::edges(pred2, succ2, _, _) and
      predDecl != succDecl and
      pred2.getNode().getEnclosingCallable() = predDecl and
      succ2.getNode().getEnclosingCallable() = succDecl and
--- a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaInternals.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaInternals.qll
@@ -4,7 +4,11 @@ private import DataFlowUtil
 private import DataFlowImplCommon as DataFlowImplCommon
 private import semmle.code.cpp.models.interfaces.Allocation as Alloc
 private import semmle.code.cpp.models.interfaces.DataFlow as DataFlow
+private import semmle.code.cpp.models.interfaces.Taint as Taint
+private import semmle.code.cpp.models.interfaces.PartialFlow as PartialFlow
+private import semmle.code.cpp.models.interfaces.FunctionInputsAndOutputs as FIO
 private import semmle.code.cpp.ir.internal.IRCppLanguage
+private import semmle.code.cpp.ir.dataflow.internal.ModelUtil
 private import DataFlowPrivate
 private import ssa0.SsaInternals as SsaInternals0
 import SsaInternalsCommon
@@ -138,12 +142,11 @@ private newtype TDefOrUseImpl =
    isIteratorUse(container, iteratorAddress, _, indirectionIndex)
  } or
  TFinalParameterUse(Parameter p, int indirectionIndex) {
-    // Avoid creating parameter nodes if there is no definitions of the variable other than the initializaion.
-    exists(SsaInternals0::Def def |
-      def.getSourceVariable().getBaseVariable().(BaseIRVariable).getIRVariable().getAst() = p and
-      not def.getValue().asInstruction() instanceof InitializeParameterInstruction and
-      unspecifiedTypeIsModifiableAt(p.getUnspecifiedType(), indirectionIndex)
-    )
+    underlyingTypeIsModifiableAt(p.getUnderlyingType(), indirectionIndex) and
+    // Only create an SSA read for the final use of a parameter if there's
+    // actually a body of the enclosing function. If there's no function body
+    // then we'll never need to flow out of the function anyway.
+    p.getFunction().hasDefinition()
  }

 private predicate isGlobalUse(
@@ -172,11 +175,13 @@ private predicate isGlobalDefImpl(
  )
 }

-private predicate unspecifiedTypeIsModifiableAt(Type unspecified, int indirectionIndex) {
-  indirectionIndex = [1 .. getIndirectionForUnspecifiedType(unspecified).getNumberOfIndirections()] and
+private predicate underlyingTypeIsModifiableAt(Type underlying, int indirectionIndex) {
+  indirectionIndex =
+    [1 .. getIndirectionForUnspecifiedType(underlying.getUnspecifiedType())
+          .getNumberOfIndirections()] and
  exists(CppType cppType |
-    cppType.hasUnspecifiedType(unspecified, _) and
-    isModifiableAt(cppType, indirectionIndex + 1)
+    cppType.hasUnderlyingType(underlying, false) and
+    isModifiableAt(cppType, indirectionIndex)
  )
 }

@@ -545,6 +550,11 @@ class GlobalUse extends UseImpl, TGlobalUse {
   */
  Type getUnspecifiedType() { result = global.getUnspecifiedType() }

+  /**
+   * Gets the type of this use, after typedefs have been resolved.
+   */
+  Type getUnderlyingType() { result = global.getUnderlyingType() }
+
  override predicate isCertain() { any() }

  override BaseSourceVariableInstruction getBase() { none() }
@@ -588,11 +598,16 @@ class GlobalDefImpl extends DefOrUseImpl, TGlobalDefImpl {
  int getIndirection() { result = indirectionIndex }

  /**
-   * Gets the type of this use after specifiers have been deeply stripped
-   * and typedefs have been resolved.
+   * Gets the type of this definition after specifiers have been deeply
+   * stripped and typedefs have been resolved.
   */
  Type getUnspecifiedType() { result = global.getUnspecifiedType() }

+  /**
+   * Gets the type of this definition, after typedefs have been resolved.
+   */
+  Type getUnderlyingType() { result = global.getUnderlyingType() }
+
  override string toString() { result = "Def of " + this.getSourceVariable() }

  override Location getLocation() { result = f.getLocation() }
@@ -784,10 +799,58 @@ private Node getAPriorDefinition(SsaDefOrUse defOrUse) {
  )
 }

+private predicate inOut(FIO::FunctionInput input, FIO::FunctionOutput output) {
+  exists(int indirectionIndex |
+    input.isQualifierObject(indirectionIndex) and
+    output.isQualifierObject(indirectionIndex)
+    or
+    exists(int i |
+      input.isParameterDeref(i, indirectionIndex) and
+      output.isParameterDeref(i, indirectionIndex)
+    )
+  )
+}
+
+/**
+ * Holds if there should not be use-use flow out of `n`. That is, `n` is
+ * an out-barrier to use-use flow. This includes:
+ *
+ * - an input to a call that would be assumed to have use-use flow to the same
+ *   argument as an output, but this flow should be blocked because the
+ *   function is modeled with another flow to that output (for example the
+ *   first argument of `strcpy`).
+ * - a conversion that flows to such an input.
+ */
+private predicate modeledFlowBarrier(Node n) {
+  exists(
+    FIO::FunctionInput input, FIO::FunctionOutput output, CallInstruction call,
+    PartialFlow::PartialFlowFunction partialFlowFunc
+  |
+    n = callInput(call, input) and
+    inOut(input, output) and
+    exists(callOutput(call, output)) and
+    partialFlowFunc = call.getStaticCallTarget() and
+    not partialFlowFunc.isPartialWrite(output)
+  |
+    call.getStaticCallTarget().(DataFlow::DataFlowFunction).hasDataFlow(_, output)
+    or
+    call.getStaticCallTarget().(Taint::TaintFunction).hasTaintFlow(_, output)
+  )
+  or
+  exists(Operand operand, Instruction instr, Node n0, int indirectionIndex |
+    modeledFlowBarrier(n0) and
+    nodeHasInstruction(n0, instr, indirectionIndex) and
+    conversionFlow(operand, instr, false, _) and
+    nodeHasOperand(n, operand, indirectionIndex)
+  )
+}
+
 /** Holds if there is def-use or use-use flow from `nodeFrom` to `nodeTo`. */
 predicate ssaFlow(Node nodeFrom, Node nodeTo) {
  exists(Node nFrom, boolean uncertain, SsaDefOrUse defOrUse |
-    ssaFlowImpl(defOrUse, nFrom, nodeTo, uncertain) and nodeFrom != nodeTo
+    ssaFlowImpl(defOrUse, nFrom, nodeTo, uncertain) and
+    not modeledFlowBarrier(nFrom) and
+    nodeFrom != nodeTo
  |
    if uncertain = true then nodeFrom = [nFrom, getAPriorDefinition(defOrUse)] else nodeFrom = nFrom
  )
@@ -1092,6 +1155,11 @@ class GlobalDef extends TGlobalDef, SsaDefOrUse {
   */
  DataFlowType getUnspecifiedType() { result = global.getUnspecifiedType() }

+  /**
+   * Gets the type of this definition, after typedefs have been resolved.
+   */
+  DataFlowType getUnderlyingType() { result = global.getUnderlyingType() }
+
  /** Gets the `IRFunction` whose body is evaluated after this definition. */
  IRFunction getIRFunction() { result = global.getIRFunction() }

--- a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaInternalsCommon.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaInternalsCommon.qll
@@ -452,7 +452,7 @@ private module IsModifiableAtImpl {
  private predicate impl(CppType cppType, int indirectionIndex) {
    exists(Type pointerType, Type base |
      isUnderlyingIndirectionType(pointerType) and
-      cppType.hasUnderlyingType(pointerType, _) and
+      cppType.hasUnderlyingType(pointerType, false) and
      base = getTypeImpl(pointerType, indirectionIndex)
    |
      // The value cannot be modified if it has a const specifier,
--- a/cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/Instruction.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/Instruction.qll
@@ -2125,13 +2125,6 @@ class ChiInstruction extends Instruction {
   */
  final Instruction getPartial() { result = this.getPartialOperand().getDef() }

-  /**
-   * Gets the bit range `[startBit, endBit)` updated by the partial operand of this `ChiInstruction`, relative to the start address of the total operand.
-   */
-  final predicate getUpdatedInterval(int startBit, int endBit) {
-    Construction::getIntervalUpdatedByChi(this, startBit, endBit)
-  }
-
  /**
   * Holds if the `ChiPartialOperand` totally, but not exactly, overlaps with the `ChiTotalOperand`.
   * This means that the `ChiPartialOperand` will not override the entire memory associated with the
--- a/cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/SSAConstruction.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/SSAConstruction.qll
@@ -233,20 +233,6 @@ private module Cached {
    )
  }

-  /**
-   * Holds if the partial operand of this `ChiInstruction` updates the bit range
-   * `[startBitOffset, endBitOffset)` of the total operand.
-   */
-  cached
-  predicate getIntervalUpdatedByChi(ChiInstruction chi, int startBitOffset, int endBitOffset) {
-    exists(Alias::MemoryLocation location, OldInstruction oldInstruction |
-      oldInstruction = getOldInstruction(chi.getPartial()) and
-      location = Alias::getResultMemoryLocation(oldInstruction) and
-      startBitOffset = Alias::getStartBitOffset(location) and
-      endBitOffset = Alias::getEndBitOffset(location)
-    )
-  }
-
  /**
   * Holds if `operand` totally overlaps with its definition and consumes the bit range
   * `[startBitOffset, endBitOffset)`.
--- a/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/Instruction.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/Instruction.qll
@@ -2125,13 +2125,6 @@ class ChiInstruction extends Instruction {
   */
  final Instruction getPartial() { result = this.getPartialOperand().getDef() }

-  /**
-   * Gets the bit range `[startBit, endBit)` updated by the partial operand of this `ChiInstruction`, relative to the start address of the total operand.
-   */
-  final predicate getUpdatedInterval(int startBit, int endBit) {
-    Construction::getIntervalUpdatedByChi(this, startBit, endBit)
-  }
-
  /**
   * Holds if the `ChiPartialOperand` totally, but not exactly, overlaps with the `ChiTotalOperand`.
   * This means that the `ChiPartialOperand` will not override the entire memory associated with the
--- a/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/IRConstruction.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/IRConstruction.qll
@@ -202,12 +202,6 @@ Instruction getMemoryOperandDefinition(
  none()
 }

-/**
- * Holds if the partial operand of this `ChiInstruction` updates the bit range
- * `[startBitOffset, endBitOffset)` of the total operand.
- */
-predicate getIntervalUpdatedByChi(ChiInstruction chi, int startBit, int endBit) { none() }
-
 /**
 * Holds if the operand totally overlaps with its definition and consumes the
 * bit range `[startBitOffset, endBitOffset)`.
--- a/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedElement.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedElement.qll
@@ -209,6 +209,8 @@ private predicate usedAsCondition(Expr expr) {
  or
  exists(IfStmt ifStmt | ifStmt.getCondition().getFullyConverted() = expr)
  or
+  exists(ConstexprIfStmt ifStmt | ifStmt.getCondition().getFullyConverted() = expr)
+  or
  exists(ConditionalExpr condExpr |
    // The two-operand form of `ConditionalExpr` treats its condition as a value, since it needs to
    // be reused as a value if the condition is true.
@@ -474,7 +476,6 @@ private module IRDeclarationEntries {
   * This class exists to work around the fact that `DeclStmt`s in some cases
   * do not have `DeclarationEntry`s. Currently, this is the case for:
   * - `DeclStmt`s in template instantiations.
-   * - `DeclStmt`s that are generated by the desugaring of range-based for-loops.
   *
   * So instead, the IR works with `IRDeclarationEntry`s that synthesize missing
   * `DeclarationEntry`s when there is no result for `DeclStmt::getDeclarationEntry`.
--- a/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedExpr.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedExpr.qll
@@ -3173,7 +3173,7 @@ class TranslatedConditionDeclExpr extends TranslatedNonConstantExpr {
  private TranslatedConditionDecl getDecl() { result = getTranslatedConditionDecl(expr) }

  private TranslatedExpr getConditionExpr() {
-    result = getTranslatedExpr(expr.getVariableAccess().getFullyConverted())
+    result = getTranslatedExpr(expr.getExpr().getFullyConverted())
  }
 }

--- a/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedStmt.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedStmt.qll
@@ -774,6 +774,72 @@ class TranslatedIfStmt extends TranslatedStmt, ConditionContext {
  }
 }

+class TranslatedConstExprIfStmt extends TranslatedStmt, ConditionContext {
+  override ConstexprIfStmt stmt;
+
+  override Instruction getFirstInstruction(EdgeKind kind) {
+    if this.hasInitialization()
+    then result = this.getInitialization().getFirstInstruction(kind)
+    else result = this.getFirstConditionInstruction(kind)
+  }
+
+  override TranslatedElement getChild(int id) {
+    id = 0 and result = this.getInitialization()
+    or
+    id = 1 and result = this.getCondition()
+    or
+    id = 2 and result = this.getThen()
+    or
+    id = 3 and result = this.getElse()
+  }
+
+  private predicate hasInitialization() { exists(stmt.getInitialization()) }
+
+  private TranslatedStmt getInitialization() {
+    result = getTranslatedStmt(stmt.getInitialization())
+  }
+
+  private TranslatedCondition getCondition() {
+    result = getTranslatedCondition(stmt.getCondition().getFullyConverted())
+  }
+
+  private Instruction getFirstConditionInstruction(EdgeKind kind) {
+    result = this.getCondition().getFirstInstruction(kind)
+  }
+
+  private TranslatedStmt getThen() { result = getTranslatedStmt(stmt.getThen()) }
+
+  private TranslatedStmt getElse() { result = getTranslatedStmt(stmt.getElse()) }
+
+  private predicate hasElse() { exists(stmt.getElse()) }
+
+  override Instruction getInstructionSuccessor(InstructionTag tag, EdgeKind kind) { none() }
+
+  override Instruction getChildTrueSuccessor(TranslatedCondition child, EdgeKind kind) {
+    child = this.getCondition() and
+    result = this.getThen().getFirstInstruction(kind)
+  }
+
+  override Instruction getChildFalseSuccessor(TranslatedCondition child, EdgeKind kind) {
+    child = this.getCondition() and
+    if this.hasElse()
+    then result = this.getElse().getFirstInstruction(kind)
+    else result = this.getParent().getChildSuccessor(this, kind)
+  }
+
+  override Instruction getChildSuccessor(TranslatedElement child, EdgeKind kind) {
+    child = this.getInitialization() and
+    result = this.getFirstConditionInstruction(kind)
+    or
+    (child = this.getThen() or child = this.getElse()) and
+    result = this.getParent().getChildSuccessor(this, kind)
+  }
+
+  override predicate hasInstruction(Opcode opcode, InstructionTag tag, CppType resultType) {
+    none()
+  }
+}
+
 abstract class TranslatedLoop extends TranslatedStmt, ConditionContext {
  override Loop stmt;

@@ -894,25 +960,38 @@ class TranslatedRangeBasedForStmt extends TranslatedStmt, ConditionContext {
  override RangeBasedForStmt stmt;

  override TranslatedElement getChild(int id) {
-    id = 0 and result = this.getRangeVariableDeclStmt()
+    id = 0 and result = this.getInitialization()
+    or
+    id = 1 and result = this.getRangeVariableDeclStmt()
    or
    // Note: `__begin` and `__end` are declared by the same `DeclStmt`
-    id = 1 and result = this.getBeginEndVariableDeclStmt()
+    id = 2 and result = this.getBeginEndVariableDeclStmt()
    or
-    id = 2 and result = this.getCondition()
+    id = 3 and result = this.getCondition()
    or
-    id = 3 and result = this.getUpdate()
+    id = 4 and result = this.getUpdate()
    or
-    id = 4 and result = this.getVariableDeclStmt()
+    id = 5 and result = this.getVariableDeclStmt()
    or
-    id = 5 and result = this.getBody()
+    id = 6 and result = this.getBody()
+  }
+
+  private predicate hasInitialization() { exists(stmt.getInitialization()) }
+
+  private TranslatedStmt getInitialization() {
+    result = getTranslatedStmt(stmt.getInitialization())
  }

  override Instruction getFirstInstruction(EdgeKind kind) {
-    result = this.getRangeVariableDeclStmt().getFirstInstruction(kind)
+    if this.hasInitialization()
+    then result = this.getInitialization().getFirstInstruction(kind)
+    else result = this.getFirstRangeVariableDeclStmtInstruction(kind)
  }

  override Instruction getChildSuccessor(TranslatedElement child, EdgeKind kind) {
+    child = this.getInitialization() and
+    result = this.getFirstRangeVariableDeclStmtInstruction(kind)
+    or
    child = this.getRangeVariableDeclStmt() and
    result = this.getBeginEndVariableDeclStmt().getFirstInstruction(kind)
    or
@@ -952,6 +1031,10 @@ class TranslatedRangeBasedForStmt extends TranslatedStmt, ConditionContext {
    )
  }

+  private Instruction getFirstRangeVariableDeclStmtInstruction(EdgeKind kind) {
+    result = this.getRangeVariableDeclStmt().getFirstInstruction(kind)
+  }
+
  private TranslatedDeclStmt getBeginEndVariableDeclStmt() {
    exists(IRVariableDeclarationEntry entry |
      entry.getStmt() = stmt.getBeginEndDeclaration() and
--- a/cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/Instruction.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/Instruction.qll
@@ -2125,13 +2125,6 @@ class ChiInstruction extends Instruction {
   */
  final Instruction getPartial() { result = this.getPartialOperand().getDef() }

-  /**
-   * Gets the bit range `[startBit, endBit)` updated by the partial operand of this `ChiInstruction`, relative to the start address of the total operand.
-   */
-  final predicate getUpdatedInterval(int startBit, int endBit) {
-    Construction::getIntervalUpdatedByChi(this, startBit, endBit)
-  }
-
  /**
   * Holds if the `ChiPartialOperand` totally, but not exactly, overlaps with the `ChiTotalOperand`.
   * This means that the `ChiPartialOperand` will not override the entire memory associated with the
--- a/cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SSAConstruction.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SSAConstruction.qll
@@ -233,20 +233,6 @@ private module Cached {
    )
  }

-  /**
-   * Holds if the partial operand of this `ChiInstruction` updates the bit range
-   * `[startBitOffset, endBitOffset)` of the total operand.
-   */
-  cached
-  predicate getIntervalUpdatedByChi(ChiInstruction chi, int startBitOffset, int endBitOffset) {
-    exists(Alias::MemoryLocation location, OldInstruction oldInstruction |
-      oldInstruction = getOldInstruction(chi.getPartial()) and
-      location = Alias::getResultMemoryLocation(oldInstruction) and
-      startBitOffset = Alias::getStartBitOffset(location) and
-      endBitOffset = Alias::getEndBitOffset(location)
-    )
-  }
-
  /**
   * Holds if `operand` totally overlaps with its definition and consumes the bit range
   * `[startBitOffset, endBitOffset)`.
--- a/cpp/ql/lib/semmle/code/cpp/models/Models.qll
+++ b/cpp/ql/lib/semmle/code/cpp/models/Models.qll
@@ -3,6 +3,7 @@ private import implementations.Deallocation
 private import implementations.Fread
 private import implementations.Getenv
 private import implementations.Gets
+private import implementations.GetText
 private import implementations.IdentityFunction
 private import implementations.Inet
 private import implementations.Iterator
--- a/cpp/ql/lib/semmle/code/cpp/models/implementations/GetDelim.qll
+++ b/cpp/ql/lib/semmle/code/cpp/models/implementations/GetDelim.qll
@@ -15,6 +15,8 @@ private class GetDelimFunction extends TaintFunction, AliasFunction, SideEffectF
    i.isParameter(3) and o.isParameterDeref(0)
  }

+  override predicate isPartialWrite(FunctionOutput o) { o.isParameterDeref(3) }
+
  override predicate parameterNeverEscapes(int index) { index = [0, 1, 3] }

  override predicate parameterEscapesOnlyViaReturn(int index) { none() }
--- a/cpp/ql/lib/semmle/code/cpp/models/implementations/GetText.qll
+++ b/cpp/ql/lib/semmle/code/cpp/models/implementations/GetText.qll
@@ -0,0 +1,33 @@
+import semmle.code.cpp.models.interfaces.DataFlow
+
+/**
+ * Returns the transated text index for a given gettext function `f`
+ */
+private int getTextArg(Function f) {
+  // basic variations of gettext
+  f.hasGlobalOrStdName("gettext") and result = 0
+  or
+  f.hasGlobalOrStdName("dgettext") and result = 1
+  or
+  f.hasGlobalOrStdName("dcgettext") and result = 1
+  or
+  // plural variations of gettext that take one format string for singular and another for plural form
+  f.hasGlobalOrStdName("ngettext") and
+  (result = 0 or result = 1)
+  or
+  f.hasGlobalOrStdName("dngettext") and
+  (result = 1 or result = 2)
+  or
+  f.hasGlobalOrStdName("dcngettext") and
+  (result = 1 or result = 2)
+}
+
+class GetTextFunction extends DataFlowFunction {
+  int argInd;
+
+  GetTextFunction() { argInd = getTextArg(this) }
+
+  override predicate hasDataFlow(FunctionInput input, FunctionOutput output) {
+    input.isParameterDeref(argInd) and output.isReturnValueDeref()
+  }
+}
--- a/cpp/ql/lib/semmle/code/cpp/models/implementations/Gets.qll
+++ b/cpp/ql/lib/semmle/code/cpp/models/implementations/Gets.qll
@@ -27,6 +27,8 @@ private class FgetsFunction extends DataFlowFunction, TaintFunction, ArrayFuncti
    output.isReturnValue()
  }

+  override predicate isPartialWrite(FunctionOutput output) { output.isParameterDeref(2) }
+
  override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
    input.isParameter(2) and
    output.isParameterDeref(0)
--- a/cpp/ql/lib/semmle/code/cpp/models/implementations/Inet.qll
+++ b/cpp/ql/lib/semmle/code/cpp/models/implementations/Inet.qll
@@ -20,6 +20,8 @@ private class InetAton extends TaintFunction, ArrayFunction {
    output.isParameterDeref(1)
  }

+  override predicate isPartialWrite(FunctionOutput output) { output.isParameterDeref(1) }
+
  override predicate hasArrayInput(int bufParam) { bufParam = 0 }

  override predicate hasArrayOutput(int bufParam) { bufParam = 1 }
--- a/cpp/ql/lib/semmle/code/cpp/models/implementations/Memset.qll
+++ b/cpp/ql/lib/semmle/code/cpp/models/implementations/Memset.qll
@@ -22,11 +22,28 @@ private class MemsetFunctionModel extends ArrayFunction, DataFlowFunction, Alias
      ])
  }

+  /**
+   * Gets the index of the parameter that specifies the fill character to insert, if any.
+   */
+  private int getFillCharParameterIndex() {
+    (
+      this.hasGlobalOrStdOrBslName("memset")
+      or
+      this.hasGlobalOrStdName("wmemset")
+      or
+      this.hasGlobalName(["__builtin_memset", "__builtin_memset_chk"])
+    ) and
+    result = 1
+  }
+
  override predicate hasArrayOutput(int bufParam) { bufParam = 0 }

  override predicate hasDataFlow(FunctionInput input, FunctionOutput output) {
    input.isParameter(0) and
    output.isReturnValue()
+    or
+    input.isParameter(this.getFillCharParameterIndex()) and
+    (output.isParameterDeref(0) or output.isReturnValueDeref())
  }

  override predicate hasArrayWithVariableSize(int bufParam, int countParam) {
--- a/cpp/ql/lib/semmle/code/cpp/models/implementations/StdContainer.qll
+++ b/cpp/ql/lib/semmle/code/cpp/models/implementations/StdContainer.qll
@@ -118,6 +118,8 @@ private class StdSequenceContainerData extends TaintFunction {
    input.isReturnValueDeref() and
    output.isQualifierObject()
  }
+
+  override predicate isPartialWrite(FunctionOutput output) { output.isQualifierObject() }
 }

 /**
@@ -147,6 +149,8 @@ private class StdSequenceContainerPushModel extends StdSequenceContainerPush, Ta
    input.isParameterDeref(0) and
    output.isQualifierObject()
  }
+
+  override predicate isPartialWrite(FunctionOutput output) { output.isQualifierObject() }
 }

 /**
@@ -207,6 +211,8 @@ private class StdSequenceContainerInsertModel extends StdSequenceContainerInsert
      output.isReturnValue()
    )
  }
+
+  override predicate isPartialWrite(FunctionOutput output) { output.isQualifierObject() }
 }

 /**
@@ -263,6 +269,8 @@ private class StdSequenceContainerAt extends TaintFunction {
    input.isReturnValueDeref() and
    output.isQualifierObject()
  }
+
+  override predicate isPartialWrite(FunctionOutput output) { output.isQualifierObject() }
 }

 /**
@@ -297,6 +305,8 @@ private class StdSequenceEmplaceModel extends StdSequenceEmplace, TaintFunction
      output.isReturnValue()
    )
  }
+
+  override predicate isPartialWrite(FunctionOutput output) { output.isQualifierObject() }
 }

 /**
@@ -335,6 +345,8 @@ private class StdSequenceEmplaceBackModel extends StdSequenceEmplaceBack, TaintF
    input.isParameterDeref([0 .. this.getNumberOfParameters() - 1]) and
    output.isQualifierObject()
  }
+
+  override predicate isPartialWrite(FunctionOutput output) { output.isQualifierObject() }
 }

 /**
--- a/cpp/ql/lib/semmle/code/cpp/models/implementations/StdMap.qll
+++ b/cpp/ql/lib/semmle/code/cpp/models/implementations/StdMap.qll
@@ -3,6 +3,7 @@
 */

 import semmle.code.cpp.models.interfaces.Taint
+import semmle.code.cpp.models.interfaces.DataFlow
 import semmle.code.cpp.models.interfaces.Iterator

 /**
@@ -53,6 +54,8 @@ private class StdMapInsert extends TaintFunction {
      output.isReturnValue()
    )
  }
+
+  override predicate isPartialWrite(FunctionOutput output) { output.isQualifierObject() }
 }

 /**
@@ -75,6 +78,8 @@ private class StdMapEmplace extends TaintFunction {
    input.isQualifierObject() and
    output.isReturnValue()
  }
+
+  override predicate isPartialWrite(FunctionOutput output) { output.isQualifierObject() }
 }

 /**
@@ -102,6 +107,8 @@ private class StdMapTryEmplace extends TaintFunction {
    input.isQualifierObject() and
    output.isReturnValue()
  }
+
+  override predicate isPartialWrite(FunctionOutput output) { output.isQualifierObject() }
 }

 /**
@@ -115,6 +122,8 @@ private class StdMapMerge extends TaintFunction {
    input.isParameterDeref(0) and
    output.isQualifierObject()
  }
+
+  override predicate isPartialWrite(FunctionOutput output) { output.isQualifierObject() }
 }

 /**
@@ -132,6 +141,8 @@ private class StdMapAt extends TaintFunction {
    input.isReturnValueDeref() and
    output.isQualifierObject()
  }
+
+  override predicate isPartialWrite(FunctionOutput output) { output.isQualifierObject() }
 }

 /**
--- a/cpp/ql/lib/semmle/code/cpp/models/implementations/StdSet.qll
+++ b/cpp/ql/lib/semmle/code/cpp/models/implementations/StdSet.qll
@@ -61,6 +61,8 @@ private class StdSetInsert extends TaintFunction {
      output.isReturnValue()
    )
  }
+
+  override predicate isPartialWrite(FunctionOutput output) { output.isQualifierObject() }
 }

 /**
@@ -82,6 +84,8 @@ private class StdSetEmplace extends TaintFunction {
    input.isQualifierObject() and
    output.isReturnValue()
  }
+
+  override predicate isPartialWrite(FunctionOutput output) { output.isQualifierObject() }
 }

 /**
@@ -95,6 +99,8 @@ private class StdSetMerge extends TaintFunction {
    input.isParameterDeref(0) and
    output.isQualifierObject()
  }
+
+  override predicate isPartialWrite(FunctionOutput output) { output.isQualifierObject() }
 }

 /**
--- a/cpp/ql/lib/semmle/code/cpp/models/implementations/StdString.qll
+++ b/cpp/ql/lib/semmle/code/cpp/models/implementations/StdString.qll
@@ -129,6 +129,8 @@ private class StdStringDataModel extends StdStringData, StdStringTaintFunction {
    input.isReturnValueDeref() and
    output.isQualifierObject()
  }
+
+  override predicate isPartialWrite(FunctionOutput output) { output.isQualifierObject() }
 }

 /**
@@ -142,6 +144,8 @@ private class StdStringPush extends StdStringTaintFunction {
    input.isParameter(0) and
    output.isQualifierObject()
  }
+
+  override predicate isPartialWrite(FunctionOutput output) { output.isQualifierObject() }
 }

 /**
@@ -204,6 +208,8 @@ private class StdStringAppend extends StdStringTaintFunction {
    input.isReturnValueDeref() and
    output.isQualifierObject()
  }
+
+  override predicate isPartialWrite(FunctionOutput output) { output.isQualifierObject() }
 }

 /**
@@ -237,6 +243,8 @@ private class StdStringInsert extends StdStringTaintFunction {
    input.isReturnValueDeref() and
    output.isQualifierObject()
  }
+
+  override predicate isPartialWrite(FunctionOutput output) { output.isQualifierObject() }
 }

 /**
@@ -305,6 +313,8 @@ private class StdStringAt extends StdStringTaintFunction {
    input.isReturnValueDeref() and
    output.isQualifierObject()
  }
+
+  override predicate isPartialWrite(FunctionOutput output) { output.isQualifierObject() }
 }

 /**
@@ -338,6 +348,8 @@ private class StdIStreamIn extends DataFlowFunction, TaintFunction {
    input.isReturnValueDeref() and
    output.isQualifierObject()
  }
+
+  override predicate isPartialWrite(FunctionOutput output) { output.isQualifierObject() }
 }

 /**
@@ -358,6 +370,8 @@ private class StdIStreamInNonMember extends DataFlowFunction, TaintFunction {
    output.isReturnValueDeref()
  }

+  override predicate isPartialWrite(FunctionOutput output) { output.isQualifierObject() }
+
  override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
    // flow from first parameter to second parameter
    input.isParameterDeref(0) and
@@ -403,6 +417,8 @@ private class StdIStreamRead extends DataFlowFunction, TaintFunction {
    output.isReturnValueDeref()
  }

+  override predicate isPartialWrite(FunctionOutput output) { output.isQualifierObject() }
+
  override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
    // flow from qualifier to first parameter
    input.isQualifierObject() and
@@ -442,6 +458,8 @@ private class StdIStreamPutBack extends DataFlowFunction, TaintFunction {
    output.isReturnValueDeref()
  }

+  override predicate isPartialWrite(FunctionOutput output) { output.isQualifierObject() }
+
  override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
    // flow from first parameter (value or pointer) to qualifier
    input.isParameter(0) and
@@ -478,6 +496,8 @@ private class StdIStreamGetLine extends DataFlowFunction, TaintFunction {
    output.isReturnValueDeref()
  }

+  override predicate isPartialWrite(FunctionOutput output) { output.isQualifierObject() }
+
  override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
    // flow from qualifier to first parameter
    input.isQualifierObject() and
@@ -540,6 +560,8 @@ private class StdOStreamOut extends DataFlowFunction, TaintFunction {
    output.isReturnValueDeref()
  }

+  override predicate isPartialWrite(FunctionOutput output) { output.isQualifierObject() }
+
  override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
    // flow from first parameter (value or pointer) to qualifier
    input.isParameter(0) and
@@ -579,6 +601,8 @@ private class StdOStreamOutNonMember extends DataFlowFunction, TaintFunction {
    output.isReturnValueDeref()
  }

+  override predicate isPartialWrite(FunctionOutput output) { output.isParameterDeref(0) }
+
  override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
    // flow from second parameter to first parameter
    input.isParameterDeref(1) and
@@ -672,6 +696,8 @@ private class StdStreamFunction extends DataFlowFunction, TaintFunction {
    output.isReturnValueDeref()
  }

+  override predicate isPartialWrite(FunctionOutput output) { output.isQualifierObject() }
+
  override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
    // reverse flow from returned reference to the qualifier
    input.isReturnValueDeref() and
--- a/cpp/ql/lib/semmle/code/cpp/models/implementations/Strcrement.qll
+++ b/cpp/ql/lib/semmle/code/cpp/models/implementations/Strcrement.qll
@@ -36,6 +36,8 @@ private class Strcrement extends ArrayFunction, TaintFunction, SideEffectFunctio
      input.isParameter(index) and output.isReturnValue()
      or
      input.isParameterDeref(index) and output.isReturnValueDeref()
+      or
+      input.isParameterDeref(index) and output.isParameterDeref(index)
    )
  }

--- a/cpp/ql/lib/semmle/code/cpp/models/interfaces/DataFlow.qll
+++ b/cpp/ql/lib/semmle/code/cpp/models/interfaces/DataFlow.qll
@@ -10,6 +10,7 @@
 import semmle.code.cpp.Function
 import FunctionInputsAndOutputs
 import semmle.code.cpp.models.Models
+import PartialFlow

 /**
 * A library function for which a value is or may be copied from a parameter
@@ -18,7 +19,7 @@ import semmle.code.cpp.models.Models
 * Note that this does not include partial copying of values or partial writes
 * to destinations; that is covered by `TaintModel.qll`.
 */
-abstract class DataFlowFunction extends Function {
+abstract class DataFlowFunction extends PartialFlowFunction {
  /**
   * Holds if data can be copied from the argument, qualifier, or buffer
   * represented by `input` to the return value or buffer represented by
--- a/cpp/ql/lib/semmle/code/cpp/models/interfaces/FunctionInputsAndOutputs.qll
+++ b/cpp/ql/lib/semmle/code/cpp/models/interfaces/FunctionInputsAndOutputs.qll
@@ -23,6 +23,14 @@ private newtype TFunctionInput =
 class FunctionInput extends TFunctionInput {
  abstract string toString();

+  /**
+   * INTERNAL: Do not use.
+   *
+   * Gets the `FunctionInput` that represents the indirection of this input,
+   * if any.
+   */
+  FunctionInput getIndirectionInput() { none() }
+
  /**
   * Holds if this is the input value of the parameter with index `index`.
   *
@@ -226,6 +234,8 @@ class InParameter extends FunctionInput, TInParameter {
  ParameterIndex getIndex() { result = index }

  override predicate isParameter(ParameterIndex i) { i = index }
+
+  override FunctionInput getIndirectionInput() { result = TInParameterDeref(index, 1) }
 }

 /**
@@ -257,6 +267,10 @@ class InParameterDeref extends FunctionInput, TInParameterDeref {
  override predicate isParameterDeref(ParameterIndex i, int indirection) {
    i = index and indirectionIndex = indirection
  }
+
+  override FunctionInput getIndirectionInput() {
+    result = TInParameterDeref(index, indirectionIndex + 1)
+  }
 }

 /**
@@ -275,6 +289,8 @@ class InQualifierObject extends FunctionInput, TInQualifierObject {
  override string toString() { result = "InQualifierObject" }

  override predicate isQualifierObject() { any() }
+
+  override FunctionInput getIndirectionInput() { none() }
 }

 /**
@@ -293,6 +309,8 @@ class InQualifierAddress extends FunctionInput, TInQualifierAddress {
  override string toString() { result = "InQualifierAddress" }

  override predicate isQualifierAddress() { any() }
+
+  override FunctionInput getIndirectionInput() { result = TInQualifierObject() }
 }

 /**
@@ -321,6 +339,8 @@ class InReturnValueDeref extends FunctionInput, TInReturnValueDeref {
  override string toString() { result = "InReturnValueDeref" }

  override predicate isReturnValueDeref() { any() }
+
+  override FunctionInput getIndirectionInput() { none() }
 }

 private newtype TFunctionOutput =
@@ -340,6 +360,14 @@ private newtype TFunctionOutput =
 class FunctionOutput extends TFunctionOutput {
  abstract string toString();

+  /**
+   * INTERNAL: Do not use.
+   *
+   * Gets the `FunctionOutput` that represents the indirection of this output,
+   * if any.
+   */
+  FunctionOutput getIndirectionOutput() { none() }
+
  /**
   * Holds if this is the output value pointed to by a pointer parameter to a function, or the
   * output value referred to by a reference parameter to a function, where the parameter has
@@ -512,6 +540,10 @@ class OutParameterDeref extends FunctionOutput, TOutParameterDeref {
  override predicate isParameterDeref(ParameterIndex i, int ind) {
    i = index and ind = indirectionIndex
  }
+
+  override FunctionOutput getIndirectionOutput() {
+    result = TOutParameterDeref(index, indirectionIndex + 1)
+  }
 }

 /**
@@ -530,6 +562,8 @@ class OutQualifierObject extends FunctionOutput, TOutQualifierObject {
  override string toString() { result = "OutQualifierObject" }

  override predicate isQualifierObject() { any() }
+
+  override FunctionOutput getIndirectionOutput() { none() }
 }

 /**
@@ -552,6 +586,8 @@ class OutReturnValue extends FunctionOutput, TOutReturnValue {
  override string toString() { result = "OutReturnValue" }

  override predicate isReturnValue() { any() }
+
+  override FunctionOutput getIndirectionOutput() { result = TOutReturnValueDeref(1) }
 }

 /**
@@ -571,11 +607,19 @@ class OutReturnValue extends FunctionOutput, TOutReturnValue {
 *   of `getInt()` is neither a pointer nor a reference.
 */
 class OutReturnValueDeref extends FunctionOutput, TOutReturnValueDeref {
+  int indirectionIndex;
+
+  OutReturnValueDeref() { this = TOutReturnValueDeref(indirectionIndex) }
+
  override string toString() { result = "OutReturnValueDeref" }

  override predicate isReturnValueDeref() { any() }

-  override predicate isReturnValueDeref(int indirectionIndex) {
-    this = TOutReturnValueDeref(indirectionIndex)
+  override predicate isReturnValueDeref(int indirectionIndex_) {
+    indirectionIndex = indirectionIndex_
+  }
+
+  override FunctionOutput getIndirectionOutput() {
+    result = TOutReturnValueDeref(indirectionIndex + 1)
  }
 }
--- a/cpp/ql/lib/semmle/code/cpp/models/interfaces/PartialFlow.qll
+++ b/cpp/ql/lib/semmle/code/cpp/models/interfaces/PartialFlow.qll
@@ -0,0 +1,31 @@
+/**
+ * Provides an abstract class to override the implicit assumption that a
+ * dataflow/taint-tracking model always fully override the parameters they are
+ * are modeled as writing to. To use this QL library, create a QL class
+ * extending `PartialFlowFunction` with a characteristic predicate that selects
+ * the function or set of functions you are modeling and override the
+ * `isPartialWrite` predicate.
+ *
+ * Note: Since both `DataFlowFunction` and `TaintFunction` extend this class
+ * you don't need to explicitly add this as a base class if your QL class
+ * already extends either `DataFlowFunction` or `TaintFunction`.
+ */
+
+import semmle.code.cpp.Function
+import FunctionInputsAndOutputs
+import semmle.code.cpp.models.Models
+
+/**
+ * A function that may update part of a `FunctionOutput`.
+ *
+ * For example, the destination argument of `strcat` only updates part of the
+ * argument.
+ */
+abstract class PartialFlowFunction extends Function {
+  /**
+   * Holds if the write to output does not overwrite the entire value that was
+   * there before, or does not do so reliably. For example the destination
+   * argument of `strcat` is modified but not overwritten.
+   */
+  predicate isPartialWrite(FunctionOutput output) { none() }
+}
--- a/cpp/ql/lib/semmle/code/cpp/models/interfaces/Taint.qll
+++ b/cpp/ql/lib/semmle/code/cpp/models/interfaces/Taint.qll
@@ -10,6 +10,7 @@
 import semmle.code.cpp.Function
 import FunctionInputsAndOutputs
 import semmle.code.cpp.models.Models
+import PartialFlow

 /**
 * A library function for which a taint-tracking library should propagate taint
@@ -23,7 +24,7 @@ import semmle.code.cpp.models.Models
 * altered (for example copying a string with `strncpy`), this is also considered
 * data flow.
 */
-abstract class TaintFunction extends Function {
+abstract class TaintFunction extends PartialFlowFunction {
  /**
   * Holds if data passed into the argument, qualifier, or buffer represented by
   * `input` influences the return value or buffer represented by `output`
--- a/cpp/ql/lib/semmle/code/cpp/stmts/Stmt.qll
+++ b/cpp/ql/lib/semmle/code/cpp/stmts/Stmt.qll
@@ -892,6 +892,26 @@ class DoStmt extends Loop, @stmt_end_test_while {
 class RangeBasedForStmt extends Loop, @stmt_range_based_for {
  override string getAPrimaryQlClass() { result = "RangeBasedForStmt" }

+  /**
+   * Gets the initialization statement of this 'for' statement, if any.
+   *
+   * For example, for
+   * ```
+   * for (int x = y; auto z : ... ) { }
+   * ```
+   * the result is `int x = y;`.
+   *
+   * Does not hold if the initialization statement is missing or an empty statement, as in
+   * ```
+   * for (auto z : ...) { }
+   * ```
+   * or
+   * ```
+   * for (; auto z : ) { }
+   * ```
+   */
+  Stmt getInitialization() { for_initialization(underlyingElement(this), unresolveElement(result)) }
+
  /**
   * Gets the 'body' statement of this range-based 'for' statement.
   *
@@ -901,7 +921,7 @@ class RangeBasedForStmt extends Loop, @stmt_range_based_for {
   * ```
   * the result is the `BlockStmt` `{ y += x; }`.
   */
-  override Stmt getStmt() { result = this.getChild(5) }
+  override Stmt getStmt() { result = this.getChild(6) }

  override string toString() { result = "for(...:...) ..." }

@@ -914,7 +934,7 @@ class RangeBasedForStmt extends Loop, @stmt_range_based_for {
   * ```
   * the result is `int x`.
   */
-  LocalVariable getVariable() { result = this.getChild(4).(DeclStmt).getADeclaration() }
+  LocalVariable getVariable() { result = this.getChild(5).(DeclStmt).getADeclaration() }

  /**
   * Gets the expression giving the range to iterate over.
@@ -928,7 +948,7 @@ class RangeBasedForStmt extends Loop, @stmt_range_based_for {
  Expr getRange() { result = this.getRangeVariable().getInitializer().getExpr() }

  /** Gets the compiler-generated `__range` variable after desugaring. */
-  LocalVariable getRangeVariable() { result = this.getChild(0).(DeclStmt).getADeclaration() }
+  LocalVariable getRangeVariable() { result = this.getChild(1).(DeclStmt).getADeclaration() }

  /**
   * Gets the compiler-generated `__begin != __end` which is the
@@ -936,7 +956,7 @@ class RangeBasedForStmt extends Loop, @stmt_range_based_for {
   * It will be either an `NEExpr` or a call to a user-defined
   * `operator!=`.
   */
-  override Expr getCondition() { result = this.getChild(2) }
+  override Expr getCondition() { result = this.getChild(3) }

  override Expr getControllingExpr() { result = this.getCondition() }

@@ -945,7 +965,7 @@ class RangeBasedForStmt extends Loop, @stmt_range_based_for {
   * `__end`, initializing them to the values they have before entering the
   * desugared loop.
   */
-  DeclStmt getBeginEndDeclaration() { result = this.getChild(1) }
+  DeclStmt getBeginEndDeclaration() { result = this.getChild(2) }

  /** Gets the compiler-generated `__begin` variable after desugaring. */
  LocalVariable getBeginVariable() { result = this.getBeginEndDeclaration().getDeclaration(0) }
@@ -959,7 +979,7 @@ class RangeBasedForStmt extends Loop, @stmt_range_based_for {
   * be either a `PrefixIncrExpr` or a call to a user-defined
   * `operator++`.
   */
-  Expr getUpdate() { result = this.getChild(3) }
+  Expr getUpdate() { result = this.getChild(4) }

  /** Gets the compiler-generated `__begin` variable after desugaring. */
  LocalVariable getAnIterationVariable() { result = this.getBeginVariable() }
--- a/cpp/ql/lib/semmlecode.cpp.dbscheme
+++ b/cpp/ql/lib/semmlecode.cpp.dbscheme
@@ -2050,8 +2050,11 @@ switch_body(
    int body_id: @stmt ref
 );

+@stmt_for_or_range_based_for = @stmt_for
+                             | @stmt_range_based_for;
+
 for_initialization(
-    unique int for_stmt: @stmt_for ref,
+    unique int for_stmt: @stmt_for_or_range_based_for ref,
    int init_id: @stmt ref
 );

--- a/cpp/ql/lib/upgrades/4f9fabab5124d49108782c081579f45a70571d74/exprparents.ql
+++ b/cpp/ql/lib/upgrades/4f9fabab5124d49108782c081579f45a70571d74/exprparents.ql
@@ -0,0 +1,19 @@
+class Element extends @element {
+  string toString() { none() }
+}
+
+class Expr extends @expr {
+  string toString() { none() }
+}
+
+class Stmt extends @stmt {
+  string toString() { none() }
+}
+
+predicate isStmtWithInitializer(Stmt stmt) { exists(int kind | stmts(stmt, kind, _) | kind = 29) }
+
+from Expr child, int index, int index_new, Element parent
+where
+  exprparents(child, index, parent) and
+  if isStmtWithInitializer(parent) then index_new = index + 1 else index_new = index
+select child, index_new, parent
--- a/cpp/ql/lib/upgrades/4f9fabab5124d49108782c081579f45a70571d74/old.dbscheme
+++ b/cpp/ql/lib/upgrades/4f9fabab5124d49108782c081579f45a70571d74/old.dbscheme
--- a/cpp/ql/lib/upgrades/4f9fabab5124d49108782c081579f45a70571d74/semmlecode.cpp.dbscheme
+++ b/cpp/ql/lib/upgrades/4f9fabab5124d49108782c081579f45a70571d74/semmlecode.cpp.dbscheme
--- a/cpp/ql/lib/upgrades/4f9fabab5124d49108782c081579f45a70571d74/stmtparents.ql
+++ b/cpp/ql/lib/upgrades/4f9fabab5124d49108782c081579f45a70571d74/stmtparents.ql
@@ -0,0 +1,15 @@
+class Element extends @element {
+  string toString() { none() }
+}
+
+class Stmt extends @stmt {
+  string toString() { none() }
+}
+
+predicate isStmtWithInitializer(Stmt stmt) { exists(int kind | stmts(stmt, kind, _) | kind = 29) }
+
+from Stmt child, int index, int index_new, Element parent
+where
+  stmtparents(child, index, parent) and
+  if isStmtWithInitializer(parent) then index_new = index + 1 else index_new = index
+select child, index_new, parent
--- a/cpp/ql/lib/upgrades/4f9fabab5124d49108782c081579f45a70571d74/upgrade.properties
+++ b/cpp/ql/lib/upgrades/4f9fabab5124d49108782c081579f45a70571d74/upgrade.properties
@@ -0,0 +1,4 @@
+description: Support C++20 range-based for initializers
+compatibility: partial
+exprparents.rel: run exprparents.qlo
+stmtparents.rel: run stmtparents.qlo
--- a/cpp/ql/src/CHANGELOG.md
+++ b/cpp/ql/src/CHANGELOG.md
@@ -1,3 +1,20 @@
+## 0.9.5
+
+### Minor Analysis Improvements
+
+* The "non-constant format string" query (`cpp/non-constant-format`) has been updated to produce fewer false positives.
+* Added dataflow models for the `gettext` function variants. 
+
+## 0.9.4
+
+### Minor Analysis Improvements
+
+* Corrected 2 false positive with `cpp/incorrect-string-type-conversion`: conversion of byte arrays to wchar and new array allocations converted to wchar.
+* The "Incorrect return-value check for a 'scanf'-like function" query (`cpp/incorrectly-checked-scanf`) no longer reports an alert when an explicit check for EOF is added.
+* The "Incorrect return-value check for a 'scanf'-like function" query (`cpp/incorrectly-checked-scanf`) now recognizes more EOF checks.
+* The "Potentially uninitialized local variable" query (`cpp/uninitialized-local`) no longer reports an alert when the local variable is used as a qualifier to a static member function call.
+* The diagnostic query `cpp/diagnostics/successfully-extracted-files` now considers any C/C++ file seen during extraction, even one with some errors, to be extracted / scanned. This affects the Code Scanning UI measure of scanned C/C++ files.
+
 ## 0.9.3

 ### Minor Analysis Improvements
--- a/Bugs/Format/NonConstantFormat.ql
+++ b/Bugs/Format/NonConstantFormat.ql
@@ -1,9 +1,13 @@
 /**
 * @name Non-constant format string
- * @description Passing a non-constant 'format' string to a printf-like function can lead
+ * @description Passing a value that is not a string literal 'format' string to a printf-like function can lead
 *              to a mismatch between the number of arguments defined by the 'format' and the number
 *              of arguments actually passed to the function. If the format string ultimately stems
 *              from an untrusted source, this can be used for exploits.
+ *              This query finds format strings coming from non-literal sources. Note that format strings of
+ *              type `const char*` it is still considered non-constant if the value is not coming from a string
+ *              literal. For example, for a parameter with type `const char*` of an exported function that is
+ *              used as a format string, there is no way to ensure the originating value was a string literal.
 * @kind problem
 * @problem.severity recommendation
 * @security-severity 9.3
@@ -17,142 +21,117 @@

 import semmle.code.cpp.ir.dataflow.TaintTracking
 import semmle.code.cpp.commons.Printf
+import semmle.code.cpp.security.FlowSources
+import semmle.code.cpp.ir.dataflow.internal.ModelUtil
+import semmle.code.cpp.models.interfaces.DataFlow
+import semmle.code.cpp.models.interfaces.Taint
+import semmle.code.cpp.ir.IR

-// For the following `...gettext` functions, we assume that
-// all translations preserve the type and order of `%` specifiers
-// (and hence are safe to use as format strings).  This
-// assumption is hard-coded into the query.
-predicate whitelistFunction(Function f, int arg) {
-  // basic variations of gettext
-  f.getName() = "_" and arg = 0
-  or
-  f.getName() = "gettext" and arg = 0
-  or
-  f.getName() = "dgettext" and arg = 1
-  or
-  f.getName() = "dcgettext" and arg = 1
-  or
-  // plural variations of gettext that take one format string for singular and another for plural form
-  f.getName() = "ngettext" and
-  (arg = 0 or arg = 1)
-  or
-  f.getName() = "dngettext" and
-  (arg = 1 or arg = 2)
-  or
-  f.getName() = "dcngettext" and
-  (arg = 1 or arg = 2)
+class UncalledFunction extends Function {
+  UncalledFunction() {
+    not exists(Call c | c.getTarget() = this) and
+    // Ignore functions that appear to be function pointers
+    // function pointers may be seen as uncalled statically
+    not exists(FunctionAccess fa | fa.getTarget() = this)
+  }
 }

-// we assume that ALL uses of the `_` macro
-// return constant string literals
-predicate underscoreMacro(Expr e) {
-  exists(MacroInvocation mi |
-    mi.getMacroName() = "_" and
-    mi.getExpr() = e
+/**
+ * Holds if `node` is a non-constant source of data flow for non-const format string detection.
+ * This is defined as either:
+ * 1) a `FlowSource`
+ * 2) a parameter of an 'uncalled' function
+ * 3) an argument to a function with no definition that is not known to define the output through its input
+ * 4) an out arg of a function with no definition that is not known to define the output through its input
+ *
+ * The latter two cases address identifying standard string manipulation libraries as input sources
+ * e.g., strcpy. More simply, functions without definitions that are known to manipulate the
+ * input to produce an output are not sources. Instead the ultimate source of input to these functions
+ * should be considered as the source.
+ *
+ * False Negative Implication: This approach has false negatives (fails to identify non-const sources)
+ * when the source is a field of a struct or object and the initialization is not observed statically.
+ * There are 3 general cases where this can occur:
+ * 1) Parameters of uncalled functions that are structs/objects and a field is accessed for a format string.
+ * 2) A local variable that is a struct/object and initialization of the field occurs in code that is unseen statically.
+ *    e.g., an object constructor isn't known statically, or a function sets fields
+ *    of a struct, but the function is not known statically.
+ * 3) A function meeting cases (3) and (4) above returns (through an out argument or return value)
+ *    a struct or object where a field containing a format string has been initialized.
+ *
+ * Note, uninitialized variables used as format strings are never detected by design.
+ * Uninitialized variables are a separate vulnerability concern and should be addressed by a separate query.
+ */
+predicate isNonConst(DataFlow::Node node) {
+  node instanceof FlowSource
+  or
+  // Parameters of uncalled functions that aren't const
+  exists(UncalledFunction f, Parameter p |
+    f.getAParameter() = p and
+    p = node.asParameter()
+  )
+  or
+  // Consider as an input any out arg of a function or a function's return where the function is not:
+  // 1. a function with a known dataflow or taintflow from input to output and the `node` is the output
+  // 2. a function where there is a known definition
+  // i.e., functions that with unknown bodies and are not known to define the output through its input
+  //       are considered as possible non-const sources
+  // The function's output must also not be const to be considered a non-const source
+  exists(Function func, CallInstruction call |
+    // NOTE: could use `Call` getAnArgument() instead of `CallInstruction` but requires two
+    // variables representing the same call in ordoer to use `callOutput` below.
+    exists(Expr arg |
+      call.getPositionalArgumentOperand(_).getDef().getUnconvertedResultExpression() = arg and
+      arg = node.asDefiningArgument()
+    )
+    or
+    call.getUnconvertedResultExpression() = node.asIndirectExpr()
+  |
+    func = call.getStaticCallTarget() and
+    not exists(FunctionOutput output |
+      // NOTE: we must include dataflow and taintflow. e.g., including only dataflow we will find sprintf
+      // variant function's output are now possible non-const sources
+      pragma[only_bind_out](func).(DataFlowFunction).hasDataFlow(_, output) or
+      pragma[only_bind_out](func).(TaintFunction).hasTaintFlow(_, output)
+    |
+      node = callOutput(call, output)
+    )
+  ) and
+  not exists(Call c |
+    c.getTarget().hasDefinition() and
+    if node instanceof DataFlow::DefinitionByReferenceNode
+    then c.getAnArgument() = node.asDefiningArgument()
+    else c = [node.asExpr(), node.asIndirectExpr()]
  )
 }

 /**
- * Holds if `t` cannot hold a character array, directly or indirectly.
+ * Holds if `sink` is a sink is a format string of any
+ * `FormattingFunctionCall`.
 */
-predicate cannotContainString(Type t, boolean isIndirect) {
-  isIndirect = false and
-  exists(Type unspecified |
-    unspecified = t.getUnspecifiedType() and
-    not unspecified instanceof UnknownType
-  |
-    unspecified instanceof BuiltInType or
-    unspecified instanceof IntegralOrEnumType
-  )
-}
-
-predicate isNonConst(DataFlow::Node node, boolean isIndirect) {
-  exists(Expr e |
-    e = node.asExpr() and isIndirect = false
-    or
-    e = node.asIndirectExpr() and isIndirect = true
-  |
-    exists(FunctionCall fc | fc = e |
-      not (
-        whitelistFunction(fc.getTarget(), _) or
-        fc.getTarget().hasDefinition()
-      )
-    )
-    or
-    exists(Parameter p | p = e.(VariableAccess).getTarget() |
-      p.getFunction().getName() = "main" and p.getType() instanceof PointerType
-    )
-    or
-    e instanceof CrementOperation
-    or
-    e instanceof AddressOfExpr
-    or
-    e instanceof ReferenceToExpr
-    or
-    e instanceof AssignPointerAddExpr
-    or
-    e instanceof AssignPointerSubExpr
-    or
-    e instanceof PointerArithmeticOperation
-    or
-    e instanceof FieldAccess
-    or
-    e instanceof PointerDereferenceExpr
-    or
-    e instanceof AddressOfExpr
-    or
-    e instanceof ExprCall
-    or
-    e instanceof NewArrayExpr
-    or
-    exists(Variable v | v = e.(VariableAccess).getTarget() |
-      v.getType().(ArrayType).getBaseType() instanceof CharType and
-      exists(AssignExpr ae |
-        ae.getLValue().(ArrayExpr).getArrayBase().(VariableAccess).getTarget() = v
-      )
-    )
-  )
-  or
-  node instanceof DataFlow::DefinitionByReferenceNode and
-  isIndirect = true
-}
-
-pragma[noinline]
-predicate isBarrierNode(DataFlow::Node node) {
-  underscoreMacro([node.asExpr(), node.asIndirectExpr()])
-  or
-  exists(node.asExpr()) and
-  cannotContainString(node.getType(), false)
-}
-
 predicate isSinkImpl(DataFlow::Node sink, Expr formatString) {
  [sink.asExpr(), sink.asIndirectExpr()] = formatString and
  exists(FormattingFunctionCall fc | formatString = fc.getArgument(fc.getFormatParameterIndex()))
 }

 module NonConstFlowConfig implements DataFlow::ConfigSig {
-  predicate isSource(DataFlow::Node source) {
-    exists(boolean isIndirect, Type t |
-      isNonConst(source, isIndirect) and
-      t = source.getType() and
-      not cannotContainString(t, isIndirect)
-    )
-  }
+  predicate isSource(DataFlow::Node source) { isNonConst(source) }

  predicate isSink(DataFlow::Node sink) { isSinkImpl(sink, _) }

-  predicate isBarrier(DataFlow::Node node) { isBarrierNode(node) }
+  predicate isBarrier(DataFlow::Node node) {
+    // Ignore tracing non-const through array indices
+    exists(ArrayExpr a | a.getArrayOffset() = node.asExpr())
+  }
 }

 module NonConstFlow = TaintTracking::Global<NonConstFlowConfig>;

-from FormattingFunctionCall call, Expr formatString
+from FormattingFunctionCall call, Expr formatString, DataFlow::Node sink
 where
  call.getArgument(call.getFormatParameterIndex()) = formatString and
-  exists(DataFlow::Node sink |
-    NonConstFlow::flowTo(sink) and
-    isSinkImpl(sink, formatString)
-  )
+  NonConstFlow::flowTo(sink) and
+  isSinkImpl(sink, formatString)
 select formatString,
  "The format string argument to " + call.getTarget().getName() +
    " should be constant to prevent security issues and other potential errors."
--- a/cpp/ql/src/change-notes/2024-01-19-extracted-files.md
+++ b/cpp/ql/src/change-notes/2024-01-19-extracted-files.md
@@ -1,4 +0,0 @@
---
-category: minorAnalysis
---
-* The diagnostic query `cpp/diagnostics/successfully-extracted-files` now considers any C/C++ file seen during extraction, even one with some errors, to be extracted / scanned. This affects the Code Scanning UI measure of scanned C/C++ files.
--- a/cpp/ql/src/change-notes/2024-01-29-false_positive_incorrect_string_type_conversion.md
+++ b/cpp/ql/src/change-notes/2024-01-29-false_positive_incorrect_string_type_conversion.md
@@ -1,4 +0,0 @@
---
-category: minorAnalysis
---
-* Corrected 2 false positive with `cpp/incorrect-string-type-conversion`: conversion of byte arrays to wchar and new array allocations converted to wchar.
--- a/cpp/ql/src/change-notes/2024-01-29-incorrectly-checked-scanf-2.md
+++ b/cpp/ql/src/change-notes/2024-01-29-incorrectly-checked-scanf-2.md
@@ -1,4 +0,0 @@
---
-category: minorAnalysis
---
-* The "Incorrect return-value check for a 'scanf'-like function" query (`cpp/incorrectly-checked-scanf`) now recognizes more EOF checks.
--- a/cpp/ql/src/change-notes/2024-01-29-incorrectly-checked-scanf.md
+++ b/cpp/ql/src/change-notes/2024-01-29-incorrectly-checked-scanf.md
@@ -1,4 +0,0 @@
---
-category: minorAnalysis
---
-* The "Incorrect return-value check for a 'scanf'-like function" query (`cpp/incorrectly-checked-scanf`) no longer reports an alert when an explicit check for EOF is added.
--- a/cpp/ql/src/change-notes/2024-01-29-uninitialized-local-false-positive.md
+++ b/cpp/ql/src/change-notes/2024-01-29-uninitialized-local-false-positive.md
@@ -1,5 +0,0 @@
---
-category: minorAnalysis
---
-* The "Potentially uninitialized local variable" query (`cpp/uninitialized-local`) no longer reports an alert when the local variable is used as a qualifier to a static member function call.
-* ```
--- a/cpp/ql/src/change-notes/2024-02-16-modelled-functions-block-flow.md
+++ b/cpp/ql/src/change-notes/2024-02-16-modelled-functions-block-flow.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The new C/C++ dataflow and taint-tracking libraries (`semmle.code.cpp.dataflow.new.DataFlow` and `semmle.code.cpp.dataflow.new.TaintTracking`) now implicitly assume that dataflow and taint modelled via `DataFlowFunction` and `TaintFunction` always fully overwrite their buffers and thus act as flow barriers. As a result, many dataflow and taint-tracking queries now produce fewer false positives. To remove this assumption and go back to the previous behavior for a given model, one can override the new `isPartialWrite` predicate.
--- a/cpp/ql/src/change-notes/released/0.9.4.md
+++ b/cpp/ql/src/change-notes/released/0.9.4.md
@@ -0,0 +1,9 @@
+## 0.9.4
+
+### Minor Analysis Improvements
+
+* Corrected 2 false positive with `cpp/incorrect-string-type-conversion`: conversion of byte arrays to wchar and new array allocations converted to wchar.
+* The "Incorrect return-value check for a 'scanf'-like function" query (`cpp/incorrectly-checked-scanf`) no longer reports an alert when an explicit check for EOF is added.
+* The "Incorrect return-value check for a 'scanf'-like function" query (`cpp/incorrectly-checked-scanf`) now recognizes more EOF checks.
+* The "Potentially uninitialized local variable" query (`cpp/uninitialized-local`) no longer reports an alert when the local variable is used as a qualifier to a static member function call.
+* The diagnostic query `cpp/diagnostics/successfully-extracted-files` now considers any C/C++ file seen during extraction, even one with some errors, to be extracted / scanned. This affects the Code Scanning UI measure of scanned C/C++ files.
--- a/Show More
+++ b/Show More
@@ -1 +1 @@
 .3.1
 .0.2