Merge branch 'main' into varfps

config/identical-files.json

@@ -282,6 +282,7 @@
     "java/ql/lib/semmle/code/java/internal/OverlayXml.qll",
     "go/ql/lib/semmle/go/internal/OverlayXml.qll",
     "python/ql/lib/semmle/python/internal/OverlayXml.qll",
-    "csharp/ql/lib/semmle/code/csharp/internal/OverlayXml.qll"
+    "csharp/ql/lib/semmle/code/csharp/internal/OverlayXml.qll",
+    "cpp/ql/lib/semmle/code/cpp/internal/OverlayXml.qll"
   ]
 }

cpp/ql/lib/semmle/code/cpp/dataflow/internal/FlowSummaryImpl.qll

@@ -148,6 +148,19 @@ module SourceSinkInterpretationInput implements
     )
   }
 
+  predicate barrierElement(
+    Element n, string output, string kind, Public::Provenance provenance, string model
+  ) {
+    none()
+  }
+
+  predicate barrierGuardElement(
+    Element n, string input, Public::AcceptingValue acceptingvalue, string kind,
+    Public::Provenance provenance, string model
+  ) {
+    none()
+  }
+
   private newtype TInterpretNode =
     TElement_(Element n) or
     TNode_(Node n)

cpp/ql/lib/semmle/code/cpp/internal/Overlay.qll

@@ -2,6 +2,8 @@
  * Defines entity discard predicates for C++ overlay analysis.
  */
 
+private import OverlayXml
+
 /**
  * Holds always for the overlay variant and never for the base variant.
  * This local predicate is used to define local predicates that behave

cpp/ql/lib/semmle/code/cpp/internal/OverlayXml.qll

@@ -0,0 +1,46 @@
+overlay[local]
+module;
+
+/**
+ * A local predicate that always holds for the overlay variant and never holds for the base variant.
+ * This is used to define local predicates that behave differently for the base and overlay variant.
+ */
+private predicate isOverlay() { databaseMetadata("isOverlay", "true") }
+
+private string getXmlFile(@xmllocatable locatable) {
+  exists(@location_default location, @file file | xmllocations(locatable, location) |
+    locations_default(location, file, _, _, _, _) and
+    files(file, result)
+  )
+}
+
+private string getXmlFileInBase(@xmllocatable locatable) {
+  not isOverlay() and
+  result = getXmlFile(locatable)
+}
+
+/**
+ * Holds if the given `file` was extracted as part of the overlay and was extracted by the HTML/XML
+ * extractor.
+ */
+private predicate overlayXmlExtracted(string file) {
+  isOverlay() and
+  exists(@xmllocatable locatable |
+    not files(locatable, _) and not xmlNs(locatable, _, _, _) and file = getXmlFile(locatable)
+  )
+}
+
+/**
+ * Holds if the given XML `locatable` should be discarded, because it is part of the overlay base
+ * and is in a file that was also extracted as part of the overlay database.
+ */
+overlay[discard_entity]
+private predicate discardXmlLocatable(@xmllocatable locatable) {
+  exists(string file | file = getXmlFileInBase(locatable) |
+    overlayChangedFiles(file)
+    or
+    // The HTML/XML extractor is currently not incremental and may extract more files than those
+    // included in overlayChangedFiles.
+    overlayXmlExtracted(file)
+  )
+}

csharp/documentation/library-coverage/coverage.csv

@@ -40,6 +40,7 @@ Microsoft.VisualBasic,,,6,,,,,,,,,,,,,,,,,,,1,5
 Microsoft.Win32,,4,2,,,,,,,,,,,,,,,,,,4,,2
 Mono.Linker,,,278,,,,,,,,,,,,,,,,,,,127,151
 MySql.Data.MySqlClient,48,,,,,,,,,,,,48,,,,,,,,,,
+NHibernate,3,,,,,,,,,,,,3,,,,,,,,,,
 Newtonsoft.Json,,,91,,,,,,,,,,,,,,,,,,,73,18
 ServiceStack,194,,7,27,,,,,75,,,,92,,,,,,,,,7,
 SourceGenerators,,,5,,,,,,,,,,,,,,,,,,,,5

csharp/documentation/library-coverage/coverage.rst

@@ -9,6 +9,6 @@ C# framework & library support
    Framework / library,Package,Flow sources,Taint & value steps,Sinks (total),`CWE-079` :sub:`Cross-site scripting`
    `ServiceStack <https://servicestack.net/>`_,"``ServiceStack.*``, ``ServiceStack``",,7,194,
    System,"``System.*``, ``System``",47,12241,54,5
-   Others,"``Amazon.Lambda.APIGatewayEvents``, ``Amazon.Lambda.Core``, ``Dapper``, ``ILCompiler``, ``ILLink.RoslynAnalyzer``, ``ILLink.Shared``, ``ILLink.Tasks``, ``Internal.IL``, ``Internal.Pgo``, ``Internal.TypeSystem``, ``Microsoft.ApplicationBlocks.Data``, ``Microsoft.AspNetCore.Components``, ``Microsoft.AspNetCore.Http``, ``Microsoft.AspNetCore.Mvc``, ``Microsoft.AspNetCore.WebUtilities``, ``Microsoft.CSharp``, ``Microsoft.Data.SqlClient``, ``Microsoft.Diagnostics.Tools.Pgo``, ``Microsoft.DotNet.Build.Tasks``, ``Microsoft.DotNet.PlatformAbstractions``, ``Microsoft.EntityFrameworkCore``, ``Microsoft.Extensions.Caching.Distributed``, ``Microsoft.Extensions.Caching.Memory``, ``Microsoft.Extensions.Configuration``, ``Microsoft.Extensions.DependencyInjection``, ``Microsoft.Extensions.DependencyModel``, ``Microsoft.Extensions.Diagnostics.Metrics``, ``Microsoft.Extensions.FileProviders``, ``Microsoft.Extensions.FileSystemGlobbing``, ``Microsoft.Extensions.Hosting``, ``Microsoft.Extensions.Http``, ``Microsoft.Extensions.Logging``, ``Microsoft.Extensions.Options``, ``Microsoft.Extensions.Primitives``, ``Microsoft.Interop``, ``Microsoft.JSInterop``, ``Microsoft.NET.Build.Tasks``, ``Microsoft.VisualBasic``, ``Microsoft.Win32``, ``Mono.Linker``, ``MySql.Data.MySqlClient``, ``Newtonsoft.Json``, ``SourceGenerators``, ``Windows.Security.Cryptography.Core``",60,2257,159,4
+   Others,"``Amazon.Lambda.APIGatewayEvents``, ``Amazon.Lambda.Core``, ``Dapper``, ``ILCompiler``, ``ILLink.RoslynAnalyzer``, ``ILLink.Shared``, ``ILLink.Tasks``, ``Internal.IL``, ``Internal.Pgo``, ``Internal.TypeSystem``, ``Microsoft.ApplicationBlocks.Data``, ``Microsoft.AspNetCore.Components``, ``Microsoft.AspNetCore.Http``, ``Microsoft.AspNetCore.Mvc``, ``Microsoft.AspNetCore.WebUtilities``, ``Microsoft.CSharp``, ``Microsoft.Data.SqlClient``, ``Microsoft.Diagnostics.Tools.Pgo``, ``Microsoft.DotNet.Build.Tasks``, ``Microsoft.DotNet.PlatformAbstractions``, ``Microsoft.EntityFrameworkCore``, ``Microsoft.Extensions.Caching.Distributed``, ``Microsoft.Extensions.Caching.Memory``, ``Microsoft.Extensions.Configuration``, ``Microsoft.Extensions.DependencyInjection``, ``Microsoft.Extensions.DependencyModel``, ``Microsoft.Extensions.Diagnostics.Metrics``, ``Microsoft.Extensions.FileProviders``, ``Microsoft.Extensions.FileSystemGlobbing``, ``Microsoft.Extensions.Hosting``, ``Microsoft.Extensions.Http``, ``Microsoft.Extensions.Logging``, ``Microsoft.Extensions.Options``, ``Microsoft.Extensions.Primitives``, ``Microsoft.Interop``, ``Microsoft.JSInterop``, ``Microsoft.NET.Build.Tasks``, ``Microsoft.VisualBasic``, ``Microsoft.Win32``, ``Mono.Linker``, ``MySql.Data.MySqlClient``, ``NHibernate``, ``Newtonsoft.Json``, ``SourceGenerators``, ``Windows.Security.Cryptography.Core``",60,2257,162,4
-   Totals,,107,14505,407,9
+   Totals,,107,14505,410,9
 

csharp/ql/lib/change-notes/2025-12-03-implicit-map-value-reads.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Added implicit reads of `System.Collections.Generic.KeyValuePair.Value` at taint-tracking sinks and at inputs to additional taint steps. As a result, taint-tracking queries will now produce more results when a container is tainted.

csharp/ql/lib/ext/NHibernate.model.yml

@@ -0,0 +1,8 @@
+extensions:
+  - addsTo:
+      pack: codeql/csharp-all
+      extensible: sinkModel
+    data:
+      - ["NHibernate", "ISession", True, "CreateSQLQuery", "(System.String)", "", "Argument[0]", "sql-injection", "manual"]
+      - ["NHibernate", "IStatelessSession", True, "CreateSQLQuery", "(System.String)", "", "Argument[0]", "sql-injection", "manual"]
+      - ["NHibernate.Impl", "AbstractSessionImpl", True, "CreateSQLQuery", "(System.String)", "", "Argument[0]", "sql-injection", "manual"]

csharp/ql/lib/semmle/code/csharp/controlflow/Guards.qll

@@ -842,6 +842,40 @@ module Internal {
     e3 = any(NullCoalescingExpr nce | e1 = nce.getLeftOperand() and e2 = nce.getRightOperand())
   }
 
+  predicate nullValueImplied(Expr e) {
+    nullValue(e)
+    or
+    exists(Expr e1 | nullValueImplied(e1) and nullValueImpliedUnary(e1, e))
+    or
+    exists(Expr e1, Expr e2 |
+      nullValueImplied(e1) and nullValueImplied(e2) and nullValueImpliedBinary(e1, e2, e)
+    )
+    or
+    e =
+      any(Ssa::Definition def |
+        forex(Ssa::Definition u | u = def.getAnUltimateDefinition() | nullDef(u))
+      ).getARead()
+  }
+
+  private predicate nullDef(Ssa::ExplicitDefinition def) {
+    nullValueImplied(def.getADefinition().getSource())
+  }
+
+  predicate nonNullValueImplied(Expr e) {
+    nonNullValue(e)
+    or
+    exists(Expr e1 | nonNullValueImplied(e1) and nonNullValueImpliedUnary(e1, e))
+    or
+    e =
+      any(Ssa::Definition def |
+        forex(Ssa::Definition u | u = def.getAnUltimateDefinition() | nonNullDef(u))
+      ).getARead()
+  }
+
+  private predicate nonNullDef(Ssa::ExplicitDefinition def) {
+    nonNullValueImplied(def.getADefinition().getSource())
+  }
+
   /** A callable that always returns a non-`null` value. */
   private class NonNullCallable extends Callable {
     NonNullCallable() { this = any(SystemObjectClass c).getGetTypeMethod() }
@@ -936,154 +970,21 @@ module Internal {
     e = any(BinaryArithmeticOperation bao | result = bao.getAnOperand())
   }
 
-  // The predicates in this module should be evaluated in the same stage as the CFG
+  deprecated predicate isGuard(Expr e, GuardValue val) {
-  // construction stage. This is to avoid recomputation of pre-basic-blocks and
+    (
-  // pre-SSA predicates
+      e.getType() instanceof BoolType and
-  private module PreCfg {
+      not e instanceof BoolLiteral and
-    private import semmle.code.csharp.controlflow.internal.PreBasicBlocks as PreBasicBlocks
+      not e instanceof SwitchCaseExpr and
-    private import semmle.code.csharp.controlflow.internal.PreSsa
+      not e instanceof PatternExpr and
-
+      exists(val.asBooleanValue())
-    private predicate nullDef(PreSsa::Definition def) {
+      or
-      nullValueImplied(def.getDefinition().getSource())
+      e instanceof DereferenceableExpr and
-    }
+      val.isNullness(_)
-
+    ) and
-    private predicate nonNullDef(PreSsa::Definition def) {
+    not e = any(ExprStmt es).getExpr() and
-      nonNullValueImplied(def.getDefinition().getSource())
+    not e = any(LocalVariableDeclStmt s).getAVariableDeclExpr()
-    }
-
-    private predicate emptyDef(PreSsa::Definition def) {
-      emptyValue(def.getDefinition().getSource())
-    }
-
-    private predicate nonEmptyDef(PreSsa::Definition def) {
-      nonEmptyValue(def.getDefinition().getSource())
-    }
-
-    deprecated predicate isGuard(Expr e, GuardValue val) {
-      (
-        e.getType() instanceof BoolType and
-        not e instanceof BoolLiteral and
-        not e instanceof SwitchCaseExpr and
-        not e instanceof PatternExpr and
-        exists(val.asBooleanValue())
-        or
-        e instanceof DereferenceableExpr and
-        val.isNullness(_)
-      ) and
-      not e = any(ExprStmt es).getExpr() and
-      not e = any(LocalVariableDeclStmt s).getAVariableDeclExpr()
-    }
-
-    cached
-    private module CachedWithCfg {
-      private import semmle.code.csharp.Caching
-
-      private predicate firstReadSameVarUniquePredecessor(
-        PreSsa::Definition def, AssignableRead read
-      ) {
-        read = def.getAFirstRead() and
-        (
-          not PreSsa::adjacentReadPairSameVar(_, read)
-          or
-          read = unique(AssignableRead read0 | PreSsa::adjacentReadPairSameVar(read0, read))
-        )
-      }
-
-      cached
-      predicate nullValueImplied(Expr e) {
-        nullValue(e)
-        or
-        exists(Expr e1 | nullValueImplied(e1) and nullValueImpliedUnary(e1, e))
-        or
-        exists(Expr e1, Expr e2 |
-          nullValueImplied(e1) and nullValueImplied(e2) and nullValueImpliedBinary(e1, e2, e)
-        )
-        or
-        e =
-          any(PreSsa::Definition def |
-            forex(PreSsa::Definition u | u = def.getAnUltimateDefinition() | nullDef(u))
-          ).getARead()
-      }
-
-      cached
-      predicate nonNullValueImplied(Expr e) {
-        nonNullValue(e)
-        or
-        exists(Expr e1 | nonNullValueImplied(e1) and nonNullValueImpliedUnary(e1, e))
-        or
-        e =
-          any(PreSsa::Definition def |
-            forex(PreSsa::Definition u | u = def.getAnUltimateDefinition() | nonNullDef(u))
-          ).getARead()
-      }
-
-      private predicate adjacentReadPairSameVarUniquePredecessor(
-        AssignableRead read1, AssignableRead read2
-      ) {
-        PreSsa::adjacentReadPairSameVar(read1, read2) and
-        (
-          read1 = read2 and
-          read1 = unique(AssignableRead other | PreSsa::adjacentReadPairSameVar(other, read2))
-          or
-          read1 =
-            unique(AssignableRead other |
-              PreSsa::adjacentReadPairSameVar(other, read2) and other != read2
-            )
-        )
-      }
-
-      cached
-      predicate emptyValue(Expr e) {
-        e.(ArrayCreation).getALengthArgument().getValue().toInt() = 0
-        or
-        e.(ArrayInitializer).hasNoElements()
-        or
-        exists(Expr mid | emptyValue(mid) |
-          mid = e.(AssignExpr).getRValue()
-          or
-          mid = e.(Cast).getExpr()
-        )
-        or
-        exists(PreSsa::Definition def | emptyDef(def) | firstReadSameVarUniquePredecessor(def, e))
-        or
-        exists(MethodCall mc |
-          mc.getTarget().getAnUltimateImplementee().getUnboundDeclaration() =
-            any(SystemCollectionsGenericICollectionInterface c).getClearMethod() and
-          adjacentReadPairSameVarUniquePredecessor(mc.getQualifier(), e)
-        )
-      }
-
-      cached
-      predicate nonEmptyValue(Expr e) {
-        forex(Expr length | length = e.(ArrayCreation).getALengthArgument() |
-          length.getValue().toInt() != 0
-        )
-        or
-        e.(ArrayInitializer).getNumberOfElements() > 0
-        or
-        exists(Expr mid | nonEmptyValue(mid) |
-          mid = e.(AssignExpr).getRValue()
-          or
-          mid = e.(Cast).getExpr()
-        )
-        or
-        exists(PreSsa::Definition def | nonEmptyDef(def) |
-          firstReadSameVarUniquePredecessor(def, e)
-        )
-        or
-        exists(MethodCall mc |
-          mc.getTarget().getAnUltimateImplementee().getUnboundDeclaration() =
-            any(SystemCollectionsGenericICollectionInterface c).getAddMethod() and
-          adjacentReadPairSameVarUniquePredecessor(mc.getQualifier(), e)
-        )
-      }
-    }
-
-    import CachedWithCfg
   }
 
-  import PreCfg
-
   private predicate interestingDescendantCandidate(Expr e) {
     guardControls(e, _, _)
     or

csharp/ql/lib/semmle/code/csharp/controlflow/internal/PreSsa.qll

@@ -1,221 +0,0 @@
-import csharp
-
-/**
- * Provides an SSA implementation based on "pre-basic-blocks", restricted
- * to local scope variables and fields/properties that behave like local
- * scope variables.
- */
-module PreSsa {
-  private import AssignableDefinitions
-  private import semmle.code.csharp.controlflow.internal.ControlFlowGraphImpl
-  private import semmle.code.csharp.controlflow.internal.PreBasicBlocks as PreBasicBlocks
-  private import codeql.ssa.Ssa as SsaImplCommon
-
-  private predicate definitionAt(
-    AssignableDefinition def, PreBasicBlocks::PreBasicBlock bb, int i, SsaInput::SourceVariable v
-  ) {
-    bb.getNode(i) = def.getExpr() and
-    v = def.getTarget() and
-    // In cases like `(x, x) = (0, 1)`, we discard the first (dead) definition of `x`
-    not exists(TupleAssignmentDefinition first, TupleAssignmentDefinition second | first = def |
-      second.getAssignment() = first.getAssignment() and
-      second.getEvaluationOrder() > first.getEvaluationOrder() and
-      second.getTarget() = v
-    )
-    or
-    def.(ImplicitParameterDefinition).getParameter() = v and
-    exists(Callable c | v = c.getAParameter() |
-      scopeFirst(c, bb) and
-      i = -1
-    )
-  }
-
-  predicate implicitEntryDef(
-    Callable c, PreBasicBlocks::PreBasicBlock bb, SsaInput::SourceVariable v
-  ) {
-    c = v.getACallable() and
-    scopeFirst(c, bb) and
-    (
-      not v instanceof LocalScopeVariable
-      or
-      v.(SimpleLocalScopeVariable).isReadonlyCapturedBy(c)
-    )
-  }
-
-  /** Holds if `a` is assigned in callable `c`. */
-  pragma[nomagic]
-  private predicate assignableDefinition(Assignable a, Callable c) {
-    exists(AssignableDefinition def |
-      def.getTarget() = a and
-      c = def.getEnclosingCallable()
-    |
-      not c instanceof Constructor or
-      a instanceof LocalScopeVariable
-    )
-  }
-
-  pragma[nomagic]
-  private predicate assignableUniqueWriter(Assignable a, Callable c) {
-    c = unique(Callable c0 | assignableDefinition(a, c0) | c0)
-  }
-
-  /** Holds if `a` is accessed in callable `c`. */
-  pragma[nomagic]
-  private predicate assignableAccess(Assignable a, Callable c) {
-    exists(AssignableAccess aa | aa.getTarget() = a | c = aa.getEnclosingCallable())
-  }
-
-  /**
-   * A local scope variable that is amenable to SSA analysis.
-   *
-   * This is either a local variable that is not captured, or one
-   * where all writes happen in the defining callable.
-   */
-  class SimpleLocalScopeVariable extends LocalScopeVariable {
-    SimpleLocalScopeVariable() { assignableUniqueWriter(this, this.getCallable()) }
-
-    /** Holds if this local scope variable is read-only captured by `c`. */
-    predicate isReadonlyCapturedBy(Callable c) {
-      assignableAccess(this, c) and
-      c != this.getCallable()
-    }
-  }
-
-  module SsaInput implements SsaImplCommon::InputSig<Location, PreBasicBlocks::PreBasicBlock> {
-    private import semmle.code.csharp.Caching
-
-    private class ExitBasicBlock extends PreBasicBlocks::PreBasicBlock {
-      ExitBasicBlock() { scopeLast(_, this.getLastNode(), _) }
-    }
-
-    pragma[noinline]
-    private predicate assignableNoComplexQualifiers(Assignable a) {
-      forall(QualifiableExpr qe | qe.(AssignableAccess).getTarget() = a | qe.targetIsThisInstance())
-    }
-
-    /**
-     * A simple assignable. Either a local scope variable or a field/property
-     * that behaves like a local scope variable.
-     */
-    class SourceVariable extends Assignable {
-      private Callable c;
-
-      SourceVariable() {
-        assignableAccess(this, c) and
-        (
-          this instanceof SimpleLocalScopeVariable
-          or
-          (
-            this = any(Field f | not f.isVolatile())
-            or
-            this = any(TrivialProperty tp | not tp.isOverridableOrImplementable())
-          ) and
-          (
-            not assignableDefinition(this, _)
-            or
-            assignableUniqueWriter(this, c)
-          ) and
-          assignableNoComplexQualifiers(this)
-        )
-      }
-
-      /** Gets a callable in which this simple assignable can be analyzed. */
-      Callable getACallable() { result = c }
-    }
-
-    predicate variableWrite(
-      PreBasicBlocks::PreBasicBlock bb, int i, SourceVariable v, boolean certain
-    ) {
-      Stages::ControlFlowStage::forceCachingInSameStage() and
-      exists(AssignableDefinition def |
-        definitionAt(def, bb, i, v) and
-        if def.getTargetAccess().isRefArgument() then certain = false else certain = true
-      )
-      or
-      implicitEntryDef(_, bb, v) and
-      i = -1 and
-      certain = true
-    }
-
-    predicate variableRead(
-      PreBasicBlocks::PreBasicBlock bb, int i, SourceVariable v, boolean certain
-    ) {
-      exists(AssignableRead read |
-        read = bb.getNode(i) and
-        read.getTarget() = v and
-        certain = true
-      )
-      or
-      v =
-        any(LocalScopeVariable lsv |
-          lsv.getCallable() = bb.(ExitBasicBlock).getEnclosingCallable() and
-          i = bb.length() and
-          (lsv.isRef() or v.(Parameter).isOut()) and
-          certain = false
-        )
-    }
-  }
-
-  private module SsaImpl = SsaImplCommon::Make<Location, PreBasicBlocks::PreCfg, SsaInput>;
-
-  class Definition extends SsaImpl::Definition {
-    final AssignableRead getARead() {
-      exists(PreBasicBlocks::PreBasicBlock bb, int i |
-        SsaImpl::ssaDefReachesRead(_, this, bb, i) and
-        result = bb.getNode(i)
-      )
-    }
-
-    final AssignableDefinition getDefinition() {
-      exists(PreBasicBlocks::PreBasicBlock bb, int i, SsaInput::SourceVariable v |
-        this.definesAt(v, bb, i) and
-        definitionAt(result, bb, i, v)
-      )
-    }
-
-    final AssignableRead getAFirstRead() {
-      exists(PreBasicBlocks::PreBasicBlock bb, int i |
-        SsaImpl::firstUse(this, bb, i, true) and
-        result = bb.getNode(i)
-      )
-    }
-
-    private Definition getAPhiInputOrPriorDefinition() {
-      result = this.(PhiNode).getAnInput() or
-      SsaImpl::uncertainWriteDefinitionInput(this, result)
-    }
-
-    final Definition getAnUltimateDefinition() {
-      result = this.getAPhiInputOrPriorDefinition*() and
-      not result instanceof PhiNode
-    }
-
-    final predicate isLiveAtEndOfBlock(PreBasicBlocks::PreBasicBlock bb) {
-      SsaImpl::ssaDefReachesEndOfBlock(bb, this, _)
-    }
-
-    override Location getLocation() {
-      result = this.getDefinition().getLocation()
-      or
-      exists(Callable c, PreBasicBlocks::PreBasicBlock bb, SsaInput::SourceVariable v |
-        this.definesAt(v, bb, -1) and
-        implicitEntryDef(c, bb, v) and
-        result = c.getLocation()
-      )
-    }
-  }
-
-  class PhiNode extends SsaImpl::PhiNode, Definition {
-    final override Location getLocation() { result = this.getBasicBlock().getLocation() }
-
-    final Definition getAnInput() { SsaImpl::phiHasInputFromBlock(this, result, _) }
-  }
-
-  predicate adjacentReadPairSameVar(AssignableRead read1, AssignableRead read2) {
-    exists(PreBasicBlocks::PreBasicBlock bb1, int i1, PreBasicBlocks::PreBasicBlock bb2, int i2 |
-      read1 = bb1.getNode(i1) and
-      SsaImpl::adjacentUseUse(bb1, i1, bb2, i2, _, true) and
-      read2 = bb2.getNode(i2)
-    )
-  }
-}

csharp/ql/lib/semmle/code/csharp/controlflow/internal/Splitting.qll

@@ -9,18 +9,11 @@ private import Completion as Comp
 private import Comp
 private import ControlFlowGraphImpl
 private import semmle.code.csharp.controlflow.ControlFlowGraph::ControlFlow as Cfg
-private import semmle.code.csharp.controlflow.internal.PreSsa
 
 cached
 private module Cached {
   private import semmle.code.csharp.Caching
 
-  cached
-  newtype TBooleanSplitSubKind =
-    TSsaBooleanSplitSubKind(PreSsa::Definition def) {
-      Stages::ControlFlowStage::forceCachingInSameStage()
-    }
-
   cached
   newtype TSplitKind = TConditionalCompletionSplitKind()
 

csharp/ql/lib/semmle/code/csharp/dataflow/internal/BaseSSA.qll

@@ -43,10 +43,47 @@ module BaseSsa {
     )
   }
 
-  private module SsaInput implements SsaImplCommon::InputSig<Location, ControlFlow::BasicBlock> {
+  /** Holds if `a` is assigned in callable `c`. */
-    private import semmle.code.csharp.controlflow.internal.PreSsa
+  pragma[nomagic]
+  private predicate assignableDefinition(Assignable a, Callable c) {
+    exists(AssignableDefinition def |
+      def.getTarget() = a and
+      c = def.getEnclosingCallable()
+    |
+      not c instanceof Constructor or
+      a instanceof LocalScopeVariable
+    )
+  }
 
-    class SourceVariable = PreSsa::SimpleLocalScopeVariable;
+  pragma[nomagic]
+  private predicate assignableUniqueWriter(Assignable a, Callable c) {
+    c = unique(Callable c0 | assignableDefinition(a, c0) | c0)
+  }
+
+  /** Holds if `a` is accessed in callable `c`. */
+  pragma[nomagic]
+  private predicate assignableAccess(Assignable a, Callable c) {
+    exists(AssignableAccess aa | aa.getTarget() = a | c = aa.getEnclosingCallable())
+  }
+
+  /**
+   * A local scope variable that is amenable to SSA analysis.
+   *
+   * This is either a local variable that is not captured, or one
+   * where all writes happen in the defining callable.
+   */
+  class SimpleLocalScopeVariable extends LocalScopeVariable {
+    SimpleLocalScopeVariable() { assignableUniqueWriter(this, this.getCallable()) }
+
+    /** Holds if this local scope variable is read-only captured by `c`. */
+    predicate isReadonlyCapturedBy(Callable c) {
+      assignableAccess(this, c) and
+      c != this.getCallable()
+    }
+  }
+
+  private module SsaInput implements SsaImplCommon::InputSig<Location, ControlFlow::BasicBlock> {
+    class SourceVariable = SimpleLocalScopeVariable;
 
     predicate variableWrite(ControlFlow::BasicBlock bb, int i, SourceVariable v, boolean certain) {
       exists(AssignableDefinition def |

csharp/ql/lib/semmle/code/csharp/dataflow/internal/FlowSummaryImpl.qll

@@ -235,6 +235,19 @@ module SourceSinkInterpretationInput implements
     )
   }
 
+  predicate barrierElement(
+    Element n, string output, string kind, Public::Provenance provenance, string model
+  ) {
+    none()
+  }
+
+  predicate barrierGuardElement(
+    Element n, string input, Public::AcceptingValue acceptingvalue, string kind,
+    Public::Provenance provenance, string model
+  ) {
+    none()
+  }
+
   class SourceOrSinkElement = Element;
 
   private newtype TInterpretNode =

csharp/ql/lib/semmle/code/csharp/dataflow/internal/SsaImpl.qll

@@ -5,9 +5,9 @@
 import csharp
 private import codeql.ssa.Ssa as SsaImplCommon
 private import AssignableDefinitions
-private import semmle.code.csharp.controlflow.internal.PreSsa
 private import semmle.code.csharp.controlflow.BasicBlocks as BasicBlocks
 private import semmle.code.csharp.controlflow.Guards as Guards
+private import semmle.code.csharp.dataflow.internal.BaseSSA
 
 private module SsaInput implements SsaImplCommon::InputSig<Location, ControlFlow::BasicBlock> {
   class SourceVariable = Ssa::SourceVariable;
@@ -783,7 +783,7 @@ cached
 private module Cached {
   cached
   newtype TSourceVariable =
-    TLocalVar(Callable c, PreSsa::SimpleLocalScopeVariable v) {
+    TLocalVar(Callable c, BaseSsa::SimpleLocalScopeVariable v) {
       c = v.getCallable()
       or
       // Local scope variables can be captured
@@ -967,18 +967,22 @@ private module Cached {
 
     cached // nothing is actually cached
     module BarrierGuard<guardChecksSig/3 guardChecks> {
-      private predicate guardChecksAdjTypes(
+      private import codeql.util.Unit
-        DataFlowIntegrationInput::Guard g, DataFlowIntegrationInput::Expr e,
+
-        DataFlowIntegrationInput::GuardValue branch
+      private predicate guardChecksAdjTypes(Guards::Guards::Guard g, Expr e, Guards::GuardValue v) {
+        guardChecks(g, e, v)
+      }
+
+      private predicate guardChecksWithWrappers(
+        Guards::Guard g, Definition def, Guards::GuardValue val, Unit state
       ) {
-        exists(Guards::GuardValue v |
+        Guards::Guards::ValidationWrapper<guardChecksAdjTypes/3>::guardChecksDef(g, def, val) and
-          guardChecks(g, e.getAstNode(), v) and
+        exists(state)
-          branch = v.asBooleanValue()
-        )
       }
 
       private Node getABarrierNodeImpl() {
-        result = DataFlowIntegrationImpl::BarrierGuard<guardChecksAdjTypes/3>::getABarrierNode()
+        result =
+          DataFlowIntegrationImpl::BarrierGuardDefWithState<Unit, guardChecksWithWrappers/4>::getABarrierNode(_)
       }
 
       predicate getABarrierNode = getABarrierNodeImpl/0;
@@ -1037,38 +1041,18 @@ private module DataFlowIntegrationInput implements Impl::DataFlowIntegrationInpu
       )
   }
 
-  class GuardValue = Boolean;
+  class GuardValue = Guards::GuardValue;
 
-  class Guard extends Guards::Guard {
+  class Guard = Guards::Guard;
-    /**
-     * Holds if the evaluation of this guard to `branch` corresponds to the edge
-     * from `bb1` to `bb2`.
-     */
-    predicate hasValueBranchEdge(BasicBlock bb1, BasicBlock bb2, GuardValue branch) {
-      exists(ControlFlow::ConditionalSuccessor s |
-        this.getAControlFlowNode() = bb1.getLastNode() and
-        bb2 = bb1.getASuccessor(s) and
-        s.getValue() = branch
-      )
-    }
 
-    /**
+  /** Holds if the guard `guard` directly controls block `bb` upon evaluating to `val`. */
-     * Holds if this guard evaluating to `branch` controls the control-flow
+  predicate guardDirectlyControlsBlock(Guard guard, BasicBlock bb, GuardValue val) {
-     * branch edge from `bb1` to `bb2`. That is, following the edge from
+    guard.directlyValueControls(bb, val)
-     * `bb1` to `bb2` implies that this guard evaluated to `branch`.
-     */
-    predicate valueControlsBranchEdge(BasicBlock bb1, BasicBlock bb2, GuardValue branch) {
-      this.hasValueBranchEdge(bb1, bb2, branch)
-    }
   }
 
-  /** Holds if the guard `guard` controls block `bb` upon evaluating to `branch`. */
+  /** Holds if the guard `guard` controls block `bb` upon evaluating to `val`. */
-  predicate guardDirectlyControlsBlock(Guard guard, ControlFlow::BasicBlock bb, GuardValue branch) {
+  predicate guardControlsBlock(Guard guard, BasicBlock bb, GuardValue val) {
-    exists(ConditionBlock conditionBlock, ControlFlow::ConditionalSuccessor s |
+    guard.valueControls(bb, val)
-      guard.getAControlFlowNode() = conditionBlock.getLastNode() and
-      s.getValue() = branch and
-      conditionBlock.edgeDominates(bb, s)
-    )
   }
 }
 

csharp/ql/lib/semmle/code/csharp/dataflow/internal/TaintTrackingPrivate.qll

@@ -24,6 +24,13 @@ predicate defaultTaintSanitizer(DataFlow::Node node) {
   )
 }
 
+/**
+ * Gets the (unbound) property `System.Collections.Generic.KeyValuePair.Value`.
+ */
+private Property keyValuePairValue() {
+  result.hasFullyQualifiedName("System.Collections.Generic", "KeyValuePair`2", "Value")
+}
+
 /**
  * Holds if default `TaintTracking::Configuration`s should allow implicit reads
  * of `c` at sinks and inputs to additional taint steps.
@@ -31,7 +38,11 @@ predicate defaultTaintSanitizer(DataFlow::Node node) {
 bindingset[node]
 predicate defaultImplicitTaintRead(DataFlow::Node node, DataFlow::ContentSet c) {
   exists(node) and
-  c.isElement()
+  (
+    c.isElement()
+    or
+    c.isProperty(keyValuePairValue())
+  )
 }
 
 private class LocalTaintExprStepConfiguration extends ControlFlowReachabilityConfiguration {

csharp/ql/src/change-notes/2025-12-11-nhibernate-sql-sinks.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Added `NHibernate.ISession.CreateSQLQuery`, `NHibernate.IStatelessSession.CreateSQLQuery` and `NHibernate.Impl.AbstractSessionImpl.CreateSQLQuery` as SQL injection sinks.

csharp/ql/test/library-tests/dataflow/collections/CollectionDataFlow.expected

@@ -0,0 +1,840 @@
+models
+| 1 | Summary: System.Collections.Generic; Dictionary<TKey,TValue>; false; get_Keys; (); ; Argument[this].Element.Property[System.Collections.Generic.KeyValuePair`2.Key]; ReturnValue.Element; value; manual |
+| 2 | Summary: System.Collections.Generic; Dictionary<TKey,TValue>; false; get_Values; (); ; Argument[this].Element.Property[System.Collections.Generic.KeyValuePair`2.Value]; ReturnValue.Element; value; manual |
+| 3 | Summary: System.Collections.Generic; ICollection<T>; true; Add; (T); ; Argument[0]; Argument[this].Element; value; manual |
+| 4 | Summary: System.Collections.Generic; IDictionary<TKey,TValue>; true; Add; (TKey,TValue); ; Argument[0]; Argument[this].Element.Property[System.Collections.Generic.KeyValuePair`2.Key]; value; manual |
+| 5 | Summary: System.Collections.Generic; IDictionary<TKey,TValue>; true; Add; (TKey,TValue); ; Argument[1]; Argument[this].Element.Property[System.Collections.Generic.KeyValuePair`2.Value]; value; manual |
+| 6 | Summary: System.Collections.Generic; IDictionary<TKey,TValue>; true; get_Item; (TKey); ; Argument[this].Element.Property[System.Collections.Generic.KeyValuePair`2.Value]; ReturnValue; value; manual |
+| 7 | Summary: System.Collections.Generic; IDictionary<TKey,TValue>; true; get_Keys; (); ; Argument[this].Element.Property[System.Collections.Generic.KeyValuePair`2.Key]; ReturnValue.Element; value; manual |
+| 8 | Summary: System.Collections.Generic; IDictionary<TKey,TValue>; true; get_Values; (); ; Argument[this].Element.Property[System.Collections.Generic.KeyValuePair`2.Value]; ReturnValue.Element; value; manual |
+| 9 | Summary: System.Collections.Generic; IDictionary<TKey,TValue>; true; set_Item; (TKey,TValue); ; Argument[0]; Argument[this].Element.Property[System.Collections.Generic.KeyValuePair`2.Key]; value; manual |
+| 10 | Summary: System.Collections.Generic; IDictionary<TKey,TValue>; true; set_Item; (TKey,TValue); ; Argument[1]; Argument[this].Element.Property[System.Collections.Generic.KeyValuePair`2.Value]; value; manual |
+| 11 | Summary: System.Collections.Generic; IList<T>; true; get_Item; (System.Int32); ; Argument[this].Element; ReturnValue; value; manual |
+| 12 | Summary: System.Collections.Generic; IList<T>; true; set_Item; (System.Int32,T); ; Argument[1]; Argument[this].Element; value; manual |
+| 13 | Summary: System.Collections.Generic; KeyValuePair<TKey,TValue>; false; KeyValuePair; (TKey,TValue); ; Argument[0]; Argument[this].Property[System.Collections.Generic.KeyValuePair`2.Key]; value; manual |
+| 14 | Summary: System.Collections.Generic; List<T>+Enumerator; false; get_Current; (); ; Argument[this].Property[System.Collections.Generic.List`1+Enumerator.Current]; ReturnValue; value; dfc-generated |
+| 15 | Summary: System.Collections.Generic; List<T>; false; GetEnumerator; (); ; Argument[this].Element; ReturnValue.Property[System.Collections.Generic.List`1+Enumerator.Current]; value; manual |
+| 16 | Summary: System.Collections; IEnumerable; true; GetEnumerator; (); ; Argument[this].Element; ReturnValue.Property[System.Collections.IEnumerator.Current]; value; manual |
+| 17 | Summary: System.Linq; Enumerable; false; First<TSource>; (System.Collections.Generic.IEnumerable<TSource>); ; Argument[0].Element; ReturnValue; value; manual |
+| 18 | Summary: System.Linq; Enumerable; false; Select<TSource,TResult>; (System.Collections.Generic.IEnumerable<TSource>,System.Func<TSource,TResult>); ; Argument[0].Element; Argument[1].Parameter[0]; value; manual |
+| 19 | Summary: System; ReadOnlySpan<T>; false; ReadOnlySpan; (T[]); ; Argument[0].Element; Argument[this].Element; value; manual |
+| 20 | Summary: System; ReadOnlySpan<T>; false; get_Item; (System.Int32); ; Argument[this].Element; ReturnValue; value; manual |
+| 21 | Summary: System; Span<T>; false; CopyTo; (System.Span<T>); ; Argument[this].Element; Argument[0].Element; value; manual |
+| 22 | Summary: System; Span<T>; false; Fill; (T); ; Argument[0]; Argument[this].Element; value; manual |
+| 23 | Summary: System; Span<T>; false; Span; (T); ; Argument[0]; Argument[this].Element; value; manual |
+| 24 | Summary: System; Span<T>; false; Span; (T[]); ; Argument[0].Element; Argument[this].Element; value; manual |
+| 25 | Summary: System; Span<T>; false; ToArray; (); ; Argument[this].Element; ReturnValue.Element; value; manual |
+| 26 | Summary: System; Span<T>; false; get_Item; (System.Int32); ; Argument[this].Element; ReturnValue; value; manual |
+edges
+| CollectionFlow.cs:14:40:14:41 | ts : A[] [element] : A | CollectionFlow.cs:14:52:14:53 | access to parameter ts : A[] [element] : A | provenance |  |
+| CollectionFlow.cs:14:40:14:41 | ts : null [element] : A | CollectionFlow.cs:14:52:14:53 | access to parameter ts : null [element] : A | provenance |  |
+| CollectionFlow.cs:14:52:14:53 | access to parameter ts : A[] [element] : A | CollectionFlow.cs:14:52:14:56 | access to array element | provenance |  |
+| CollectionFlow.cs:14:52:14:53 | access to parameter ts : null [element] : A | CollectionFlow.cs:14:52:14:56 | access to array element | provenance |  |
+| CollectionFlow.cs:16:44:16:45 | ts : A[] [element] : A | CollectionFlow.cs:16:56:16:57 | access to parameter ts : A[] [element] : A | provenance |  |
+| CollectionFlow.cs:16:56:16:57 | access to parameter ts : A[] [element] : A | CollectionFlow.cs:16:56:16:61 | access to array element | provenance |  |
+| CollectionFlow.cs:18:49:18:52 | list : List<T> [element] : A | CollectionFlow.cs:18:63:18:66 | access to parameter list : List<T> [element] : A | provenance |  |
+| CollectionFlow.cs:18:63:18:66 | access to parameter list : List<T> [element] : A | CollectionFlow.cs:18:63:18:69 | access to indexer | provenance | MaD:11 |
+| CollectionFlow.cs:20:61:20:64 | dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:20:75:20:78 | access to parameter dict : Dictionary<T,T> [element, property Value] : A | provenance |  |
+| CollectionFlow.cs:20:75:20:78 | access to parameter dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:20:75:20:81 | access to indexer | provenance | MaD:6 |
+| CollectionFlow.cs:22:59:22:62 | dict : Dictionary<T,T> [element, property Key] : A | CollectionFlow.cs:22:73:22:76 | access to parameter dict : Dictionary<T,T> [element, property Key] : A | provenance |  |
+| CollectionFlow.cs:22:73:22:76 | access to parameter dict : Dictionary<T,T> [element, property Key] : A | CollectionFlow.cs:22:73:22:81 | access to property Keys : ICollection<T> [element] : A | provenance | MaD:1 |
+| CollectionFlow.cs:22:73:22:76 | access to parameter dict : Dictionary<T,T> [element, property Key] : A | CollectionFlow.cs:22:73:22:81 | access to property Keys : ICollection<T> [element] : A | provenance | MaD:7 |
+| CollectionFlow.cs:22:73:22:81 | access to property Keys : ICollection<T> [element] : A | CollectionFlow.cs:22:73:22:89 | call to method First<T> | provenance | MaD:17 |
+| CollectionFlow.cs:24:34:24:35 | ts : A[] [element] : A | CollectionFlow.cs:24:41:24:42 | access to parameter ts : A[] [element] : A | provenance |  |
+| CollectionFlow.cs:24:34:24:35 | ts : null [element] : A | CollectionFlow.cs:24:41:24:42 | access to parameter ts : null [element] : A | provenance |  |
+| CollectionFlow.cs:24:41:24:42 | access to parameter ts : A[] [element] : A | CollectionFlow.cs:24:41:24:45 | access to array element : A | provenance |  |
+| CollectionFlow.cs:24:41:24:42 | access to parameter ts : null [element] : A | CollectionFlow.cs:24:41:24:45 | access to array element : A | provenance |  |
+| CollectionFlow.cs:26:33:26:34 | ts : A[] [element] : A | CollectionFlow.cs:26:40:26:41 | access to parameter ts : A[] [element] : A | provenance |  |
+| CollectionFlow.cs:26:40:26:41 | access to parameter ts : A[] [element] : A | CollectionFlow.cs:26:40:26:45 | access to array element : A | provenance |  |
+| CollectionFlow.cs:28:43:28:46 | list : List<T> [element] : A | CollectionFlow.cs:28:52:28:55 | access to parameter list : List<T> [element] : A | provenance |  |
+| CollectionFlow.cs:28:52:28:55 | access to parameter list : List<T> [element] : A | CollectionFlow.cs:28:52:28:58 | access to indexer : A | provenance | MaD:11 |
+| CollectionFlow.cs:30:58:30:61 | dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:30:67:30:70 | access to parameter dict : Dictionary<T,T> [element, property Value] : A | provenance |  |
+| CollectionFlow.cs:30:67:30:70 | access to parameter dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:30:67:30:73 | access to indexer : A | provenance | MaD:6 |
+| CollectionFlow.cs:32:59:32:62 | dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:32:68:32:71 | access to parameter dict : Dictionary<T,T> [element, property Value] : A | provenance |  |
+| CollectionFlow.cs:32:68:32:71 | access to parameter dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:32:68:32:79 | call to method First<KeyValuePair<Int32,T>> : KeyValuePair<Int32,T> [property Value] : A | provenance | MaD:17 |
+| CollectionFlow.cs:32:68:32:79 | call to method First<KeyValuePair<Int32,T>> : KeyValuePair<Int32,T> [property Value] : A | CollectionFlow.cs:32:68:32:85 | access to property Value : A | provenance |  |
+| CollectionFlow.cs:34:60:34:63 | dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:34:69:34:72 | access to parameter dict : Dictionary<T,T> [element, property Value] : A | provenance |  |
+| CollectionFlow.cs:34:69:34:72 | access to parameter dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:34:69:34:79 | access to property Values : ICollection<T> [element] : A | provenance | MaD:2 |
+| CollectionFlow.cs:34:69:34:72 | access to parameter dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:34:69:34:79 | access to property Values : ICollection<T> [element] : A | provenance | MaD:8 |
+| CollectionFlow.cs:34:69:34:79 | access to property Values : ICollection<T> [element] : A | CollectionFlow.cs:34:69:34:87 | call to method First<T> : A | provenance | MaD:17 |
+| CollectionFlow.cs:36:58:36:61 | dict : Dictionary<T,T> [element, property Key] : A | CollectionFlow.cs:36:67:36:70 | access to parameter dict : Dictionary<T,T> [element, property Key] : A | provenance |  |
+| CollectionFlow.cs:36:67:36:70 | access to parameter dict : Dictionary<T,T> [element, property Key] : A | CollectionFlow.cs:36:67:36:75 | access to property Keys : ICollection<T> [element] : A | provenance | MaD:1 |
+| CollectionFlow.cs:36:67:36:70 | access to parameter dict : Dictionary<T,T> [element, property Key] : A | CollectionFlow.cs:36:67:36:75 | access to property Keys : ICollection<T> [element] : A | provenance | MaD:7 |
+| CollectionFlow.cs:36:67:36:75 | access to property Keys : ICollection<T> [element] : A | CollectionFlow.cs:36:67:36:83 | call to method First<T> : A | provenance | MaD:17 |
+| CollectionFlow.cs:38:57:38:60 | dict : Dictionary<T,T> [element, property Key] : A | CollectionFlow.cs:38:66:38:69 | access to parameter dict : Dictionary<T,T> [element, property Key] : A | provenance |  |
+| CollectionFlow.cs:38:66:38:69 | access to parameter dict : Dictionary<T,T> [element, property Key] : A | CollectionFlow.cs:38:66:38:77 | call to method First<KeyValuePair<T,Int32>> : KeyValuePair<T,Int32> [property Key] : A | provenance | MaD:17 |
+| CollectionFlow.cs:38:66:38:77 | call to method First<KeyValuePair<T,Int32>> : KeyValuePair<T,Int32> [property Key] : A | CollectionFlow.cs:38:66:38:81 | access to property Key : A | provenance |  |
+| CollectionFlow.cs:40:49:40:52 | args : A[] [element] : A | CollectionFlow.cs:40:63:40:66 | access to parameter args : A[] [element] : A | provenance |  |
+| CollectionFlow.cs:40:49:40:52 | args : null [element] : A | CollectionFlow.cs:40:63:40:66 | access to parameter args : null [element] : A | provenance |  |
+| CollectionFlow.cs:40:63:40:66 | access to parameter args : A[] [element] : A | CollectionFlow.cs:40:63:40:69 | access to array element | provenance |  |
+| CollectionFlow.cs:40:63:40:66 | access to parameter args : null [element] : A | CollectionFlow.cs:40:63:40:69 | access to array element | provenance |  |
+| CollectionFlow.cs:42:70:42:73 | args : IEnumerable<A> [element] : A | CollectionFlow.cs:42:84:42:87 | access to parameter args : IEnumerable<A> [element] : A | provenance |  |
+| CollectionFlow.cs:42:84:42:87 | access to parameter args : IEnumerable<A> [element] : A | CollectionFlow.cs:42:84:42:95 | call to method First<T> | provenance | MaD:17 |
+| CollectionFlow.cs:46:13:46:13 | access to local variable a : A | CollectionFlow.cs:47:27:47:27 | access to local variable a : A | provenance |  |
+| CollectionFlow.cs:46:17:46:23 | object creation of type A : A | CollectionFlow.cs:46:13:46:13 | access to local variable a : A | provenance |  |
+| CollectionFlow.cs:47:13:47:15 | access to local variable as : null [element] : A | CollectionFlow.cs:48:14:48:16 | access to local variable as : null [element] : A | provenance |  |
+| CollectionFlow.cs:47:13:47:15 | access to local variable as : null [element] : A | CollectionFlow.cs:49:18:49:20 | access to local variable as : null [element] : A | provenance |  |
+| CollectionFlow.cs:47:13:47:15 | access to local variable as : null [element] : A | CollectionFlow.cs:50:20:50:22 | access to local variable as : null [element] : A | provenance |  |
+| CollectionFlow.cs:47:25:47:29 | { ..., ... } : null [element] : A | CollectionFlow.cs:47:13:47:15 | access to local variable as : null [element] : A | provenance |  |
+| CollectionFlow.cs:47:27:47:27 | access to local variable a : A | CollectionFlow.cs:47:25:47:29 | { ..., ... } : null [element] : A | provenance |  |
+| CollectionFlow.cs:48:14:48:16 | access to local variable as : null [element] : A | CollectionFlow.cs:48:14:48:19 | access to array element | provenance |  |
+| CollectionFlow.cs:49:18:49:20 | access to local variable as : null [element] : A | CollectionFlow.cs:14:40:14:41 | ts : null [element] : A | provenance |  |
+| CollectionFlow.cs:50:20:50:22 | access to local variable as : null [element] : A | CollectionFlow.cs:24:34:24:35 | ts : null [element] : A | provenance |  |
+| CollectionFlow.cs:50:20:50:22 | access to local variable as : null [element] : A | CollectionFlow.cs:50:14:50:23 | call to method First<A> | provenance |  |
+| CollectionFlow.cs:64:13:64:13 | access to local variable a : A | CollectionFlow.cs:65:53:65:53 | access to local variable a : A | provenance |  |
+| CollectionFlow.cs:64:17:64:23 | object creation of type A : A | CollectionFlow.cs:64:13:64:13 | access to local variable a : A | provenance |  |
+| CollectionFlow.cs:65:13:65:13 | access to local variable c : CollectionFlow [field As, element] : A | CollectionFlow.cs:66:14:66:14 | access to local variable c : CollectionFlow [field As, element] : A | provenance |  |
+| CollectionFlow.cs:65:13:65:13 | access to local variable c : CollectionFlow [field As, element] : A | CollectionFlow.cs:67:18:67:18 | access to local variable c : CollectionFlow [field As, element] : A | provenance |  |
+| CollectionFlow.cs:65:13:65:13 | access to local variable c : CollectionFlow [field As, element] : A | CollectionFlow.cs:68:20:68:20 | access to local variable c : CollectionFlow [field As, element] : A | provenance |  |
+| CollectionFlow.cs:65:38:65:57 | { ..., ... } : CollectionFlow [field As, element] : A | CollectionFlow.cs:65:13:65:13 | access to local variable c : CollectionFlow [field As, element] : A | provenance |  |
+| CollectionFlow.cs:65:45:65:55 | { ..., ... } : A[] [element] : A | CollectionFlow.cs:65:38:65:57 | { ..., ... } : CollectionFlow [field As, element] : A | provenance |  |
+| CollectionFlow.cs:65:53:65:53 | access to local variable a : A | CollectionFlow.cs:65:45:65:55 | { ..., ... } : A[] [element] : A | provenance |  |
+| CollectionFlow.cs:66:14:66:14 | access to local variable c : CollectionFlow [field As, element] : A | CollectionFlow.cs:66:14:66:17 | access to field As : A[] [element] : A | provenance |  |
+| CollectionFlow.cs:66:14:66:17 | access to field As : A[] [element] : A | CollectionFlow.cs:66:14:66:20 | access to array element | provenance |  |
+| CollectionFlow.cs:67:18:67:18 | access to local variable c : CollectionFlow [field As, element] : A | CollectionFlow.cs:67:18:67:21 | access to field As : A[] [element] : A | provenance |  |
+| CollectionFlow.cs:67:18:67:21 | access to field As : A[] [element] : A | CollectionFlow.cs:14:40:14:41 | ts : A[] [element] : A | provenance |  |
+| CollectionFlow.cs:68:20:68:20 | access to local variable c : CollectionFlow [field As, element] : A | CollectionFlow.cs:68:20:68:23 | access to field As : A[] [element] : A | provenance |  |
+| CollectionFlow.cs:68:20:68:23 | access to field As : A[] [element] : A | CollectionFlow.cs:24:34:24:35 | ts : A[] [element] : A | provenance |  |
+| CollectionFlow.cs:68:20:68:23 | access to field As : A[] [element] : A | CollectionFlow.cs:68:14:68:24 | call to method First<A> | provenance |  |
+| CollectionFlow.cs:82:13:82:13 | access to local variable a : A | CollectionFlow.cs:83:54:83:54 | access to local variable a : A | provenance |  |
+| CollectionFlow.cs:82:17:82:23 | object creation of type A : A | CollectionFlow.cs:82:13:82:13 | access to local variable a : A | provenance |  |
+| CollectionFlow.cs:83:13:83:13 | access to local variable c : CollectionFlow [field As, element] : A | CollectionFlow.cs:84:14:84:14 | access to local variable c : CollectionFlow [field As, element] : A | provenance |  |
+| CollectionFlow.cs:83:13:83:13 | access to local variable c : CollectionFlow [field As, element] : A | CollectionFlow.cs:85:22:85:22 | access to local variable c : CollectionFlow [field As, element] : A | provenance |  |
+| CollectionFlow.cs:83:13:83:13 | access to local variable c : CollectionFlow [field As, element] : A | CollectionFlow.cs:86:19:86:19 | access to local variable c : CollectionFlow [field As, element] : A | provenance |  |
+| CollectionFlow.cs:83:38:83:58 | { ..., ... } : CollectionFlow [field As, element] : A | CollectionFlow.cs:83:13:83:13 | access to local variable c : CollectionFlow [field As, element] : A | provenance |  |
+| CollectionFlow.cs:83:45:83:56 | { ..., ... } : A[] [element] : A | CollectionFlow.cs:83:38:83:58 | { ..., ... } : CollectionFlow [field As, element] : A | provenance |  |
+| CollectionFlow.cs:83:54:83:54 | access to local variable a : A | CollectionFlow.cs:83:45:83:56 | { ..., ... } : A[] [element] : A | provenance |  |
+| CollectionFlow.cs:84:14:84:14 | access to local variable c : CollectionFlow [field As, element] : A | CollectionFlow.cs:84:14:84:17 | access to field As : A[] [element] : A | provenance |  |
+| CollectionFlow.cs:84:14:84:17 | access to field As : A[] [element] : A | CollectionFlow.cs:84:14:84:21 | access to array element | provenance |  |
+| CollectionFlow.cs:85:22:85:22 | access to local variable c : CollectionFlow [field As, element] : A | CollectionFlow.cs:85:22:85:25 | access to field As : A[] [element] : A | provenance |  |
+| CollectionFlow.cs:85:22:85:25 | access to field As : A[] [element] : A | CollectionFlow.cs:16:44:16:45 | ts : A[] [element] : A | provenance |  |
+| CollectionFlow.cs:86:19:86:19 | access to local variable c : CollectionFlow [field As, element] : A | CollectionFlow.cs:86:19:86:22 | access to field As : A[] [element] : A | provenance |  |
+| CollectionFlow.cs:86:19:86:22 | access to field As : A[] [element] : A | CollectionFlow.cs:26:33:26:34 | ts : A[] [element] : A | provenance |  |
+| CollectionFlow.cs:86:19:86:22 | access to field As : A[] [element] : A | CollectionFlow.cs:86:14:86:23 | call to method Last<A> | provenance |  |
+| CollectionFlow.cs:91:13:91:13 | access to local variable a : A | CollectionFlow.cs:93:18:93:18 | access to local variable a : A | provenance |  |
+| CollectionFlow.cs:91:17:91:23 | object creation of type A : A | CollectionFlow.cs:91:13:91:13 | access to local variable a : A | provenance |  |
+| CollectionFlow.cs:93:9:93:11 | [post] access to local variable as : A[] [element] : A | CollectionFlow.cs:94:14:94:16 | access to local variable as : A[] [element] : A | provenance |  |
+| CollectionFlow.cs:93:9:93:11 | [post] access to local variable as : A[] [element] : A | CollectionFlow.cs:95:18:95:20 | access to local variable as : A[] [element] : A | provenance |  |
+| CollectionFlow.cs:93:9:93:11 | [post] access to local variable as : A[] [element] : A | CollectionFlow.cs:96:20:96:22 | access to local variable as : A[] [element] : A | provenance |  |
+| CollectionFlow.cs:93:18:93:18 | access to local variable a : A | CollectionFlow.cs:93:9:93:11 | [post] access to local variable as : A[] [element] : A | provenance |  |
+| CollectionFlow.cs:94:14:94:16 | access to local variable as : A[] [element] : A | CollectionFlow.cs:94:14:94:19 | access to array element | provenance |  |
+| CollectionFlow.cs:95:18:95:20 | access to local variable as : A[] [element] : A | CollectionFlow.cs:14:40:14:41 | ts : A[] [element] : A | provenance |  |
+| CollectionFlow.cs:96:20:96:22 | access to local variable as : A[] [element] : A | CollectionFlow.cs:24:34:24:35 | ts : A[] [element] : A | provenance |  |
+| CollectionFlow.cs:96:20:96:22 | access to local variable as : A[] [element] : A | CollectionFlow.cs:96:14:96:23 | call to method First<A> | provenance |  |
+| CollectionFlow.cs:111:13:111:13 | access to local variable a : A | CollectionFlow.cs:113:19:113:19 | access to local variable a : A | provenance |  |
+| CollectionFlow.cs:111:17:111:23 | object creation of type A : A | CollectionFlow.cs:111:13:111:13 | access to local variable a : A | provenance |  |
+| CollectionFlow.cs:113:9:113:11 | [post] access to local variable as : A[] [element] : A | CollectionFlow.cs:114:14:114:16 | access to local variable as : A[] [element] : A | provenance |  |
+| CollectionFlow.cs:113:9:113:11 | [post] access to local variable as : A[] [element] : A | CollectionFlow.cs:115:22:115:24 | access to local variable as : A[] [element] : A | provenance |  |
+| CollectionFlow.cs:113:9:113:11 | [post] access to local variable as : A[] [element] : A | CollectionFlow.cs:116:19:116:21 | access to local variable as : A[] [element] : A | provenance |  |
+| CollectionFlow.cs:113:19:113:19 | access to local variable a : A | CollectionFlow.cs:113:9:113:11 | [post] access to local variable as : A[] [element] : A | provenance |  |
+| CollectionFlow.cs:114:14:114:16 | access to local variable as : A[] [element] : A | CollectionFlow.cs:114:14:114:20 | access to array element | provenance |  |
+| CollectionFlow.cs:115:22:115:24 | access to local variable as : A[] [element] : A | CollectionFlow.cs:16:44:16:45 | ts : A[] [element] : A | provenance |  |
+| CollectionFlow.cs:116:19:116:21 | access to local variable as : A[] [element] : A | CollectionFlow.cs:26:33:26:34 | ts : A[] [element] : A | provenance |  |
+| CollectionFlow.cs:116:19:116:21 | access to local variable as : A[] [element] : A | CollectionFlow.cs:116:14:116:22 | call to method Last<A> | provenance |  |
+| CollectionFlow.cs:121:13:121:13 | access to local variable a : A | CollectionFlow.cs:123:19:123:19 | access to local variable a : A | provenance |  |
+| CollectionFlow.cs:121:17:121:23 | object creation of type A : A | CollectionFlow.cs:121:13:121:13 | access to local variable a : A | provenance |  |
+| CollectionFlow.cs:123:9:123:12 | [post] access to local variable list : List<T> [element] : A | CollectionFlow.cs:124:14:124:17 | access to local variable list : List<T> [element] : A | provenance |  |
+| CollectionFlow.cs:123:9:123:12 | [post] access to local variable list : List<T> [element] : A | CollectionFlow.cs:125:22:125:25 | access to local variable list : List<T> [element] : A | provenance |  |
+| CollectionFlow.cs:123:9:123:12 | [post] access to local variable list : List<T> [element] : A | CollectionFlow.cs:126:24:126:27 | access to local variable list : List<T> [element] : A | provenance |  |
+| CollectionFlow.cs:123:19:123:19 | access to local variable a : A | CollectionFlow.cs:123:9:123:12 | [post] access to local variable list : List<T> [element] : A | provenance | MaD:12 |
+| CollectionFlow.cs:124:14:124:17 | access to local variable list : List<T> [element] : A | CollectionFlow.cs:124:14:124:20 | access to indexer | provenance | MaD:11 |
+| CollectionFlow.cs:125:22:125:25 | access to local variable list : List<T> [element] : A | CollectionFlow.cs:18:49:18:52 | list : List<T> [element] : A | provenance |  |
+| CollectionFlow.cs:126:24:126:27 | access to local variable list : List<T> [element] : A | CollectionFlow.cs:28:43:28:46 | list : List<T> [element] : A | provenance |  |
+| CollectionFlow.cs:126:24:126:27 | access to local variable list : List<T> [element] : A | CollectionFlow.cs:126:14:126:28 | call to method ListFirst<A> | provenance | MaD:11 |
+| CollectionFlow.cs:140:13:140:13 | access to local variable a : A | CollectionFlow.cs:141:36:141:36 | access to local variable a : A | provenance |  |
+| CollectionFlow.cs:140:17:140:23 | object creation of type A : A | CollectionFlow.cs:140:13:140:13 | access to local variable a : A | provenance |  |
+| CollectionFlow.cs:141:13:141:16 | access to local variable list : List<T> [element] : A | CollectionFlow.cs:142:14:142:17 | access to local variable list : List<T> [element] : A | provenance |  |
+| CollectionFlow.cs:141:13:141:16 | access to local variable list : List<T> [element] : A | CollectionFlow.cs:143:22:143:25 | access to local variable list : List<T> [element] : A | provenance |  |
+| CollectionFlow.cs:141:13:141:16 | access to local variable list : List<T> [element] : A | CollectionFlow.cs:144:24:144:27 | access to local variable list : List<T> [element] : A | provenance |  |
+| CollectionFlow.cs:141:20:141:38 | object creation of type List<A> : List<T> [element] : A | CollectionFlow.cs:141:13:141:16 | access to local variable list : List<T> [element] : A | provenance |  |
+| CollectionFlow.cs:141:36:141:36 | access to local variable a : A | CollectionFlow.cs:141:20:141:38 | object creation of type List<A> : List<T> [element] : A | provenance | MaD:3 |
+| CollectionFlow.cs:142:14:142:17 | access to local variable list : List<T> [element] : A | CollectionFlow.cs:142:14:142:20 | access to indexer | provenance | MaD:11 |
+| CollectionFlow.cs:143:22:143:25 | access to local variable list : List<T> [element] : A | CollectionFlow.cs:18:49:18:52 | list : List<T> [element] : A | provenance |  |
+| CollectionFlow.cs:144:24:144:27 | access to local variable list : List<T> [element] : A | CollectionFlow.cs:28:43:28:46 | list : List<T> [element] : A | provenance |  |
+| CollectionFlow.cs:144:24:144:27 | access to local variable list : List<T> [element] : A | CollectionFlow.cs:144:14:144:28 | call to method ListFirst<A> | provenance | MaD:11 |
+| CollectionFlow.cs:157:13:157:13 | access to local variable a : A | CollectionFlow.cs:159:18:159:18 | access to local variable a : A | provenance |  |
+| CollectionFlow.cs:157:17:157:23 | object creation of type A : A | CollectionFlow.cs:157:13:157:13 | access to local variable a : A | provenance |  |
+| CollectionFlow.cs:159:9:159:12 | [post] access to local variable list : List<T> [element] : A | CollectionFlow.cs:160:14:160:17 | access to local variable list : List<T> [element] : A | provenance |  |
+| CollectionFlow.cs:159:9:159:12 | [post] access to local variable list : List<T> [element] : A | CollectionFlow.cs:161:22:161:25 | access to local variable list : List<T> [element] : A | provenance |  |
+| CollectionFlow.cs:159:9:159:12 | [post] access to local variable list : List<T> [element] : A | CollectionFlow.cs:162:24:162:27 | access to local variable list : List<T> [element] : A | provenance |  |
+| CollectionFlow.cs:159:18:159:18 | access to local variable a : A | CollectionFlow.cs:159:9:159:12 | [post] access to local variable list : List<T> [element] : A | provenance | MaD:3 |
+| CollectionFlow.cs:160:14:160:17 | access to local variable list : List<T> [element] : A | CollectionFlow.cs:160:14:160:20 | access to indexer | provenance | MaD:11 |
+| CollectionFlow.cs:161:22:161:25 | access to local variable list : List<T> [element] : A | CollectionFlow.cs:18:49:18:52 | list : List<T> [element] : A | provenance |  |
+| CollectionFlow.cs:162:24:162:27 | access to local variable list : List<T> [element] : A | CollectionFlow.cs:28:43:28:46 | list : List<T> [element] : A | provenance |  |
+| CollectionFlow.cs:162:24:162:27 | access to local variable list : List<T> [element] : A | CollectionFlow.cs:162:14:162:28 | call to method ListFirst<A> | provenance | MaD:11 |
+| CollectionFlow.cs:176:13:176:13 | access to local variable a : A | CollectionFlow.cs:178:19:178:19 | access to local variable a : A | provenance |  |
+| CollectionFlow.cs:176:17:176:23 | object creation of type A : A | CollectionFlow.cs:176:13:176:13 | access to local variable a : A | provenance |  |
+| CollectionFlow.cs:178:9:178:12 | [post] access to local variable dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:179:14:179:17 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | provenance |  |
+| CollectionFlow.cs:178:9:178:12 | [post] access to local variable dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:180:23:180:26 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | provenance |  |
+| CollectionFlow.cs:178:9:178:12 | [post] access to local variable dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:181:28:181:31 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | provenance |  |
+| CollectionFlow.cs:178:9:178:12 | [post] access to local variable dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:182:29:182:32 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | provenance |  |
+| CollectionFlow.cs:178:9:178:12 | [post] access to local variable dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:183:30:183:33 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | provenance |  |
+| CollectionFlow.cs:178:19:178:19 | access to local variable a : A | CollectionFlow.cs:178:9:178:12 | [post] access to local variable dict : Dictionary<T,T> [element, property Value] : A | provenance | MaD:10 |
+| CollectionFlow.cs:179:14:179:17 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:179:14:179:20 | access to indexer | provenance | MaD:6 |
+| CollectionFlow.cs:180:23:180:26 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:20:61:20:64 | dict : Dictionary<T,T> [element, property Value] : A | provenance |  |
+| CollectionFlow.cs:181:28:181:31 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:30:58:30:61 | dict : Dictionary<T,T> [element, property Value] : A | provenance |  |
+| CollectionFlow.cs:181:28:181:31 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:181:14:181:32 | call to method DictIndexZero<A> | provenance | MaD:6 |
+| CollectionFlow.cs:182:29:182:32 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:32:59:32:62 | dict : Dictionary<T,T> [element, property Value] : A | provenance |  |
+| CollectionFlow.cs:182:29:182:32 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:182:14:182:33 | call to method DictFirstValue<A> | provenance | MaD:17 |
+| CollectionFlow.cs:183:30:183:33 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:34:60:34:63 | dict : Dictionary<T,T> [element, property Value] : A | provenance |  |
+| CollectionFlow.cs:183:30:183:33 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:183:14:183:34 | call to method DictValuesFirst<A> | provenance | MaD:2 |
+| CollectionFlow.cs:183:30:183:33 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:183:14:183:34 | call to method DictValuesFirst<A> | provenance | MaD:8 |
+| CollectionFlow.cs:199:13:199:13 | access to local variable a : A | CollectionFlow.cs:200:52:200:52 | access to local variable a : A | provenance |  |
+| CollectionFlow.cs:199:17:199:23 | object creation of type A : A | CollectionFlow.cs:199:13:199:13 | access to local variable a : A | provenance |  |
+| CollectionFlow.cs:200:13:200:16 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:201:14:201:17 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | provenance |  |
+| CollectionFlow.cs:200:13:200:16 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:202:23:202:26 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | provenance |  |
+| CollectionFlow.cs:200:13:200:16 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:203:28:203:31 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | provenance |  |
+| CollectionFlow.cs:200:13:200:16 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:204:29:204:32 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | provenance |  |
+| CollectionFlow.cs:200:13:200:16 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:205:30:205:33 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | provenance |  |
+| CollectionFlow.cs:200:20:200:56 | object creation of type Dictionary<Int32,A> : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:200:13:200:16 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | provenance |  |
+| CollectionFlow.cs:200:52:200:52 | access to local variable a : A | CollectionFlow.cs:200:20:200:56 | object creation of type Dictionary<Int32,A> : Dictionary<T,T> [element, property Value] : A | provenance | MaD:5 |
+| CollectionFlow.cs:201:14:201:17 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:201:14:201:20 | access to indexer | provenance | MaD:6 |
+| CollectionFlow.cs:202:23:202:26 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:20:61:20:64 | dict : Dictionary<T,T> [element, property Value] : A | provenance |  |
+| CollectionFlow.cs:203:28:203:31 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:30:58:30:61 | dict : Dictionary<T,T> [element, property Value] : A | provenance |  |
+| CollectionFlow.cs:203:28:203:31 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:203:14:203:32 | call to method DictIndexZero<A> | provenance | MaD:6 |
+| CollectionFlow.cs:204:29:204:32 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:32:59:32:62 | dict : Dictionary<T,T> [element, property Value] : A | provenance |  |
+| CollectionFlow.cs:204:29:204:32 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:204:14:204:33 | call to method DictFirstValue<A> | provenance | MaD:17 |
+| CollectionFlow.cs:205:30:205:33 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:34:60:34:63 | dict : Dictionary<T,T> [element, property Value] : A | provenance |  |
+| CollectionFlow.cs:205:30:205:33 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:205:14:205:34 | call to method DictValuesFirst<A> | provenance | MaD:2 |
+| CollectionFlow.cs:205:30:205:33 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:205:14:205:34 | call to method DictValuesFirst<A> | provenance | MaD:8 |
+| CollectionFlow.cs:220:13:220:13 | access to local variable a : A | CollectionFlow.cs:221:53:221:53 | access to local variable a : A | provenance |  |
+| CollectionFlow.cs:220:17:220:23 | object creation of type A : A | CollectionFlow.cs:220:13:220:13 | access to local variable a : A | provenance |  |
+| CollectionFlow.cs:221:13:221:16 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:222:14:222:17 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | provenance |  |
+| CollectionFlow.cs:221:13:221:16 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:223:23:223:26 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | provenance |  |
+| CollectionFlow.cs:221:13:221:16 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:224:28:224:31 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | provenance |  |
+| CollectionFlow.cs:221:13:221:16 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:225:29:225:32 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | provenance |  |
+| CollectionFlow.cs:221:13:221:16 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:226:30:226:33 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | provenance |  |
+| CollectionFlow.cs:221:20:221:55 | object creation of type Dictionary<Int32,A> : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:221:13:221:16 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | provenance |  |
+| CollectionFlow.cs:221:53:221:53 | access to local variable a : A | CollectionFlow.cs:221:20:221:55 | object creation of type Dictionary<Int32,A> : Dictionary<T,T> [element, property Value] : A | provenance | MaD:10 |
+| CollectionFlow.cs:222:14:222:17 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:222:14:222:20 | access to indexer | provenance | MaD:6 |
+| CollectionFlow.cs:223:23:223:26 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:20:61:20:64 | dict : Dictionary<T,T> [element, property Value] : A | provenance |  |
+| CollectionFlow.cs:224:28:224:31 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:30:58:30:61 | dict : Dictionary<T,T> [element, property Value] : A | provenance |  |
+| CollectionFlow.cs:224:28:224:31 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:224:14:224:32 | call to method DictIndexZero<A> | provenance | MaD:6 |
+| CollectionFlow.cs:225:29:225:32 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:32:59:32:62 | dict : Dictionary<T,T> [element, property Value] : A | provenance |  |
+| CollectionFlow.cs:225:29:225:32 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:225:14:225:33 | call to method DictFirstValue<A> | provenance | MaD:17 |
+| CollectionFlow.cs:226:30:226:33 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:34:60:34:63 | dict : Dictionary<T,T> [element, property Value] : A | provenance |  |
+| CollectionFlow.cs:226:30:226:33 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:226:14:226:34 | call to method DictValuesFirst<A> | provenance | MaD:2 |
+| CollectionFlow.cs:226:30:226:33 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:226:14:226:34 | call to method DictValuesFirst<A> | provenance | MaD:8 |
+| CollectionFlow.cs:242:13:242:13 | access to local variable a : A | CollectionFlow.cs:243:49:243:49 | access to local variable a : A | provenance |  |
+| CollectionFlow.cs:242:17:242:23 | object creation of type A : A | CollectionFlow.cs:242:13:242:13 | access to local variable a : A | provenance |  |
+| CollectionFlow.cs:243:13:243:16 | access to local variable dict : Dictionary<T,T> [element, property Key] : A | CollectionFlow.cs:244:14:244:17 | access to local variable dict : Dictionary<T,T> [element, property Key] : A | provenance |  |
+| CollectionFlow.cs:243:13:243:16 | access to local variable dict : Dictionary<T,T> [element, property Key] : A | CollectionFlow.cs:245:21:245:24 | access to local variable dict : Dictionary<T,T> [element, property Key] : A | provenance |  |
+| CollectionFlow.cs:243:13:243:16 | access to local variable dict : Dictionary<T,T> [element, property Key] : A | CollectionFlow.cs:246:28:246:31 | access to local variable dict : Dictionary<T,T> [element, property Key] : A | provenance |  |
+| CollectionFlow.cs:243:13:243:16 | access to local variable dict : Dictionary<T,T> [element, property Key] : A | CollectionFlow.cs:247:27:247:30 | access to local variable dict : Dictionary<T,T> [element, property Key] : A | provenance |  |
+| CollectionFlow.cs:243:20:243:56 | object creation of type Dictionary<A,Int32> : Dictionary<T,T> [element, property Key] : A | CollectionFlow.cs:243:13:243:16 | access to local variable dict : Dictionary<T,T> [element, property Key] : A | provenance |  |
+| CollectionFlow.cs:243:49:243:49 | access to local variable a : A | CollectionFlow.cs:243:20:243:56 | object creation of type Dictionary<A,Int32> : Dictionary<T,T> [element, property Key] : A | provenance | MaD:4 |
+| CollectionFlow.cs:244:14:244:17 | access to local variable dict : Dictionary<T,T> [element, property Key] : A | CollectionFlow.cs:244:14:244:22 | access to property Keys : Dictionary<T,T>.KeyCollection [element] : A | provenance | MaD:1 |
+| CollectionFlow.cs:244:14:244:22 | access to property Keys : Dictionary<T,T>.KeyCollection [element] : A | CollectionFlow.cs:244:14:244:30 | call to method First<A> | provenance | MaD:17 |
+| CollectionFlow.cs:245:21:245:24 | access to local variable dict : Dictionary<T,T> [element, property Key] : A | CollectionFlow.cs:22:59:22:62 | dict : Dictionary<T,T> [element, property Key] : A | provenance |  |
+| CollectionFlow.cs:246:28:246:31 | access to local variable dict : Dictionary<T,T> [element, property Key] : A | CollectionFlow.cs:36:58:36:61 | dict : Dictionary<T,T> [element, property Key] : A | provenance |  |
+| CollectionFlow.cs:246:28:246:31 | access to local variable dict : Dictionary<T,T> [element, property Key] : A | CollectionFlow.cs:246:14:246:32 | call to method DictKeysFirst<A> | provenance | MaD:1 |
+| CollectionFlow.cs:246:28:246:31 | access to local variable dict : Dictionary<T,T> [element, property Key] : A | CollectionFlow.cs:246:14:246:32 | call to method DictKeysFirst<A> | provenance | MaD:7 |
+| CollectionFlow.cs:247:27:247:30 | access to local variable dict : Dictionary<T,T> [element, property Key] : A | CollectionFlow.cs:38:57:38:60 | dict : Dictionary<T,T> [element, property Key] : A | provenance |  |
+| CollectionFlow.cs:247:27:247:30 | access to local variable dict : Dictionary<T,T> [element, property Key] : A | CollectionFlow.cs:247:14:247:31 | call to method DictFirstKey<A> | provenance | MaD:17 |
+| CollectionFlow.cs:261:13:261:13 | access to local variable a : A | CollectionFlow.cs:262:48:262:48 | access to local variable a : A | provenance |  |
+| CollectionFlow.cs:261:17:261:23 | object creation of type A : A | CollectionFlow.cs:261:13:261:13 | access to local variable a : A | provenance |  |
+| CollectionFlow.cs:262:13:262:16 | access to local variable dict : Dictionary<T,T> [element, property Key] : A | CollectionFlow.cs:263:14:263:17 | access to local variable dict : Dictionary<T,T> [element, property Key] : A | provenance |  |
+| CollectionFlow.cs:262:13:262:16 | access to local variable dict : Dictionary<T,T> [element, property Key] : A | CollectionFlow.cs:264:21:264:24 | access to local variable dict : Dictionary<T,T> [element, property Key] : A | provenance |  |
+| CollectionFlow.cs:262:13:262:16 | access to local variable dict : Dictionary<T,T> [element, property Key] : A | CollectionFlow.cs:265:28:265:31 | access to local variable dict : Dictionary<T,T> [element, property Key] : A | provenance |  |
+| CollectionFlow.cs:262:13:262:16 | access to local variable dict : Dictionary<T,T> [element, property Key] : A | CollectionFlow.cs:266:27:266:30 | access to local variable dict : Dictionary<T,T> [element, property Key] : A | provenance |  |
+| CollectionFlow.cs:262:20:262:55 | object creation of type Dictionary<A,Int32> : Dictionary<T,T> [element, property Key] : A | CollectionFlow.cs:262:13:262:16 | access to local variable dict : Dictionary<T,T> [element, property Key] : A | provenance |  |
+| CollectionFlow.cs:262:48:262:48 | access to local variable a : A | CollectionFlow.cs:262:20:262:55 | object creation of type Dictionary<A,Int32> : Dictionary<T,T> [element, property Key] : A | provenance | MaD:9 |
+| CollectionFlow.cs:263:14:263:17 | access to local variable dict : Dictionary<T,T> [element, property Key] : A | CollectionFlow.cs:263:14:263:22 | access to property Keys : Dictionary<T,T>.KeyCollection [element] : A | provenance | MaD:1 |
+| CollectionFlow.cs:263:14:263:22 | access to property Keys : Dictionary<T,T>.KeyCollection [element] : A | CollectionFlow.cs:263:14:263:30 | call to method First<A> | provenance | MaD:17 |
+| CollectionFlow.cs:264:21:264:24 | access to local variable dict : Dictionary<T,T> [element, property Key] : A | CollectionFlow.cs:22:59:22:62 | dict : Dictionary<T,T> [element, property Key] : A | provenance |  |
+| CollectionFlow.cs:265:28:265:31 | access to local variable dict : Dictionary<T,T> [element, property Key] : A | CollectionFlow.cs:36:58:36:61 | dict : Dictionary<T,T> [element, property Key] : A | provenance |  |
+| CollectionFlow.cs:265:28:265:31 | access to local variable dict : Dictionary<T,T> [element, property Key] : A | CollectionFlow.cs:265:14:265:32 | call to method DictKeysFirst<A> | provenance | MaD:1 |
+| CollectionFlow.cs:265:28:265:31 | access to local variable dict : Dictionary<T,T> [element, property Key] : A | CollectionFlow.cs:265:14:265:32 | call to method DictKeysFirst<A> | provenance | MaD:7 |
+| CollectionFlow.cs:266:27:266:30 | access to local variable dict : Dictionary<T,T> [element, property Key] : A | CollectionFlow.cs:38:57:38:60 | dict : Dictionary<T,T> [element, property Key] : A | provenance |  |
+| CollectionFlow.cs:266:27:266:30 | access to local variable dict : Dictionary<T,T> [element, property Key] : A | CollectionFlow.cs:266:14:266:31 | call to method DictFirstKey<A> | provenance | MaD:17 |
+| CollectionFlow.cs:280:13:280:13 | access to local variable a : A | CollectionFlow.cs:281:27:281:27 | access to local variable a : A | provenance |  |
+| CollectionFlow.cs:280:17:280:23 | object creation of type A : A | CollectionFlow.cs:280:13:280:13 | access to local variable a : A | provenance |  |
+| CollectionFlow.cs:281:13:281:15 | access to local variable as : null [element] : A | CollectionFlow.cs:282:27:282:29 | access to local variable as : null [element] : A | provenance |  |
+| CollectionFlow.cs:281:25:281:29 | { ..., ... } : null [element] : A | CollectionFlow.cs:281:13:281:15 | access to local variable as : null [element] : A | provenance |  |
+| CollectionFlow.cs:281:27:281:27 | access to local variable a : A | CollectionFlow.cs:281:25:281:29 | { ..., ... } : null [element] : A | provenance |  |
+| CollectionFlow.cs:282:27:282:29 | access to local variable as : null [element] : A | CollectionFlow.cs:283:18:283:18 | access to local variable x | provenance |  |
+| CollectionFlow.cs:295:13:295:13 | access to local variable a : A | CollectionFlow.cs:296:27:296:27 | access to local variable a : A | provenance |  |
+| CollectionFlow.cs:295:17:295:23 | object creation of type A : A | CollectionFlow.cs:295:13:295:13 | access to local variable a : A | provenance |  |
+| CollectionFlow.cs:296:13:296:15 | access to local variable as : null [element] : A | CollectionFlow.cs:297:26:297:28 | access to local variable as : null [element] : A | provenance |  |
+| CollectionFlow.cs:296:25:296:29 | { ..., ... } : null [element] : A | CollectionFlow.cs:296:13:296:15 | access to local variable as : null [element] : A | provenance |  |
+| CollectionFlow.cs:296:27:296:27 | access to local variable a : A | CollectionFlow.cs:296:25:296:29 | { ..., ... } : null [element] : A | provenance |  |
+| CollectionFlow.cs:297:13:297:22 | access to local variable enumerator : IEnumerator [property Current] : A | CollectionFlow.cs:299:18:299:27 | access to local variable enumerator : IEnumerator [property Current] : A | provenance |  |
+| CollectionFlow.cs:297:26:297:28 | access to local variable as : null [element] : A | CollectionFlow.cs:297:26:297:44 | call to method GetEnumerator : IEnumerator [property Current] : A | provenance | MaD:16 |
+| CollectionFlow.cs:297:26:297:44 | call to method GetEnumerator : IEnumerator [property Current] : A | CollectionFlow.cs:297:13:297:22 | access to local variable enumerator : IEnumerator [property Current] : A | provenance |  |
+| CollectionFlow.cs:299:18:299:27 | access to local variable enumerator : IEnumerator [property Current] : A | CollectionFlow.cs:299:18:299:35 | access to property Current | provenance |  |
+| CollectionFlow.cs:312:13:312:13 | access to local variable a : A | CollectionFlow.cs:314:18:314:18 | access to local variable a : A | provenance |  |
+| CollectionFlow.cs:312:17:312:23 | object creation of type A : A | CollectionFlow.cs:312:13:312:13 | access to local variable a : A | provenance |  |
+| CollectionFlow.cs:314:9:314:12 | [post] access to local variable list : List<T> [element] : A | CollectionFlow.cs:315:26:315:29 | access to local variable list : List<T> [element] : A | provenance |  |
+| CollectionFlow.cs:314:18:314:18 | access to local variable a : A | CollectionFlow.cs:314:9:314:12 | [post] access to local variable list : List<T> [element] : A | provenance | MaD:3 |
+| CollectionFlow.cs:315:13:315:22 | access to local variable enumerator : List<T>.Enumerator [property Current] : A | CollectionFlow.cs:317:18:317:27 | access to local variable enumerator : List<T>.Enumerator [property Current] : A | provenance |  |
+| CollectionFlow.cs:315:13:315:22 | access to local variable enumerator : List<T>.Enumerator [property Current] : A | CollectionFlow.cs:317:18:317:27 | access to local variable enumerator : List<T>.Enumerator [property Current] : A | provenance |  |
+| CollectionFlow.cs:315:26:315:29 | access to local variable list : List<T> [element] : A | CollectionFlow.cs:315:26:315:45 | call to method GetEnumerator : List<T>.Enumerator [property Current] : A | provenance | MaD:15 |
+| CollectionFlow.cs:315:26:315:29 | access to local variable list : List<T> [element] : A | CollectionFlow.cs:315:26:315:45 | call to method GetEnumerator : List<T>.Enumerator [property Current] : A | provenance | MaD:15 |
+| CollectionFlow.cs:315:26:315:45 | call to method GetEnumerator : List<T>.Enumerator [property Current] : A | CollectionFlow.cs:315:13:315:22 | access to local variable enumerator : List<T>.Enumerator [property Current] : A | provenance |  |
+| CollectionFlow.cs:315:26:315:45 | call to method GetEnumerator : List<T>.Enumerator [property Current] : A | CollectionFlow.cs:315:13:315:22 | access to local variable enumerator : List<T>.Enumerator [property Current] : A | provenance |  |
+| CollectionFlow.cs:317:18:317:27 | access to local variable enumerator : List<T>.Enumerator [property Current] : A | CollectionFlow.cs:317:18:317:35 | access to property Current | provenance |  |
+| CollectionFlow.cs:317:18:317:27 | access to local variable enumerator : List<T>.Enumerator [property Current] : A | CollectionFlow.cs:317:18:317:35 | access to property Current | provenance | MaD:14 |
+| CollectionFlow.cs:317:18:317:27 | access to local variable enumerator : List<T>.Enumerator [property Current] : A | CollectionFlow.cs:317:18:317:35 | access to property Current | provenance | MaD:14 |
+| CollectionFlow.cs:331:13:331:13 | access to local variable a : A | CollectionFlow.cs:333:43:333:43 | access to local variable a : A | provenance |  |
+| CollectionFlow.cs:331:17:331:23 | object creation of type A : A | CollectionFlow.cs:331:13:331:13 | access to local variable a : A | provenance |  |
+| CollectionFlow.cs:333:9:333:12 | [post] access to local variable list : List<T> [element, property Key] : A | CollectionFlow.cs:334:9:334:12 | access to local variable list : List<T> [element, property Key] : A | provenance |  |
+| CollectionFlow.cs:333:18:333:47 | object creation of type KeyValuePair<A,Int32> : KeyValuePair<T,T> [property Key] : A | CollectionFlow.cs:333:9:333:12 | [post] access to local variable list : List<T> [element, property Key] : A | provenance | MaD:3 |
+| CollectionFlow.cs:333:43:333:43 | access to local variable a : A | CollectionFlow.cs:333:18:333:47 | object creation of type KeyValuePair<A,Int32> : KeyValuePair<T,T> [property Key] : A | provenance | MaD:13 |
+| CollectionFlow.cs:334:9:334:12 | access to local variable list : List<T> [element, property Key] : A | CollectionFlow.cs:334:21:334:23 | kvp : KeyValuePair<A,Int32> [property Key] : A | provenance | MaD:18 |
+| CollectionFlow.cs:334:21:334:23 | kvp : KeyValuePair<A,Int32> [property Key] : A | CollectionFlow.cs:336:18:336:20 | access to parameter kvp : KeyValuePair<A,Int32> [property Key] : A | provenance |  |
+| CollectionFlow.cs:336:18:336:20 | access to parameter kvp : KeyValuePair<A,Int32> [property Key] : A | CollectionFlow.cs:336:18:336:24 | access to property Key | provenance |  |
+| CollectionFlow.cs:353:32:353:38 | element : A | CollectionFlow.cs:353:55:353:61 | access to parameter element : A | provenance |  |
+| CollectionFlow.cs:353:44:353:48 | [post] access to parameter array : A[] [element] : A | CollectionFlow.cs:353:23:353:27 | array [Return] : A[] [element] : A | provenance |  |
+| CollectionFlow.cs:353:55:353:61 | access to parameter element : A | CollectionFlow.cs:353:44:353:48 | [post] access to parameter array : A[] [element] : A | provenance |  |
+| CollectionFlow.cs:357:13:357:13 | access to local variable a : A | CollectionFlow.cs:359:23:359:23 | access to local variable a : A | provenance |  |
+| CollectionFlow.cs:357:17:357:23 | object creation of type A : A | CollectionFlow.cs:357:13:357:13 | access to local variable a : A | provenance |  |
+| CollectionFlow.cs:359:18:359:20 | [post] access to local variable as : A[] [element] : A | CollectionFlow.cs:360:14:360:16 | access to local variable as : A[] [element] : A | provenance |  |
+| CollectionFlow.cs:359:18:359:20 | [post] access to local variable as : A[] [element] : A | CollectionFlow.cs:361:18:361:20 | access to local variable as : A[] [element] : A | provenance |  |
+| CollectionFlow.cs:359:18:359:20 | [post] access to local variable as : A[] [element] : A | CollectionFlow.cs:362:20:362:22 | access to local variable as : A[] [element] : A | provenance |  |
+| CollectionFlow.cs:359:23:359:23 | access to local variable a : A | CollectionFlow.cs:353:32:353:38 | element : A | provenance |  |
+| CollectionFlow.cs:359:23:359:23 | access to local variable a : A | CollectionFlow.cs:359:18:359:20 | [post] access to local variable as : A[] [element] : A | provenance |  |
+| CollectionFlow.cs:360:14:360:16 | access to local variable as : A[] [element] : A | CollectionFlow.cs:360:14:360:19 | access to array element | provenance |  |
+| CollectionFlow.cs:361:18:361:20 | access to local variable as : A[] [element] : A | CollectionFlow.cs:14:40:14:41 | ts : A[] [element] : A | provenance |  |
+| CollectionFlow.cs:362:20:362:22 | access to local variable as : A[] [element] : A | CollectionFlow.cs:24:34:24:35 | ts : A[] [element] : A | provenance |  |
+| CollectionFlow.cs:362:20:362:22 | access to local variable as : A[] [element] : A | CollectionFlow.cs:362:14:362:23 | call to method First<A> | provenance |  |
+| CollectionFlow.cs:375:34:375:40 | element : A | CollectionFlow.cs:375:55:375:61 | access to parameter element : A | provenance |  |
+| CollectionFlow.cs:375:46:375:49 | [post] access to parameter list : List<T> [element] : A | CollectionFlow.cs:375:26:375:29 | list [Return] : List<T> [element] : A | provenance |  |
+| CollectionFlow.cs:375:55:375:61 | access to parameter element : A | CollectionFlow.cs:375:46:375:49 | [post] access to parameter list : List<T> [element] : A | provenance | MaD:3 |
+| CollectionFlow.cs:379:13:379:13 | access to local variable a : A | CollectionFlow.cs:381:23:381:23 | access to local variable a : A | provenance |  |
+| CollectionFlow.cs:379:17:379:23 | object creation of type A : A | CollectionFlow.cs:379:13:379:13 | access to local variable a : A | provenance |  |
+| CollectionFlow.cs:381:17:381:20 | [post] access to local variable list : List<T> [element] : A | CollectionFlow.cs:382:14:382:17 | access to local variable list : List<T> [element] : A | provenance |  |
+| CollectionFlow.cs:381:17:381:20 | [post] access to local variable list : List<T> [element] : A | CollectionFlow.cs:383:22:383:25 | access to local variable list : List<T> [element] : A | provenance |  |
+| CollectionFlow.cs:381:17:381:20 | [post] access to local variable list : List<T> [element] : A | CollectionFlow.cs:384:24:384:27 | access to local variable list : List<T> [element] : A | provenance |  |
+| CollectionFlow.cs:381:23:381:23 | access to local variable a : A | CollectionFlow.cs:375:34:375:40 | element : A | provenance |  |
+| CollectionFlow.cs:381:23:381:23 | access to local variable a : A | CollectionFlow.cs:381:17:381:20 | [post] access to local variable list : List<T> [element] : A | provenance | MaD:3 |
+| CollectionFlow.cs:382:14:382:17 | access to local variable list : List<T> [element] : A | CollectionFlow.cs:382:14:382:20 | access to indexer | provenance | MaD:11 |
+| CollectionFlow.cs:383:22:383:25 | access to local variable list : List<T> [element] : A | CollectionFlow.cs:18:49:18:52 | list : List<T> [element] : A | provenance |  |
+| CollectionFlow.cs:384:24:384:27 | access to local variable list : List<T> [element] : A | CollectionFlow.cs:28:43:28:46 | list : List<T> [element] : A | provenance |  |
+| CollectionFlow.cs:384:24:384:27 | access to local variable list : List<T> [element] : A | CollectionFlow.cs:384:14:384:28 | call to method ListFirst<A> | provenance | MaD:11 |
+| CollectionFlow.cs:398:20:398:26 | object creation of type A : A | CollectionFlow.cs:40:49:40:52 | args : A[] [element] : A | provenance |  |
+| CollectionFlow.cs:399:26:399:32 | object creation of type A : A | CollectionFlow.cs:40:49:40:52 | args : A[] [element] : A | provenance |  |
+| CollectionFlow.cs:400:26:400:32 | object creation of type A : A | CollectionFlow.cs:40:49:40:52 | args : A[] [element] : A | provenance |  |
+| CollectionFlow.cs:401:20:401:38 | array creation of type A[] : null [element] : A | CollectionFlow.cs:40:49:40:52 | args : null [element] : A | provenance |  |
+| CollectionFlow.cs:401:28:401:38 | { ..., ... } : null [element] : A | CollectionFlow.cs:401:20:401:38 | array creation of type A[] : null [element] : A | provenance |  |
+| CollectionFlow.cs:401:30:401:36 | object creation of type A : A | CollectionFlow.cs:401:28:401:38 | { ..., ... } : null [element] : A | provenance |  |
+| CollectionFlow.cs:414:30:414:36 | object creation of type A : A | CollectionFlow.cs:42:70:42:73 | args : IEnumerable<A> [element] : A | provenance |  |
+| CollectionFlow.cs:415:36:415:42 | object creation of type A : A | CollectionFlow.cs:42:70:42:73 | args : IEnumerable<A> [element] : A | provenance |  |
+| CollectionFlow.cs:416:36:416:42 | object creation of type A : A | CollectionFlow.cs:42:70:42:73 | args : IEnumerable<A> [element] : A | provenance |  |
+| CollectionFlow.cs:417:30:417:38 | [...] : IEnumerable<A> [element] : A | CollectionFlow.cs:42:70:42:73 | args : IEnumerable<A> [element] : A | provenance |  |
+| CollectionFlow.cs:417:31:417:37 | object creation of type A : A | CollectionFlow.cs:417:30:417:38 | [...] : IEnumerable<A> [element] : A | provenance |  |
+| CollectionFlow.cs:439:13:439:13 | access to local variable a : A | CollectionFlow.cs:441:20:441:20 | access to local variable a : A | provenance |  |
+| CollectionFlow.cs:439:17:439:23 | object creation of type A : A | CollectionFlow.cs:439:13:439:13 | access to local variable a : A | provenance |  |
+| CollectionFlow.cs:441:9:441:13 | [post] access to local variable array : MyInlineArray [element] : A | CollectionFlow.cs:442:14:442:18 | access to local variable array : MyInlineArray [element] : A | provenance |  |
+| CollectionFlow.cs:441:20:441:20 | access to local variable a : A | CollectionFlow.cs:441:9:441:13 | [post] access to local variable array : MyInlineArray [element] : A | provenance |  |
+| CollectionFlow.cs:442:14:442:18 | access to local variable array : MyInlineArray [element] : A | CollectionFlow.cs:442:14:442:21 | access to array element | provenance |  |
+| CollectionFlow.cs:460:13:460:13 | access to local variable a : A | CollectionFlow.cs:461:22:461:22 | access to local variable a : A | provenance |  |
+| CollectionFlow.cs:460:17:460:23 | object creation of type A : A | CollectionFlow.cs:460:13:460:13 | access to local variable a : A | provenance |  |
+| CollectionFlow.cs:461:13:461:17 | access to local variable array : A[] [element] : A | CollectionFlow.cs:462:14:462:18 | access to local variable array : A[] [element] : A | provenance |  |
+| CollectionFlow.cs:461:21:461:23 | [...] : A[] [element] : A | CollectionFlow.cs:461:13:461:17 | access to local variable array : A[] [element] : A | provenance |  |
+| CollectionFlow.cs:461:22:461:22 | access to local variable a : A | CollectionFlow.cs:461:21:461:23 | [...] : A[] [element] : A | provenance |  |
+| CollectionFlow.cs:462:14:462:18 | access to local variable array : A[] [element] : A | CollectionFlow.cs:462:14:462:21 | access to array element | provenance |  |
+| CollectionFlow.cs:467:13:467:13 | access to local variable a : A | CollectionFlow.cs:468:22:468:22 | access to local variable a : A | provenance |  |
+| CollectionFlow.cs:467:17:467:23 | object creation of type A : A | CollectionFlow.cs:467:13:467:13 | access to local variable a : A | provenance |  |
+| CollectionFlow.cs:468:17:468:17 | access to local variable l : List<A> [element] : A | CollectionFlow.cs:469:14:469:14 | access to local variable l : List<A> [element] : A | provenance |  |
+| CollectionFlow.cs:468:21:468:23 | [...] : List<A> [element] : A | CollectionFlow.cs:468:17:468:17 | access to local variable l : List<A> [element] : A | provenance |  |
+| CollectionFlow.cs:468:22:468:22 | access to local variable a : A | CollectionFlow.cs:468:21:468:23 | [...] : List<A> [element] : A | provenance |  |
+| CollectionFlow.cs:469:14:469:14 | access to local variable l : List<A> [element] : A | CollectionFlow.cs:469:14:469:17 | access to indexer | provenance | MaD:11 |
+| CollectionFlow.cs:480:13:480:13 | access to local variable a : A | CollectionFlow.cs:481:21:481:21 | access to local variable a : A | provenance |  |
+| CollectionFlow.cs:480:17:480:23 | object creation of type A : A | CollectionFlow.cs:480:13:480:13 | access to local variable a : A | provenance |  |
+| CollectionFlow.cs:481:13:481:16 | access to local variable temp : A[] [element] : A | CollectionFlow.cs:482:22:482:28 | .. access to local variable temp : A[] [element] : A | provenance |  |
+| CollectionFlow.cs:481:20:481:22 | [...] : A[] [element] : A | CollectionFlow.cs:481:13:481:16 | access to local variable temp : A[] [element] : A | provenance |  |
+| CollectionFlow.cs:481:21:481:21 | access to local variable a : A | CollectionFlow.cs:481:20:481:22 | [...] : A[] [element] : A | provenance |  |
+| CollectionFlow.cs:482:13:482:17 | access to local variable array : A[] [element] : A | CollectionFlow.cs:483:14:483:18 | access to local variable array : A[] [element] : A | provenance |  |
+| CollectionFlow.cs:482:22:482:28 | .. access to local variable temp : A[] [element] : A | CollectionFlow.cs:482:13:482:17 | access to local variable array : A[] [element] : A | provenance |  |
+| CollectionFlow.cs:483:14:483:18 | access to local variable array : A[] [element] : A | CollectionFlow.cs:483:14:483:21 | access to array element | provenance |  |
+| CollectionFlow.cs:520:13:520:13 | access to local variable a : A | CollectionFlow.cs:521:40:521:40 | access to local variable a : A | provenance |  |
+| CollectionFlow.cs:520:17:520:23 | object creation of type A : A | CollectionFlow.cs:520:13:520:13 | access to local variable a : A | provenance |  |
+| CollectionFlow.cs:521:17:521:20 | access to local variable span : Span<T> [element] : A | CollectionFlow.cs:522:14:522:17 | access to local variable span : Span<T> [element] : A | provenance |  |
+| CollectionFlow.cs:521:24:521:41 | object creation of type Span<A> : Span<T> [element] : A | CollectionFlow.cs:521:17:521:20 | access to local variable span : Span<T> [element] : A | provenance |  |
+| CollectionFlow.cs:521:40:521:40 | access to local variable a : A | CollectionFlow.cs:521:24:521:41 | object creation of type Span<A> : Span<T> [element] : A | provenance | MaD:23 |
+| CollectionFlow.cs:522:14:522:17 | access to local variable span : Span<T> [element] : A | CollectionFlow.cs:522:14:522:20 | access to indexer | provenance | MaD:26 |
+| CollectionFlow.cs:527:13:527:13 | access to local variable a : A | CollectionFlow.cs:528:40:528:40 | access to local variable a : A | provenance |  |
+| CollectionFlow.cs:527:17:527:23 | object creation of type A : A | CollectionFlow.cs:527:13:527:13 | access to local variable a : A | provenance |  |
+| CollectionFlow.cs:528:17:528:20 | access to local variable span : Span<T> [element] : A | CollectionFlow.cs:529:19:529:22 | access to local variable span : Span<T> [element] : A | provenance |  |
+| CollectionFlow.cs:528:24:528:41 | object creation of type Span<A> : Span<T> [element] : A | CollectionFlow.cs:528:17:528:20 | access to local variable span : Span<T> [element] : A | provenance |  |
+| CollectionFlow.cs:528:40:528:40 | access to local variable a : A | CollectionFlow.cs:528:24:528:41 | object creation of type Span<A> : Span<T> [element] : A | provenance | MaD:23 |
+| CollectionFlow.cs:529:13:529:15 | access to local variable arr : T[] [element] : A | CollectionFlow.cs:530:14:530:16 | access to local variable arr : T[] [element] : A | provenance |  |
+| CollectionFlow.cs:529:19:529:22 | access to local variable span : Span<T> [element] : A | CollectionFlow.cs:529:19:529:32 | call to method ToArray : T[] [element] : A | provenance | MaD:25 |
+| CollectionFlow.cs:529:19:529:32 | call to method ToArray : T[] [element] : A | CollectionFlow.cs:529:13:529:15 | access to local variable arr : T[] [element] : A | provenance |  |
+| CollectionFlow.cs:530:14:530:16 | access to local variable arr : T[] [element] : A | CollectionFlow.cs:530:14:530:19 | access to array element | provenance |  |
+| CollectionFlow.cs:535:13:535:13 | access to local variable a : A | CollectionFlow.cs:536:21:536:21 | access to local variable a : A | provenance |  |
+| CollectionFlow.cs:535:17:535:23 | object creation of type A : A | CollectionFlow.cs:535:13:535:13 | access to local variable a : A | provenance |  |
+| CollectionFlow.cs:536:9:536:14 | [post] access to parameter target : Span<T> [element] : A | CollectionFlow.cs:537:14:537:19 | access to parameter target : Span<T> [element] : A | provenance |  |
+| CollectionFlow.cs:536:21:536:21 | access to local variable a : A | CollectionFlow.cs:536:9:536:14 | [post] access to parameter target : Span<T> [element] : A | provenance | MaD:22 |
+| CollectionFlow.cs:537:14:537:19 | access to parameter target : Span<T> [element] : A | CollectionFlow.cs:537:14:537:22 | access to indexer | provenance | MaD:26 |
+| CollectionFlow.cs:542:13:542:18 | access to local variable source : Span<T> [element] : A | CollectionFlow.cs:543:9:543:14 | access to local variable source : Span<T> [element] : A | provenance |  |
+| CollectionFlow.cs:542:22:542:51 | object creation of type Span<A> : Span<T> [element] : A | CollectionFlow.cs:542:13:542:18 | access to local variable source : Span<T> [element] : A | provenance |  |
+| CollectionFlow.cs:542:34:542:50 | array creation of type A[] : null [element] : A | CollectionFlow.cs:542:22:542:51 | object creation of type Span<A> : Span<T> [element] : A | provenance | MaD:24 |
+| CollectionFlow.cs:542:40:542:50 | { ..., ... } : null [element] : A | CollectionFlow.cs:542:34:542:50 | array creation of type A[] : null [element] : A | provenance |  |
+| CollectionFlow.cs:542:42:542:48 | object creation of type A : A | CollectionFlow.cs:542:40:542:50 | { ..., ... } : null [element] : A | provenance |  |
+| CollectionFlow.cs:543:9:543:14 | access to local variable source : Span<T> [element] : A | CollectionFlow.cs:543:23:543:28 | [post] access to parameter target : Span<T> [element] : A | provenance | MaD:21 |
+| CollectionFlow.cs:543:23:543:28 | [post] access to parameter target : Span<T> [element] : A | CollectionFlow.cs:544:14:544:19 | access to parameter target : Span<T> [element] : A | provenance |  |
+| CollectionFlow.cs:544:14:544:19 | access to parameter target : Span<T> [element] : A | CollectionFlow.cs:544:14:544:22 | access to indexer | provenance | MaD:26 |
+| CollectionFlow.cs:549:13:549:13 | access to local variable a : A | CollectionFlow.cs:550:60:550:60 | access to local variable a : A | provenance |  |
+| CollectionFlow.cs:549:17:549:23 | object creation of type A : A | CollectionFlow.cs:549:13:549:13 | access to local variable a : A | provenance |  |
+| CollectionFlow.cs:550:25:550:28 | access to local variable span : ReadOnlySpan<T> [element] : A | CollectionFlow.cs:551:14:551:17 | access to local variable span : ReadOnlySpan<T> [element] : A | provenance |  |
+| CollectionFlow.cs:550:32:550:63 | object creation of type ReadOnlySpan<A> : ReadOnlySpan<T> [element] : A | CollectionFlow.cs:550:25:550:28 | access to local variable span : ReadOnlySpan<T> [element] : A | provenance |  |
+| CollectionFlow.cs:550:52:550:62 | array creation of type A[] : null [element] : A | CollectionFlow.cs:550:32:550:63 | object creation of type ReadOnlySpan<A> : ReadOnlySpan<T> [element] : A | provenance | MaD:19 |
+| CollectionFlow.cs:550:58:550:62 | { ..., ... } : null [element] : A | CollectionFlow.cs:550:52:550:62 | array creation of type A[] : null [element] : A | provenance |  |
+| CollectionFlow.cs:550:60:550:60 | access to local variable a : A | CollectionFlow.cs:550:58:550:62 | { ..., ... } : null [element] : A | provenance |  |
+| CollectionFlow.cs:551:14:551:17 | access to local variable span : ReadOnlySpan<T> [element] : A | CollectionFlow.cs:551:14:551:20 | access to indexer | provenance | MaD:20 |
+nodes
+| CollectionFlow.cs:14:40:14:41 | ts : A[] [element] : A | semmle.label | ts : A[] [element] : A |
+| CollectionFlow.cs:14:40:14:41 | ts : null [element] : A | semmle.label | ts : null [element] : A |
+| CollectionFlow.cs:14:52:14:53 | access to parameter ts : A[] [element] : A | semmle.label | access to parameter ts : A[] [element] : A |
+| CollectionFlow.cs:14:52:14:53 | access to parameter ts : null [element] : A | semmle.label | access to parameter ts : null [element] : A |
+| CollectionFlow.cs:14:52:14:56 | access to array element | semmle.label | access to array element |
+| CollectionFlow.cs:16:44:16:45 | ts : A[] [element] : A | semmle.label | ts : A[] [element] : A |
+| CollectionFlow.cs:16:56:16:57 | access to parameter ts : A[] [element] : A | semmle.label | access to parameter ts : A[] [element] : A |
+| CollectionFlow.cs:16:56:16:61 | access to array element | semmle.label | access to array element |
+| CollectionFlow.cs:18:49:18:52 | list : List<T> [element] : A | semmle.label | list : List<T> [element] : A |
+| CollectionFlow.cs:18:63:18:66 | access to parameter list : List<T> [element] : A | semmle.label | access to parameter list : List<T> [element] : A |
+| CollectionFlow.cs:18:63:18:69 | access to indexer | semmle.label | access to indexer |
+| CollectionFlow.cs:20:61:20:64 | dict : Dictionary<T,T> [element, property Value] : A | semmle.label | dict : Dictionary<T,T> [element, property Value] : A |
+| CollectionFlow.cs:20:75:20:78 | access to parameter dict : Dictionary<T,T> [element, property Value] : A | semmle.label | access to parameter dict : Dictionary<T,T> [element, property Value] : A |
+| CollectionFlow.cs:20:75:20:81 | access to indexer | semmle.label | access to indexer |
+| CollectionFlow.cs:22:59:22:62 | dict : Dictionary<T,T> [element, property Key] : A | semmle.label | dict : Dictionary<T,T> [element, property Key] : A |
+| CollectionFlow.cs:22:73:22:76 | access to parameter dict : Dictionary<T,T> [element, property Key] : A | semmle.label | access to parameter dict : Dictionary<T,T> [element, property Key] : A |
+| CollectionFlow.cs:22:73:22:81 | access to property Keys : ICollection<T> [element] : A | semmle.label | access to property Keys : ICollection<T> [element] : A |
+| CollectionFlow.cs:22:73:22:89 | call to method First<T> | semmle.label | call to method First<T> |
+| CollectionFlow.cs:24:34:24:35 | ts : A[] [element] : A | semmle.label | ts : A[] [element] : A |
+| CollectionFlow.cs:24:34:24:35 | ts : null [element] : A | semmle.label | ts : null [element] : A |
+| CollectionFlow.cs:24:41:24:42 | access to parameter ts : A[] [element] : A | semmle.label | access to parameter ts : A[] [element] : A |
+| CollectionFlow.cs:24:41:24:42 | access to parameter ts : null [element] : A | semmle.label | access to parameter ts : null [element] : A |
+| CollectionFlow.cs:24:41:24:45 | access to array element : A | semmle.label | access to array element : A |
+| CollectionFlow.cs:24:41:24:45 | access to array element : A | semmle.label | access to array element : A |
+| CollectionFlow.cs:26:33:26:34 | ts : A[] [element] : A | semmle.label | ts : A[] [element] : A |
+| CollectionFlow.cs:26:40:26:41 | access to parameter ts : A[] [element] : A | semmle.label | access to parameter ts : A[] [element] : A |
+| CollectionFlow.cs:26:40:26:45 | access to array element : A | semmle.label | access to array element : A |
+| CollectionFlow.cs:28:43:28:46 | list : List<T> [element] : A | semmle.label | list : List<T> [element] : A |
+| CollectionFlow.cs:28:52:28:55 | access to parameter list : List<T> [element] : A | semmle.label | access to parameter list : List<T> [element] : A |
+| CollectionFlow.cs:28:52:28:58 | access to indexer : A | semmle.label | access to indexer : A |
+| CollectionFlow.cs:30:58:30:61 | dict : Dictionary<T,T> [element, property Value] : A | semmle.label | dict : Dictionary<T,T> [element, property Value] : A |
+| CollectionFlow.cs:30:67:30:70 | access to parameter dict : Dictionary<T,T> [element, property Value] : A | semmle.label | access to parameter dict : Dictionary<T,T> [element, property Value] : A |
+| CollectionFlow.cs:30:67:30:73 | access to indexer : A | semmle.label | access to indexer : A |
+| CollectionFlow.cs:32:59:32:62 | dict : Dictionary<T,T> [element, property Value] : A | semmle.label | dict : Dictionary<T,T> [element, property Value] : A |
+| CollectionFlow.cs:32:68:32:71 | access to parameter dict : Dictionary<T,T> [element, property Value] : A | semmle.label | access to parameter dict : Dictionary<T,T> [element, property Value] : A |
+| CollectionFlow.cs:32:68:32:79 | call to method First<KeyValuePair<Int32,T>> : KeyValuePair<Int32,T> [property Value] : A | semmle.label | call to method First<KeyValuePair<Int32,T>> : KeyValuePair<Int32,T> [property Value] : A |
+| CollectionFlow.cs:32:68:32:85 | access to property Value : A | semmle.label | access to property Value : A |
+| CollectionFlow.cs:34:60:34:63 | dict : Dictionary<T,T> [element, property Value] : A | semmle.label | dict : Dictionary<T,T> [element, property Value] : A |
+| CollectionFlow.cs:34:69:34:72 | access to parameter dict : Dictionary<T,T> [element, property Value] : A | semmle.label | access to parameter dict : Dictionary<T,T> [element, property Value] : A |
+| CollectionFlow.cs:34:69:34:79 | access to property Values : ICollection<T> [element] : A | semmle.label | access to property Values : ICollection<T> [element] : A |
+| CollectionFlow.cs:34:69:34:87 | call to method First<T> : A | semmle.label | call to method First<T> : A |
+| CollectionFlow.cs:36:58:36:61 | dict : Dictionary<T,T> [element, property Key] : A | semmle.label | dict : Dictionary<T,T> [element, property Key] : A |
+| CollectionFlow.cs:36:67:36:70 | access to parameter dict : Dictionary<T,T> [element, property Key] : A | semmle.label | access to parameter dict : Dictionary<T,T> [element, property Key] : A |
+| CollectionFlow.cs:36:67:36:75 | access to property Keys : ICollection<T> [element] : A | semmle.label | access to property Keys : ICollection<T> [element] : A |
+| CollectionFlow.cs:36:67:36:83 | call to method First<T> : A | semmle.label | call to method First<T> : A |
+| CollectionFlow.cs:38:57:38:60 | dict : Dictionary<T,T> [element, property Key] : A | semmle.label | dict : Dictionary<T,T> [element, property Key] : A |
+| CollectionFlow.cs:38:66:38:69 | access to parameter dict : Dictionary<T,T> [element, property Key] : A | semmle.label | access to parameter dict : Dictionary<T,T> [element, property Key] : A |
+| CollectionFlow.cs:38:66:38:77 | call to method First<KeyValuePair<T,Int32>> : KeyValuePair<T,Int32> [property Key] : A | semmle.label | call to method First<KeyValuePair<T,Int32>> : KeyValuePair<T,Int32> [property Key] : A |
+| CollectionFlow.cs:38:66:38:81 | access to property Key : A | semmle.label | access to property Key : A |
+| CollectionFlow.cs:40:49:40:52 | args : A[] [element] : A | semmle.label | args : A[] [element] : A |
+| CollectionFlow.cs:40:49:40:52 | args : null [element] : A | semmle.label | args : null [element] : A |
+| CollectionFlow.cs:40:63:40:66 | access to parameter args : A[] [element] : A | semmle.label | access to parameter args : A[] [element] : A |
+| CollectionFlow.cs:40:63:40:66 | access to parameter args : null [element] : A | semmle.label | access to parameter args : null [element] : A |
+| CollectionFlow.cs:40:63:40:69 | access to array element | semmle.label | access to array element |
+| CollectionFlow.cs:42:70:42:73 | args : IEnumerable<A> [element] : A | semmle.label | args : IEnumerable<A> [element] : A |
+| CollectionFlow.cs:42:84:42:87 | access to parameter args : IEnumerable<A> [element] : A | semmle.label | access to parameter args : IEnumerable<A> [element] : A |
+| CollectionFlow.cs:42:84:42:95 | call to method First<T> | semmle.label | call to method First<T> |
+| CollectionFlow.cs:46:13:46:13 | access to local variable a : A | semmle.label | access to local variable a : A |
+| CollectionFlow.cs:46:17:46:23 | object creation of type A : A | semmle.label | object creation of type A : A |
+| CollectionFlow.cs:47:13:47:15 | access to local variable as : null [element] : A | semmle.label | access to local variable as : null [element] : A |
+| CollectionFlow.cs:47:25:47:29 | { ..., ... } : null [element] : A | semmle.label | { ..., ... } : null [element] : A |
+| CollectionFlow.cs:47:27:47:27 | access to local variable a : A | semmle.label | access to local variable a : A |
+| CollectionFlow.cs:48:14:48:16 | access to local variable as : null [element] : A | semmle.label | access to local variable as : null [element] : A |
+| CollectionFlow.cs:48:14:48:19 | access to array element | semmle.label | access to array element |
+| CollectionFlow.cs:49:18:49:20 | access to local variable as : null [element] : A | semmle.label | access to local variable as : null [element] : A |
+| CollectionFlow.cs:50:14:50:23 | call to method First<A> | semmle.label | call to method First<A> |
+| CollectionFlow.cs:50:20:50:22 | access to local variable as : null [element] : A | semmle.label | access to local variable as : null [element] : A |
+| CollectionFlow.cs:64:13:64:13 | access to local variable a : A | semmle.label | access to local variable a : A |
+| CollectionFlow.cs:64:17:64:23 | object creation of type A : A | semmle.label | object creation of type A : A |
+| CollectionFlow.cs:65:13:65:13 | access to local variable c : CollectionFlow [field As, element] : A | semmle.label | access to local variable c : CollectionFlow [field As, element] : A |
+| CollectionFlow.cs:65:38:65:57 | { ..., ... } : CollectionFlow [field As, element] : A | semmle.label | { ..., ... } : CollectionFlow [field As, element] : A |
+| CollectionFlow.cs:65:45:65:55 | { ..., ... } : A[] [element] : A | semmle.label | { ..., ... } : A[] [element] : A |
+| CollectionFlow.cs:65:53:65:53 | access to local variable a : A | semmle.label | access to local variable a : A |
+| CollectionFlow.cs:66:14:66:14 | access to local variable c : CollectionFlow [field As, element] : A | semmle.label | access to local variable c : CollectionFlow [field As, element] : A |
+| CollectionFlow.cs:66:14:66:17 | access to field As : A[] [element] : A | semmle.label | access to field As : A[] [element] : A |
+| CollectionFlow.cs:66:14:66:20 | access to array element | semmle.label | access to array element |
+| CollectionFlow.cs:67:18:67:18 | access to local variable c : CollectionFlow [field As, element] : A | semmle.label | access to local variable c : CollectionFlow [field As, element] : A |
+| CollectionFlow.cs:67:18:67:21 | access to field As : A[] [element] : A | semmle.label | access to field As : A[] [element] : A |
+| CollectionFlow.cs:68:14:68:24 | call to method First<A> | semmle.label | call to method First<A> |
+| CollectionFlow.cs:68:20:68:20 | access to local variable c : CollectionFlow [field As, element] : A | semmle.label | access to local variable c : CollectionFlow [field As, element] : A |
+| CollectionFlow.cs:68:20:68:23 | access to field As : A[] [element] : A | semmle.label | access to field As : A[] [element] : A |
+| CollectionFlow.cs:82:13:82:13 | access to local variable a : A | semmle.label | access to local variable a : A |
+| CollectionFlow.cs:82:17:82:23 | object creation of type A : A | semmle.label | object creation of type A : A |
+| CollectionFlow.cs:83:13:83:13 | access to local variable c : CollectionFlow [field As, element] : A | semmle.label | access to local variable c : CollectionFlow [field As, element] : A |
+| CollectionFlow.cs:83:38:83:58 | { ..., ... } : CollectionFlow [field As, element] : A | semmle.label | { ..., ... } : CollectionFlow [field As, element] : A |
+| CollectionFlow.cs:83:45:83:56 | { ..., ... } : A[] [element] : A | semmle.label | { ..., ... } : A[] [element] : A |
+| CollectionFlow.cs:83:54:83:54 | access to local variable a : A | semmle.label | access to local variable a : A |
+| CollectionFlow.cs:84:14:84:14 | access to local variable c : CollectionFlow [field As, element] : A | semmle.label | access to local variable c : CollectionFlow [field As, element] : A |
+| CollectionFlow.cs:84:14:84:17 | access to field As : A[] [element] : A | semmle.label | access to field As : A[] [element] : A |
+| CollectionFlow.cs:84:14:84:21 | access to array element | semmle.label | access to array element |
+| CollectionFlow.cs:85:22:85:22 | access to local variable c : CollectionFlow [field As, element] : A | semmle.label | access to local variable c : CollectionFlow [field As, element] : A |
+| CollectionFlow.cs:85:22:85:25 | access to field As : A[] [element] : A | semmle.label | access to field As : A[] [element] : A |
+| CollectionFlow.cs:86:14:86:23 | call to method Last<A> | semmle.label | call to method Last<A> |
+| CollectionFlow.cs:86:19:86:19 | access to local variable c : CollectionFlow [field As, element] : A | semmle.label | access to local variable c : CollectionFlow [field As, element] : A |
+| CollectionFlow.cs:86:19:86:22 | access to field As : A[] [element] : A | semmle.label | access to field As : A[] [element] : A |
+| CollectionFlow.cs:91:13:91:13 | access to local variable a : A | semmle.label | access to local variable a : A |
+| CollectionFlow.cs:91:17:91:23 | object creation of type A : A | semmle.label | object creation of type A : A |
+| CollectionFlow.cs:93:9:93:11 | [post] access to local variable as : A[] [element] : A | semmle.label | [post] access to local variable as : A[] [element] : A |
+| CollectionFlow.cs:93:18:93:18 | access to local variable a : A | semmle.label | access to local variable a : A |
+| CollectionFlow.cs:94:14:94:16 | access to local variable as : A[] [element] : A | semmle.label | access to local variable as : A[] [element] : A |
+| CollectionFlow.cs:94:14:94:19 | access to array element | semmle.label | access to array element |
+| CollectionFlow.cs:95:18:95:20 | access to local variable as : A[] [element] : A | semmle.label | access to local variable as : A[] [element] : A |
+| CollectionFlow.cs:96:14:96:23 | call to method First<A> | semmle.label | call to method First<A> |
+| CollectionFlow.cs:96:20:96:22 | access to local variable as : A[] [element] : A | semmle.label | access to local variable as : A[] [element] : A |
+| CollectionFlow.cs:111:13:111:13 | access to local variable a : A | semmle.label | access to local variable a : A |
+| CollectionFlow.cs:111:17:111:23 | object creation of type A : A | semmle.label | object creation of type A : A |
+| CollectionFlow.cs:113:9:113:11 | [post] access to local variable as : A[] [element] : A | semmle.label | [post] access to local variable as : A[] [element] : A |
+| CollectionFlow.cs:113:19:113:19 | access to local variable a : A | semmle.label | access to local variable a : A |
+| CollectionFlow.cs:114:14:114:16 | access to local variable as : A[] [element] : A | semmle.label | access to local variable as : A[] [element] : A |
+| CollectionFlow.cs:114:14:114:20 | access to array element | semmle.label | access to array element |
+| CollectionFlow.cs:115:22:115:24 | access to local variable as : A[] [element] : A | semmle.label | access to local variable as : A[] [element] : A |
+| CollectionFlow.cs:116:14:116:22 | call to method Last<A> | semmle.label | call to method Last<A> |
+| CollectionFlow.cs:116:19:116:21 | access to local variable as : A[] [element] : A | semmle.label | access to local variable as : A[] [element] : A |
+| CollectionFlow.cs:121:13:121:13 | access to local variable a : A | semmle.label | access to local variable a : A |
+| CollectionFlow.cs:121:17:121:23 | object creation of type A : A | semmle.label | object creation of type A : A |
+| CollectionFlow.cs:123:9:123:12 | [post] access to local variable list : List<T> [element] : A | semmle.label | [post] access to local variable list : List<T> [element] : A |
+| CollectionFlow.cs:123:19:123:19 | access to local variable a : A | semmle.label | access to local variable a : A |
+| CollectionFlow.cs:124:14:124:17 | access to local variable list : List<T> [element] : A | semmle.label | access to local variable list : List<T> [element] : A |
+| CollectionFlow.cs:124:14:124:20 | access to indexer | semmle.label | access to indexer |
+| CollectionFlow.cs:125:22:125:25 | access to local variable list : List<T> [element] : A | semmle.label | access to local variable list : List<T> [element] : A |
+| CollectionFlow.cs:126:14:126:28 | call to method ListFirst<A> | semmle.label | call to method ListFirst<A> |
+| CollectionFlow.cs:126:24:126:27 | access to local variable list : List<T> [element] : A | semmle.label | access to local variable list : List<T> [element] : A |
+| CollectionFlow.cs:140:13:140:13 | access to local variable a : A | semmle.label | access to local variable a : A |
+| CollectionFlow.cs:140:17:140:23 | object creation of type A : A | semmle.label | object creation of type A : A |
+| CollectionFlow.cs:141:13:141:16 | access to local variable list : List<T> [element] : A | semmle.label | access to local variable list : List<T> [element] : A |
+| CollectionFlow.cs:141:20:141:38 | object creation of type List<A> : List<T> [element] : A | semmle.label | object creation of type List<A> : List<T> [element] : A |
+| CollectionFlow.cs:141:36:141:36 | access to local variable a : A | semmle.label | access to local variable a : A |
+| CollectionFlow.cs:142:14:142:17 | access to local variable list : List<T> [element] : A | semmle.label | access to local variable list : List<T> [element] : A |
+| CollectionFlow.cs:142:14:142:20 | access to indexer | semmle.label | access to indexer |
+| CollectionFlow.cs:143:22:143:25 | access to local variable list : List<T> [element] : A | semmle.label | access to local variable list : List<T> [element] : A |
+| CollectionFlow.cs:144:14:144:28 | call to method ListFirst<A> | semmle.label | call to method ListFirst<A> |
+| CollectionFlow.cs:144:24:144:27 | access to local variable list : List<T> [element] : A | semmle.label | access to local variable list : List<T> [element] : A |
+| CollectionFlow.cs:157:13:157:13 | access to local variable a : A | semmle.label | access to local variable a : A |
+| CollectionFlow.cs:157:17:157:23 | object creation of type A : A | semmle.label | object creation of type A : A |
+| CollectionFlow.cs:159:9:159:12 | [post] access to local variable list : List<T> [element] : A | semmle.label | [post] access to local variable list : List<T> [element] : A |
+| CollectionFlow.cs:159:18:159:18 | access to local variable a : A | semmle.label | access to local variable a : A |
+| CollectionFlow.cs:160:14:160:17 | access to local variable list : List<T> [element] : A | semmle.label | access to local variable list : List<T> [element] : A |
+| CollectionFlow.cs:160:14:160:20 | access to indexer | semmle.label | access to indexer |
+| CollectionFlow.cs:161:22:161:25 | access to local variable list : List<T> [element] : A | semmle.label | access to local variable list : List<T> [element] : A |
+| CollectionFlow.cs:162:14:162:28 | call to method ListFirst<A> | semmle.label | call to method ListFirst<A> |
+| CollectionFlow.cs:162:24:162:27 | access to local variable list : List<T> [element] : A | semmle.label | access to local variable list : List<T> [element] : A |
+| CollectionFlow.cs:176:13:176:13 | access to local variable a : A | semmle.label | access to local variable a : A |
+| CollectionFlow.cs:176:17:176:23 | object creation of type A : A | semmle.label | object creation of type A : A |
+| CollectionFlow.cs:178:9:178:12 | [post] access to local variable dict : Dictionary<T,T> [element, property Value] : A | semmle.label | [post] access to local variable dict : Dictionary<T,T> [element, property Value] : A |
+| CollectionFlow.cs:178:19:178:19 | access to local variable a : A | semmle.label | access to local variable a : A |
+| CollectionFlow.cs:179:14:179:17 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | semmle.label | access to local variable dict : Dictionary<T,T> [element, property Value] : A |
+| CollectionFlow.cs:179:14:179:20 | access to indexer | semmle.label | access to indexer |
+| CollectionFlow.cs:180:23:180:26 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | semmle.label | access to local variable dict : Dictionary<T,T> [element, property Value] : A |
+| CollectionFlow.cs:181:14:181:32 | call to method DictIndexZero<A> | semmle.label | call to method DictIndexZero<A> |
+| CollectionFlow.cs:181:28:181:31 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | semmle.label | access to local variable dict : Dictionary<T,T> [element, property Value] : A |
+| CollectionFlow.cs:182:14:182:33 | call to method DictFirstValue<A> | semmle.label | call to method DictFirstValue<A> |
+| CollectionFlow.cs:182:29:182:32 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | semmle.label | access to local variable dict : Dictionary<T,T> [element, property Value] : A |
+| CollectionFlow.cs:183:14:183:34 | call to method DictValuesFirst<A> | semmle.label | call to method DictValuesFirst<A> |
+| CollectionFlow.cs:183:30:183:33 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | semmle.label | access to local variable dict : Dictionary<T,T> [element, property Value] : A |
+| CollectionFlow.cs:199:13:199:13 | access to local variable a : A | semmle.label | access to local variable a : A |
+| CollectionFlow.cs:199:17:199:23 | object creation of type A : A | semmle.label | object creation of type A : A |
+| CollectionFlow.cs:200:13:200:16 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | semmle.label | access to local variable dict : Dictionary<T,T> [element, property Value] : A |
+| CollectionFlow.cs:200:20:200:56 | object creation of type Dictionary<Int32,A> : Dictionary<T,T> [element, property Value] : A | semmle.label | object creation of type Dictionary<Int32,A> : Dictionary<T,T> [element, property Value] : A |
+| CollectionFlow.cs:200:52:200:52 | access to local variable a : A | semmle.label | access to local variable a : A |
+| CollectionFlow.cs:201:14:201:17 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | semmle.label | access to local variable dict : Dictionary<T,T> [element, property Value] : A |
+| CollectionFlow.cs:201:14:201:20 | access to indexer | semmle.label | access to indexer |
+| CollectionFlow.cs:202:23:202:26 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | semmle.label | access to local variable dict : Dictionary<T,T> [element, property Value] : A |
+| CollectionFlow.cs:203:14:203:32 | call to method DictIndexZero<A> | semmle.label | call to method DictIndexZero<A> |
+| CollectionFlow.cs:203:28:203:31 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | semmle.label | access to local variable dict : Dictionary<T,T> [element, property Value] : A |
+| CollectionFlow.cs:204:14:204:33 | call to method DictFirstValue<A> | semmle.label | call to method DictFirstValue<A> |
+| CollectionFlow.cs:204:29:204:32 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | semmle.label | access to local variable dict : Dictionary<T,T> [element, property Value] : A |
+| CollectionFlow.cs:205:14:205:34 | call to method DictValuesFirst<A> | semmle.label | call to method DictValuesFirst<A> |
+| CollectionFlow.cs:205:30:205:33 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | semmle.label | access to local variable dict : Dictionary<T,T> [element, property Value] : A |
+| CollectionFlow.cs:220:13:220:13 | access to local variable a : A | semmle.label | access to local variable a : A |
+| CollectionFlow.cs:220:17:220:23 | object creation of type A : A | semmle.label | object creation of type A : A |
+| CollectionFlow.cs:221:13:221:16 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | semmle.label | access to local variable dict : Dictionary<T,T> [element, property Value] : A |
+| CollectionFlow.cs:221:20:221:55 | object creation of type Dictionary<Int32,A> : Dictionary<T,T> [element, property Value] : A | semmle.label | object creation of type Dictionary<Int32,A> : Dictionary<T,T> [element, property Value] : A |
+| CollectionFlow.cs:221:53:221:53 | access to local variable a : A | semmle.label | access to local variable a : A |
+| CollectionFlow.cs:222:14:222:17 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | semmle.label | access to local variable dict : Dictionary<T,T> [element, property Value] : A |
+| CollectionFlow.cs:222:14:222:20 | access to indexer | semmle.label | access to indexer |
+| CollectionFlow.cs:223:23:223:26 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | semmle.label | access to local variable dict : Dictionary<T,T> [element, property Value] : A |
+| CollectionFlow.cs:224:14:224:32 | call to method DictIndexZero<A> | semmle.label | call to method DictIndexZero<A> |
+| CollectionFlow.cs:224:28:224:31 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | semmle.label | access to local variable dict : Dictionary<T,T> [element, property Value] : A |
+| CollectionFlow.cs:225:14:225:33 | call to method DictFirstValue<A> | semmle.label | call to method DictFirstValue<A> |
+| CollectionFlow.cs:225:29:225:32 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | semmle.label | access to local variable dict : Dictionary<T,T> [element, property Value] : A |
+| CollectionFlow.cs:226:14:226:34 | call to method DictValuesFirst<A> | semmle.label | call to method DictValuesFirst<A> |
+| CollectionFlow.cs:226:30:226:33 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | semmle.label | access to local variable dict : Dictionary<T,T> [element, property Value] : A |
+| CollectionFlow.cs:242:13:242:13 | access to local variable a : A | semmle.label | access to local variable a : A |
+| CollectionFlow.cs:242:17:242:23 | object creation of type A : A | semmle.label | object creation of type A : A |
+| CollectionFlow.cs:243:13:243:16 | access to local variable dict : Dictionary<T,T> [element, property Key] : A | semmle.label | access to local variable dict : Dictionary<T,T> [element, property Key] : A |
+| CollectionFlow.cs:243:20:243:56 | object creation of type Dictionary<A,Int32> : Dictionary<T,T> [element, property Key] : A | semmle.label | object creation of type Dictionary<A,Int32> : Dictionary<T,T> [element, property Key] : A |
+| CollectionFlow.cs:243:49:243:49 | access to local variable a : A | semmle.label | access to local variable a : A |
+| CollectionFlow.cs:244:14:244:17 | access to local variable dict : Dictionary<T,T> [element, property Key] : A | semmle.label | access to local variable dict : Dictionary<T,T> [element, property Key] : A |
+| CollectionFlow.cs:244:14:244:22 | access to property Keys : Dictionary<T,T>.KeyCollection [element] : A | semmle.label | access to property Keys : Dictionary<T,T>.KeyCollection [element] : A |
+| CollectionFlow.cs:244:14:244:30 | call to method First<A> | semmle.label | call to method First<A> |
+| CollectionFlow.cs:245:21:245:24 | access to local variable dict : Dictionary<T,T> [element, property Key] : A | semmle.label | access to local variable dict : Dictionary<T,T> [element, property Key] : A |
+| CollectionFlow.cs:246:14:246:32 | call to method DictKeysFirst<A> | semmle.label | call to method DictKeysFirst<A> |
+| CollectionFlow.cs:246:28:246:31 | access to local variable dict : Dictionary<T,T> [element, property Key] : A | semmle.label | access to local variable dict : Dictionary<T,T> [element, property Key] : A |
+| CollectionFlow.cs:247:14:247:31 | call to method DictFirstKey<A> | semmle.label | call to method DictFirstKey<A> |
+| CollectionFlow.cs:247:27:247:30 | access to local variable dict : Dictionary<T,T> [element, property Key] : A | semmle.label | access to local variable dict : Dictionary<T,T> [element, property Key] : A |
+| CollectionFlow.cs:261:13:261:13 | access to local variable a : A | semmle.label | access to local variable a : A |
+| CollectionFlow.cs:261:17:261:23 | object creation of type A : A | semmle.label | object creation of type A : A |
+| CollectionFlow.cs:262:13:262:16 | access to local variable dict : Dictionary<T,T> [element, property Key] : A | semmle.label | access to local variable dict : Dictionary<T,T> [element, property Key] : A |
+| CollectionFlow.cs:262:20:262:55 | object creation of type Dictionary<A,Int32> : Dictionary<T,T> [element, property Key] : A | semmle.label | object creation of type Dictionary<A,Int32> : Dictionary<T,T> [element, property Key] : A |
+| CollectionFlow.cs:262:48:262:48 | access to local variable a : A | semmle.label | access to local variable a : A |
+| CollectionFlow.cs:263:14:263:17 | access to local variable dict : Dictionary<T,T> [element, property Key] : A | semmle.label | access to local variable dict : Dictionary<T,T> [element, property Key] : A |
+| CollectionFlow.cs:263:14:263:22 | access to property Keys : Dictionary<T,T>.KeyCollection [element] : A | semmle.label | access to property Keys : Dictionary<T,T>.KeyCollection [element] : A |
+| CollectionFlow.cs:263:14:263:30 | call to method First<A> | semmle.label | call to method First<A> |
+| CollectionFlow.cs:264:21:264:24 | access to local variable dict : Dictionary<T,T> [element, property Key] : A | semmle.label | access to local variable dict : Dictionary<T,T> [element, property Key] : A |
+| CollectionFlow.cs:265:14:265:32 | call to method DictKeysFirst<A> | semmle.label | call to method DictKeysFirst<A> |
+| CollectionFlow.cs:265:28:265:31 | access to local variable dict : Dictionary<T,T> [element, property Key] : A | semmle.label | access to local variable dict : Dictionary<T,T> [element, property Key] : A |
+| CollectionFlow.cs:266:14:266:31 | call to method DictFirstKey<A> | semmle.label | call to method DictFirstKey<A> |
+| CollectionFlow.cs:266:27:266:30 | access to local variable dict : Dictionary<T,T> [element, property Key] : A | semmle.label | access to local variable dict : Dictionary<T,T> [element, property Key] : A |
+| CollectionFlow.cs:280:13:280:13 | access to local variable a : A | semmle.label | access to local variable a : A |
+| CollectionFlow.cs:280:17:280:23 | object creation of type A : A | semmle.label | object creation of type A : A |
+| CollectionFlow.cs:281:13:281:15 | access to local variable as : null [element] : A | semmle.label | access to local variable as : null [element] : A |
+| CollectionFlow.cs:281:25:281:29 | { ..., ... } : null [element] : A | semmle.label | { ..., ... } : null [element] : A |
+| CollectionFlow.cs:281:27:281:27 | access to local variable a : A | semmle.label | access to local variable a : A |
+| CollectionFlow.cs:282:27:282:29 | access to local variable as : null [element] : A | semmle.label | access to local variable as : null [element] : A |
+| CollectionFlow.cs:283:18:283:18 | access to local variable x | semmle.label | access to local variable x |
+| CollectionFlow.cs:295:13:295:13 | access to local variable a : A | semmle.label | access to local variable a : A |
+| CollectionFlow.cs:295:17:295:23 | object creation of type A : A | semmle.label | object creation of type A : A |
+| CollectionFlow.cs:296:13:296:15 | access to local variable as : null [element] : A | semmle.label | access to local variable as : null [element] : A |
+| CollectionFlow.cs:296:25:296:29 | { ..., ... } : null [element] : A | semmle.label | { ..., ... } : null [element] : A |
+| CollectionFlow.cs:296:27:296:27 | access to local variable a : A | semmle.label | access to local variable a : A |
+| CollectionFlow.cs:297:13:297:22 | access to local variable enumerator : IEnumerator [property Current] : A | semmle.label | access to local variable enumerator : IEnumerator [property Current] : A |
+| CollectionFlow.cs:297:26:297:28 | access to local variable as : null [element] : A | semmle.label | access to local variable as : null [element] : A |
+| CollectionFlow.cs:297:26:297:44 | call to method GetEnumerator : IEnumerator [property Current] : A | semmle.label | call to method GetEnumerator : IEnumerator [property Current] : A |
+| CollectionFlow.cs:299:18:299:27 | access to local variable enumerator : IEnumerator [property Current] : A | semmle.label | access to local variable enumerator : IEnumerator [property Current] : A |
+| CollectionFlow.cs:299:18:299:35 | access to property Current | semmle.label | access to property Current |
+| CollectionFlow.cs:312:13:312:13 | access to local variable a : A | semmle.label | access to local variable a : A |
+| CollectionFlow.cs:312:17:312:23 | object creation of type A : A | semmle.label | object creation of type A : A |
+| CollectionFlow.cs:314:9:314:12 | [post] access to local variable list : List<T> [element] : A | semmle.label | [post] access to local variable list : List<T> [element] : A |
+| CollectionFlow.cs:314:18:314:18 | access to local variable a : A | semmle.label | access to local variable a : A |
+| CollectionFlow.cs:315:13:315:22 | access to local variable enumerator : List<T>.Enumerator [property Current] : A | semmle.label | access to local variable enumerator : List<T>.Enumerator [property Current] : A |
+| CollectionFlow.cs:315:13:315:22 | access to local variable enumerator : List<T>.Enumerator [property Current] : A | semmle.label | access to local variable enumerator : List<T>.Enumerator [property Current] : A |
+| CollectionFlow.cs:315:26:315:29 | access to local variable list : List<T> [element] : A | semmle.label | access to local variable list : List<T> [element] : A |
+| CollectionFlow.cs:315:26:315:45 | call to method GetEnumerator : List<T>.Enumerator [property Current] : A | semmle.label | call to method GetEnumerator : List<T>.Enumerator [property Current] : A |
+| CollectionFlow.cs:315:26:315:45 | call to method GetEnumerator : List<T>.Enumerator [property Current] : A | semmle.label | call to method GetEnumerator : List<T>.Enumerator [property Current] : A |
+| CollectionFlow.cs:317:18:317:27 | access to local variable enumerator : List<T>.Enumerator [property Current] : A | semmle.label | access to local variable enumerator : List<T>.Enumerator [property Current] : A |
+| CollectionFlow.cs:317:18:317:27 | access to local variable enumerator : List<T>.Enumerator [property Current] : A | semmle.label | access to local variable enumerator : List<T>.Enumerator [property Current] : A |
+| CollectionFlow.cs:317:18:317:35 | access to property Current | semmle.label | access to property Current |
+| CollectionFlow.cs:331:13:331:13 | access to local variable a : A | semmle.label | access to local variable a : A |
+| CollectionFlow.cs:331:17:331:23 | object creation of type A : A | semmle.label | object creation of type A : A |
+| CollectionFlow.cs:333:9:333:12 | [post] access to local variable list : List<T> [element, property Key] : A | semmle.label | [post] access to local variable list : List<T> [element, property Key] : A |
+| CollectionFlow.cs:333:18:333:47 | object creation of type KeyValuePair<A,Int32> : KeyValuePair<T,T> [property Key] : A | semmle.label | object creation of type KeyValuePair<A,Int32> : KeyValuePair<T,T> [property Key] : A |
+| CollectionFlow.cs:333:43:333:43 | access to local variable a : A | semmle.label | access to local variable a : A |
+| CollectionFlow.cs:334:9:334:12 | access to local variable list : List<T> [element, property Key] : A | semmle.label | access to local variable list : List<T> [element, property Key] : A |
+| CollectionFlow.cs:334:21:334:23 | kvp : KeyValuePair<A,Int32> [property Key] : A | semmle.label | kvp : KeyValuePair<A,Int32> [property Key] : A |
+| CollectionFlow.cs:336:18:336:20 | access to parameter kvp : KeyValuePair<A,Int32> [property Key] : A | semmle.label | access to parameter kvp : KeyValuePair<A,Int32> [property Key] : A |
+| CollectionFlow.cs:336:18:336:24 | access to property Key | semmle.label | access to property Key |
+| CollectionFlow.cs:353:23:353:27 | array [Return] : A[] [element] : A | semmle.label | array [Return] : A[] [element] : A |
+| CollectionFlow.cs:353:32:353:38 | element : A | semmle.label | element : A |
+| CollectionFlow.cs:353:44:353:48 | [post] access to parameter array : A[] [element] : A | semmle.label | [post] access to parameter array : A[] [element] : A |
+| CollectionFlow.cs:353:55:353:61 | access to parameter element : A | semmle.label | access to parameter element : A |
+| CollectionFlow.cs:357:13:357:13 | access to local variable a : A | semmle.label | access to local variable a : A |
+| CollectionFlow.cs:357:17:357:23 | object creation of type A : A | semmle.label | object creation of type A : A |
+| CollectionFlow.cs:359:18:359:20 | [post] access to local variable as : A[] [element] : A | semmle.label | [post] access to local variable as : A[] [element] : A |
+| CollectionFlow.cs:359:23:359:23 | access to local variable a : A | semmle.label | access to local variable a : A |
+| CollectionFlow.cs:360:14:360:16 | access to local variable as : A[] [element] : A | semmle.label | access to local variable as : A[] [element] : A |
+| CollectionFlow.cs:360:14:360:19 | access to array element | semmle.label | access to array element |
+| CollectionFlow.cs:361:18:361:20 | access to local variable as : A[] [element] : A | semmle.label | access to local variable as : A[] [element] : A |
+| CollectionFlow.cs:362:14:362:23 | call to method First<A> | semmle.label | call to method First<A> |
+| CollectionFlow.cs:362:20:362:22 | access to local variable as : A[] [element] : A | semmle.label | access to local variable as : A[] [element] : A |
+| CollectionFlow.cs:375:26:375:29 | list [Return] : List<T> [element] : A | semmle.label | list [Return] : List<T> [element] : A |
+| CollectionFlow.cs:375:34:375:40 | element : A | semmle.label | element : A |
+| CollectionFlow.cs:375:46:375:49 | [post] access to parameter list : List<T> [element] : A | semmle.label | [post] access to parameter list : List<T> [element] : A |
+| CollectionFlow.cs:375:55:375:61 | access to parameter element : A | semmle.label | access to parameter element : A |
+| CollectionFlow.cs:379:13:379:13 | access to local variable a : A | semmle.label | access to local variable a : A |
+| CollectionFlow.cs:379:17:379:23 | object creation of type A : A | semmle.label | object creation of type A : A |
+| CollectionFlow.cs:381:17:381:20 | [post] access to local variable list : List<T> [element] : A | semmle.label | [post] access to local variable list : List<T> [element] : A |
+| CollectionFlow.cs:381:23:381:23 | access to local variable a : A | semmle.label | access to local variable a : A |
+| CollectionFlow.cs:382:14:382:17 | access to local variable list : List<T> [element] : A | semmle.label | access to local variable list : List<T> [element] : A |
+| CollectionFlow.cs:382:14:382:20 | access to indexer | semmle.label | access to indexer |
+| CollectionFlow.cs:383:22:383:25 | access to local variable list : List<T> [element] : A | semmle.label | access to local variable list : List<T> [element] : A |
+| CollectionFlow.cs:384:14:384:28 | call to method ListFirst<A> | semmle.label | call to method ListFirst<A> |
+| CollectionFlow.cs:384:24:384:27 | access to local variable list : List<T> [element] : A | semmle.label | access to local variable list : List<T> [element] : A |
+| CollectionFlow.cs:398:20:398:26 | object creation of type A : A | semmle.label | object creation of type A : A |
+| CollectionFlow.cs:399:26:399:32 | object creation of type A : A | semmle.label | object creation of type A : A |
+| CollectionFlow.cs:400:26:400:32 | object creation of type A : A | semmle.label | object creation of type A : A |
+| CollectionFlow.cs:401:20:401:38 | array creation of type A[] : null [element] : A | semmle.label | array creation of type A[] : null [element] : A |
+| CollectionFlow.cs:401:28:401:38 | { ..., ... } : null [element] : A | semmle.label | { ..., ... } : null [element] : A |
+| CollectionFlow.cs:401:30:401:36 | object creation of type A : A | semmle.label | object creation of type A : A |
+| CollectionFlow.cs:414:30:414:36 | object creation of type A : A | semmle.label | object creation of type A : A |
+| CollectionFlow.cs:415:36:415:42 | object creation of type A : A | semmle.label | object creation of type A : A |
+| CollectionFlow.cs:416:36:416:42 | object creation of type A : A | semmle.label | object creation of type A : A |
+| CollectionFlow.cs:417:30:417:38 | [...] : IEnumerable<A> [element] : A | semmle.label | [...] : IEnumerable<A> [element] : A |
+| CollectionFlow.cs:417:31:417:37 | object creation of type A : A | semmle.label | object creation of type A : A |
+| CollectionFlow.cs:439:13:439:13 | access to local variable a : A | semmle.label | access to local variable a : A |
+| CollectionFlow.cs:439:17:439:23 | object creation of type A : A | semmle.label | object creation of type A : A |
+| CollectionFlow.cs:441:9:441:13 | [post] access to local variable array : MyInlineArray [element] : A | semmle.label | [post] access to local variable array : MyInlineArray [element] : A |
+| CollectionFlow.cs:441:20:441:20 | access to local variable a : A | semmle.label | access to local variable a : A |
+| CollectionFlow.cs:442:14:442:18 | access to local variable array : MyInlineArray [element] : A | semmle.label | access to local variable array : MyInlineArray [element] : A |
+| CollectionFlow.cs:442:14:442:21 | access to array element | semmle.label | access to array element |
+| CollectionFlow.cs:460:13:460:13 | access to local variable a : A | semmle.label | access to local variable a : A |
+| CollectionFlow.cs:460:17:460:23 | object creation of type A : A | semmle.label | object creation of type A : A |
+| CollectionFlow.cs:461:13:461:17 | access to local variable array : A[] [element] : A | semmle.label | access to local variable array : A[] [element] : A |
+| CollectionFlow.cs:461:21:461:23 | [...] : A[] [element] : A | semmle.label | [...] : A[] [element] : A |
+| CollectionFlow.cs:461:22:461:22 | access to local variable a : A | semmle.label | access to local variable a : A |
+| CollectionFlow.cs:462:14:462:18 | access to local variable array : A[] [element] : A | semmle.label | access to local variable array : A[] [element] : A |
+| CollectionFlow.cs:462:14:462:21 | access to array element | semmle.label | access to array element |
+| CollectionFlow.cs:467:13:467:13 | access to local variable a : A | semmle.label | access to local variable a : A |
+| CollectionFlow.cs:467:17:467:23 | object creation of type A : A | semmle.label | object creation of type A : A |
+| CollectionFlow.cs:468:17:468:17 | access to local variable l : List<A> [element] : A | semmle.label | access to local variable l : List<A> [element] : A |
+| CollectionFlow.cs:468:21:468:23 | [...] : List<A> [element] : A | semmle.label | [...] : List<A> [element] : A |
+| CollectionFlow.cs:468:22:468:22 | access to local variable a : A | semmle.label | access to local variable a : A |
+| CollectionFlow.cs:469:14:469:14 | access to local variable l : List<A> [element] : A | semmle.label | access to local variable l : List<A> [element] : A |
+| CollectionFlow.cs:469:14:469:17 | access to indexer | semmle.label | access to indexer |
+| CollectionFlow.cs:480:13:480:13 | access to local variable a : A | semmle.label | access to local variable a : A |
+| CollectionFlow.cs:480:17:480:23 | object creation of type A : A | semmle.label | object creation of type A : A |
+| CollectionFlow.cs:481:13:481:16 | access to local variable temp : A[] [element] : A | semmle.label | access to local variable temp : A[] [element] : A |
+| CollectionFlow.cs:481:20:481:22 | [...] : A[] [element] : A | semmle.label | [...] : A[] [element] : A |
+| CollectionFlow.cs:481:21:481:21 | access to local variable a : A | semmle.label | access to local variable a : A |
+| CollectionFlow.cs:482:13:482:17 | access to local variable array : A[] [element] : A | semmle.label | access to local variable array : A[] [element] : A |
+| CollectionFlow.cs:482:22:482:28 | .. access to local variable temp : A[] [element] : A | semmle.label | .. access to local variable temp : A[] [element] : A |
+| CollectionFlow.cs:483:14:483:18 | access to local variable array : A[] [element] : A | semmle.label | access to local variable array : A[] [element] : A |
+| CollectionFlow.cs:483:14:483:21 | access to array element | semmle.label | access to array element |
+| CollectionFlow.cs:520:13:520:13 | access to local variable a : A | semmle.label | access to local variable a : A |
+| CollectionFlow.cs:520:17:520:23 | object creation of type A : A | semmle.label | object creation of type A : A |
+| CollectionFlow.cs:521:17:521:20 | access to local variable span : Span<T> [element] : A | semmle.label | access to local variable span : Span<T> [element] : A |
+| CollectionFlow.cs:521:24:521:41 | object creation of type Span<A> : Span<T> [element] : A | semmle.label | object creation of type Span<A> : Span<T> [element] : A |
+| CollectionFlow.cs:521:40:521:40 | access to local variable a : A | semmle.label | access to local variable a : A |
+| CollectionFlow.cs:522:14:522:17 | access to local variable span : Span<T> [element] : A | semmle.label | access to local variable span : Span<T> [element] : A |
+| CollectionFlow.cs:522:14:522:20 | access to indexer | semmle.label | access to indexer |
+| CollectionFlow.cs:527:13:527:13 | access to local variable a : A | semmle.label | access to local variable a : A |
+| CollectionFlow.cs:527:17:527:23 | object creation of type A : A | semmle.label | object creation of type A : A |
+| CollectionFlow.cs:528:17:528:20 | access to local variable span : Span<T> [element] : A | semmle.label | access to local variable span : Span<T> [element] : A |
+| CollectionFlow.cs:528:24:528:41 | object creation of type Span<A> : Span<T> [element] : A | semmle.label | object creation of type Span<A> : Span<T> [element] : A |
+| CollectionFlow.cs:528:40:528:40 | access to local variable a : A | semmle.label | access to local variable a : A |
+| CollectionFlow.cs:529:13:529:15 | access to local variable arr : T[] [element] : A | semmle.label | access to local variable arr : T[] [element] : A |
+| CollectionFlow.cs:529:19:529:22 | access to local variable span : Span<T> [element] : A | semmle.label | access to local variable span : Span<T> [element] : A |
+| CollectionFlow.cs:529:19:529:32 | call to method ToArray : T[] [element] : A | semmle.label | call to method ToArray : T[] [element] : A |
+| CollectionFlow.cs:530:14:530:16 | access to local variable arr : T[] [element] : A | semmle.label | access to local variable arr : T[] [element] : A |
+| CollectionFlow.cs:530:14:530:19 | access to array element | semmle.label | access to array element |
+| CollectionFlow.cs:535:13:535:13 | access to local variable a : A | semmle.label | access to local variable a : A |
+| CollectionFlow.cs:535:17:535:23 | object creation of type A : A | semmle.label | object creation of type A : A |
+| CollectionFlow.cs:536:9:536:14 | [post] access to parameter target : Span<T> [element] : A | semmle.label | [post] access to parameter target : Span<T> [element] : A |
+| CollectionFlow.cs:536:21:536:21 | access to local variable a : A | semmle.label | access to local variable a : A |
+| CollectionFlow.cs:537:14:537:19 | access to parameter target : Span<T> [element] : A | semmle.label | access to parameter target : Span<T> [element] : A |
+| CollectionFlow.cs:537:14:537:22 | access to indexer | semmle.label | access to indexer |
+| CollectionFlow.cs:542:13:542:18 | access to local variable source : Span<T> [element] : A | semmle.label | access to local variable source : Span<T> [element] : A |
+| CollectionFlow.cs:542:22:542:51 | object creation of type Span<A> : Span<T> [element] : A | semmle.label | object creation of type Span<A> : Span<T> [element] : A |
+| CollectionFlow.cs:542:34:542:50 | array creation of type A[] : null [element] : A | semmle.label | array creation of type A[] : null [element] : A |
+| CollectionFlow.cs:542:40:542:50 | { ..., ... } : null [element] : A | semmle.label | { ..., ... } : null [element] : A |
+| CollectionFlow.cs:542:42:542:48 | object creation of type A : A | semmle.label | object creation of type A : A |
+| CollectionFlow.cs:543:9:543:14 | access to local variable source : Span<T> [element] : A | semmle.label | access to local variable source : Span<T> [element] : A |
+| CollectionFlow.cs:543:23:543:28 | [post] access to parameter target : Span<T> [element] : A | semmle.label | [post] access to parameter target : Span<T> [element] : A |
+| CollectionFlow.cs:544:14:544:19 | access to parameter target : Span<T> [element] : A | semmle.label | access to parameter target : Span<T> [element] : A |
+| CollectionFlow.cs:544:14:544:22 | access to indexer | semmle.label | access to indexer |
+| CollectionFlow.cs:549:13:549:13 | access to local variable a : A | semmle.label | access to local variable a : A |
+| CollectionFlow.cs:549:17:549:23 | object creation of type A : A | semmle.label | object creation of type A : A |
+| CollectionFlow.cs:550:25:550:28 | access to local variable span : ReadOnlySpan<T> [element] : A | semmle.label | access to local variable span : ReadOnlySpan<T> [element] : A |
+| CollectionFlow.cs:550:32:550:63 | object creation of type ReadOnlySpan<A> : ReadOnlySpan<T> [element] : A | semmle.label | object creation of type ReadOnlySpan<A> : ReadOnlySpan<T> [element] : A |
+| CollectionFlow.cs:550:52:550:62 | array creation of type A[] : null [element] : A | semmle.label | array creation of type A[] : null [element] : A |
+| CollectionFlow.cs:550:58:550:62 | { ..., ... } : null [element] : A | semmle.label | { ..., ... } : null [element] : A |
+| CollectionFlow.cs:550:60:550:60 | access to local variable a : A | semmle.label | access to local variable a : A |
+| CollectionFlow.cs:551:14:551:17 | access to local variable span : ReadOnlySpan<T> [element] : A | semmle.label | access to local variable span : ReadOnlySpan<T> [element] : A |
+| CollectionFlow.cs:551:14:551:20 | access to indexer | semmle.label | access to indexer |
+subpaths
+| CollectionFlow.cs:50:20:50:22 | access to local variable as : null [element] : A | CollectionFlow.cs:24:34:24:35 | ts : null [element] : A | CollectionFlow.cs:24:41:24:45 | access to array element : A | CollectionFlow.cs:50:14:50:23 | call to method First<A> |
+| CollectionFlow.cs:68:20:68:23 | access to field As : A[] [element] : A | CollectionFlow.cs:24:34:24:35 | ts : A[] [element] : A | CollectionFlow.cs:24:41:24:45 | access to array element : A | CollectionFlow.cs:68:14:68:24 | call to method First<A> |
+| CollectionFlow.cs:86:19:86:22 | access to field As : A[] [element] : A | CollectionFlow.cs:26:33:26:34 | ts : A[] [element] : A | CollectionFlow.cs:26:40:26:45 | access to array element : A | CollectionFlow.cs:86:14:86:23 | call to method Last<A> |
+| CollectionFlow.cs:96:20:96:22 | access to local variable as : A[] [element] : A | CollectionFlow.cs:24:34:24:35 | ts : A[] [element] : A | CollectionFlow.cs:24:41:24:45 | access to array element : A | CollectionFlow.cs:96:14:96:23 | call to method First<A> |
+| CollectionFlow.cs:116:19:116:21 | access to local variable as : A[] [element] : A | CollectionFlow.cs:26:33:26:34 | ts : A[] [element] : A | CollectionFlow.cs:26:40:26:45 | access to array element : A | CollectionFlow.cs:116:14:116:22 | call to method Last<A> |
+| CollectionFlow.cs:126:24:126:27 | access to local variable list : List<T> [element] : A | CollectionFlow.cs:28:43:28:46 | list : List<T> [element] : A | CollectionFlow.cs:28:52:28:58 | access to indexer : A | CollectionFlow.cs:126:14:126:28 | call to method ListFirst<A> |
+| CollectionFlow.cs:144:24:144:27 | access to local variable list : List<T> [element] : A | CollectionFlow.cs:28:43:28:46 | list : List<T> [element] : A | CollectionFlow.cs:28:52:28:58 | access to indexer : A | CollectionFlow.cs:144:14:144:28 | call to method ListFirst<A> |
+| CollectionFlow.cs:162:24:162:27 | access to local variable list : List<T> [element] : A | CollectionFlow.cs:28:43:28:46 | list : List<T> [element] : A | CollectionFlow.cs:28:52:28:58 | access to indexer : A | CollectionFlow.cs:162:14:162:28 | call to method ListFirst<A> |
+| CollectionFlow.cs:181:28:181:31 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:30:58:30:61 | dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:30:67:30:73 | access to indexer : A | CollectionFlow.cs:181:14:181:32 | call to method DictIndexZero<A> |
+| CollectionFlow.cs:182:29:182:32 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:32:59:32:62 | dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:32:68:32:85 | access to property Value : A | CollectionFlow.cs:182:14:182:33 | call to method DictFirstValue<A> |
+| CollectionFlow.cs:183:30:183:33 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:34:60:34:63 | dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:34:69:34:87 | call to method First<T> : A | CollectionFlow.cs:183:14:183:34 | call to method DictValuesFirst<A> |
+| CollectionFlow.cs:203:28:203:31 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:30:58:30:61 | dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:30:67:30:73 | access to indexer : A | CollectionFlow.cs:203:14:203:32 | call to method DictIndexZero<A> |
+| CollectionFlow.cs:204:29:204:32 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:32:59:32:62 | dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:32:68:32:85 | access to property Value : A | CollectionFlow.cs:204:14:204:33 | call to method DictFirstValue<A> |
+| CollectionFlow.cs:205:30:205:33 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:34:60:34:63 | dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:34:69:34:87 | call to method First<T> : A | CollectionFlow.cs:205:14:205:34 | call to method DictValuesFirst<A> |
+| CollectionFlow.cs:224:28:224:31 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:30:58:30:61 | dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:30:67:30:73 | access to indexer : A | CollectionFlow.cs:224:14:224:32 | call to method DictIndexZero<A> |
+| CollectionFlow.cs:225:29:225:32 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:32:59:32:62 | dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:32:68:32:85 | access to property Value : A | CollectionFlow.cs:225:14:225:33 | call to method DictFirstValue<A> |
+| CollectionFlow.cs:226:30:226:33 | access to local variable dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:34:60:34:63 | dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:34:69:34:87 | call to method First<T> : A | CollectionFlow.cs:226:14:226:34 | call to method DictValuesFirst<A> |
+| CollectionFlow.cs:246:28:246:31 | access to local variable dict : Dictionary<T,T> [element, property Key] : A | CollectionFlow.cs:36:58:36:61 | dict : Dictionary<T,T> [element, property Key] : A | CollectionFlow.cs:36:67:36:83 | call to method First<T> : A | CollectionFlow.cs:246:14:246:32 | call to method DictKeysFirst<A> |
+| CollectionFlow.cs:247:27:247:30 | access to local variable dict : Dictionary<T,T> [element, property Key] : A | CollectionFlow.cs:38:57:38:60 | dict : Dictionary<T,T> [element, property Key] : A | CollectionFlow.cs:38:66:38:81 | access to property Key : A | CollectionFlow.cs:247:14:247:31 | call to method DictFirstKey<A> |
+| CollectionFlow.cs:265:28:265:31 | access to local variable dict : Dictionary<T,T> [element, property Key] : A | CollectionFlow.cs:36:58:36:61 | dict : Dictionary<T,T> [element, property Key] : A | CollectionFlow.cs:36:67:36:83 | call to method First<T> : A | CollectionFlow.cs:265:14:265:32 | call to method DictKeysFirst<A> |
+| CollectionFlow.cs:266:27:266:30 | access to local variable dict : Dictionary<T,T> [element, property Key] : A | CollectionFlow.cs:38:57:38:60 | dict : Dictionary<T,T> [element, property Key] : A | CollectionFlow.cs:38:66:38:81 | access to property Key : A | CollectionFlow.cs:266:14:266:31 | call to method DictFirstKey<A> |
+| CollectionFlow.cs:359:23:359:23 | access to local variable a : A | CollectionFlow.cs:353:32:353:38 | element : A | CollectionFlow.cs:353:23:353:27 | array [Return] : A[] [element] : A | CollectionFlow.cs:359:18:359:20 | [post] access to local variable as : A[] [element] : A |
+| CollectionFlow.cs:362:20:362:22 | access to local variable as : A[] [element] : A | CollectionFlow.cs:24:34:24:35 | ts : A[] [element] : A | CollectionFlow.cs:24:41:24:45 | access to array element : A | CollectionFlow.cs:362:14:362:23 | call to method First<A> |
+| CollectionFlow.cs:381:23:381:23 | access to local variable a : A | CollectionFlow.cs:375:34:375:40 | element : A | CollectionFlow.cs:375:26:375:29 | list [Return] : List<T> [element] : A | CollectionFlow.cs:381:17:381:20 | [post] access to local variable list : List<T> [element] : A |
+| CollectionFlow.cs:384:24:384:27 | access to local variable list : List<T> [element] : A | CollectionFlow.cs:28:43:28:46 | list : List<T> [element] : A | CollectionFlow.cs:28:52:28:58 | access to indexer : A | CollectionFlow.cs:384:14:384:28 | call to method ListFirst<A> |
+#select
+| CollectionFlow.cs:46:17:46:23 | object creation of type A : A | CollectionFlow.cs:46:17:46:23 | object creation of type A : A | CollectionFlow.cs:14:52:14:56 | access to array element | $@ | CollectionFlow.cs:14:52:14:56 | access to array element | access to array element |
+| CollectionFlow.cs:46:17:46:23 | object creation of type A : A | CollectionFlow.cs:46:17:46:23 | object creation of type A : A | CollectionFlow.cs:48:14:48:19 | access to array element | $@ | CollectionFlow.cs:48:14:48:19 | access to array element | access to array element |
+| CollectionFlow.cs:46:17:46:23 | object creation of type A : A | CollectionFlow.cs:46:17:46:23 | object creation of type A : A | CollectionFlow.cs:50:14:50:23 | call to method First<A> | $@ | CollectionFlow.cs:50:14:50:23 | call to method First<A> | call to method First<A> |
+| CollectionFlow.cs:64:17:64:23 | object creation of type A : A | CollectionFlow.cs:64:17:64:23 | object creation of type A : A | CollectionFlow.cs:14:52:14:56 | access to array element | $@ | CollectionFlow.cs:14:52:14:56 | access to array element | access to array element |
+| CollectionFlow.cs:64:17:64:23 | object creation of type A : A | CollectionFlow.cs:64:17:64:23 | object creation of type A : A | CollectionFlow.cs:66:14:66:20 | access to array element | $@ | CollectionFlow.cs:66:14:66:20 | access to array element | access to array element |
+| CollectionFlow.cs:64:17:64:23 | object creation of type A : A | CollectionFlow.cs:64:17:64:23 | object creation of type A : A | CollectionFlow.cs:68:14:68:24 | call to method First<A> | $@ | CollectionFlow.cs:68:14:68:24 | call to method First<A> | call to method First<A> |
+| CollectionFlow.cs:82:17:82:23 | object creation of type A : A | CollectionFlow.cs:82:17:82:23 | object creation of type A : A | CollectionFlow.cs:16:56:16:61 | access to array element | $@ | CollectionFlow.cs:16:56:16:61 | access to array element | access to array element |
+| CollectionFlow.cs:82:17:82:23 | object creation of type A : A | CollectionFlow.cs:82:17:82:23 | object creation of type A : A | CollectionFlow.cs:84:14:84:21 | access to array element | $@ | CollectionFlow.cs:84:14:84:21 | access to array element | access to array element |
+| CollectionFlow.cs:82:17:82:23 | object creation of type A : A | CollectionFlow.cs:82:17:82:23 | object creation of type A : A | CollectionFlow.cs:86:14:86:23 | call to method Last<A> | $@ | CollectionFlow.cs:86:14:86:23 | call to method Last<A> | call to method Last<A> |
+| CollectionFlow.cs:91:17:91:23 | object creation of type A : A | CollectionFlow.cs:91:17:91:23 | object creation of type A : A | CollectionFlow.cs:14:52:14:56 | access to array element | $@ | CollectionFlow.cs:14:52:14:56 | access to array element | access to array element |
+| CollectionFlow.cs:91:17:91:23 | object creation of type A : A | CollectionFlow.cs:91:17:91:23 | object creation of type A : A | CollectionFlow.cs:94:14:94:19 | access to array element | $@ | CollectionFlow.cs:94:14:94:19 | access to array element | access to array element |
+| CollectionFlow.cs:91:17:91:23 | object creation of type A : A | CollectionFlow.cs:91:17:91:23 | object creation of type A : A | CollectionFlow.cs:96:14:96:23 | call to method First<A> | $@ | CollectionFlow.cs:96:14:96:23 | call to method First<A> | call to method First<A> |
+| CollectionFlow.cs:111:17:111:23 | object creation of type A : A | CollectionFlow.cs:111:17:111:23 | object creation of type A : A | CollectionFlow.cs:16:56:16:61 | access to array element | $@ | CollectionFlow.cs:16:56:16:61 | access to array element | access to array element |
+| CollectionFlow.cs:111:17:111:23 | object creation of type A : A | CollectionFlow.cs:111:17:111:23 | object creation of type A : A | CollectionFlow.cs:114:14:114:20 | access to array element | $@ | CollectionFlow.cs:114:14:114:20 | access to array element | access to array element |
+| CollectionFlow.cs:111:17:111:23 | object creation of type A : A | CollectionFlow.cs:111:17:111:23 | object creation of type A : A | CollectionFlow.cs:116:14:116:22 | call to method Last<A> | $@ | CollectionFlow.cs:116:14:116:22 | call to method Last<A> | call to method Last<A> |
+| CollectionFlow.cs:121:17:121:23 | object creation of type A : A | CollectionFlow.cs:121:17:121:23 | object creation of type A : A | CollectionFlow.cs:18:63:18:69 | access to indexer | $@ | CollectionFlow.cs:18:63:18:69 | access to indexer | access to indexer |
+| CollectionFlow.cs:121:17:121:23 | object creation of type A : A | CollectionFlow.cs:121:17:121:23 | object creation of type A : A | CollectionFlow.cs:124:14:124:20 | access to indexer | $@ | CollectionFlow.cs:124:14:124:20 | access to indexer | access to indexer |
+| CollectionFlow.cs:121:17:121:23 | object creation of type A : A | CollectionFlow.cs:121:17:121:23 | object creation of type A : A | CollectionFlow.cs:126:14:126:28 | call to method ListFirst<A> | $@ | CollectionFlow.cs:126:14:126:28 | call to method ListFirst<A> | call to method ListFirst<A> |
+| CollectionFlow.cs:140:17:140:23 | object creation of type A : A | CollectionFlow.cs:140:17:140:23 | object creation of type A : A | CollectionFlow.cs:18:63:18:69 | access to indexer | $@ | CollectionFlow.cs:18:63:18:69 | access to indexer | access to indexer |
+| CollectionFlow.cs:140:17:140:23 | object creation of type A : A | CollectionFlow.cs:140:17:140:23 | object creation of type A : A | CollectionFlow.cs:142:14:142:20 | access to indexer | $@ | CollectionFlow.cs:142:14:142:20 | access to indexer | access to indexer |
+| CollectionFlow.cs:140:17:140:23 | object creation of type A : A | CollectionFlow.cs:140:17:140:23 | object creation of type A : A | CollectionFlow.cs:144:14:144:28 | call to method ListFirst<A> | $@ | CollectionFlow.cs:144:14:144:28 | call to method ListFirst<A> | call to method ListFirst<A> |
+| CollectionFlow.cs:157:17:157:23 | object creation of type A : A | CollectionFlow.cs:157:17:157:23 | object creation of type A : A | CollectionFlow.cs:18:63:18:69 | access to indexer | $@ | CollectionFlow.cs:18:63:18:69 | access to indexer | access to indexer |
+| CollectionFlow.cs:157:17:157:23 | object creation of type A : A | CollectionFlow.cs:157:17:157:23 | object creation of type A : A | CollectionFlow.cs:160:14:160:20 | access to indexer | $@ | CollectionFlow.cs:160:14:160:20 | access to indexer | access to indexer |
+| CollectionFlow.cs:157:17:157:23 | object creation of type A : A | CollectionFlow.cs:157:17:157:23 | object creation of type A : A | CollectionFlow.cs:162:14:162:28 | call to method ListFirst<A> | $@ | CollectionFlow.cs:162:14:162:28 | call to method ListFirst<A> | call to method ListFirst<A> |
+| CollectionFlow.cs:176:17:176:23 | object creation of type A : A | CollectionFlow.cs:176:17:176:23 | object creation of type A : A | CollectionFlow.cs:20:75:20:81 | access to indexer | $@ | CollectionFlow.cs:20:75:20:81 | access to indexer | access to indexer |
+| CollectionFlow.cs:176:17:176:23 | object creation of type A : A | CollectionFlow.cs:176:17:176:23 | object creation of type A : A | CollectionFlow.cs:179:14:179:20 | access to indexer | $@ | CollectionFlow.cs:179:14:179:20 | access to indexer | access to indexer |
+| CollectionFlow.cs:176:17:176:23 | object creation of type A : A | CollectionFlow.cs:176:17:176:23 | object creation of type A : A | CollectionFlow.cs:181:14:181:32 | call to method DictIndexZero<A> | $@ | CollectionFlow.cs:181:14:181:32 | call to method DictIndexZero<A> | call to method DictIndexZero<A> |
+| CollectionFlow.cs:176:17:176:23 | object creation of type A : A | CollectionFlow.cs:176:17:176:23 | object creation of type A : A | CollectionFlow.cs:182:14:182:33 | call to method DictFirstValue<A> | $@ | CollectionFlow.cs:182:14:182:33 | call to method DictFirstValue<A> | call to method DictFirstValue<A> |
+| CollectionFlow.cs:176:17:176:23 | object creation of type A : A | CollectionFlow.cs:176:17:176:23 | object creation of type A : A | CollectionFlow.cs:183:14:183:34 | call to method DictValuesFirst<A> | $@ | CollectionFlow.cs:183:14:183:34 | call to method DictValuesFirst<A> | call to method DictValuesFirst<A> |
+| CollectionFlow.cs:199:17:199:23 | object creation of type A : A | CollectionFlow.cs:199:17:199:23 | object creation of type A : A | CollectionFlow.cs:20:75:20:81 | access to indexer | $@ | CollectionFlow.cs:20:75:20:81 | access to indexer | access to indexer |
+| CollectionFlow.cs:199:17:199:23 | object creation of type A : A | CollectionFlow.cs:199:17:199:23 | object creation of type A : A | CollectionFlow.cs:201:14:201:20 | access to indexer | $@ | CollectionFlow.cs:201:14:201:20 | access to indexer | access to indexer |
+| CollectionFlow.cs:199:17:199:23 | object creation of type A : A | CollectionFlow.cs:199:17:199:23 | object creation of type A : A | CollectionFlow.cs:203:14:203:32 | call to method DictIndexZero<A> | $@ | CollectionFlow.cs:203:14:203:32 | call to method DictIndexZero<A> | call to method DictIndexZero<A> |
+| CollectionFlow.cs:199:17:199:23 | object creation of type A : A | CollectionFlow.cs:199:17:199:23 | object creation of type A : A | CollectionFlow.cs:204:14:204:33 | call to method DictFirstValue<A> | $@ | CollectionFlow.cs:204:14:204:33 | call to method DictFirstValue<A> | call to method DictFirstValue<A> |
+| CollectionFlow.cs:199:17:199:23 | object creation of type A : A | CollectionFlow.cs:199:17:199:23 | object creation of type A : A | CollectionFlow.cs:205:14:205:34 | call to method DictValuesFirst<A> | $@ | CollectionFlow.cs:205:14:205:34 | call to method DictValuesFirst<A> | call to method DictValuesFirst<A> |
+| CollectionFlow.cs:220:17:220:23 | object creation of type A : A | CollectionFlow.cs:220:17:220:23 | object creation of type A : A | CollectionFlow.cs:20:75:20:81 | access to indexer | $@ | CollectionFlow.cs:20:75:20:81 | access to indexer | access to indexer |
+| CollectionFlow.cs:220:17:220:23 | object creation of type A : A | CollectionFlow.cs:220:17:220:23 | object creation of type A : A | CollectionFlow.cs:222:14:222:20 | access to indexer | $@ | CollectionFlow.cs:222:14:222:20 | access to indexer | access to indexer |
+| CollectionFlow.cs:220:17:220:23 | object creation of type A : A | CollectionFlow.cs:220:17:220:23 | object creation of type A : A | CollectionFlow.cs:224:14:224:32 | call to method DictIndexZero<A> | $@ | CollectionFlow.cs:224:14:224:32 | call to method DictIndexZero<A> | call to method DictIndexZero<A> |
+| CollectionFlow.cs:220:17:220:23 | object creation of type A : A | CollectionFlow.cs:220:17:220:23 | object creation of type A : A | CollectionFlow.cs:225:14:225:33 | call to method DictFirstValue<A> | $@ | CollectionFlow.cs:225:14:225:33 | call to method DictFirstValue<A> | call to method DictFirstValue<A> |
+| CollectionFlow.cs:220:17:220:23 | object creation of type A : A | CollectionFlow.cs:220:17:220:23 | object creation of type A : A | CollectionFlow.cs:226:14:226:34 | call to method DictValuesFirst<A> | $@ | CollectionFlow.cs:226:14:226:34 | call to method DictValuesFirst<A> | call to method DictValuesFirst<A> |
+| CollectionFlow.cs:242:17:242:23 | object creation of type A : A | CollectionFlow.cs:242:17:242:23 | object creation of type A : A | CollectionFlow.cs:22:73:22:89 | call to method First<T> | $@ | CollectionFlow.cs:22:73:22:89 | call to method First<T> | call to method First<T> |
+| CollectionFlow.cs:242:17:242:23 | object creation of type A : A | CollectionFlow.cs:242:17:242:23 | object creation of type A : A | CollectionFlow.cs:244:14:244:30 | call to method First<A> | $@ | CollectionFlow.cs:244:14:244:30 | call to method First<A> | call to method First<A> |
+| CollectionFlow.cs:242:17:242:23 | object creation of type A : A | CollectionFlow.cs:242:17:242:23 | object creation of type A : A | CollectionFlow.cs:246:14:246:32 | call to method DictKeysFirst<A> | $@ | CollectionFlow.cs:246:14:246:32 | call to method DictKeysFirst<A> | call to method DictKeysFirst<A> |
+| CollectionFlow.cs:242:17:242:23 | object creation of type A : A | CollectionFlow.cs:242:17:242:23 | object creation of type A : A | CollectionFlow.cs:247:14:247:31 | call to method DictFirstKey<A> | $@ | CollectionFlow.cs:247:14:247:31 | call to method DictFirstKey<A> | call to method DictFirstKey<A> |
+| CollectionFlow.cs:261:17:261:23 | object creation of type A : A | CollectionFlow.cs:261:17:261:23 | object creation of type A : A | CollectionFlow.cs:22:73:22:89 | call to method First<T> | $@ | CollectionFlow.cs:22:73:22:89 | call to method First<T> | call to method First<T> |
+| CollectionFlow.cs:261:17:261:23 | object creation of type A : A | CollectionFlow.cs:261:17:261:23 | object creation of type A : A | CollectionFlow.cs:263:14:263:30 | call to method First<A> | $@ | CollectionFlow.cs:263:14:263:30 | call to method First<A> | call to method First<A> |
+| CollectionFlow.cs:261:17:261:23 | object creation of type A : A | CollectionFlow.cs:261:17:261:23 | object creation of type A : A | CollectionFlow.cs:265:14:265:32 | call to method DictKeysFirst<A> | $@ | CollectionFlow.cs:265:14:265:32 | call to method DictKeysFirst<A> | call to method DictKeysFirst<A> |
+| CollectionFlow.cs:261:17:261:23 | object creation of type A : A | CollectionFlow.cs:261:17:261:23 | object creation of type A : A | CollectionFlow.cs:266:14:266:31 | call to method DictFirstKey<A> | $@ | CollectionFlow.cs:266:14:266:31 | call to method DictFirstKey<A> | call to method DictFirstKey<A> |
+| CollectionFlow.cs:280:17:280:23 | object creation of type A : A | CollectionFlow.cs:280:17:280:23 | object creation of type A : A | CollectionFlow.cs:283:18:283:18 | access to local variable x | $@ | CollectionFlow.cs:283:18:283:18 | access to local variable x | access to local variable x |
+| CollectionFlow.cs:295:17:295:23 | object creation of type A : A | CollectionFlow.cs:295:17:295:23 | object creation of type A : A | CollectionFlow.cs:299:18:299:35 | access to property Current | $@ | CollectionFlow.cs:299:18:299:35 | access to property Current | access to property Current |
+| CollectionFlow.cs:312:17:312:23 | object creation of type A : A | CollectionFlow.cs:312:17:312:23 | object creation of type A : A | CollectionFlow.cs:317:18:317:35 | access to property Current | $@ | CollectionFlow.cs:317:18:317:35 | access to property Current | access to property Current |
+| CollectionFlow.cs:331:17:331:23 | object creation of type A : A | CollectionFlow.cs:331:17:331:23 | object creation of type A : A | CollectionFlow.cs:336:18:336:24 | access to property Key | $@ | CollectionFlow.cs:336:18:336:24 | access to property Key | access to property Key |
+| CollectionFlow.cs:357:17:357:23 | object creation of type A : A | CollectionFlow.cs:357:17:357:23 | object creation of type A : A | CollectionFlow.cs:14:52:14:56 | access to array element | $@ | CollectionFlow.cs:14:52:14:56 | access to array element | access to array element |
+| CollectionFlow.cs:357:17:357:23 | object creation of type A : A | CollectionFlow.cs:357:17:357:23 | object creation of type A : A | CollectionFlow.cs:360:14:360:19 | access to array element | $@ | CollectionFlow.cs:360:14:360:19 | access to array element | access to array element |
+| CollectionFlow.cs:357:17:357:23 | object creation of type A : A | CollectionFlow.cs:357:17:357:23 | object creation of type A : A | CollectionFlow.cs:362:14:362:23 | call to method First<A> | $@ | CollectionFlow.cs:362:14:362:23 | call to method First<A> | call to method First<A> |
+| CollectionFlow.cs:379:17:379:23 | object creation of type A : A | CollectionFlow.cs:379:17:379:23 | object creation of type A : A | CollectionFlow.cs:18:63:18:69 | access to indexer | $@ | CollectionFlow.cs:18:63:18:69 | access to indexer | access to indexer |
+| CollectionFlow.cs:379:17:379:23 | object creation of type A : A | CollectionFlow.cs:379:17:379:23 | object creation of type A : A | CollectionFlow.cs:382:14:382:20 | access to indexer | $@ | CollectionFlow.cs:382:14:382:20 | access to indexer | access to indexer |
+| CollectionFlow.cs:379:17:379:23 | object creation of type A : A | CollectionFlow.cs:379:17:379:23 | object creation of type A : A | CollectionFlow.cs:384:14:384:28 | call to method ListFirst<A> | $@ | CollectionFlow.cs:384:14:384:28 | call to method ListFirst<A> | call to method ListFirst<A> |
+| CollectionFlow.cs:398:20:398:26 | object creation of type A : A | CollectionFlow.cs:398:20:398:26 | object creation of type A : A | CollectionFlow.cs:40:63:40:69 | access to array element | $@ | CollectionFlow.cs:40:63:40:69 | access to array element | access to array element |
+| CollectionFlow.cs:399:26:399:32 | object creation of type A : A | CollectionFlow.cs:399:26:399:32 | object creation of type A : A | CollectionFlow.cs:40:63:40:69 | access to array element | $@ | CollectionFlow.cs:40:63:40:69 | access to array element | access to array element |
+| CollectionFlow.cs:400:26:400:32 | object creation of type A : A | CollectionFlow.cs:400:26:400:32 | object creation of type A : A | CollectionFlow.cs:40:63:40:69 | access to array element | $@ | CollectionFlow.cs:40:63:40:69 | access to array element | access to array element |
+| CollectionFlow.cs:401:30:401:36 | object creation of type A : A | CollectionFlow.cs:401:30:401:36 | object creation of type A : A | CollectionFlow.cs:40:63:40:69 | access to array element | $@ | CollectionFlow.cs:40:63:40:69 | access to array element | access to array element |
+| CollectionFlow.cs:414:30:414:36 | object creation of type A : A | CollectionFlow.cs:414:30:414:36 | object creation of type A : A | CollectionFlow.cs:42:84:42:95 | call to method First<T> | $@ | CollectionFlow.cs:42:84:42:95 | call to method First<T> | call to method First<T> |
+| CollectionFlow.cs:415:36:415:42 | object creation of type A : A | CollectionFlow.cs:415:36:415:42 | object creation of type A : A | CollectionFlow.cs:42:84:42:95 | call to method First<T> | $@ | CollectionFlow.cs:42:84:42:95 | call to method First<T> | call to method First<T> |
+| CollectionFlow.cs:416:36:416:42 | object creation of type A : A | CollectionFlow.cs:416:36:416:42 | object creation of type A : A | CollectionFlow.cs:42:84:42:95 | call to method First<T> | $@ | CollectionFlow.cs:42:84:42:95 | call to method First<T> | call to method First<T> |
+| CollectionFlow.cs:417:31:417:37 | object creation of type A : A | CollectionFlow.cs:417:31:417:37 | object creation of type A : A | CollectionFlow.cs:42:84:42:95 | call to method First<T> | $@ | CollectionFlow.cs:42:84:42:95 | call to method First<T> | call to method First<T> |
+| CollectionFlow.cs:439:17:439:23 | object creation of type A : A | CollectionFlow.cs:439:17:439:23 | object creation of type A : A | CollectionFlow.cs:442:14:442:21 | access to array element | $@ | CollectionFlow.cs:442:14:442:21 | access to array element | access to array element |
+| CollectionFlow.cs:460:17:460:23 | object creation of type A : A | CollectionFlow.cs:460:17:460:23 | object creation of type A : A | CollectionFlow.cs:462:14:462:21 | access to array element | $@ | CollectionFlow.cs:462:14:462:21 | access to array element | access to array element |
+| CollectionFlow.cs:467:17:467:23 | object creation of type A : A | CollectionFlow.cs:467:17:467:23 | object creation of type A : A | CollectionFlow.cs:469:14:469:17 | access to indexer | $@ | CollectionFlow.cs:469:14:469:17 | access to indexer | access to indexer |
+| CollectionFlow.cs:480:17:480:23 | object creation of type A : A | CollectionFlow.cs:480:17:480:23 | object creation of type A : A | CollectionFlow.cs:483:14:483:21 | access to array element | $@ | CollectionFlow.cs:483:14:483:21 | access to array element | access to array element |
+| CollectionFlow.cs:520:17:520:23 | object creation of type A : A | CollectionFlow.cs:520:17:520:23 | object creation of type A : A | CollectionFlow.cs:522:14:522:20 | access to indexer | $@ | CollectionFlow.cs:522:14:522:20 | access to indexer | access to indexer |
+| CollectionFlow.cs:527:17:527:23 | object creation of type A : A | CollectionFlow.cs:527:17:527:23 | object creation of type A : A | CollectionFlow.cs:530:14:530:19 | access to array element | $@ | CollectionFlow.cs:530:14:530:19 | access to array element | access to array element |
+| CollectionFlow.cs:535:17:535:23 | object creation of type A : A | CollectionFlow.cs:535:17:535:23 | object creation of type A : A | CollectionFlow.cs:537:14:537:22 | access to indexer | $@ | CollectionFlow.cs:537:14:537:22 | access to indexer | access to indexer |
+| CollectionFlow.cs:542:42:542:48 | object creation of type A : A | CollectionFlow.cs:542:42:542:48 | object creation of type A : A | CollectionFlow.cs:544:14:544:22 | access to indexer | $@ | CollectionFlow.cs:544:14:544:22 | access to indexer | access to indexer |
+| CollectionFlow.cs:549:17:549:23 | object creation of type A : A | CollectionFlow.cs:549:17:549:23 | object creation of type A : A | CollectionFlow.cs:551:14:551:20 | access to indexer | $@ | CollectionFlow.cs:551:14:551:20 | access to indexer | access to indexer |

csharp/ql/test/library-tests/dataflow/collections/CollectionDataFlow.ql

@@ -2,20 +2,9 @@
  * @kind path-problem
  */
 
-import csharp
+import CollectionFlowCommon
 import utils.test.ProvenancePathGraph::ShowProvenance<ArrayFlow::PathNode, ArrayFlow::PathGraph>
 
-module ArrayFlowConfig implements DataFlow::ConfigSig {
-  predicate isSource(DataFlow::Node src) { src.asExpr() instanceof ObjectCreation }
-
-  predicate isSink(DataFlow::Node sink) {
-    exists(MethodCall mc |
-      mc.getTarget().hasUndecoratedName("Sink") and
-      mc.getAnArgument() = sink.asExpr()
-    )
-  }
-}
-
 module ArrayFlow = DataFlow::Global<ArrayFlowConfig>;
 
 from ArrayFlow::PathNode source, ArrayFlow::PathNode sink

csharp/ql/test/library-tests/dataflow/collections/CollectionFlow.cs

@@ -550,4 +550,10 @@ public class CollectionFlow
         ReadOnlySpan<A> span = new ReadOnlySpan<A>(new[] { a });
         Sink(span[0]); // flow
     }
+
+    public void ImplicitMapValueRead(Dictionary<int, A> dict) {
+        var a = new A();
+        dict[0] = a;
+        Sink(dict); // taint flow
+    }
 }

csharp/ql/test/library-tests/dataflow/collections/CollectionFlowCommon.qll

@@ -0,0 +1,12 @@
+import csharp
+
+module ArrayFlowConfig implements DataFlow::ConfigSig {
+  predicate isSource(DataFlow::Node src) { src.asExpr() instanceof ObjectCreation }
+
+  predicate isSink(DataFlow::Node sink) {
+    exists(MethodCall mc |
+      mc.getTarget().hasUndecoratedName("Sink") and
+      mc.getAnArgument() = sink.asExpr()
+    )
+  }
+}

csharp/ql/test/library-tests/dataflow/collections/CollectionTaintFlow.ql

@@ -0,0 +1,12 @@
+/**
+ * @kind path-problem
+ */
+
+import CollectionFlowCommon
+import utils.test.ProvenancePathGraph::ShowProvenance<ArrayFlow::PathNode, ArrayFlow::PathGraph>
+
+module ArrayFlow = TaintTracking::Global<ArrayFlowConfig>;
+
+from ArrayFlow::PathNode source, ArrayFlow::PathNode sink
+where ArrayFlow::flowPath(source, sink)
+select source, source, sink, "$@", sink, sink.toString()

csharp/ql/test/library-tests/dataflow/defuse/defUseEquivalence.ql

@@ -1,9 +1,9 @@
 import csharp
-private import semmle.code.csharp.controlflow.internal.PreSsa
+private import semmle.code.csharp.dataflow.internal.BaseSSA
 
 /** "Naive" def-use implementation. */
 predicate defReaches(
-  AssignableDefinition def, PreSsa::SimpleLocalScopeVariable v, ControlFlow::Node cfn
+  AssignableDefinition def, BaseSsa::SimpleLocalScopeVariable v, ControlFlow::Node cfn
 ) {
   def.getTarget() = v and cfn = def.getExpr().getAControlFlowNode().getASuccessor()
   or

csharp/ql/test/library-tests/dataflow/defuse/parameterUseEquivalence.ql

@@ -1,10 +1,10 @@
 import csharp
-private import semmle.code.csharp.controlflow.internal.PreSsa
+private import semmle.code.csharp.dataflow.internal.BaseSSA
 
 /** "Naive" parameter-use implementation. */
 predicate parameterReaches(Parameter p, ControlFlow::Node cfn) {
   cfn = p.getCallable().getEntryPoint().getASuccessor() and
-  p instanceof PreSsa::SimpleLocalScopeVariable
+  p instanceof BaseSsa::SimpleLocalScopeVariable
   or
   exists(ControlFlow::Node mid | parameterReaches(p, mid) |
     not mid =

csharp/ql/test/library-tests/dataflow/defuse/useUseEquivalence.ql

@@ -1,9 +1,9 @@
 import csharp
-private import semmle.code.csharp.controlflow.internal.PreSsa
+private import semmle.code.csharp.dataflow.internal.BaseSSA
 
 /** "Naive" use-use implementation. */
 predicate useReaches(
-  LocalScopeVariableRead read, PreSsa::SimpleLocalScopeVariable v, ControlFlow::Node cfn
+  LocalScopeVariableRead read, BaseSsa::SimpleLocalScopeVariable v, ControlFlow::Node cfn
 ) {
   read.getTarget() = v and cfn = read.getAControlFlowNode().getASuccessor()
   or

csharp/ql/test/library-tests/dataflow/ssa/PreSsaConsistency.expected

@@ -1,3 +0,0 @@
-defReadInconsistency
-readReadInconsistency
-phiInconsistency

csharp/ql/test/library-tests/dataflow/ssa/PreSsaConsistency.ql

@@ -1,99 +0,0 @@
-import csharp
-import semmle.code.csharp.controlflow.internal.PreSsa
-import semmle.code.csharp.controlflow.internal.ControlFlowGraphImpl
-import semmle.code.csharp.dataflow.internal.SsaImpl as SsaImpl
-
-class CallableWithSplitting extends Callable {
-  CallableWithSplitting() { this = any(SplitAstNode n).getEnclosingCallable() }
-}
-
-query predicate defReadInconsistency(
-  AssignableRead ar, Expr e, PreSsa::SsaInput::SourceVariable v, boolean b
-) {
-  // Exclude definitions in callables with CFG splitting, as SSA definitions may be
-  // very different from pre-SSA definitions
-  not ar.getEnclosingCallable() instanceof CallableWithSplitting and
-  exists(AssignableDefinition def | e = def.getExpr() |
-    b = true and
-    exists(PreSsa::Definition ssaDef | ssaDef.getSourceVariable() = v |
-      ar = ssaDef.getAFirstRead() and
-      ssaDef.getDefinition() = def and
-      not exists(Ssa::ExplicitDefinition edef |
-        edef.getADefinition() = def and
-        edef.getAFirstRead() = ar
-      )
-    )
-    or
-    b = false and
-    exists(Ssa::ExplicitDefinition edef |
-      edef.getADefinition() = def and
-      edef.getAFirstRead() = ar and
-      def.getTarget() = v and
-      not exists(PreSsa::Definition ssaDef |
-        ar = ssaDef.getAFirstRead() and
-        ssaDef.getDefinition() = def
-      )
-    )
-  )
-}
-
-query predicate readReadInconsistency(
-  LocalScopeVariableRead read1, LocalScopeVariableRead read2, PreSsa::SsaInput::SourceVariable v,
-  boolean b
-) {
-  // Exclude definitions in callables with CFG splitting, as SSA definitions may be
-  // very different from pre-SSA definitions
-  not read1.getEnclosingCallable() instanceof CallableWithSplitting and
-  (
-    b = true and
-    v = read1.getTarget() and
-    PreSsa::adjacentReadPairSameVar(read1, read2) and
-    not SsaImpl::adjacentReadPairSameVar(_, read1.getAControlFlowNode(), read2.getAControlFlowNode())
-    or
-    b = false and
-    v = read1.getTarget() and
-    SsaImpl::adjacentReadPairSameVar(_, read1.getAControlFlowNode(), read2.getAControlFlowNode()) and
-    read1.getTarget() instanceof PreSsa::SsaInput::SourceVariable and
-    not PreSsa::adjacentReadPairSameVar(read1, read2) and
-    // Exclude split CFG elements because SSA may be more precise than pre-SSA
-    // in those cases
-    not read1 instanceof SplitAstNode and
-    not read2 instanceof SplitAstNode
-  )
-}
-
-query predicate phiInconsistency(
-  ControlFlowElement cfe, Expr e, PreSsa::SsaInput::SourceVariable v, boolean b
-) {
-  // Exclude definitions in callables with CFG splitting, as SSA definitions may be
-  // very different from pre-SSA definitions
-  not cfe.getEnclosingCallable() instanceof CallableWithSplitting and
-  exists(AssignableDefinition adef | e = adef.getExpr() |
-    b = true and
-    exists(PreSsa::PhiNode prePhi | v = prePhi.getSourceVariable() |
-      adef = prePhi.getAnInput+().getDefinition() and
-      cfe = prePhi.getBasicBlock().getFirstElement() and
-      not exists(Ssa::PhiNode phi, ControlFlow::BasicBlock bb, Ssa::ExplicitDefinition edef |
-        edef = phi.getAnUltimateDefinition()
-      |
-        edef.getADefinition() = adef and
-        phi.definesAt(_, bb, _) and
-        cfe = bb.getFirstNode().getAstNode()
-      )
-    )
-    or
-    b = false and
-    exists(Ssa::PhiNode phi, ControlFlow::BasicBlock bb, Ssa::ExplicitDefinition edef |
-      v = phi.getSourceVariable().getAssignable()
-    |
-      edef = phi.getAnUltimateDefinition() and
-      edef.getADefinition() = adef and
-      phi.definesAt(_, bb, _) and
-      cfe = bb.getFirstNode().getAstNode() and
-      not exists(PreSsa::PhiNode prePhi |
-        adef = prePhi.getAnInput+().getDefinition() and
-        cfe = prePhi.getBasicBlock().getFirstElement()
-      )
-    )
-  )
-}

csharp/ql/test/query-tests/Security Features/CWE-089/SqlInjection.expected

@@ -17,6 +17,9 @@
 | SqlInjectionDapper.cs:58:42:58:46 | access to local variable query | SqlInjectionDapper.cs:57:86:57:94 | access to property Text : String | SqlInjectionDapper.cs:58:42:58:46 | access to local variable query | This query depends on $@. | SqlInjectionDapper.cs:57:86:57:94 | access to property Text : String | this TextBox text |
 | SqlInjectionDapper.cs:67:42:67:46 | access to local variable query | SqlInjectionDapper.cs:66:86:66:94 | access to property Text : String | SqlInjectionDapper.cs:67:42:67:46 | access to local variable query | This query depends on $@. | SqlInjectionDapper.cs:66:86:66:94 | access to property Text : String | this TextBox text |
 | SqlInjectionDapper.cs:77:52:77:56 | access to local variable query | SqlInjectionDapper.cs:75:86:75:94 | access to property Text : String | SqlInjectionDapper.cs:77:52:77:56 | access to local variable query | This query depends on $@. | SqlInjectionDapper.cs:75:86:75:94 | access to property Text : String | this TextBox text |
+| SqlInjectionNHibernate.cs:17:36:17:53 | access to property Text | SqlInjectionNHibernate.cs:17:36:17:48 | access to field untrustedData : TextBox | SqlInjectionNHibernate.cs:17:36:17:53 | access to property Text | This query depends on $@. | SqlInjectionNHibernate.cs:17:36:17:48 | access to field untrustedData : TextBox | this ASP.NET user input |
+| SqlInjectionNHibernate.cs:19:45:19:62 | access to property Text | SqlInjectionNHibernate.cs:19:45:19:57 | access to field untrustedData : TextBox | SqlInjectionNHibernate.cs:19:45:19:62 | access to property Text | This query depends on $@. | SqlInjectionNHibernate.cs:19:45:19:57 | access to field untrustedData : TextBox | this ASP.NET user input |
+| SqlInjectionNHibernate.cs:21:33:21:50 | access to property Text | SqlInjectionNHibernate.cs:21:33:21:45 | access to field untrustedData : TextBox | SqlInjectionNHibernate.cs:21:33:21:50 | access to property Text | This query depends on $@. | SqlInjectionNHibernate.cs:21:33:21:45 | access to field untrustedData : TextBox | this ASP.NET user input |
 | SqlInjectionSqlite.cs:19:51:19:68 | access to property Text | SqlInjectionSqlite.cs:19:51:19:63 | access to field untrustedData : TextBox | SqlInjectionSqlite.cs:19:51:19:68 | access to property Text | This query depends on $@. | SqlInjectionSqlite.cs:19:51:19:63 | access to field untrustedData : TextBox | this ASP.NET user input |
 | SqlInjectionSqlite.cs:24:41:24:58 | access to property Text | SqlInjectionSqlite.cs:24:41:24:53 | access to field untrustedData : TextBox | SqlInjectionSqlite.cs:24:41:24:58 | access to property Text | This query depends on $@. | SqlInjectionSqlite.cs:24:41:24:53 | access to field untrustedData : TextBox | this ASP.NET user input |
 | SqlInjectionSqlite.cs:33:49:33:66 | access to property Text | SqlInjectionSqlite.cs:33:49:33:61 | access to field untrustedData : TextBox | SqlInjectionSqlite.cs:33:49:33:66 | access to property Text | This query depends on $@. | SqlInjectionSqlite.cs:33:49:33:61 | access to field untrustedData : TextBox | this ASP.NET user input |
@@ -27,43 +30,43 @@
 edges
 | SecondOrderSqlInjection.cs:20:31:20:44 | access to local variable customerReader : SqlDataReader | SecondOrderSqlInjection.cs:25:119:25:132 | access to local variable customerReader : SqlDataReader | provenance |  |
 | SecondOrderSqlInjection.cs:20:48:20:78 | call to method ExecuteReader : SqlDataReader | SecondOrderSqlInjection.cs:20:31:20:44 | access to local variable customerReader : SqlDataReader | provenance |  |
-| SecondOrderSqlInjection.cs:25:119:25:132 | access to local variable customerReader : SqlDataReader | SecondOrderSqlInjection.cs:25:119:25:145 | call to method GetString : String | provenance | MaD:23 |
+| SecondOrderSqlInjection.cs:25:119:25:132 | access to local variable customerReader : SqlDataReader | SecondOrderSqlInjection.cs:25:119:25:145 | call to method GetString : String | provenance | MaD:26 |
-| SecondOrderSqlInjection.cs:25:119:25:145 | call to method GetString : String | SecondOrderSqlInjection.cs:25:71:25:145 | ... + ... | provenance | Sink:MaD:15 |
+| SecondOrderSqlInjection.cs:25:119:25:145 | call to method GetString : String | SecondOrderSqlInjection.cs:25:71:25:145 | ... + ... | provenance | Sink:MaD:18 |
 | SecondOrderSqlInjection.cs:33:31:33:32 | access to local variable fs : FileStream | SecondOrderSqlInjection.cs:35:59:35:60 | access to local variable fs : FileStream | provenance |  |
-| SecondOrderSqlInjection.cs:33:36:33:78 | object creation of type FileStream : FileStream | SecondOrderSqlInjection.cs:33:31:33:32 | access to local variable fs : FileStream | provenance | Src:MaD:19  |
+| SecondOrderSqlInjection.cs:33:36:33:78 | object creation of type FileStream : FileStream | SecondOrderSqlInjection.cs:33:31:33:32 | access to local variable fs : FileStream | provenance | Src:MaD:22  |
-| SecondOrderSqlInjection.cs:33:36:33:78 | object creation of type FileStream : FileStream | SecondOrderSqlInjection.cs:33:31:33:32 | access to local variable fs : FileStream | provenance | Src:MaD:18  |
+| SecondOrderSqlInjection.cs:33:36:33:78 | object creation of type FileStream : FileStream | SecondOrderSqlInjection.cs:33:31:33:32 | access to local variable fs : FileStream | provenance | Src:MaD:21  |
 | SecondOrderSqlInjection.cs:35:37:35:38 | access to local variable sr : StreamReader | SecondOrderSqlInjection.cs:38:35:38:36 | access to local variable sr : StreamReader | provenance |  |
 | SecondOrderSqlInjection.cs:35:42:35:76 | object creation of type StreamReader : StreamReader | SecondOrderSqlInjection.cs:35:37:35:38 | access to local variable sr : StreamReader | provenance |  |
-| SecondOrderSqlInjection.cs:35:59:35:60 | access to local variable fs : FileStream | SecondOrderSqlInjection.cs:35:42:35:76 | object creation of type StreamReader : StreamReader | provenance | MaD:25 |
+| SecondOrderSqlInjection.cs:35:59:35:60 | access to local variable fs : FileStream | SecondOrderSqlInjection.cs:35:42:35:76 | object creation of type StreamReader : StreamReader | provenance | MaD:28 |
 | SecondOrderSqlInjection.cs:38:29:38:31 | access to local variable sql : String | SecondOrderSqlInjection.cs:40:31:40:33 | access to local variable sql : String | provenance |  |
-| SecondOrderSqlInjection.cs:38:35:38:36 | access to local variable sr : StreamReader | SecondOrderSqlInjection.cs:38:35:38:47 | call to method ReadLine : String | provenance | MaD:26 |
+| SecondOrderSqlInjection.cs:38:35:38:36 | access to local variable sr : StreamReader | SecondOrderSqlInjection.cs:38:35:38:47 | call to method ReadLine : String | provenance | MaD:29 |
 | SecondOrderSqlInjection.cs:38:35:38:47 | call to method ReadLine : String | SecondOrderSqlInjection.cs:38:29:38:31 | access to local variable sql : String | provenance |  |
-| SecondOrderSqlInjection.cs:40:25:40:27 | access to local variable sql : String | SecondOrderSqlInjection.cs:45:57:45:59 | access to local variable sql | provenance | Sink:MaD:10 |
+| SecondOrderSqlInjection.cs:40:25:40:27 | access to local variable sql : String | SecondOrderSqlInjection.cs:45:57:45:59 | access to local variable sql | provenance | Sink:MaD:13 |
-| SecondOrderSqlInjection.cs:40:31:40:33 | access to local variable sql : String | SecondOrderSqlInjection.cs:40:31:40:40 | call to method Trim : String | provenance | MaD:28 |
+| SecondOrderSqlInjection.cs:40:31:40:33 | access to local variable sql : String | SecondOrderSqlInjection.cs:40:31:40:40 | call to method Trim : String | provenance | MaD:31 |
 | SecondOrderSqlInjection.cs:40:31:40:40 | call to method Trim : String | SecondOrderSqlInjection.cs:40:25:40:27 | access to local variable sql : String | provenance |  |
-| SqlInjection.cs:37:21:37:26 | access to local variable query1 : String | SqlInjection.cs:39:50:39:55 | access to local variable query1 | provenance | Sink:MaD:17 |
+| SqlInjection.cs:37:21:37:26 | access to local variable query1 : String | SqlInjection.cs:39:50:39:55 | access to local variable query1 | provenance | Sink:MaD:20 |
-| SqlInjection.cs:38:21:38:35 | access to field categoryTextBox : TextBox | SqlInjection.cs:38:21:38:40 | access to property Text : String | provenance | MaD:27 |
+| SqlInjection.cs:38:21:38:35 | access to field categoryTextBox : TextBox | SqlInjection.cs:38:21:38:40 | access to property Text : String | provenance | MaD:30 |
 | SqlInjection.cs:38:21:38:40 | access to property Text : String | SqlInjection.cs:37:21:37:26 | access to local variable query1 : String | provenance |  |
-| SqlInjection.cs:72:25:72:30 | access to local variable query1 : String | SqlInjection.cs:74:56:74:61 | access to local variable query1 | provenance | Sink:MaD:7 |
+| SqlInjection.cs:72:25:72:30 | access to local variable query1 : String | SqlInjection.cs:74:56:74:61 | access to local variable query1 | provenance | Sink:MaD:10 |
-| SqlInjection.cs:72:25:72:30 | access to local variable query1 : String | SqlInjection.cs:75:55:75:60 | access to local variable query1 | provenance | Sink:MaD:8 |
+| SqlInjection.cs:72:25:72:30 | access to local variable query1 : String | SqlInjection.cs:75:55:75:60 | access to local variable query1 | provenance | Sink:MaD:11 |
-| SqlInjection.cs:73:33:73:47 | access to field categoryTextBox : TextBox | SqlInjection.cs:73:33:73:52 | access to property Text : String | provenance | MaD:27 |
+| SqlInjection.cs:73:33:73:47 | access to field categoryTextBox : TextBox | SqlInjection.cs:73:33:73:52 | access to property Text : String | provenance | MaD:30 |
 | SqlInjection.cs:73:33:73:52 | access to property Text : String | SqlInjection.cs:72:25:72:30 | access to local variable query1 : String | provenance |  |
-| SqlInjection.cs:86:21:86:26 | access to local variable query1 : String | SqlInjection.cs:88:50:88:55 | access to local variable query1 | provenance | Sink:MaD:17 |
+| SqlInjection.cs:86:21:86:26 | access to local variable query1 : String | SqlInjection.cs:88:50:88:55 | access to local variable query1 | provenance | Sink:MaD:20 |
 | SqlInjection.cs:87:21:87:29 | access to property Text : String | SqlInjection.cs:86:21:86:26 | access to local variable query1 : String | provenance |  |
-| SqlInjection.cs:96:21:96:31 | access to local variable queryString : String | SqlInjection.cs:98:42:98:52 | access to local variable queryString | provenance | Sink:MaD:14 |
+| SqlInjection.cs:96:21:96:31 | access to local variable queryString : String | SqlInjection.cs:98:42:98:52 | access to local variable queryString | provenance | Sink:MaD:17 |
 | SqlInjection.cs:96:21:96:31 | access to local variable queryString : String | SqlInjection.cs:98:42:98:52 | access to local variable queryString : String | provenance |  |
 | SqlInjection.cs:97:21:97:29 | access to property Text : String | SqlInjection.cs:96:21:96:31 | access to local variable queryString : String | provenance |  |
-| SqlInjection.cs:98:21:98:23 | access to local variable cmd : SqlCommand | SqlInjection.cs:99:50:99:52 | access to local variable cmd | provenance | Sink:MaD:16 |
+| SqlInjection.cs:98:21:98:23 | access to local variable cmd : SqlCommand | SqlInjection.cs:99:50:99:52 | access to local variable cmd | provenance | Sink:MaD:19 |
 | SqlInjection.cs:98:27:98:53 | object creation of type SqlCommand : SqlCommand | SqlInjection.cs:98:21:98:23 | access to local variable cmd : SqlCommand | provenance |  |
-| SqlInjection.cs:98:42:98:52 | access to local variable queryString : String | SqlInjection.cs:98:27:98:53 | object creation of type SqlCommand : SqlCommand | provenance | MaD:22 |
+| SqlInjection.cs:98:42:98:52 | access to local variable queryString : String | SqlInjection.cs:98:27:98:53 | object creation of type SqlCommand : SqlCommand | provenance | MaD:25 |
-| SqlInjection.cs:107:21:107:31 | access to local variable queryString : String | SqlInjection.cs:109:42:109:52 | access to local variable queryString | provenance | Sink:MaD:14 |
+| SqlInjection.cs:107:21:107:31 | access to local variable queryString : String | SqlInjection.cs:109:42:109:52 | access to local variable queryString | provenance | Sink:MaD:17 |
 | SqlInjection.cs:107:21:107:31 | access to local variable queryString : String | SqlInjection.cs:109:42:109:52 | access to local variable queryString : String | provenance |  |
-| SqlInjection.cs:108:21:108:38 | call to method ReadLine : String | SqlInjection.cs:107:21:107:31 | access to local variable queryString : String | provenance | Src:MaD:20  |
+| SqlInjection.cs:108:21:108:38 | call to method ReadLine : String | SqlInjection.cs:107:21:107:31 | access to local variable queryString : String | provenance | Src:MaD:23  |
-| SqlInjection.cs:109:21:109:23 | access to local variable cmd : SqlCommand | SqlInjection.cs:110:50:110:52 | access to local variable cmd | provenance | Sink:MaD:16 |
+| SqlInjection.cs:109:21:109:23 | access to local variable cmd : SqlCommand | SqlInjection.cs:110:50:110:52 | access to local variable cmd | provenance | Sink:MaD:19 |
 | SqlInjection.cs:109:27:109:53 | object creation of type SqlCommand : SqlCommand | SqlInjection.cs:109:21:109:23 | access to local variable cmd : SqlCommand | provenance |  |
-| SqlInjection.cs:109:42:109:52 | access to local variable queryString : String | SqlInjection.cs:109:27:109:53 | object creation of type SqlCommand : SqlCommand | provenance | MaD:22 |
+| SqlInjection.cs:109:42:109:52 | access to local variable queryString : String | SqlInjection.cs:109:27:109:53 | object creation of type SqlCommand : SqlCommand | provenance | MaD:25 |
 | SqlInjection.cs:122:73:122:78 | userId : String | SqlInjection.cs:125:20:125:24 | access to local variable query : String | provenance |  |
-| SqlInjection.cs:125:20:125:24 | access to local variable query : String | SqlInjection.cs:129:53:129:57 | access to local variable query | provenance | Sink:MaD:15 |
+| SqlInjection.cs:125:20:125:24 | access to local variable query : String | SqlInjection.cs:129:53:129:57 | access to local variable query | provenance | Sink:MaD:18 |
 | SqlInjectionDapper.cs:20:21:20:25 | access to local variable query : String | SqlInjectionDapper.cs:21:55:21:59 | access to local variable query | provenance | Sink:MaD:4 |
 | SqlInjectionDapper.cs:20:86:20:94 | access to property Text : String | SqlInjectionDapper.cs:20:21:20:25 | access to local variable query : String | provenance |  |
 | SqlInjectionDapper.cs:29:21:29:25 | access to local variable query : String | SqlInjectionDapper.cs:30:66:30:70 | access to local variable query | provenance | Sink:MaD:5 |
@@ -78,27 +81,36 @@ edges
 | SqlInjectionDapper.cs:66:86:66:94 | access to property Text : String | SqlInjectionDapper.cs:66:21:66:25 | access to local variable query : String | provenance |  |
 | SqlInjectionDapper.cs:75:21:75:25 | access to local variable query : String | SqlInjectionDapper.cs:77:52:77:56 | access to local variable query | provenance |  |
 | SqlInjectionDapper.cs:75:86:75:94 | access to property Text : String | SqlInjectionDapper.cs:75:21:75:25 | access to local variable query : String | provenance |  |
-| SqlInjectionSqlite.cs:19:51:19:63 | access to field untrustedData : TextBox | SqlInjectionSqlite.cs:19:51:19:68 | access to property Text | provenance | MaD:27 Sink:MaD:9 |
+| SqlInjectionNHibernate.cs:17:36:17:48 | access to field untrustedData : TextBox | SqlInjectionNHibernate.cs:17:36:17:53 | access to property Text | provenance | MaD:30 Sink:MaD:8 |
-| SqlInjectionSqlite.cs:24:17:24:19 | access to local variable cmd : SQLiteCommand | SqlInjectionSqlite.cs:44:45:44:47 | access to local variable cmd | provenance | Sink:MaD:11 |
+| SqlInjectionNHibernate.cs:17:36:17:48 | access to field untrustedData : TextBox | SqlInjectionNHibernate.cs:17:36:17:53 | access to property Text | provenance | MaD:30 Sink:MaD:9 |
+| SqlInjectionNHibernate.cs:17:36:17:48 | access to field untrustedData : TextBox | SqlInjectionNHibernate.cs:17:36:17:53 | access to property Text | provenance | MaD:30 Sink:MaD:7 |
+| SqlInjectionNHibernate.cs:19:45:19:57 | access to field untrustedData : TextBox | SqlInjectionNHibernate.cs:19:45:19:62 | access to property Text | provenance | MaD:30 Sink:MaD:8 |
+| SqlInjectionNHibernate.cs:19:45:19:57 | access to field untrustedData : TextBox | SqlInjectionNHibernate.cs:19:45:19:62 | access to property Text | provenance | MaD:30 Sink:MaD:9 |
+| SqlInjectionNHibernate.cs:19:45:19:57 | access to field untrustedData : TextBox | SqlInjectionNHibernate.cs:19:45:19:62 | access to property Text | provenance | MaD:30 Sink:MaD:7 |
+| SqlInjectionNHibernate.cs:21:33:21:45 | access to field untrustedData : TextBox | SqlInjectionNHibernate.cs:21:33:21:50 | access to property Text | provenance | MaD:30 Sink:MaD:8 |
+| SqlInjectionNHibernate.cs:21:33:21:45 | access to field untrustedData : TextBox | SqlInjectionNHibernate.cs:21:33:21:50 | access to property Text | provenance | MaD:30 Sink:MaD:9 |
+| SqlInjectionNHibernate.cs:21:33:21:45 | access to field untrustedData : TextBox | SqlInjectionNHibernate.cs:21:33:21:50 | access to property Text | provenance | MaD:30 Sink:MaD:7 |
+| SqlInjectionSqlite.cs:19:51:19:63 | access to field untrustedData : TextBox | SqlInjectionSqlite.cs:19:51:19:68 | access to property Text | provenance | MaD:30 Sink:MaD:12 |
+| SqlInjectionSqlite.cs:24:17:24:19 | access to local variable cmd : SQLiteCommand | SqlInjectionSqlite.cs:44:45:44:47 | access to local variable cmd | provenance | Sink:MaD:14 |
 | SqlInjectionSqlite.cs:24:23:24:71 | object creation of type SQLiteCommand : SQLiteCommand | SqlInjectionSqlite.cs:24:17:24:19 | access to local variable cmd : SQLiteCommand | provenance |  |
-| SqlInjectionSqlite.cs:24:41:24:53 | access to field untrustedData : TextBox | SqlInjectionSqlite.cs:24:41:24:58 | access to property Text | provenance | MaD:27 Sink:MaD:10 |
+| SqlInjectionSqlite.cs:24:41:24:53 | access to field untrustedData : TextBox | SqlInjectionSqlite.cs:24:41:24:58 | access to property Text | provenance | MaD:30 Sink:MaD:13 |
-| SqlInjectionSqlite.cs:24:41:24:53 | access to field untrustedData : TextBox | SqlInjectionSqlite.cs:24:41:24:58 | access to property Text : String | provenance | MaD:27 |
+| SqlInjectionSqlite.cs:24:41:24:53 | access to field untrustedData : TextBox | SqlInjectionSqlite.cs:24:41:24:58 | access to property Text : String | provenance | MaD:30 |
-| SqlInjectionSqlite.cs:24:41:24:58 | access to property Text : String | SqlInjectionSqlite.cs:24:23:24:71 | object creation of type SQLiteCommand : SQLiteCommand | provenance | MaD:21 |
+| SqlInjectionSqlite.cs:24:41:24:58 | access to property Text : String | SqlInjectionSqlite.cs:24:23:24:71 | object creation of type SQLiteCommand : SQLiteCommand | provenance | MaD:24 |
-| SqlInjectionSqlite.cs:33:49:33:61 | access to field untrustedData : TextBox | SqlInjectionSqlite.cs:33:49:33:66 | access to property Text | provenance | MaD:27 Sink:MaD:12 |
+| SqlInjectionSqlite.cs:33:49:33:61 | access to field untrustedData : TextBox | SqlInjectionSqlite.cs:33:49:33:66 | access to property Text | provenance | MaD:30 Sink:MaD:15 |
-| SqlInjectionSqlite.cs:39:45:39:57 | access to field untrustedData : TextBox | SqlInjectionSqlite.cs:39:45:39:62 | access to property Text | provenance | MaD:27 Sink:MaD:13 |
+| SqlInjectionSqlite.cs:39:45:39:57 | access to field untrustedData : TextBox | SqlInjectionSqlite.cs:39:45:39:62 | access to property Text | provenance | MaD:30 Sink:MaD:16 |
 | SqlInjectionSqlite.cs:49:31:49:32 | access to local variable fs : FileStream | SqlInjectionSqlite.cs:51:59:51:60 | access to local variable fs : FileStream | provenance |  |
-| SqlInjectionSqlite.cs:49:36:49:84 | object creation of type FileStream : FileStream | SqlInjectionSqlite.cs:49:31:49:32 | access to local variable fs : FileStream | provenance | Src:MaD:19  |
+| SqlInjectionSqlite.cs:49:36:49:84 | object creation of type FileStream : FileStream | SqlInjectionSqlite.cs:49:31:49:32 | access to local variable fs : FileStream | provenance | Src:MaD:22  |
-| SqlInjectionSqlite.cs:49:36:49:84 | object creation of type FileStream : FileStream | SqlInjectionSqlite.cs:49:31:49:32 | access to local variable fs : FileStream | provenance | Src:MaD:18  |
+| SqlInjectionSqlite.cs:49:36:49:84 | object creation of type FileStream : FileStream | SqlInjectionSqlite.cs:49:31:49:32 | access to local variable fs : FileStream | provenance | Src:MaD:21  |
-| SqlInjectionSqlite.cs:49:51:49:63 | access to field untrustedData : TextBox | SqlInjectionSqlite.cs:49:51:49:68 | access to property Text : String | provenance | MaD:27 |
+| SqlInjectionSqlite.cs:49:51:49:63 | access to field untrustedData : TextBox | SqlInjectionSqlite.cs:49:51:49:68 | access to property Text : String | provenance | MaD:30 |
-| SqlInjectionSqlite.cs:49:51:49:68 | access to property Text : String | SqlInjectionSqlite.cs:49:36:49:84 | object creation of type FileStream : FileStream | provenance | MaD:24 |
+| SqlInjectionSqlite.cs:49:51:49:68 | access to property Text : String | SqlInjectionSqlite.cs:49:36:49:84 | object creation of type FileStream : FileStream | provenance | MaD:27 |
 | SqlInjectionSqlite.cs:51:37:51:38 | access to local variable sr : StreamReader | SqlInjectionSqlite.cs:54:35:54:36 | access to local variable sr : StreamReader | provenance |  |
 | SqlInjectionSqlite.cs:51:42:51:76 | object creation of type StreamReader : StreamReader | SqlInjectionSqlite.cs:51:37:51:38 | access to local variable sr : StreamReader | provenance |  |
-| SqlInjectionSqlite.cs:51:59:51:60 | access to local variable fs : FileStream | SqlInjectionSqlite.cs:51:42:51:76 | object creation of type StreamReader : StreamReader | provenance | MaD:25 |
+| SqlInjectionSqlite.cs:51:59:51:60 | access to local variable fs : FileStream | SqlInjectionSqlite.cs:51:42:51:76 | object creation of type StreamReader : StreamReader | provenance | MaD:28 |
 | SqlInjectionSqlite.cs:54:29:54:31 | access to local variable sql : String | SqlInjectionSqlite.cs:56:31:56:33 | access to local variable sql : String | provenance |  |
-| SqlInjectionSqlite.cs:54:35:54:36 | access to local variable sr : StreamReader | SqlInjectionSqlite.cs:54:35:54:47 | call to method ReadLine : String | provenance | MaD:26 |
+| SqlInjectionSqlite.cs:54:35:54:36 | access to local variable sr : StreamReader | SqlInjectionSqlite.cs:54:35:54:47 | call to method ReadLine : String | provenance | MaD:29 |
 | SqlInjectionSqlite.cs:54:35:54:47 | call to method ReadLine : String | SqlInjectionSqlite.cs:54:29:54:31 | access to local variable sql : String | provenance |  |
-| SqlInjectionSqlite.cs:56:25:56:27 | access to local variable sql : String | SqlInjectionSqlite.cs:61:53:61:55 | access to local variable sql | provenance | Sink:MaD:10 |
+| SqlInjectionSqlite.cs:56:25:56:27 | access to local variable sql : String | SqlInjectionSqlite.cs:61:53:61:55 | access to local variable sql | provenance | Sink:MaD:13 |
-| SqlInjectionSqlite.cs:56:31:56:33 | access to local variable sql : String | SqlInjectionSqlite.cs:56:31:56:40 | call to method Trim : String | provenance | MaD:28 |
+| SqlInjectionSqlite.cs:56:31:56:33 | access to local variable sql : String | SqlInjectionSqlite.cs:56:31:56:40 | call to method Trim : String | provenance | MaD:31 |
 | SqlInjectionSqlite.cs:56:31:56:40 | call to method Trim : String | SqlInjectionSqlite.cs:56:25:56:27 | access to local variable sql : String | provenance |  |
 models
 | 1 | Sink: Dapper; SqlMapper; false; ExecuteAsync; (System.Data.IDbConnection,System.String,System.Object,System.Data.IDbTransaction,System.Nullable<System.Int32>,System.Nullable<System.Data.CommandType>); ; Argument[1]; sql-injection; manual |
@@ -107,28 +119,31 @@ models
 | 4 | Sink: Dapper; SqlMapper; false; Query<T>; (System.Data.IDbConnection,System.String,System.Object,System.Data.IDbTransaction,System.Boolean,System.Nullable<System.Int32>,System.Nullable<System.Data.CommandType>); ; Argument[1]; sql-injection; manual |
 | 5 | Sink: Dapper; SqlMapper; false; QueryAsync<T>; (System.Data.IDbConnection,System.String,System.Object,System.Data.IDbTransaction,System.Nullable<System.Int32>,System.Nullable<System.Data.CommandType>); ; Argument[1]; sql-injection; manual |
 | 6 | Sink: Dapper; SqlMapper; false; QueryFirstAsync; (System.Data.IDbConnection,System.String,System.Object,System.Data.IDbTransaction,System.Nullable<System.Int32>,System.Nullable<System.Data.CommandType>); ; Argument[1]; sql-injection; manual |
-| 7 | Sink: System.Data.Entity; Database; false; ExecuteSqlCommand; (System.String,System.Object[]); ; Argument[0]; sql-injection; manual |
+| 7 | Sink: NHibernate.Impl; AbstractSessionImpl; true; CreateSQLQuery; (System.String); ; Argument[0]; sql-injection; manual |
-| 8 | Sink: System.Data.Entity; Database; false; SqlQuery<TElement>; (System.String,System.Object[]); ; Argument[0]; sql-injection; manual |
+| 8 | Sink: NHibernate; ISession; true; CreateSQLQuery; (System.String); ; Argument[0]; sql-injection; manual |
-| 9 | Sink: System.Data.SQLite; SQLiteCommand; false; SQLiteCommand; (System.String); ; Argument[0]; sql-injection; manual |
+| 9 | Sink: NHibernate; IStatelessSession; true; CreateSQLQuery; (System.String); ; Argument[0]; sql-injection; manual |
-| 10 | Sink: System.Data.SQLite; SQLiteCommand; false; SQLiteCommand; (System.String,System.Data.SQLite.SQLiteConnection); ; Argument[0]; sql-injection; manual |
+| 10 | Sink: System.Data.Entity; Database; false; ExecuteSqlCommand; (System.String,System.Object[]); ; Argument[0]; sql-injection; manual |
-| 11 | Sink: System.Data.SQLite; SQLiteDataAdapter; false; SQLiteDataAdapter; (System.Data.SQLite.SQLiteCommand); ; Argument[0]; sql-injection; manual |
+| 11 | Sink: System.Data.Entity; Database; false; SqlQuery<TElement>; (System.String,System.Object[]); ; Argument[0]; sql-injection; manual |
-| 12 | Sink: System.Data.SQLite; SQLiteDataAdapter; false; SQLiteDataAdapter; (System.String,System.Data.SQLite.SQLiteConnection); ; Argument[0]; sql-injection; manual |
+| 12 | Sink: System.Data.SQLite; SQLiteCommand; false; SQLiteCommand; (System.String); ; Argument[0]; sql-injection; manual |
-| 13 | Sink: System.Data.SQLite; SQLiteDataAdapter; false; SQLiteDataAdapter; (System.String,System.String); ; Argument[0]; sql-injection; manual |
+| 13 | Sink: System.Data.SQLite; SQLiteCommand; false; SQLiteCommand; (System.String,System.Data.SQLite.SQLiteConnection); ; Argument[0]; sql-injection; manual |
-| 14 | Sink: System.Data.SqlClient; SqlCommand; false; SqlCommand; (System.String); ; Argument[0]; sql-injection; manual |
+| 14 | Sink: System.Data.SQLite; SQLiteDataAdapter; false; SQLiteDataAdapter; (System.Data.SQLite.SQLiteCommand); ; Argument[0]; sql-injection; manual |
-| 15 | Sink: System.Data.SqlClient; SqlCommand; false; SqlCommand; (System.String,System.Data.SqlClient.SqlConnection); ; Argument[0]; sql-injection; manual |
+| 15 | Sink: System.Data.SQLite; SQLiteDataAdapter; false; SQLiteDataAdapter; (System.String,System.Data.SQLite.SQLiteConnection); ; Argument[0]; sql-injection; manual |
-| 16 | Sink: System.Data.SqlClient; SqlDataAdapter; false; SqlDataAdapter; (System.Data.SqlClient.SqlCommand); ; Argument[0]; sql-injection; manual |
+| 16 | Sink: System.Data.SQLite; SQLiteDataAdapter; false; SQLiteDataAdapter; (System.String,System.String); ; Argument[0]; sql-injection; manual |
-| 17 | Sink: System.Data.SqlClient; SqlDataAdapter; false; SqlDataAdapter; (System.String,System.Data.SqlClient.SqlConnection); ; Argument[0]; sql-injection; manual |
+| 17 | Sink: System.Data.SqlClient; SqlCommand; false; SqlCommand; (System.String); ; Argument[0]; sql-injection; manual |
-| 18 | Source: System.IO; FileStream; false; FileStream; ; ; Argument[this]; file-write; manual |
+| 18 | Sink: System.Data.SqlClient; SqlCommand; false; SqlCommand; (System.String,System.Data.SqlClient.SqlConnection); ; Argument[0]; sql-injection; manual |
-| 19 | Source: System.IO; FileStream; false; FileStream; ; ; Argument[this]; file; manual |
+| 19 | Sink: System.Data.SqlClient; SqlDataAdapter; false; SqlDataAdapter; (System.Data.SqlClient.SqlCommand); ; Argument[0]; sql-injection; manual |
-| 20 | Source: System; Console; false; ReadLine; ; ; ReturnValue; stdin; manual |
+| 20 | Sink: System.Data.SqlClient; SqlDataAdapter; false; SqlDataAdapter; (System.String,System.Data.SqlClient.SqlConnection); ; Argument[0]; sql-injection; manual |
-| 21 | Summary: System.Data.SQLite; SQLiteCommand; false; SQLiteCommand; (System.String,System.Data.SQLite.SQLiteConnection); ; Argument[0]; Argument[this]; taint; manual |
+| 21 | Source: System.IO; FileStream; false; FileStream; ; ; Argument[this]; file-write; manual |
-| 22 | Summary: System.Data.SqlClient; SqlCommand; false; SqlCommand; (System.String); ; Argument[0]; Argument[this]; taint; manual |
+| 22 | Source: System.IO; FileStream; false; FileStream; ; ; Argument[this]; file; manual |
-| 23 | Summary: System.Data; IDataRecord; true; GetString; (System.Int32); ; Argument[this]; ReturnValue; taint; manual |
+| 23 | Source: System; Console; false; ReadLine; ; ; ReturnValue; stdin; manual |
-| 24 | Summary: System.IO; FileStream; false; FileStream; (System.String,System.IO.FileMode); ; Argument[0]; Argument[this]; taint; manual |
+| 24 | Summary: System.Data.SQLite; SQLiteCommand; false; SQLiteCommand; (System.String,System.Data.SQLite.SQLiteConnection); ; Argument[0]; Argument[this]; taint; manual |
-| 25 | Summary: System.IO; StreamReader; false; StreamReader; (System.IO.Stream,System.Text.Encoding); ; Argument[0]; Argument[this]; taint; manual |
+| 25 | Summary: System.Data.SqlClient; SqlCommand; false; SqlCommand; (System.String); ; Argument[0]; Argument[this]; taint; manual |
-| 26 | Summary: System.IO; TextReader; true; ReadLine; (); ; Argument[this]; ReturnValue; taint; manual |
+| 26 | Summary: System.Data; IDataRecord; true; GetString; (System.Int32); ; Argument[this]; ReturnValue; taint; manual |
-| 27 | Summary: System.Web.UI.WebControls; TextBox; false; get_Text; (); ; Argument[this]; ReturnValue; taint; manual |
+| 27 | Summary: System.IO; FileStream; false; FileStream; (System.String,System.IO.FileMode); ; Argument[0]; Argument[this]; taint; manual |
-| 28 | Summary: System; String; false; Trim; (); ; Argument[this]; ReturnValue; taint; manual |
+| 28 | Summary: System.IO; StreamReader; false; StreamReader; (System.IO.Stream,System.Text.Encoding); ; Argument[0]; Argument[this]; taint; manual |
+| 29 | Summary: System.IO; TextReader; true; ReadLine; (); ; Argument[this]; ReturnValue; taint; manual |
+| 30 | Summary: System.Web.UI.WebControls; TextBox; false; get_Text; (); ; Argument[this]; ReturnValue; taint; manual |
+| 31 | Summary: System; String; false; Trim; (); ; Argument[this]; ReturnValue; taint; manual |
 nodes
 | SecondOrderSqlInjection.cs:20:31:20:44 | access to local variable customerReader : SqlDataReader | semmle.label | access to local variable customerReader : SqlDataReader |
 | SecondOrderSqlInjection.cs:20:48:20:78 | call to method ExecuteReader : SqlDataReader | semmle.label | call to method ExecuteReader : SqlDataReader |
@@ -197,6 +212,12 @@ nodes
 | SqlInjectionDapper.cs:75:21:75:25 | access to local variable query : String | semmle.label | access to local variable query : String |
 | SqlInjectionDapper.cs:75:86:75:94 | access to property Text : String | semmle.label | access to property Text : String |
 | SqlInjectionDapper.cs:77:52:77:56 | access to local variable query | semmle.label | access to local variable query |
+| SqlInjectionNHibernate.cs:17:36:17:48 | access to field untrustedData : TextBox | semmle.label | access to field untrustedData : TextBox |
+| SqlInjectionNHibernate.cs:17:36:17:53 | access to property Text | semmle.label | access to property Text |
+| SqlInjectionNHibernate.cs:19:45:19:57 | access to field untrustedData : TextBox | semmle.label | access to field untrustedData : TextBox |
+| SqlInjectionNHibernate.cs:19:45:19:62 | access to property Text | semmle.label | access to property Text |
+| SqlInjectionNHibernate.cs:21:33:21:45 | access to field untrustedData : TextBox | semmle.label | access to field untrustedData : TextBox |
+| SqlInjectionNHibernate.cs:21:33:21:50 | access to property Text | semmle.label | access to property Text |
 | SqlInjectionSqlite.cs:19:51:19:63 | access to field untrustedData : TextBox | semmle.label | access to field untrustedData : TextBox |
 | SqlInjectionSqlite.cs:19:51:19:68 | access to property Text | semmle.label | access to property Text |
 | SqlInjectionSqlite.cs:24:17:24:19 | access to local variable cmd : SQLiteCommand | semmle.label | access to local variable cmd : SQLiteCommand |

csharp/ql/test/query-tests/Security Features/CWE-089/SqlInjectionNHibernate.cs

@@ -0,0 +1,24 @@
+using System;
+
+namespace TestNHibernate
+{
+    using System.Data;
+    using System.IO;
+    using System.Text;
+    using System.Web.UI.WebControls;
+
+    class SqlInjection
+    {
+        private string connectionString;
+        public TextBox untrustedData;
+
+        public void InjectUntrustedData(NHibernate.ISession session, NHibernate.IStatelessSession statelessSession, NHibernate.Impl.AbstractSessionImpl impl)
+        {
+            session.CreateSQLQuery(untrustedData.Text); // $ Alert[cs/sql-injection]
+
+            statelessSession.CreateSQLQuery(untrustedData.Text); // $ Alert[cs/sql-injection]
+
+            impl.CreateSQLQuery(untrustedData.Text); // $ Alert[cs/sql-injection]
+        }
+    }
+}

csharp/ql/test/query-tests/Security Features/CWE-089/options

@@ -4,3 +4,4 @@ semmle-extractor-options: --load-sources-from-project:${testdir}/../../../resour
 semmle-extractor-options: --load-sources-from-project:${testdir}/../../../resources/stubs/System.Data.SQLite/1.0.119/System.Data.SQLite.csproj
 semmle-extractor-options: ${testdir}/../../../resources/stubs/System.Windows.cs
 semmle-extractor-options: --load-sources-from-project:${testdir}/../../../resources/stubs/_frameworks/Microsoft.AspNetCore.App/Microsoft.AspNetCore.App.csproj
+semmle-extractor-options: --load-sources-from-project:${testdir}/../../../resources/stubs/NHibernate/5.5.2/NHibernate.csproj

go/ql/lib/change-notes/2025-11-26-unexpected-frontend-errors-query-moved.md

@@ -1,4 +1,4 @@
 ---
 category: breaking
 ---
-* The query `go/unexpected-frontend-error` has been moved from the `codeql/go-queries` query  to the `codeql-go-consistency-queries` query pack.
+* The query `go/unexpected-frontend-error` has been moved from the `codeql/go-queries` query to the `codeql-go-consistency-queries` query pack.

go/ql/lib/semmle/go/controlflow/IR.qll

@@ -1588,4 +1588,9 @@ module IR {
    * in a field/method access, element access, or slice expression.
    */
   EvalImplicitDerefInstruction implicitDerefInstruction(Expr e) { result = MkImplicitDeref(e) }
+
+  /** Gets the base of `insn`, if `insn` is an implicit field read. */
+  Instruction lookThroughImplicitFieldRead(Instruction insn) {
+    result = insn.(ImplicitFieldReadInstruction).getBaseInstruction()
+  }
 }

go/ql/lib/semmle/go/dataflow/internal/DataFlowNodes.qll

@@ -838,7 +838,11 @@ module Public {
       exists(IR::MethodReadInstruction mri |
         ce.getTarget() instanceof Method and
         mri = IR::evalExprInstruction(ce.getCalleeExpr()) and
-        insn = mri.getReceiver()
+        // If a.x is reading a promoted field, and it's equivalent to a.b.c.x,
+        // then mri.getReceiver() will give us the implicit field read a.b.c
+        // and we want to have post-update nodes for a, the implicit field
+        // read a.b and the implicit field read a.b.c.
+        insn = IR::lookThroughImplicitFieldRead*(mri.getReceiver())
       )
     ) and
     mutableType(insn.getResultType())

go/ql/lib/semmle/go/dataflow/internal/DataFlowPrivate.qll

@@ -89,7 +89,8 @@ predicate basicLocalFlowStep(Node nodeFrom, Node nodeTo) {
       nodeFrom = instructionNode(pred) or
       nodeFrom.(PostUpdateNode).getPreUpdateNode() = instructionNode(pred)
     ) and
-    nodeTo = instructionNode(succ)
+    nodeTo = instructionNode(succ) and
+    nodeTo != nodeFrom
   )
   or
   // GlobalFunctionNode -> use

go/ql/lib/semmle/go/dataflow/internal/FlowSummaryImpl.qll

@@ -163,6 +163,19 @@ module SourceSinkInterpretationInput implements
     )
   }
 
+  predicate barrierElement(
+    Element n, string output, string kind, Public::Provenance provenance, string model
+  ) {
+    none()
+  }
+
+  predicate barrierGuardElement(
+    Element n, string input, Public::AcceptingValue acceptingvalue, string kind,
+    Public::Provenance provenance, string model
+  ) {
+    none()
+  }
+
   // Note that due to embedding, which is currently implemented via some
   // Methods having multiple qualified names, a given Method is liable to have
   // more than one SourceOrSinkElement, one for each of the names it claims.
@@ -384,17 +397,13 @@ module SourceSinkInterpretationInput implements
   }
 
   private DataFlow::Node skipImplicitFieldReads(DataFlow::Node n) {
-    not exists(lookThroughImplicitFieldRead(n)) and result = n
+    not exists(IR::lookThroughImplicitFieldRead(n.asInstruction())) and result = n
     or
-    result = skipImplicitFieldReads(lookThroughImplicitFieldRead(n))
+    exists(DataFlow::Node mid |
-  }
+      mid.asInstruction() = IR::lookThroughImplicitFieldRead(n.asInstruction())
-
+    |
-  private DataFlow::Node lookThroughImplicitFieldRead(DataFlow::Node n) {
+      result = skipImplicitFieldReads(mid)
-    result.asInstruction() =
+    )
-      n.(DataFlow::InstructionNode)
-          .asInstruction()
-          .(IR::ImplicitFieldReadInstruction)
-          .getBaseInstruction()
   }
 
   /** Provides additional sink specification logic. */

go/ql/test/example-tests/snippets/CONSISTENCY/DataFlowConsistency.expected

@@ -1,3 +0,0 @@
-identityLocalStep
-| main.go:46:18:46:18 | n | Node steps to itself |
-| main.go:47:3:47:3 | c | Node steps to itself |

go/ql/test/experimental/CWE-400/CONSISTENCY/DataFlowConsistency.expected

@@ -1,4 +0,0 @@
-identityLocalStep
-| DatabaseCallInLoop.go:9:3:9:4 | db | Node steps to itself |
-| test.go:21:12:21:13 | db | Node steps to itself |
-| test.go:25:15:25:16 | db | Node steps to itself |

go/ql/test/experimental/CWE-522-DecompressionBombs/CONSISTENCY/DataFlowConsistency.expected

@@ -34,25 +34,3 @@ reverseRead
 | test.go:92:19:92:25 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
 | test.go:93:5:93:11 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
 | test.go:94:9:94:15 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
-identityLocalStep
-| test.go:114:37:114:38 | rc | Node steps to itself |
-| test.go:198:27:198:29 | out | Node steps to itself |
-| test.go:224:27:224:29 | out | Node steps to itself |
-| test.go:249:27:249:29 | out | Node steps to itself |
-| test.go:274:27:274:29 | out | Node steps to itself |
-| test.go:299:27:299:29 | out | Node steps to itself |
-| test.go:324:26:324:28 | out | Node steps to itself |
-| test.go:349:26:349:28 | out | Node steps to itself |
-| test.go:375:28:375:30 | out | Node steps to itself |
-| test.go:403:28:403:30 | out | Node steps to itself |
-| test.go:431:24:431:26 | out | Node steps to itself |
-| test.go:463:26:463:28 | out | Node steps to itself |
-| test.go:490:26:490:28 | out | Node steps to itself |
-| test.go:517:27:517:29 | out | Node steps to itself |
-| test.go:546:26:546:28 | out | Node steps to itself |
-| test.go:571:26:571:28 | out | Node steps to itself |
-| test.go:601:24:601:26 | out | Node steps to itself |
-| test.go:614:15:614:21 | tarRead | Node steps to itself |
-| test.go:622:3:622:7 | files | Node steps to itself |
-| test.go:637:10:637:16 | tarRead | Node steps to itself |
-| test.go:647:10:647:16 | tarRead | Node steps to itself |

go/ql/test/experimental/CWE-942/CONSISTENCY/DataFlowConsistency.expected

@@ -13,6 +13,3 @@ reverseRead
 | CorsMisconfiguration.go:170:14:170:16 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
 | CorsMisconfiguration.go:194:17:194:19 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
 | CorsMisconfiguration.go:206:14:206:16 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
-identityLocalStep
-| CorsMisconfiguration.go:208:13:208:18 | origin | Node steps to itself |
-| CorsMisconfiguration.go:235:6:235:8 | try | Node steps to itself |

go/ql/test/library-tests/semmle/go/Types/CONSISTENCY/DataFlowConsistency.expected

@@ -1,11 +1,5 @@
 reverseRead
-| pkg1/embedding.go:56:29:56:39 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
-| pkg1/embedding.go:57:33:57:46 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
-| pkg1/embedding.go:58:14:58:22 | implicit read of field embedder | Origin of readStep is missing a PostUpdateNode. |
-| pkg1/embedding.go:58:31:58:42 | implicit read of field embedder | Origin of readStep is missing a PostUpdateNode. |
 | pkg1/tst.go:43:6:43:6 | t | Origin of readStep is missing a PostUpdateNode. |
 | pkg1/tst.go:46:6:46:6 | t | Origin of readStep is missing a PostUpdateNode. |
-| pkg1/tst.go:50:2:50:2 | t | Origin of readStep is missing a PostUpdateNode. |
 | pkg1/tst.go:53:6:53:7 | t2 | Origin of readStep is missing a PostUpdateNode. |
 | pkg1/tst.go:55:6:55:7 | t2 | Origin of readStep is missing a PostUpdateNode. |
-| promoted.go:18:6:18:6 | t | Origin of readStep is missing a PostUpdateNode. |

go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/CONSISTENCY/DataFlowConsistency.expected

@@ -1,37 +0,0 @@
-reverseRead
-| test_methods.go:44:7:44:7 | t | Origin of readStep is missing a PostUpdateNode. |
-| test_methods.go:45:7:45:7 | t | Origin of readStep is missing a PostUpdateNode. |
-| test_methods.go:46:2:46:2 | t | Origin of readStep is missing a PostUpdateNode. |
-| test_methods.go:50:7:50:7 | t | Origin of readStep is missing a PostUpdateNode. |
-| test_methods.go:51:7:51:7 | t | Origin of readStep is missing a PostUpdateNode. |
-| test_methods.go:52:2:52:2 | t | Origin of readStep is missing a PostUpdateNode. |
-| test_methods.go:92:7:92:7 | t | Origin of readStep is missing a PostUpdateNode. |
-| test_methods.go:93:7:93:7 | t | Origin of readStep is missing a PostUpdateNode. |
-| test_methods.go:94:2:94:2 | t | Origin of readStep is missing a PostUpdateNode. |
-| test_methods.go:98:7:98:7 | t | Origin of readStep is missing a PostUpdateNode. |
-| test_methods.go:99:7:99:7 | t | Origin of readStep is missing a PostUpdateNode. |
-| test_methods.go:100:2:100:2 | t | Origin of readStep is missing a PostUpdateNode. |
-| test_methods.go:104:7:104:7 | t | Origin of readStep is missing a PostUpdateNode. |
-| test_methods.go:105:7:105:7 | t | Origin of readStep is missing a PostUpdateNode. |
-| test_methods.go:106:2:106:2 | t | Origin of readStep is missing a PostUpdateNode. |
-| test_methods.go:110:7:110:7 | t | Origin of readStep is missing a PostUpdateNode. |
-| test_methods.go:111:7:111:7 | t | Origin of readStep is missing a PostUpdateNode. |
-| test_methods.go:112:2:112:2 | t | Origin of readStep is missing a PostUpdateNode. |
-| test_methods.go:140:7:140:7 | implicit read of field SEmbedI1 | Origin of readStep is missing a PostUpdateNode. |
-| test_methods.go:141:7:141:7 | implicit read of field SEmbedI1 | Origin of readStep is missing a PostUpdateNode. |
-| test_methods.go:142:2:142:2 | implicit read of field SEmbedI1 | Origin of readStep is missing a PostUpdateNode. |
-| test_methods.go:146:7:146:7 | implicit read of field SEmbedS1 | Origin of readStep is missing a PostUpdateNode. |
-| test_methods.go:147:7:147:7 | implicit read of field SEmbedS1 | Origin of readStep is missing a PostUpdateNode. |
-| test_methods.go:148:2:148:2 | implicit read of field SEmbedS1 | Origin of readStep is missing a PostUpdateNode. |
-| test_methods.go:152:7:152:7 | implicit read of field SEmbedPtrS1 | Origin of readStep is missing a PostUpdateNode. |
-| test_methods.go:153:7:153:7 | implicit read of field SEmbedPtrS1 | Origin of readStep is missing a PostUpdateNode. |
-| test_methods.go:154:2:154:2 | implicit read of field SEmbedPtrS1 | Origin of readStep is missing a PostUpdateNode. |
-| test_methods.go:158:7:158:7 | implicit read of field SEmbedS1 | Origin of readStep is missing a PostUpdateNode. |
-| test_methods.go:159:7:159:7 | implicit read of field SEmbedS1 | Origin of readStep is missing a PostUpdateNode. |
-| test_methods.go:160:2:160:2 | implicit read of field SEmbedS1 | Origin of readStep is missing a PostUpdateNode. |
-| test_methods.go:164:7:164:7 | implicit read of field SEmbedPtrS1 | Origin of readStep is missing a PostUpdateNode. |
-| test_methods.go:165:7:165:7 | implicit read of field SEmbedPtrS1 | Origin of readStep is missing a PostUpdateNode. |
-| test_methods.go:166:2:166:2 | implicit read of field SEmbedPtrS1 | Origin of readStep is missing a PostUpdateNode. |
-| test_methods.go:170:7:170:7 | t | Origin of readStep is missing a PostUpdateNode. |
-| test_methods.go:171:7:171:7 | t | Origin of readStep is missing a PostUpdateNode. |
-| test_methods.go:172:2:172:2 | t | Origin of readStep is missing a PostUpdateNode. |

go/ql/test/library-tests/semmle/go/dataflow/ExternalTaintFlow/CONSISTENCY/DataFlowConsistency.expected

@@ -2,14 +2,3 @@ reverseRead
 | test.go:90:10:90:15 | taint8 | Origin of readStep is missing a PostUpdateNode. |
 | test.go:104:12:104:18 | taint10 | Origin of readStep is missing a PostUpdateNode. |
 | test.go:150:10:150:14 | slice | Origin of readStep is missing a PostUpdateNode. |
-identityLocalStep
-| test.go:92:3:92:3 | b | Node steps to itself |
-| test.go:95:3:95:3 | b | Node steps to itself |
-| test.go:106:3:106:3 | b | Node steps to itself |
-| test.go:109:3:109:3 | b | Node steps to itself |
-| test.go:119:3:119:3 | b | Node steps to itself |
-| test.go:122:3:122:3 | b | Node steps to itself |
-| test.go:125:3:125:3 | b | Node steps to itself |
-| test.go:128:3:128:3 | b | Node steps to itself |
-| test.go:138:3:138:3 | b | Node steps to itself |
-| test.go:141:3:141:3 | b | Node steps to itself |

go/ql/test/library-tests/semmle/go/dataflow/ExternalValueFlow/CONSISTENCY/DataFlowConsistency.expected

@@ -2,14 +2,3 @@ reverseRead
 | test.go:90:10:90:15 | taint8 | Origin of readStep is missing a PostUpdateNode. |
 | test.go:104:12:104:18 | taint10 | Origin of readStep is missing a PostUpdateNode. |
 | test.go:150:10:150:14 | slice | Origin of readStep is missing a PostUpdateNode. |
-identityLocalStep
-| test.go:92:3:92:3 | b | Node steps to itself |
-| test.go:95:3:95:3 | b | Node steps to itself |
-| test.go:106:3:106:3 | b | Node steps to itself |
-| test.go:109:3:109:3 | b | Node steps to itself |
-| test.go:119:3:119:3 | b | Node steps to itself |
-| test.go:122:3:122:3 | b | Node steps to itself |
-| test.go:125:3:125:3 | b | Node steps to itself |
-| test.go:128:3:128:3 | b | Node steps to itself |
-| test.go:138:3:138:3 | b | Node steps to itself |
-| test.go:141:3:141:3 | b | Node steps to itself |

go/ql/test/library-tests/semmle/go/dataflow/PromotedMethods/CONSISTENCY/DataFlowConsistency.expected

@@ -1,7 +0,0 @@
-reverseRead
-| methods.go:48:2:48:6 | base1 | Origin of readStep is missing a PostUpdateNode. |
-| methods.go:58:2:58:7 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
-| methods.go:67:2:67:6 | base2 | Origin of readStep is missing a PostUpdateNode. |
-| methods.go:68:2:68:6 | base2 | Origin of readStep is missing a PostUpdateNode. |
-| methods.go:77:2:77:7 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
-| methods.go:78:2:78:7 | base2p | Origin of readStep is missing a PostUpdateNode. |

go/ql/test/library-tests/semmle/go/dataflow/flowsources/local/database/CONSISTENCY/DataFlowConsistency.expected

@@ -1,28 +0,0 @@
-reverseRead
-| test_couchbase_gocb_v2.go:151:2:151:10 | call to Next | Origin of readStep is missing a PostUpdateNode. |
-| test_couchbase_gocb_v2.go:161:2:161:3 | r7 | Origin of readStep is missing a PostUpdateNode. |
-| test_jmoiron_sqlx.go:66:6:66:9 | rows | Origin of readStep is missing a PostUpdateNode. |
-| test_jmoiron_sqlx.go:69:9:69:12 | rows | Origin of readStep is missing a PostUpdateNode. |
-| test_jmoiron_sqlx.go:80:18:80:19 | db | Origin of readStep is missing a PostUpdateNode. |
-| test_jmoiron_sqlx.go:89:8:89:11 | rows | Origin of readStep is missing a PostUpdateNode. |
-| test_jmoiron_sqlx.go:91:6:91:9 | rows | Origin of readStep is missing a PostUpdateNode. |
-| test_jmoiron_sqlx.go:94:9:94:12 | rows | Origin of readStep is missing a PostUpdateNode. |
-| test_jmoiron_sqlx.go:151:8:151:11 | rows | Origin of readStep is missing a PostUpdateNode. |
-| test_jmoiron_sqlx.go:153:6:153:9 | rows | Origin of readStep is missing a PostUpdateNode. |
-| test_jmoiron_sqlx.go:156:9:156:12 | rows | Origin of readStep is missing a PostUpdateNode. |
-| test_jmoiron_sqlx.go:198:18:198:21 | stmt | Origin of readStep is missing a PostUpdateNode. |
-| test_jmoiron_sqlx.go:207:8:207:11 | rows | Origin of readStep is missing a PostUpdateNode. |
-| test_jmoiron_sqlx.go:209:6:209:9 | rows | Origin of readStep is missing a PostUpdateNode. |
-| test_jmoiron_sqlx.go:212:9:212:12 | rows | Origin of readStep is missing a PostUpdateNode. |
-| test_jmoiron_sqlx.go:254:18:254:19 | tx | Origin of readStep is missing a PostUpdateNode. |
-| test_jmoiron_sqlx.go:263:8:263:11 | rows | Origin of readStep is missing a PostUpdateNode. |
-| test_jmoiron_sqlx.go:265:6:265:9 | rows | Origin of readStep is missing a PostUpdateNode. |
-| test_jmoiron_sqlx.go:268:9:268:12 | rows | Origin of readStep is missing a PostUpdateNode. |
-identityLocalStep
-| test_couchbase_gocb_v1.go:20:6:20:7 | r1 | Node steps to itself |
-| test_couchbase_gocb_v1.go:40:6:40:7 | r2 | Node steps to itself |
-| test_mongo_driver_mongo.go:80:24:80:26 | ctx | Node steps to itself |
-| test_mongo_driver_mongo.go:103:24:103:26 | ctx | Node steps to itself |
-| test_mongo_driver_mongo.go:116:24:116:26 | ctx | Node steps to itself |
-| test_uptrace_bun.go:27:3:27:4 | db | Node steps to itself |
-| test_uptrace_bun.go:27:14:27:16 | ctx | Node steps to itself |

go/ql/test/library-tests/semmle/go/frameworks/Beego/CONSISTENCY/DataFlowConsistency.expected

@@ -14,6 +14,3 @@ reverseRead
 | test.go:318:20:318:22 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
 | test.go:324:17:324:19 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
 | test.go:324:17:324:25 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
-identityLocalStep
-| test.go:278:3:278:14 | genericFiles | Node steps to itself |
-| test.go:278:21:278:25 | files | Node steps to itself |

go/ql/test/library-tests/semmle/go/frameworks/Macaron/CONSISTENCY/DataFlowConsistency.expected

@@ -1,2 +0,0 @@
-reverseRead
-| main.go:19:2:19:4 | ctx | Origin of readStep is missing a PostUpdateNode. |

go/ql/test/library-tests/semmle/go/frameworks/Revel/CONSISTENCY/DataFlowConsistency.expected

@@ -1,42 +1,29 @@
 reverseRead
-| EndToEnd.go:30:9:30:9 | c | Origin of readStep is missing a PostUpdateNode. |
 | EndToEnd.go:30:35:30:35 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
 | EndToEnd.go:30:35:30:42 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
 | EndToEnd.go:36:18:36:18 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
 | EndToEnd.go:36:18:36:25 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
-| EndToEnd.go:37:9:37:9 | c | Origin of readStep is missing a PostUpdateNode. |
 | EndToEnd.go:44:18:44:18 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
 | EndToEnd.go:44:18:44:25 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
-| EndToEnd.go:45:9:45:9 | c | Origin of readStep is missing a PostUpdateNode. |
 | EndToEnd.go:51:20:51:20 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
 | EndToEnd.go:51:20:51:27 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
-| EndToEnd.go:52:9:52:9 | c | Origin of readStep is missing a PostUpdateNode. |
 | EndToEnd.go:58:18:58:18 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
 | EndToEnd.go:58:18:58:25 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
-| EndToEnd.go:59:9:59:9 | c | Origin of readStep is missing a PostUpdateNode. |
-| EndToEnd.go:64:9:64:9 | c | Origin of readStep is missing a PostUpdateNode. |
 | EndToEnd.go:64:26:64:26 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
 | EndToEnd.go:64:26:64:33 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
-| EndToEnd.go:69:9:69:9 | c | Origin of readStep is missing a PostUpdateNode. |
 | EndToEnd.go:69:22:69:22 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
 | EndToEnd.go:69:22:69:29 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
-| EndToEnd.go:74:9:74:9 | c | Origin of readStep is missing a PostUpdateNode. |
 | EndToEnd.go:74:22:74:22 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
 | EndToEnd.go:74:22:74:29 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
-| EndToEnd.go:79:9:79:9 | c | Origin of readStep is missing a PostUpdateNode. |
 | EndToEnd.go:79:35:79:35 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
 | EndToEnd.go:79:35:79:42 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
-| EndToEnd.go:84:9:84:9 | c | Origin of readStep is missing a PostUpdateNode. |
 | EndToEnd.go:84:22:84:22 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
 | EndToEnd.go:84:22:84:29 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
-| EndToEnd.go:89:9:89:9 | c | Origin of readStep is missing a PostUpdateNode. |
 | EndToEnd.go:89:21:89:21 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
 | EndToEnd.go:89:21:89:28 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
-| EndToEnd.go:94:9:94:9 | c | Origin of readStep is missing a PostUpdateNode. |
 | EndToEnd.go:94:20:94:20 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
 | EndToEnd.go:94:20:94:27 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
 | Revel.go:26:7:26:7 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
-| Revel.go:26:7:26:14 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
 | Revel.go:27:7:27:7 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
 | Revel.go:27:7:27:14 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
 | Revel.go:30:2:30:2 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
@@ -55,7 +42,6 @@ reverseRead
 | Revel.go:60:7:60:14 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
 | Revel.go:63:2:63:2 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
 | Revel.go:70:22:70:22 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
-| Revel.go:71:2:71:2 | c | Origin of readStep is missing a PostUpdateNode. |
 | Revel.go:75:7:75:7 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
 | Revel.go:76:7:76:7 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
 | Revel.go:77:7:77:7 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
@@ -87,64 +73,34 @@ reverseRead
 | Revel.go:128:14:128:22 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
 | Revel.go:133:13:133:13 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
 | examples/booking/app/controllers/app.go:34:2:34:2 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
-| examples/booking/app/controllers/app.go:45:10:45:10 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
 | examples/booking/app/controllers/app.go:47:2:47:2 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
-| examples/booking/app/controllers/app.go:48:9:48:9 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
-| examples/booking/app/controllers/app.go:52:9:52:9 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
 | examples/booking/app/controllers/app.go:56:2:56:2 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
 | examples/booking/app/controllers/app.go:57:2:57:2 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
 | examples/booking/app/controllers/app.go:59:16:59:16 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
 | examples/booking/app/controllers/app.go:61:5:61:5 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
 | examples/booking/app/controllers/app.go:62:3:62:3 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
-| examples/booking/app/controllers/app.go:63:3:63:3 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
-| examples/booking/app/controllers/app.go:64:10:64:10 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
 | examples/booking/app/controllers/app.go:68:2:68:2 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
-| examples/booking/app/controllers/app.go:69:9:69:9 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
 | examples/booking/app/controllers/app.go:79:5:79:5 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
 | examples/booking/app/controllers/app.go:81:5:81:5 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
 | examples/booking/app/controllers/app.go:83:4:83:4 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
-| examples/booking/app/controllers/app.go:84:11:84:11 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
 | examples/booking/app/controllers/app.go:89:2:89:2 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
-| examples/booking/app/controllers/app.go:90:9:90:9 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
 | examples/booking/app/controllers/app.go:95:10:95:10 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
-| examples/booking/app/controllers/app.go:97:9:97:9 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
-| examples/booking/app/controllers/hotels.go:43:13:43:13 | c | Origin of readStep is missing a PostUpdateNode. |
 | examples/booking/app/controllers/hotels.go:44:3:44:3 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
-| examples/booking/app/controllers/hotels.go:45:10:45:10 | c | Origin of readStep is missing a PostUpdateNode. |
 | examples/booking/app/controllers/hotels.go:51:2:51:2 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
-| examples/booking/app/controllers/hotels.go:54:9:54:9 | c | Origin of readStep is missing a PostUpdateNode. |
-| examples/booking/app/controllers/hotels.go:107:9:107:9 | c | Origin of readStep is missing a PostUpdateNode. |
-| examples/booking/app/controllers/hotels.go:118:9:118:9 | c | Origin of readStep is missing a PostUpdateNode. |
-| examples/booking/app/controllers/hotels.go:132:10:132:10 | c | Origin of readStep is missing a PostUpdateNode. |
-| examples/booking/app/controllers/hotels.go:135:9:135:9 | c | Origin of readStep is missing a PostUpdateNode. |
-| examples/booking/app/controllers/hotels.go:139:9:139:9 | c | Origin of readStep is missing a PostUpdateNode. |
 | examples/booking/app/controllers/hotels.go:143:26:143:26 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
 | examples/booking/app/controllers/hotels.go:144:2:144:2 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
 | examples/booking/app/controllers/hotels.go:146:2:146:2 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
 | examples/booking/app/controllers/hotels.go:148:5:148:5 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
 | examples/booking/app/controllers/hotels.go:149:3:149:3 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
-| examples/booking/app/controllers/hotels.go:150:10:150:10 | c | Origin of readStep is missing a PostUpdateNode. |
 | examples/booking/app/controllers/hotels.go:153:2:153:2 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
-| examples/booking/app/controllers/hotels.go:154:9:154:9 | c | Origin of readStep is missing a PostUpdateNode. |
-| examples/booking/app/controllers/hotels.go:160:10:160:10 | c | Origin of readStep is missing a PostUpdateNode. |
-| examples/booking/app/controllers/hotels.go:165:17:165:17 | c | Origin of readStep is missing a PostUpdateNode. |
 | examples/booking/app/controllers/hotels.go:166:19:166:19 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
 | examples/booking/app/controllers/hotels.go:168:5:168:5 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
 | examples/booking/app/controllers/hotels.go:168:33:168:33 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
-| examples/booking/app/controllers/hotels.go:168:33:168:40 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
 | examples/booking/app/controllers/hotels.go:169:3:169:3 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
-| examples/booking/app/controllers/hotels.go:170:3:170:3 | c | Origin of readStep is missing a PostUpdateNode. |
-| examples/booking/app/controllers/hotels.go:171:10:171:10 | c | Origin of readStep is missing a PostUpdateNode. |
 | examples/booking/app/controllers/hotels.go:174:5:174:5 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
-| examples/booking/app/controllers/hotels.go:174:5:174:12 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
 | examples/booking/app/controllers/hotels.go:175:3:175:3 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
 | examples/booking/app/controllers/hotels.go:176:4:176:10 | booking | Origin of readStep is missing a PostUpdateNode. |
-| examples/booking/app/controllers/hotels.go:177:10:177:10 | c | Origin of readStep is missing a PostUpdateNode. |
-| examples/booking/app/controllers/hotels.go:180:9:180:9 | c | Origin of readStep is missing a PostUpdateNode. |
 | examples/booking/app/controllers/hotels.go:184:2:184:2 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
-| examples/booking/app/controllers/hotels.go:185:9:185:9 | c | Origin of readStep is missing a PostUpdateNode. |
-| examples/booking/app/controllers/hotels.go:191:10:191:10 | c | Origin of readStep is missing a PostUpdateNode. |
-| examples/booking/app/controllers/hotels.go:195:9:195:9 | c | Origin of readStep is missing a PostUpdateNode. |
 | examples/booking/app/init.go:36:44:36:44 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
 | examples/booking/app/init.go:40:49:40:49 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
 | examples/booking/app/init.go:52:2:52:2 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
@@ -169,5 +125,3 @@ reverseRead
 | examples/booking/app/models/booking.go:82:14:82:14 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
 | examples/booking/app/models/booking.go:83:17:83:17 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
 | examples/booking/app/models/booking.go:84:18:84:18 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
-identityLocalStep
-| examples/booking/app/controllers/app.go:95:10:95:10 | c | Node steps to itself |

go/ql/test/library-tests/semmle/go/frameworks/Twirp/CONSISTENCY/DataFlowConsistency.expected

@@ -95,9 +95,3 @@ reverseRead
 | rpc/notes/service.twirp.go:1278:11:1278:14 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
 | rpc/notes/service.twirp.go:1292:23:1292:26 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
 | server/main.go:33:19:33:19 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
-identityLocalStep
-| rpc/notes/service.twirp.go:60:6:60:15 | clientOpts | Node steps to itself |
-| rpc/notes/service.twirp.go:199:6:199:15 | clientOpts | Node steps to itself |
-| rpc/notes/service.twirp.go:852:6:852:15 | serverOpts | Node steps to itself |
-| rpc/notes/service.twirp.go:854:29:854:38 | serverOpts | Node steps to itself |
-| rpc/notes/service.twirp.go:965:4:965:9 | copied | Node steps to itself |

go/ql/test/query-tests/InconsistentCode/InconsistentLoopOrientation/CONSISTENCY/DataFlowConsistency.expected

@@ -1,6 +0,0 @@
-identityLocalStep
-| InconsistentLoopOrientation.go:6:3:6:3 | a | Node steps to itself |
-| InconsistentLoopOrientationGood.go:6:3:6:3 | a | Node steps to itself |
-| main.go:9:26:9:26 | s | Node steps to itself |
-| main.go:14:29:14:29 | l | Node steps to itself |
-| main.go:20:3:20:3 | a | Node steps to itself |

go/ql/test/query-tests/InconsistentCode/LengthComparisonOffByOne/CONSISTENCY/DataFlowConsistency.expected

@@ -1,3 +0,0 @@
-identityLocalStep
-| LengthComparisonOffByOne.go:10:19:10:28 | searchName | Node steps to itself |
-| LengthComparisonOffByOneGood.go:9:14:9:23 | searchName | Node steps to itself |

go/ql/test/query-tests/RedundantCode/DeadStoreOfLocal/CONSISTENCY/DataFlowConsistency.expected

@@ -1,4 +1,2 @@
 reverseRead
 | testdata.go:206:7:206:7 | x | Origin of readStep is missing a PostUpdateNode. |
-identityLocalStep
-| testdata.go:583:7:583:7 | x | Node steps to itself |

go/ql/test/query-tests/RedundantCode/UnreachableStatement/CONSISTENCY/DataFlowConsistency.expected

@@ -1,3 +0,0 @@
-identityLocalStep
-| main.go:35:6:35:9 | cond | Node steps to itself |
-| main.go:44:6:44:9 | cond | Node steps to itself |

go/ql/test/query-tests/Security/CWE-022/CONSISTENCY/DataFlowConsistency.expected

@@ -1,22 +1,3 @@
 reverseRead
 | TaintedPath.go:15:18:15:18 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
 | TaintedPath.go:84:28:84:32 | files | Origin of readStep is missing a PostUpdateNode. |
-identityLocalStep
-| UnsafeUnzipSymlink.go:26:18:26:18 | r | Node steps to itself |
-| UnsafeUnzipSymlink.go:30:29:30:34 | target | Node steps to itself |
-| UnsafeUnzipSymlink.go:42:22:42:27 | target | Node steps to itself |
-| UnsafeUnzipSymlink.go:58:18:58:18 | r | Node steps to itself |
-| UnsafeUnzipSymlink.go:62:3:62:7 | links | Node steps to itself |
-| UnsafeUnzipSymlink.go:79:18:79:18 | r | Node steps to itself |
-| UnsafeUnzipSymlink.go:85:29:85:34 | target | Node steps to itself |
-| UnsafeUnzipSymlink.go:94:18:94:18 | r | Node steps to itself |
-| UnsafeUnzipSymlink.go:98:29:98:34 | target | Node steps to itself |
-| UnsafeUnzipSymlink.go:121:32:121:32 | r | Node steps to itself |
-| UnsafeUnzipSymlink.go:125:29:125:34 | target | Node steps to itself |
-| UnsafeUnzipSymlink.go:146:32:146:32 | r | Node steps to itself |
-| UnsafeUnzipSymlink.go:150:29:150:34 | target | Node steps to itself |
-| UnsafeUnzipSymlinkGood.go:30:18:30:18 | r | Node steps to itself |
-| UnsafeUnzipSymlinkGood.go:34:33:34:38 | target | Node steps to itself |
-| UnsafeUnzipSymlinkGood.go:46:26:46:31 | target | Node steps to itself |
-| UnsafeUnzipSymlinkGood.go:72:18:72:18 | r | Node steps to itself |
-| UnsafeUnzipSymlinkGood.go:76:41:76:46 | target | Node steps to itself |

go/ql/test/query-tests/Security/CWE-079/CONSISTENCY/DataFlowConsistency.expected

@@ -19,8 +19,3 @@ reverseRead
 | tst.go:48:14:48:14 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
 | tst.go:66:15:66:15 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
 | websocketXss.go:26:9:26:9 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
-identityLocalStep
-| StoredXss.go:13:18:13:18 | w | Node steps to itself |
-| StoredXssGood.go:17:3:17:10 | template | Node steps to itself |
-| stored.go:30:19:30:19 | w | Node steps to itself |
-| stored.go:51:20:51:20 | w | Node steps to itself |

go/ql/test/query-tests/Security/CWE-312/CONSISTENCY/DataFlowConsistency.expected

@@ -29,6 +29,3 @@ reverseRead
 | server1.go:14:11:14:14 | vals | Origin of readStep is missing a PostUpdateNode. |
 | server1.go:17:41:17:41 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
 | server1.go:21:46:21:46 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
-identityLocalStep
-| klog.go:24:20:24:23 | name | Node steps to itself |
-| server1.go:29:3:29:3 | s | Node steps to itself |

go/ql/test/query-tests/Security/CWE-327/CONSISTENCY/DataFlowConsistency.expected

@@ -2,5 +2,3 @@ reverseRead
 | UnsafeTLS.go:329:32:329:37 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
 | UnsafeTLS.go:336:33:336:38 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
 | UnsafeTLS.go:353:40:353:45 | suites | Origin of readStep is missing a PostUpdateNode. |
-identityLocalStep
-| UnsafeTLS.go:353:40:353:45 | suites | Node steps to itself |

go/ql/test/query-tests/Security/CWE-338/InsecureRandomness/CONSISTENCY/DataFlowConsistency.expected

@@ -1,3 +0,0 @@
-identityLocalStep
-| InsecureRandomness.go:12:3:12:3 | s | Node steps to itself |
-| InsecureRandomnessGood.go:15:3:15:3 | s | Node steps to itself |

go/ql/test/query-tests/Security/CWE-770/CONSISTENCY/DataFlowConsistency.expected

@@ -4,14 +4,3 @@ reverseRead
 | UncontrolledAllocationSizeGood.go:32:12:32:12 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
 | UncontrolledAllocationSizeGood.go:52:12:52:12 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
 | UncontrolledAllocationSizeGood.go:73:12:73:12 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
-identityLocalStep
-| UncontrolledAllocationSizeBad.go:21:18:21:21 | sink | Node steps to itself |
-| UncontrolledAllocationSizeBad.go:22:3:22:8 | result | Node steps to itself |
-| UncontrolledAllocationSizeGood.go:23:18:23:21 | sink | Node steps to itself |
-| UncontrolledAllocationSizeGood.go:24:3:24:8 | result | Node steps to itself |
-| UncontrolledAllocationSizeGood.go:42:19:42:22 | sink | Node steps to itself |
-| UncontrolledAllocationSizeGood.go:43:4:43:9 | result | Node steps to itself |
-| UncontrolledAllocationSizeGood.go:63:19:63:22 | sink | Node steps to itself |
-| UncontrolledAllocationSizeGood.go:64:4:64:9 | result | Node steps to itself |
-| UncontrolledAllocationSizeGood.go:88:18:88:21 | sink | Node steps to itself |
-| UncontrolledAllocationSizeGood.go:89:3:89:8 | result | Node steps to itself |

go/ql/test/query-tests/Security/CWE-798/CONSISTENCY/DataFlowConsistency.expected

@@ -1,9 +0,0 @@
-identityLocalStep
-| HardcodedKeysGood.go:20:3:20:5 | ret | Node steps to itself |
-| sanitizer.go:26:3:26:7 | bytes | Node steps to itself |
-| sanitizer.go:39:3:39:5 | ret | Node steps to itself |
-| sanitizer.go:49:3:49:7 | bytes | Node steps to itself |
-| sanitizer.go:70:12:70:17 | length | Node steps to itself |
-| sanitizer.go:71:27:71:33 | sources | Node steps to itself |
-| sanitizer.go:71:35:71:35 | r | Node steps to itself |
-| sanitizer.go:71:42:71:53 | sourceLength | Node steps to itself |

java/ql/lib/ext/empty.model.yml

@@ -13,6 +13,14 @@ extensions:
       pack: codeql/java-all
       extensible: summaryModel
     data: []
+  - addsTo:
+      pack: codeql/java-all
+      extensible: barrierModel
+    data: []
+  - addsTo:
+      pack: codeql/java-all
+      extensible: barrierGuardModel
+    data: []
   - addsTo:
       pack: codeql/java-all
       extensible: neutralModel

java/ql/lib/ext/hudson.model.yml

@@ -50,6 +50,12 @@ extensions:
       - ["hudson", "FilePath", False, "readToString", "", "", "ReturnValue", "file", "manual"]
       - ["hudson", "Plugin", True, "configure", "", "", "Parameter", "remote", "manual"]
       - ["hudson", "Plugin", True, "newInstance", "", "", "Parameter", "remote", "manual"]
+  - addsTo:
+      pack: codeql/java-all
+      extensible: barrierModel
+    data:
+      - ["hudson", "Util", True, "escape", "(String)", "", "ReturnValue", "html-injection", "manual"]
+        # Not including xmlEscape because it only accounts for >, <, and &. It does not account for ", or ', which makes it an incomplete XSS sanitizer.
   - addsTo:
       pack: codeql/java-all
       extensible: summaryModel

java/ql/lib/ext/java.io.model.yml

@@ -162,3 +162,8 @@ extensions:
       extensible: sourceModel
     data:
       - ["java.io", "FileInputStream", True, "FileInputStream", "", "", "Argument[this]", "file", "manual"]
+  - addsTo:
+      pack: codeql/java-all
+      extensible: barrierModel
+    data:
+      - ["java.io", "File", True, "getName", "()", "", "ReturnValue", "path-injection", "manual"]

java/ql/lib/ext/java.net.model.yml

@@ -34,6 +34,11 @@ extensions:
       - ["java.net", "URLClassLoader", False, "URLClassLoader", "(URL[],ClassLoader)", "", "Argument[0]", "request-forgery", "manual"]
       - ["java.net", "URLClassLoader", False, "URLClassLoader", "(URL[])", "", "Argument[0]", "request-forgery", "manual"]
       - ["java.net", "PasswordAuthentication", False, "PasswordAuthentication", "(String,char[])", "", "Argument[0]", "credentials-username", "hq-generated"]
+  - addsTo:
+      pack: codeql/java-all
+      extensible: barrierGuardModel
+    data:
+      - ["java.net", "URI", True, "isAbsolute", "()", "", "Argument[this]", "false", "request-forgery", "manual"]
   - addsTo:
       pack: codeql/java-all
       extensible: summaryModel

java/ql/lib/ext/java.util.regex.model.yml

@@ -12,6 +12,11 @@ extensions:
       - ["java.util.regex", "Pattern", False, "split", "(CharSequence)", "", "Argument[this]", "regex-use[0]", "manual"]
       - ["java.util.regex", "Pattern", False, "split", "(CharSequence,int)", "", "Argument[this]", "regex-use[0]", "manual"]
       - ["java.util.regex", "Pattern", False, "splitAsStream", "(CharSequence)", "", "Argument[this]", "regex-use[0]", "manual"]
+  - addsTo:
+      pack: codeql/java-all
+      extensible: barrierModel
+    data:
+      - ["java.util.regex", "Pattern", False, "quote", "(String)", "", "ReturnValue", "regex-use", "manual"]
   - addsTo:
       pack: codeql/java-all
       extensible: summaryModel

java/ql/lib/ext/org.owasp.esapi.model.yml

@@ -1,6 +1,42 @@
 extensions:
+  - addsTo:
+      pack: codeql/java-all
+      extensible: barrierGuardModel
+    data:
+      - ["org.owasp.esapi", "Validator", true, "isValidCreditCard", "", "", "Argument[1]", "true", "trust-boundary-violation", "manual"]
+      - ["org.owasp.esapi", "Validator", true, "isValidDate", "", "", "Argument[1]", "true", "trust-boundary-violation", "manual"]
+      - ["org.owasp.esapi", "Validator", true, "isValidDirectoryPath", "", "", "Argument[1]", "true", "trust-boundary-violation", "manual"]
+      - ["org.owasp.esapi", "Validator", true, "isValidDouble", "", "", "Argument[1]", "true", "trust-boundary-violation", "manual"]
+      - ["org.owasp.esapi", "Validator", true, "isValidFileContent", "", "", "Argument[1]", "true", "trust-boundary-violation", "manual"]
+      - ["org.owasp.esapi", "Validator", true, "isValidFileName", "", "", "Argument[1]", "true", "trust-boundary-violation", "manual"]
+      - ["org.owasp.esapi", "Validator", true, "isValidInput", "", "", "Argument[1]", "true", "trust-boundary-violation", "manual"]
+      - ["org.owasp.esapi", "Validator", true, "isValidInteger", "", "", "Argument[1]", "true", "trust-boundary-violation", "manual"]
+      - ["org.owasp.esapi", "Validator", true, "isValidListItem", "", "", "Argument[1]", "true", "trust-boundary-violation", "manual"]
+      - ["org.owasp.esapi", "Validator", true, "isValidNumber", "", "", "Argument[1]", "true", "trust-boundary-violation", "manual"]
+      - ["org.owasp.esapi", "Validator", true, "isValidPrintable", "", "", "Argument[1]", "true", "trust-boundary-violation", "manual"]
+      - ["org.owasp.esapi", "Validator", true, "isValidRedirectLocation", "", "", "Argument[1]", "true", "trust-boundary-violation", "manual"]
+      - ["org.owasp.esapi", "Validator", true, "isValidSafeHTML", "", "", "Argument[1]", "true", "trust-boundary-violation", "manual"]
+      - ["org.owasp.esapi", "Validator", true, "isValidURI", "", "", "Argument[1]", "true", "trust-boundary-violation", "manual"]
+  - addsTo:
+      pack: codeql/java-all
+      extensible: barrierModel
+    data:
+      - ["org.owasp.esapi", "Validator", true, "getValidCreditCard", "", "", "ReturnValue", "trust-boundary-violation", "manual"]
+      - ["org.owasp.esapi", "Validator", true, "getValidDate", "", "", "ReturnValue", "trust-boundary-violation", "manual"]
+      - ["org.owasp.esapi", "Validator", true, "getValidDirectoryPath", "", "", "ReturnValue", "trust-boundary-violation", "manual"]
+      - ["org.owasp.esapi", "Validator", true, "getValidDouble", "", "", "ReturnValue", "trust-boundary-violation", "manual"]
+      - ["org.owasp.esapi", "Validator", true, "getValidFileContent", "", "", "ReturnValue", "trust-boundary-violation", "manual"]
+      - ["org.owasp.esapi", "Validator", true, "getValidFileName", "", "", "ReturnValue", "trust-boundary-violation", "manual"]
+      - ["org.owasp.esapi", "Validator", true, "getValidInput", "", "", "ReturnValue", "trust-boundary-violation", "manual"]
+      - ["org.owasp.esapi", "Validator", true, "getValidInteger", "", "", "ReturnValue", "trust-boundary-violation", "manual"]
+      - ["org.owasp.esapi", "Validator", true, "getValidListItem", "", "", "ReturnValue", "trust-boundary-violation", "manual"]
+      - ["org.owasp.esapi", "Validator", true, "getValidNumber", "", "", "ReturnValue", "trust-boundary-violation", "manual"]
+      - ["org.owasp.esapi", "Validator", true, "getValidPrintable", "", "", "ReturnValue", "trust-boundary-violation", "manual"]
+      - ["org.owasp.esapi", "Validator", true, "getValidRedirectLocation", "", "", "ReturnValue", "trust-boundary-violation", "manual"]
+      - ["org.owasp.esapi", "Validator", true, "getValidSafeHTML", "", "", "ReturnValue", "trust-boundary-violation", "manual"]
+      - ["org.owasp.esapi", "Validator", true, "getValidURI", "", "", "ReturnValue", "trust-boundary-violation", "manual"]
   - addsTo:
       pack: codeql/java-all
       extensible: summaryModel
     data:
-      - ["org.owasp.esapi", "Encoder", true, "encodeForHTML", "(String)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
+      - ["org.owasp.esapi", "Encoder", true, "encodeForHTML", "(String)", "", "Argument[0]", "ReturnValue", "taint", "manual"]

java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll

@@ -91,6 +91,7 @@ module;
 
 import java
 private import semmle.code.java.dataflow.DataFlow::DataFlow
+private import semmle.code.java.controlflow.Guards
 private import FlowSummary as FlowSummary
 private import internal.DataFlowPrivate
 private import internal.FlowSummaryImpl
@@ -174,6 +175,24 @@ predicate sinkModel(
   )
 }
 
+/** Holds if a barrier model exists for the given parameters. */
+predicate barrierModel(
+  string package, string type, boolean subtypes, string name, string signature, string ext,
+  string output, string kind, string provenance, QlBuiltins::ExtensionId madId
+) {
+  Extensions::barrierModel(package, type, subtypes, name, signature, ext, output, kind, provenance,
+    madId)
+}
+
+/** Holds if a barrier guard model exists for the given parameters. */
+predicate barrierGuardModel(
+  string package, string type, boolean subtypes, string name, string signature, string ext,
+  string input, string acceptingvalue, string kind, string provenance, QlBuiltins::ExtensionId madId
+) {
+  Extensions::barrierGuardModel(package, type, subtypes, name, signature, ext, input,
+    acceptingvalue, kind, provenance, madId)
+}
+
 /** Holds if a summary model exists for the given parameters. */
 predicate summaryModel(
   string package, string type, boolean subtypes, string name, string signature, string ext,
@@ -234,6 +253,7 @@ predicate interpretModelForTest(QlBuiltins::ExtensionId madId, string model) {
       "Summary: " + package + "; " + type + "; " + subtypes + "; " + name + "; " + signature + "; " +
         ext + "; " + input + "; " + output + "; " + kind + "; " + provenance
   )
+  //TODO: possibly barrier models?
 }
 
 /** Holds if a neutral model exists for the given parameters. */
@@ -292,6 +312,7 @@ predicate modelCoverage(string package, int pkgs, string kind, string part, int
         summaryModel(subpkg, type, subtypes, name, signature, ext, input, output, kind, provenance,
           _)
       )
+    // TODO: possibly barrier models?
   )
 }
 
@@ -303,7 +324,9 @@ module ModelValidation {
     summaryModel(_, _, _, _, _, _, path, _, _, _, _) or
     summaryModel(_, _, _, _, _, _, _, path, _, _, _) or
     sinkModel(_, _, _, _, _, _, path, _, _, _) or
-    sourceModel(_, _, _, _, _, _, path, _, _, _)
+    sourceModel(_, _, _, _, _, _, path, _, _, _) or
+    barrierModel(_, _, _, _, _, _, path, _, _, _) or
+    barrierGuardModel(_, _, _, _, _, _, path, _, _, _, _)
   }
 
   private module MkAccessPath = AccessPathSyntax::AccessPath<getRelevantAccessPath/1>;
@@ -316,6 +339,8 @@ module ModelValidation {
     exists(string pred, AccessPath input, AccessPathToken part |
       sinkModel(_, _, _, _, _, _, input, _, _, _) and pred = "sink"
       or
+      barrierGuardModel(_, _, _, _, _, _, input, _, _, _, _) and pred = "barrier guard"
+      or
       summaryModel(_, _, _, _, _, _, input, _, _, _, _) and pred = "summary"
     |
       (
@@ -338,6 +363,8 @@ module ModelValidation {
     exists(string pred, AccessPath output, AccessPathToken part |
       sourceModel(_, _, _, _, _, _, output, _, _, _) and pred = "source"
       or
+      barrierModel(_, _, _, _, _, _, output, _, _, _) and pred = "barrier"
+      or
       summaryModel(_, _, _, _, _, _, _, output, _, _, _) and pred = "summary"
     |
       (
@@ -355,7 +382,13 @@ module ModelValidation {
   private module KindValConfig implements SharedModelVal::KindValidationConfigSig {
     predicate summaryKind(string kind) { summaryModel(_, _, _, _, _, _, _, _, kind, _, _) }
 
-    predicate sinkKind(string kind) { sinkModel(_, _, _, _, _, _, _, kind, _, _) }
+    predicate sinkKind(string kind) {
+      sinkModel(_, _, _, _, _, _, _, kind, _, _)
+      or
+      barrierModel(_, _, _, _, _, _, _, kind, _, _)
+      or
+      barrierGuardModel(_, _, _, _, _, _, _, _, kind, _, _)
+    }
 
     predicate sourceKind(string kind) { sourceModel(_, _, _, _, _, _, _, kind, _, _) }
 
@@ -373,6 +406,11 @@ module ModelValidation {
       or
       sinkModel(package, type, _, name, signature, ext, _, _, provenance, _) and pred = "sink"
       or
+      barrierModel(package, type, _, name, signature, ext, _, _, provenance, _) and pred = "barrier"
+      or
+      barrierGuardModel(package, type, _, name, signature, ext, _, _, _, provenance, _) and
+      pred = "barrier guard"
+      or
       summaryModel(package, type, _, name, signature, ext, _, _, _, provenance, _) and
       pred = "summary"
       or
@@ -398,6 +436,14 @@ module ModelValidation {
       invalidProvenance(provenance) and
       result = "Unrecognized provenance description \"" + provenance + "\" in " + pred + " model."
     )
+    or
+    exists(string acceptingvalue |
+      barrierGuardModel(_, _, _, _, _, _, _, acceptingvalue, _, _, _) and
+      invalidAcceptingValue(acceptingvalue) and
+      result =
+        "Unrecognized accepting value description \"" + acceptingvalue +
+          "\" in barrier guard model."
+    )
   }
 
   /** Holds if some row in a MaD flow model appears to contain typos. */
@@ -418,6 +464,10 @@ private predicate elementSpec(
   or
   sinkModel(package, type, subtypes, name, signature, ext, _, _, _, _)
   or
+  barrierModel(package, type, subtypes, name, signature, ext, _, _, _, _)
+  or
+  barrierGuardModel(package, type, subtypes, name, signature, ext, _, _, _, _, _)
+  or
   summaryModel(package, type, subtypes, name, signature, ext, _, _, _, _, _)
   or
   neutralModel(package, type, name, signature, _, _) and ext = "" and subtypes = true
@@ -578,6 +628,53 @@ private module Cached {
       isSinkNode(n, kind, model) and n.asNode() = node
     )
   }
+
+  private newtype TKindModelPair =
+    TMkPair(string kind, string model) { isBarrierGuardNode(_, _, kind, model) }
+
+  private GuardValue convertAcceptingValue(AcceptingValue av) {
+    av.isTrue() and result.asBooleanValue() = true
+    or
+    av.isFalse() and result.asBooleanValue() = false
+    or
+    av.isNoException() and result.getDualValue().isThrowsException()
+    or
+    av.isZero() and result.asIntValue() = 0
+    or
+    av.isNotZero() and result.getDualValue().asIntValue() = 0
+    or
+    av.isNull() and result.isNullValue()
+    or
+    av.isNotNull() and result.isNonNullValue()
+  }
+
+  private predicate barrierGuardChecks(Guard g, Expr e, GuardValue gv, TKindModelPair kmp) {
+    exists(
+      SourceSinkInterpretationInput::InterpretNode n, AcceptingValue acceptingvalue, string kind,
+      string model
+    |
+      isBarrierGuardNode(n, acceptingvalue, kind, model) and
+      n.asNode().asExpr() = e and
+      kmp = TMkPair(kind, model) and
+      gv = convertAcceptingValue(acceptingvalue)
+    |
+      g.(Call).getAnArgument() = e or g.(MethodCall).getQualifier() = e
+    )
+  }
+
+  /**
+   * Holds if `node` is specified as a barrier with the given kind in a MaD flow
+   * model.
+   */
+  cached
+  predicate barrierNode(Node node, string kind, string model) {
+    exists(SourceSinkInterpretationInput::InterpretNode n |
+      isBarrierNode(n, kind, model) and n.asNode() = node
+    )
+    or
+    ParameterizedBarrierGuard<TKindModelPair, barrierGuardChecks/4>::getABarrierNode(TMkPair(kind,
+        model)) = node
+  }
 }
 
 import Cached
@@ -594,6 +691,12 @@ predicate sourceNode(Node node, string kind) { sourceNode(node, kind, _) }
  */
 predicate sinkNode(Node node, string kind) { sinkNode(node, kind, _) }
 
+/**
+ * Holds if `node` is specified as a barrier with the given kind in a MaD flow
+ * model.
+ */
+predicate barrierNode(Node node, string kind) { barrierNode(node, kind, _) }
+
 // adapter class for converting Mad summaries to `SummarizedCallable`s
 private class SummarizedCallableAdapter extends SummarizedCallable {
   SummarizedCallableAdapter() { summaryElement(this, _, _, _, _, _, _) }

java/ql/lib/semmle/code/java/dataflow/internal/DataFlowDispatch.qll

@@ -60,7 +60,7 @@ private module DispatchImpl {
       not (
         // Only use summarized callables with generated summaries in case
         // the static call target is not in the source code.
-        // Note that if applyGeneratedModel holds it implies that there doesn't
+        // Note that if `applyGeneratedModel` holds it implies that there doesn't
         // exist a manual model.
         exists(Callable staticTarget | staticTarget = call.getCallee().getSourceDeclaration() |
           staticTarget.fromSource() and not staticTarget.isStub()

java/ql/lib/semmle/code/java/dataflow/internal/DataFlowUtil.qll

@@ -420,3 +420,31 @@ module BarrierGuard<guardChecksSig/3 guardChecks> {
   /** Gets a node that is safely guarded by the given guard check. */
   Node getABarrierNode() { result = BarrierGuardValue<guardChecks0/3>::getABarrierNode() }
 }
+
+bindingset[this]
+private signature class ParamSig;
+
+private module WithParam<ParamSig P> {
+  /**
+   * Holds if the guard `g` validates the expression `e` upon evaluating to `gv`.
+   *
+   * The expression `e` is expected to be a syntactic part of the guard `g`.
+   * For example, the guard `g` might be a call `isSafe(x)` and the expression `e`
+   * the argument `x`.
+   */
+  signature predicate guardChecksSig(Guard g, Expr e, GuardValue gv, P param);
+}
+
+/**
+ * Provides a set of barrier nodes for a guard that validates an expression.
+ *
+ * This is expected to be used in `isBarrier`/`isSanitizer` definitions
+ * in data flow and taint tracking.
+ */
+module ParameterizedBarrierGuard<ParamSig P, WithParam<P>::guardChecksSig/4 guardChecks> {
+  /** Gets a node that is safely guarded by the given guard check. */
+  Node getABarrierNode(P param) {
+    SsaFlow::asNode(result) =
+      SsaImpl::DataFlowIntegration::ParameterizedBarrierGuard<P, guardChecks/4>::getABarrierNode(param)
+  }
+}

java/ql/lib/semmle/code/java/dataflow/internal/ExternalFlowExtensions.qll

@@ -20,6 +20,22 @@ extensible predicate sinkModel(
   string input, string kind, string provenance, QlBuiltins::ExtensionId madId
 );
 
+/**
+ * Holds if a barrier model exists for the given parameters.
+ */
+extensible predicate barrierModel(
+  string package, string type, boolean subtypes, string name, string signature, string ext,
+  string output, string kind, string provenance, QlBuiltins::ExtensionId madId
+);
+
+/**
+ * Holds if a barrier guard model exists for the given parameters.
+ */
+extensible predicate barrierGuardModel(
+  string package, string type, boolean subtypes, string name, string signature, string ext,
+  string input, string acceptingvalue, string kind, string provenance, QlBuiltins::ExtensionId madId
+);
+
 /**
  * Holds if a summary model exists for the given parameters.
  */

java/ql/lib/semmle/code/java/dataflow/internal/FlowSummaryImpl.qll

@@ -158,7 +158,9 @@ private predicate relatedArgSpec(Callable c, string spec) {
     summaryModel(namespace, type, subtypes, name, signature, ext, spec, _, _, _, _) or
     summaryModel(namespace, type, subtypes, name, signature, ext, _, spec, _, _, _) or
     sourceModel(namespace, type, subtypes, name, signature, ext, spec, _, _, _) or
-    sinkModel(namespace, type, subtypes, name, signature, ext, spec, _, _, _)
+    sinkModel(namespace, type, subtypes, name, signature, ext, spec, _, _, _) or
+    barrierModel(namespace, type, subtypes, name, signature, ext, spec, _, _, _) or
+    barrierGuardModel(namespace, type, subtypes, name, signature, ext, spec, _, _, _, _)
   |
     c = interpretElement(namespace, type, subtypes, name, signature, ext, _)
   )
@@ -259,6 +261,45 @@ module SourceSinkInterpretationInput implements
     )
   }
 
+  predicate barrierElement(
+    Element e, string output, string kind, Public::Provenance provenance, string model
+  ) {
+    exists(
+      string namespace, string type, boolean subtypes, string name, string signature, string ext,
+      SourceOrSinkElement baseBarrier, string originalOutput, QlBuiltins::ExtensionId madId
+    |
+      barrierModel(namespace, type, subtypes, name, signature, ext, originalOutput, kind,
+        provenance, madId) and
+      model = "MaD:" + madId.toString() and
+      baseBarrier = interpretElement(namespace, type, subtypes, name, signature, ext, _) and
+      (
+        e = baseBarrier and output = originalOutput
+        or
+        correspondingKotlinParameterDefaultsArgSpec(baseBarrier, e, originalOutput, output)
+      )
+    )
+  }
+
+  predicate barrierGuardElement(
+    Element e, string input, Public::AcceptingValue acceptingvalue, string kind,
+    Public::Provenance provenance, string model
+  ) {
+    exists(
+      string namespace, string type, boolean subtypes, string name, string signature, string ext,
+      SourceOrSinkElement baseBarrier, string originalInput, QlBuiltins::ExtensionId madId
+    |
+      barrierGuardModel(namespace, type, subtypes, name, signature, ext, originalInput,
+        acceptingvalue, kind, provenance, madId) and
+      model = "MaD:" + madId.toString() and
+      baseBarrier = interpretElement(namespace, type, subtypes, name, signature, ext, _) and
+      (
+        e = baseBarrier and input = originalInput
+        or
+        correspondingKotlinParameterDefaultsArgSpec(baseBarrier, e, originalInput, input)
+      )
+    )
+  }
+
   class SourceOrSinkElement = Element;
 
   private newtype TInterpretNode =

java/ql/lib/semmle/code/java/dataflow/internal/SsaImpl.qll

@@ -588,6 +588,36 @@ private module Cached {
 
       predicate getABarrierNode = getABarrierNodeImpl/0;
     }
+
+    bindingset[this]
+    private signature class ParamSig;
+
+    private module WithParam<ParamSig P> {
+      signature predicate guardChecksSig(Guards::Guard g, Expr e, Guards::GuardValue gv, P param);
+    }
+
+    cached // nothing is actually cached
+    module ParameterizedBarrierGuard<ParamSig P, WithParam<P>::guardChecksSig/4 guardChecks> {
+      private predicate guardChecksAdjTypes(
+        Guards::Guards_v3::Guard g, Expr e, Guards::GuardValue gv, P param
+      ) {
+        guardChecks(g, e, gv, param)
+      }
+
+      private predicate guardChecksWithWrappers(
+        DataFlowIntegrationInput::Guard g, Definition def, Guards::GuardValue val, P param
+      ) {
+        Guards::Guards_v3::ParameterizedValidationWrapper<P, guardChecksAdjTypes/4>::guardChecksDef(g,
+          def, val, param)
+      }
+
+      private Node getABarrierNodeImpl(P param) {
+        result =
+          DataFlowIntegrationImpl::BarrierGuardDefWithState<P, guardChecksWithWrappers/4>::getABarrierNode(param)
+      }
+
+      predicate getABarrierNode = getABarrierNodeImpl/1;
+    }
   }
 
   cached

java/ql/lib/semmle/code/java/frameworks/hudson/Hudson.qll

@@ -14,14 +14,3 @@ class HudsonWebMethod extends Method {
     this.getDeclaringType().getASourceSupertype*().hasQualifiedName("hudson.model", "Descriptor")
   }
 }
-
-private class HudsonUtilXssSanitizer extends XssSanitizer {
-  HudsonUtilXssSanitizer() {
-    this.asExpr()
-        .(MethodCall)
-        .getMethod()
-        // Not including xmlEscape because it only accounts for >, <, and &.
-        // It does not account for ", or ', which makes it an incomplete XSS sanitizer.
-        .hasQualifiedName("hudson", "Util", "escape")
-  }
-}

java/ql/lib/semmle/code/java/frameworks/owasp/Esapi.qll

@@ -1,42 +0,0 @@
-/** Classes and predicates for reasoning about the `owasp.easpi` package. */
-overlay[local?]
-module;
-
-import java
-
-/**
- * The `org.owasp.esapi.Validator` interface.
- */
-class EsapiValidator extends RefType {
-  EsapiValidator() { this.hasQualifiedName("org.owasp.esapi", "Validator") }
-}
-
-/**
- * The methods of `org.owasp.esapi.Validator` which validate data.
- */
-class EsapiIsValidMethod extends Method {
-  EsapiIsValidMethod() {
-    this.getDeclaringType() instanceof EsapiValidator and
-    this.hasName([
-        "isValidCreditCard", "isValidDate", "isValidDirectoryPath", "isValidDouble",
-        "isValidFileContent", "isValidFileName", "isValidInput", "isValidInteger",
-        "isValidListItem", "isValidNumber", "isValidPrintable", "isValidRedirectLocation",
-        "isValidSafeHTML", "isValidURI"
-      ])
-  }
-}
-
-/**
- * The methods of `org.owasp.esapi.Validator` which return validated data.
- */
-class EsapiGetValidMethod extends Method {
-  EsapiGetValidMethod() {
-    this.getDeclaringType() instanceof EsapiValidator and
-    this.hasName([
-        "getValidCreditCard", "getValidDate", "getValidDirectoryPath", "getValidDouble",
-        "getValidFileContent", "getValidFileName", "getValidInput", "getValidInteger",
-        "getValidListItem", "getValidNumber", "getValidPrintable", "getValidRedirectLocation",
-        "getValidSafeHTML", "getValidURI"
-      ])
-  }
-}

java/ql/lib/semmle/code/java/security/PathSanitizer.qll

@@ -4,6 +4,7 @@ module;
 
 import java
 private import semmle.code.java.controlflow.Guards
+private import semmle.code.java.dataflow.ExternalFlow
 private import semmle.code.java.dataflow.FlowSources
 private import semmle.code.java.dataflow.SSA
 private import semmle.code.java.frameworks.kotlin.IO
@@ -288,19 +289,8 @@ private Method getSourceMethod(Method m) {
   result = m
 }
 
-/**
+private class DefaultPathInjectionSanitizer extends PathInjectionSanitizer {
- * A sanitizer that protects against path injection vulnerabilities
+  DefaultPathInjectionSanitizer() { barrierNode(this, "path-injection") }
- * by extracting the final component of the user provided path.
- *
- * TODO: convert this class to models-as-data if sanitizer support is added
- */
-private class FileGetNameSanitizer extends PathInjectionSanitizer {
-  FileGetNameSanitizer() {
-    exists(MethodCall mc |
-      mc.getMethod().hasQualifiedName("java.io", "File", "getName") and
-      this.asExpr() = mc
-    )
-  }
 }
 
 /** Holds if `g` is a guard that checks for `..` components. */

java/ql/lib/semmle/code/java/security/RequestForgery.qll

@@ -118,25 +118,8 @@ private class ContainsUrlSanitizer extends RequestForgerySanitizer {
   }
 }
 
-/**
+private class DefaultRequestForgerySanitizer extends RequestForgerySanitizer {
- * A check that the URL is relative, and therefore safe for URL redirects.
+  DefaultRequestForgerySanitizer() { barrierNode(this, "request-forgery") }
- */
-private predicate isRelativeUrlSanitizer(Guard guard, Expr e, boolean branch) {
-  guard =
-    any(MethodCall call |
-      call.getMethod().hasQualifiedName("java.net", "URI", "isAbsolute") and
-      e = call.getQualifier() and
-      branch = false
-    )
-}
-
-/**
- * A check that the URL is relative, and therefore safe for URL redirects.
- */
-private class RelativeUrlSanitizer extends RequestForgerySanitizer {
-  RelativeUrlSanitizer() {
-    this = DataFlow::BarrierGuard<isRelativeUrlSanitizer/3>::getABarrierNode()
-  }
 }
 
 /**

java/ql/lib/semmle/code/java/security/TrustBoundaryViolationQuery.qll

@@ -5,7 +5,6 @@ private import semmle.code.java.dataflow.DataFlow
 private import semmle.code.java.controlflow.Guards
 private import semmle.code.java.dataflow.ExternalFlow
 private import semmle.code.java.dataflow.FlowSources
-private import semmle.code.java.frameworks.owasp.Esapi
 private import semmle.code.java.security.Sanitizers
 
 /**
@@ -28,25 +27,8 @@ class TrustBoundaryViolationSink extends DataFlow::Node {
  */
 abstract class TrustBoundaryValidationSanitizer extends DataFlow::Node { }
 
-/**
+private class DefaultTrustBoundaryValidationSanitizer extends TrustBoundaryValidationSanitizer {
- * A node validated by an OWASP ESAPI validation method.
+  DefaultTrustBoundaryValidationSanitizer() { barrierNode(this, "trust-boundary-violation") }
- */
-private class EsapiValidatedInputSanitizer extends TrustBoundaryValidationSanitizer {
-  EsapiValidatedInputSanitizer() {
-    this = DataFlow::BarrierGuard<esapiIsValidData/3>::getABarrierNode() or
-    this.asExpr().(MethodCall).getMethod() instanceof EsapiGetValidMethod
-  }
-}
-
-/**
- * Holds if `g` is a guard that checks that `e` is valid data according to an OWASP ESAPI validation method.
- */
-private predicate esapiIsValidData(Guard g, Expr e, boolean branch) {
-  branch = true and
-  exists(MethodCall ma | ma.getMethod() instanceof EsapiIsValidMethod |
-    g = ma and
-    e = ma.getArgument(1)
-  )
 }
 
 /**

java/ql/lib/semmle/code/java/security/XSS.qll

@@ -54,12 +54,24 @@ private class DefaultXssSink extends XssSink {
   }
 }
 
-/** A default sanitizer that considers numeric and boolean typed data safe for writing to output. */
 private class DefaultXssSanitizer extends XssSanitizer {
-  DefaultXssSanitizer() {
+  DefaultXssSanitizer() { barrierNode(this, ["html-injection", "js-injection"]) }
+}
+
+/** A sanitizer that considers numeric and boolean typed data safe for writing to output. */
+private class PrimitiveSanitizer extends XssSanitizer {
+  PrimitiveSanitizer() {
     this.getType() instanceof NumericType or
-    this.getType() instanceof BooleanType or
+    this.getType() instanceof BooleanType
-    // Match `org.springframework.web.util.HtmlUtils.htmlEscape` and possibly other methods like it.
+  }
+}
+
+/**
+ * A call to `org.springframework.web.util.HtmlUtils.htmlEscape`, or possibly
+ * other methods like it, considered as a sanitizer for XSS.
+ */
+private class HtmlEscapeXssSanitizer extends XssSanitizer {
+  HtmlEscapeXssSanitizer() {
     this.asExpr().(MethodCall).getMethod().getName().regexpMatch("(?i)html_?escape.*")
   }
 }

java/ql/lib/semmle/code/java/security/regexp/RegexInjection.qll

@@ -21,17 +21,8 @@ private class DefaultRegexInjectionSink extends RegexInjectionSink {
   }
 }
 
-/**
+private class DefaultRegexInjectionSanitizer extends RegexInjectionSanitizer {
- * A call to the `Pattern.quote` method, which gives metacharacters or escape sequences
+  DefaultRegexInjectionSanitizer() { barrierNode(this, "regex-use") }
- * no special meaning.
- */
-private class PatternQuoteCall extends RegexInjectionSanitizer {
-  PatternQuoteCall() {
-    exists(MethodCall ma, Method m | m = ma.getMethod() |
-      ma.getArgument(0) = this.asExpr() and
-      m instanceof PatternQuoteMethod
-    )
-  }
 }
 
 /**

rust/ql/lib/codeql/rust/dataflow/internal/DataFlowImpl.qll

@@ -445,7 +445,15 @@ module RustDataFlow implements InputSig<Location> {
       or
       exists(SummarizedCallable sc, Function staticTarget |
         staticTarget = getStaticTargetExt(c) and
-        sc = result.asSummarizedCallable()
+        sc = result.asSummarizedCallable() and
+        // Only use summarized callables with generated summaries in case
+        // the static call target is not in the source code.
+        // Note that if `applyGeneratedModel` holds it implies that there doesn't
+        // exist a manual model.
+        not (
+          staticTarget.fromSource() and
+          sc.applyGeneratedModel()
+        )
       |
         sc = staticTarget
         or

rust/ql/lib/codeql/rust/internal/TypeInference.qll

@@ -267,11 +267,6 @@ private TypeMention getTypeAnnotation(AstNode n) {
     n = p.getPat() and
     result = p.getTypeRepr()
   )
-  or
-  exists(Function f |
-    result = getReturnTypeMention(f) and
-    n = f.getFunctionBody()
-  )
 }
 
 /** Gets the type of `n`, which has an explicit type annotation. */
@@ -282,6 +277,17 @@ private Type inferAnnotatedType(AstNode n, TypePath path) {
   result = n.(ShorthandSelfParameterMention).resolveTypeAt(path)
 }
 
+pragma[nomagic]
+private Type inferFunctionBodyType(AstNode n, TypePath path) {
+  exists(Function f |
+    n = f.getFunctionBody() and
+    result = getReturnTypeMention(f).resolveTypeAt(path) and
+    not exists(ImplTraitReturnType i | i.getFunction() = f |
+      result = i or result = i.getATypeParameter()
+    )
+  )
+}
+
 /**
  * Holds if `me` is a call to the `panic!` macro.
  *
@@ -419,6 +425,8 @@ module CertainTypeInference {
     result = inferAnnotatedType(n, path) and
     Stages::TypeInferenceStage::ref()
     or
+    result = inferFunctionBodyType(n, path)
+    or
     result = inferCertainCallExprType(n, path)
     or
     result = inferCertainTypeEquality(n, path)

rust/ql/test/library-tests/dataflow/sources/file/InlineFlow.expected

@@ -10,57 +10,43 @@ models
 | 9 | Source: <tokio::fs::read_dir::DirEntry>::file_name; ReturnValue; file |
 | 10 | Source: <tokio::fs::read_dir::DirEntry>::path; ReturnValue; file |
 | 11 | Source: std::fs::read; ReturnValue.Field[core::result::Result::Ok(0)]; file |
-| 12 | Source: std::fs::read; ReturnValue; file |
+| 12 | Source: std::fs::read_link; ReturnValue.Field[core::result::Result::Ok(0)]; file |
-| 13 | Source: std::fs::read_link; ReturnValue.Field[core::result::Result::Ok(0)]; file |
+| 13 | Source: std::fs::read_to_string; ReturnValue.Field[core::result::Result::Ok(0)]; file |
-| 14 | Source: std::fs::read_to_string; ReturnValue.Field[core::result::Result::Ok(0)]; file |
+| 14 | Source: tokio::fs::read::read; ReturnValue.Future.Field[core::result::Result::Ok(0)]; file |
-| 15 | Source: std::fs::read_to_string; ReturnValue; file |
+| 15 | Source: tokio::fs::read_link::read_link; ReturnValue.Future.Field[core::result::Result::Ok(0)]; file |
-| 16 | Source: tokio::fs::read::read; ReturnValue.Future.Field[core::result::Result::Ok(0)]; file |
+| 16 | Source: tokio::fs::read_to_string::read_to_string; ReturnValue.Future.Field[core::result::Result::Ok(0)]; file |
-| 17 | Source: tokio::fs::read_link::read_link; ReturnValue.Future.Field[core::result::Result::Ok(0)]; file |
+| 17 | Summary: <_ as async_std::io::read::ReadExt>::read; Argument[self].Reference; Argument[0].Reference; taint |
-| 18 | Source: tokio::fs::read_to_string::read_to_string; ReturnValue.Future.Field[core::result::Result::Ok(0)]; file |
+| 18 | Summary: <_ as core::clone::Clone>::clone; Argument[self].Reference; ReturnValue; value |
-| 19 | Summary: <_ as async_std::io::read::ReadExt>::read; Argument[self].Reference; Argument[0].Reference; taint |
+| 19 | Summary: <_ as std::io::Read>::bytes; Argument[self]; ReturnValue; taint |
-| 20 | Summary: <_ as core::clone::Clone>::clone; Argument[self].Reference; ReturnValue; value |
+| 20 | Summary: <_ as std::io::Read>::chain; Argument[0]; ReturnValue; taint |
-| 21 | Summary: <_ as std::io::Read>::bytes; Argument[self]; ReturnValue; taint |
+| 21 | Summary: <_ as std::io::Read>::chain; Argument[self]; ReturnValue; taint |
-| 22 | Summary: <_ as std::io::Read>::chain; Argument[0]; ReturnValue; taint |
+| 22 | Summary: <_ as std::io::Read>::read; Argument[self].Reference; Argument[0].Reference; taint |
-| 23 | Summary: <_ as std::io::Read>::chain; Argument[self]; ReturnValue; taint |
+| 23 | Summary: <_ as std::io::Read>::read_exact; Argument[self].Reference; Argument[0].Reference; taint |
-| 24 | Summary: <_ as std::io::Read>::read; Argument[self].Reference; Argument[0].Reference; taint |
+| 24 | Summary: <_ as std::io::Read>::read_to_end; Argument[self].Reference; Argument[0].Reference; taint |
-| 25 | Summary: <_ as std::io::Read>::read_exact; Argument[self].Reference; Argument[0].Reference; taint |
+| 25 | Summary: <_ as std::io::Read>::read_to_string; Argument[self].Reference; Argument[0].Reference; taint |
-| 26 | Summary: <_ as std::io::Read>::read_to_end; Argument[self].Reference; Argument[0].Reference; taint |
+| 26 | Summary: <_ as std::io::Read>::take; Argument[self]; ReturnValue; taint |
-| 27 | Summary: <_ as std::io::Read>::read_to_string; Argument[self].Reference; Argument[0].Reference; taint |
+| 27 | Summary: <_ as tokio::io::util::async_read_ext::AsyncReadExt>::read; Argument[self].Reference; Argument[0].Reference; taint |
-| 28 | Summary: <_ as std::io::Read>::take; Argument[self]; ReturnValue; taint |
+| 28 | Summary: <_ as tokio::io::util::async_read_ext::AsyncReadExt>::read_buf; Argument[self].Reference; Argument[0].Reference; taint |
-| 29 | Summary: <_ as tokio::io::util::async_read_ext::AsyncReadExt>::read; Argument[self].Reference; Argument[0].Reference; taint |
+| 29 | Summary: <_ as tokio::io::util::async_read_ext::AsyncReadExt>::read_exact; Argument[self].Reference; Argument[0].Reference; taint |
-| 30 | Summary: <_ as tokio::io::util::async_read_ext::AsyncReadExt>::read_buf; Argument[self].Reference; Argument[0].Reference; taint |
+| 30 | Summary: <_ as tokio::io::util::async_read_ext::AsyncReadExt>::read_f32; Argument[self].Reference; ReturnValue.Future.Field[core::result::Result::Ok(0)]; taint |
-| 31 | Summary: <_ as tokio::io::util::async_read_ext::AsyncReadExt>::read_exact; Argument[self].Reference; Argument[0].Reference; taint |
+| 31 | Summary: <_ as tokio::io::util::async_read_ext::AsyncReadExt>::read_i16; Argument[self].Reference; ReturnValue.Future.Field[core::result::Result::Ok(0)]; taint |
-| 32 | Summary: <_ as tokio::io::util::async_read_ext::AsyncReadExt>::read_f32; Argument[self].Reference; ReturnValue.Future.Field[core::result::Result::Ok(0)]; taint |
+| 32 | Summary: <_ as tokio::io::util::async_read_ext::AsyncReadExt>::read_i64_le; Argument[self].Reference; ReturnValue.Future.Field[core::result::Result::Ok(0)]; taint |
-| 33 | Summary: <_ as tokio::io::util::async_read_ext::AsyncReadExt>::read_i16; Argument[self].Reference; ReturnValue.Future.Field[core::result::Result::Ok(0)]; taint |
+| 33 | Summary: <_ as tokio::io::util::async_read_ext::AsyncReadExt>::read_to_end; Argument[self].Reference; Argument[0].Reference; taint |
-| 34 | Summary: <_ as tokio::io::util::async_read_ext::AsyncReadExt>::read_i64_le; Argument[self].Reference; ReturnValue.Future.Field[core::result::Result::Ok(0)]; taint |
+| 34 | Summary: <_ as tokio::io::util::async_read_ext::AsyncReadExt>::read_to_string; Argument[self].Reference; Argument[0].Reference; taint |
-| 35 | Summary: <_ as tokio::io::util::async_read_ext::AsyncReadExt>::read_to_end; Argument[self].Reference; Argument[0].Reference; taint |
+| 35 | Summary: <_ as tokio::io::util::async_read_ext::AsyncReadExt>::read_u8; Argument[self].Reference; ReturnValue.Future.Field[core::result::Result::Ok(0)]; taint |
-| 36 | Summary: <_ as tokio::io::util::async_read_ext::AsyncReadExt>::read_to_string; Argument[self].Reference; Argument[0].Reference; taint |
+| 36 | Summary: <core::result::Result>::unwrap; Argument[self].Field[core::result::Result::Ok(0)]; ReturnValue; value |
-| 37 | Summary: <_ as tokio::io::util::async_read_ext::AsyncReadExt>::read_u8; Argument[self].Reference; ReturnValue.Future.Field[core::result::Result::Ok(0)]; taint |
+| 37 | Summary: <std::path::PathBuf>::as_path; Argument[self]; ReturnValue; value |
-| 38 | Summary: <core::result::Result>::unwrap; Argument[self].Field[core::result::Result::Ok(0)]; ReturnValue; value |
-| 39 | Summary: <std::path::PathBuf>::as_path; Argument[self]; ReturnValue; value |
 edges
 | test.rs:12:13:12:18 | buffer | test.rs:13:14:13:19 | buffer | provenance |  |
-| test.rs:12:31:12:43 | ...::read | test.rs:12:31:12:43 | ...::read [Ok] | provenance | Src:MaD:11  |
-| test.rs:12:31:12:43 | ...::read | test.rs:12:31:12:55 | ...::read(...) | provenance | Src:MaD:12 MaD:12 |
 | test.rs:12:31:12:43 | ...::read | test.rs:12:31:12:55 | ...::read(...) [Ok] | provenance | Src:MaD:11  |
-| test.rs:12:31:12:43 | ...::read [Ok] | test.rs:12:31:12:55 | ...::read(...) [Ok] | provenance | MaD:12 |
-| test.rs:12:31:12:55 | ...::read(...) | test.rs:12:13:12:18 | buffer | provenance |  |
 | test.rs:12:31:12:55 | ...::read(...) [Ok] | test.rs:12:31:12:56 | TryExpr | provenance |  |
 | test.rs:12:31:12:56 | TryExpr | test.rs:12:13:12:18 | buffer | provenance |  |
 | test.rs:17:13:17:18 | buffer | test.rs:18:14:18:19 | buffer | provenance |  |
-| test.rs:17:31:17:38 | ...::read | test.rs:17:31:17:38 | ...::read [Ok] | provenance | Src:MaD:11  |
-| test.rs:17:31:17:38 | ...::read | test.rs:17:31:17:50 | ...::read(...) | provenance | Src:MaD:12 MaD:12 |
 | test.rs:17:31:17:38 | ...::read | test.rs:17:31:17:50 | ...::read(...) [Ok] | provenance | Src:MaD:11  |
-| test.rs:17:31:17:38 | ...::read [Ok] | test.rs:17:31:17:50 | ...::read(...) [Ok] | provenance | MaD:12 |
-| test.rs:17:31:17:50 | ...::read(...) | test.rs:17:13:17:18 | buffer | provenance |  |
 | test.rs:17:31:17:50 | ...::read(...) [Ok] | test.rs:17:31:17:51 | TryExpr | provenance |  |
 | test.rs:17:31:17:51 | TryExpr | test.rs:17:13:17:18 | buffer | provenance |  |
 | test.rs:22:13:22:18 | buffer | test.rs:23:14:23:19 | buffer | provenance |  |
-| test.rs:22:22:22:39 | ...::read_to_string | test.rs:22:22:22:39 | ...::read_to_string [Ok] | provenance | Src:MaD:14  |
+| test.rs:22:22:22:39 | ...::read_to_string | test.rs:22:22:22:51 | ...::read_to_string(...) [Ok] | provenance | Src:MaD:13  |
-| test.rs:22:22:22:39 | ...::read_to_string | test.rs:22:22:22:51 | ...::read_to_string(...) | provenance | Src:MaD:15 MaD:15 |
-| test.rs:22:22:22:39 | ...::read_to_string | test.rs:22:22:22:51 | ...::read_to_string(...) [Ok] | provenance | Src:MaD:14  |
-| test.rs:22:22:22:39 | ...::read_to_string [Ok] | test.rs:22:22:22:51 | ...::read_to_string(...) [Ok] | provenance | MaD:15 |
-| test.rs:22:22:22:51 | ...::read_to_string(...) | test.rs:22:13:22:18 | buffer | provenance |  |
 | test.rs:22:22:22:51 | ...::read_to_string(...) [Ok] | test.rs:22:22:22:52 | TryExpr | provenance |  |
 | test.rs:22:22:22:52 | TryExpr | test.rs:22:13:22:18 | buffer | provenance |  |
 | test.rs:29:13:29:16 | path | test.rs:30:14:30:17 | path | provenance |  |
@@ -68,43 +54,41 @@ edges
 | test.rs:29:13:29:16 | path | test.rs:41:14:41:17 | path | provenance |  |
 | test.rs:29:20:29:27 | e.path() | test.rs:29:13:29:16 | path | provenance |  |
 | test.rs:29:22:29:25 | path | test.rs:29:20:29:27 | e.path() | provenance | Src:MaD:4 MaD:4 |
-| test.rs:30:14:30:17 | path | test.rs:30:14:30:25 | path.clone() | provenance | MaD:20 |
+| test.rs:30:14:30:17 | path | test.rs:30:14:30:25 | path.clone() | provenance | MaD:18 |
-| test.rs:31:14:31:17 | path | test.rs:31:14:31:25 | path.clone() | provenance | MaD:20 |
+| test.rs:31:14:31:17 | path | test.rs:31:14:31:25 | path.clone() | provenance | MaD:18 |
-| test.rs:31:14:31:25 | path.clone() | test.rs:31:14:31:35 | ... .as_path() | provenance | MaD:39 |
+| test.rs:31:14:31:25 | path.clone() | test.rs:31:14:31:35 | ... .as_path() | provenance | MaD:37 |
 | test.rs:43:13:43:21 | file_name | test.rs:44:14:44:22 | file_name | provenance |  |
 | test.rs:43:13:43:21 | file_name | test.rs:49:14:49:22 | file_name | provenance |  |
 | test.rs:43:25:43:37 | e.file_name() | test.rs:43:13:43:21 | file_name | provenance |  |
 | test.rs:43:27:43:35 | file_name | test.rs:43:25:43:37 | e.file_name() | provenance | Src:MaD:3 MaD:3 |
-| test.rs:44:14:44:22 | file_name | test.rs:44:14:44:30 | file_name.clone() | provenance | MaD:20 |
+| test.rs:44:14:44:22 | file_name | test.rs:44:14:44:30 | file_name.clone() | provenance | MaD:18 |
 | test.rs:65:13:65:18 | target | test.rs:66:14:66:19 | target | provenance |  |
-| test.rs:65:22:65:34 | ...::read_link | test.rs:65:22:65:49 | ...::read_link(...) [Ok] | provenance | Src:MaD:13  |
+| test.rs:65:22:65:34 | ...::read_link | test.rs:65:22:65:49 | ...::read_link(...) [Ok] | provenance | Src:MaD:12  |
 | test.rs:65:22:65:49 | ...::read_link(...) [Ok] | test.rs:65:22:65:50 | TryExpr | provenance |  |
 | test.rs:65:22:65:50 | TryExpr | test.rs:65:13:65:18 | target | provenance |  |
 | test.rs:74:13:74:18 | buffer | test.rs:75:14:75:19 | buffer | provenance |  |
-| test.rs:74:31:74:45 | ...::read | test.rs:74:31:74:57 | ...::read(...) [future, Ok] | provenance | Src:MaD:16  |
+| test.rs:74:31:74:45 | ...::read | test.rs:74:31:74:57 | ...::read(...) [future, Ok] | provenance | Src:MaD:14  |
 | test.rs:74:31:74:57 | ...::read(...) [future, Ok] | test.rs:74:31:74:63 | await ... [Ok] | provenance |  |
 | test.rs:74:31:74:63 | await ... [Ok] | test.rs:74:31:74:64 | TryExpr | provenance |  |
 | test.rs:74:31:74:64 | TryExpr | test.rs:74:13:74:18 | buffer | provenance |  |
 | test.rs:79:13:79:18 | buffer | test.rs:80:14:80:19 | buffer | provenance |  |
-| test.rs:79:31:79:45 | ...::read | test.rs:79:31:79:57 | ...::read(...) [future, Ok] | provenance | Src:MaD:16  |
+| test.rs:79:31:79:45 | ...::read | test.rs:79:31:79:57 | ...::read(...) [future, Ok] | provenance | Src:MaD:14  |
 | test.rs:79:31:79:57 | ...::read(...) [future, Ok] | test.rs:79:31:79:63 | await ... [Ok] | provenance |  |
 | test.rs:79:31:79:63 | await ... [Ok] | test.rs:79:31:79:64 | TryExpr | provenance |  |
 | test.rs:79:31:79:64 | TryExpr | test.rs:79:13:79:18 | buffer | provenance |  |
 | test.rs:84:13:84:18 | buffer | test.rs:85:14:85:19 | buffer | provenance |  |
-| test.rs:84:22:84:46 | ...::read_to_string | test.rs:84:22:84:58 | ...::read_to_string(...) [future, Ok] | provenance | Src:MaD:18  |
+| test.rs:84:22:84:46 | ...::read_to_string | test.rs:84:22:84:58 | ...::read_to_string(...) [future, Ok] | provenance | Src:MaD:16  |
 | test.rs:84:22:84:58 | ...::read_to_string(...) [future, Ok] | test.rs:84:22:84:64 | await ... [Ok] | provenance |  |
 | test.rs:84:22:84:64 | await ... [Ok] | test.rs:84:22:84:65 | TryExpr | provenance |  |
 | test.rs:84:22:84:65 | TryExpr | test.rs:84:13:84:18 | buffer | provenance |  |
 | test.rs:90:13:90:16 | path | test.rs:92:14:92:17 | path | provenance |  |
 | test.rs:90:20:90:31 | entry.path() | test.rs:90:13:90:16 | path | provenance |  |
 | test.rs:90:26:90:29 | path | test.rs:90:20:90:31 | entry.path() | provenance | Src:MaD:10 MaD:10 |
-| test.rs:90:26:90:29 | path | test.rs:90:20:90:31 | entry.path() | provenance | Src:MaD:10 MaD:10 |
 | test.rs:91:13:91:21 | file_name | test.rs:93:14:93:22 | file_name | provenance |  |
 | test.rs:91:25:91:41 | entry.file_name() | test.rs:91:13:91:21 | file_name | provenance |  |
 | test.rs:91:31:91:39 | file_name | test.rs:91:25:91:41 | entry.file_name() | provenance | Src:MaD:9 MaD:9 |
-| test.rs:91:31:91:39 | file_name | test.rs:91:25:91:41 | entry.file_name() | provenance | Src:MaD:9 MaD:9 |
 | test.rs:97:13:97:18 | target | test.rs:98:14:98:19 | target | provenance |  |
-| test.rs:97:22:97:41 | ...::read_link | test.rs:97:22:97:56 | ...::read_link(...) [future, Ok] | provenance | Src:MaD:17  |
+| test.rs:97:22:97:41 | ...::read_link | test.rs:97:22:97:56 | ...::read_link(...) [future, Ok] | provenance | Src:MaD:15  |
 | test.rs:97:22:97:56 | ...::read_link(...) [future, Ok] | test.rs:97:22:97:62 | await ... [Ok] | provenance |  |
 | test.rs:97:22:97:62 | await ... [Ok] | test.rs:97:22:97:63 | TryExpr | provenance |  |
 | test.rs:97:22:97:63 | TryExpr | test.rs:97:13:97:18 | target | provenance |  |
@@ -116,45 +100,45 @@ edges
 | test.rs:107:20:107:38 | ...::open | test.rs:107:20:107:50 | ...::open(...) [Ok] | provenance | Src:MaD:5  |
 | test.rs:107:20:107:50 | ...::open(...) [Ok] | test.rs:107:20:107:51 | TryExpr | provenance |  |
 | test.rs:107:20:107:51 | TryExpr | test.rs:107:9:107:16 | mut file | provenance |  |
-| test.rs:111:22:111:25 | file | test.rs:111:32:111:42 | [post] &mut buffer [&ref] | provenance | MaD:24 |
+| test.rs:111:22:111:25 | file | test.rs:111:32:111:42 | [post] &mut buffer [&ref] | provenance | MaD:22 |
 | test.rs:111:32:111:42 | [post] &mut buffer [&ref] | test.rs:111:37:111:42 | [post] buffer | provenance |  |
 | test.rs:111:37:111:42 | [post] buffer | test.rs:112:15:112:20 | buffer | provenance |  |
 | test.rs:112:15:112:20 | buffer | test.rs:112:14:112:20 | &buffer | provenance |  |
-| test.rs:117:22:117:25 | file | test.rs:117:39:117:49 | [post] &mut buffer [&ref] | provenance | MaD:26 |
+| test.rs:117:22:117:25 | file | test.rs:117:39:117:49 | [post] &mut buffer [&ref] | provenance | MaD:24 |
 | test.rs:117:39:117:49 | [post] &mut buffer [&ref] | test.rs:117:44:117:49 | [post] buffer | provenance |  |
 | test.rs:117:44:117:49 | [post] buffer | test.rs:118:15:118:20 | buffer | provenance |  |
 | test.rs:118:15:118:20 | buffer | test.rs:118:14:118:20 | &buffer | provenance |  |
-| test.rs:123:22:123:25 | file | test.rs:123:42:123:52 | [post] &mut buffer [&ref] | provenance | MaD:27 |
+| test.rs:123:22:123:25 | file | test.rs:123:42:123:52 | [post] &mut buffer [&ref] | provenance | MaD:25 |
 | test.rs:123:42:123:52 | [post] &mut buffer [&ref] | test.rs:123:47:123:52 | [post] buffer | provenance |  |
 | test.rs:123:47:123:52 | [post] buffer | test.rs:124:15:124:20 | buffer | provenance |  |
 | test.rs:124:15:124:20 | buffer | test.rs:124:14:124:20 | &buffer | provenance |  |
-| test.rs:129:9:129:12 | file | test.rs:129:25:129:35 | [post] &mut buffer [&ref] | provenance | MaD:25 |
+| test.rs:129:9:129:12 | file | test.rs:129:25:129:35 | [post] &mut buffer [&ref] | provenance | MaD:23 |
 | test.rs:129:25:129:35 | [post] &mut buffer [&ref] | test.rs:129:30:129:35 | [post] buffer | provenance |  |
 | test.rs:129:30:129:35 | [post] buffer | test.rs:130:15:130:20 | buffer | provenance |  |
 | test.rs:130:15:130:20 | buffer | test.rs:130:14:130:20 | &buffer | provenance |  |
-| test.rs:133:17:133:20 | file | test.rs:133:17:133:28 | file.bytes() | provenance | MaD:21 |
+| test.rs:133:17:133:20 | file | test.rs:133:17:133:28 | file.bytes() | provenance | MaD:19 |
 | test.rs:133:17:133:28 | file.bytes() | test.rs:134:14:134:17 | byte | provenance |  |
 | test.rs:140:13:140:18 | mut f1 | test.rs:142:22:142:23 | f1 | provenance |  |
-| test.rs:140:22:140:63 | ... .open(...) [Ok] | test.rs:140:22:140:72 | ... .unwrap() | provenance | MaD:38 |
+| test.rs:140:22:140:63 | ... .open(...) [Ok] | test.rs:140:22:140:72 | ... .unwrap() | provenance | MaD:36 |
 | test.rs:140:22:140:72 | ... .unwrap() | test.rs:140:13:140:18 | mut f1 | provenance |  |
 | test.rs:140:50:140:53 | open | test.rs:140:22:140:63 | ... .open(...) [Ok] | provenance | Src:MaD:6  |
-| test.rs:142:22:142:23 | f1 | test.rs:142:30:142:40 | [post] &mut buffer [&ref] | provenance | MaD:24 |
+| test.rs:142:22:142:23 | f1 | test.rs:142:30:142:40 | [post] &mut buffer [&ref] | provenance | MaD:22 |
 | test.rs:142:30:142:40 | [post] &mut buffer [&ref] | test.rs:142:35:142:40 | [post] buffer | provenance |  |
 | test.rs:142:35:142:40 | [post] buffer | test.rs:143:15:143:20 | buffer | provenance |  |
 | test.rs:143:15:143:20 | buffer | test.rs:143:14:143:20 | &buffer | provenance |  |
 | test.rs:147:13:147:18 | mut f2 | test.rs:149:22:149:23 | f2 | provenance |  |
-| test.rs:147:22:147:80 | ... .open(...) [Ok] | test.rs:147:22:147:89 | ... .unwrap() | provenance | MaD:38 |
+| test.rs:147:22:147:80 | ... .open(...) [Ok] | test.rs:147:22:147:89 | ... .unwrap() | provenance | MaD:36 |
 | test.rs:147:22:147:89 | ... .unwrap() | test.rs:147:13:147:18 | mut f2 | provenance |  |
 | test.rs:147:67:147:70 | open | test.rs:147:22:147:80 | ... .open(...) [Ok] | provenance | Src:MaD:6  |
-| test.rs:149:22:149:23 | f2 | test.rs:149:30:149:40 | [post] &mut buffer [&ref] | provenance | MaD:24 |
+| test.rs:149:22:149:23 | f2 | test.rs:149:30:149:40 | [post] &mut buffer [&ref] | provenance | MaD:22 |
 | test.rs:149:30:149:40 | [post] &mut buffer [&ref] | test.rs:149:35:149:40 | [post] buffer | provenance |  |
 | test.rs:149:35:149:40 | [post] buffer | test.rs:150:15:150:20 | buffer | provenance |  |
 | test.rs:150:15:150:20 | buffer | test.rs:150:14:150:20 | &buffer | provenance |  |
 | test.rs:154:13:154:18 | mut f3 | test.rs:156:22:156:23 | f3 | provenance |  |
-| test.rs:154:22:154:114 | ... .open(...) [Ok] | test.rs:154:22:154:123 | ... .unwrap() | provenance | MaD:38 |
+| test.rs:154:22:154:114 | ... .open(...) [Ok] | test.rs:154:22:154:123 | ... .unwrap() | provenance | MaD:36 |
 | test.rs:154:22:154:123 | ... .unwrap() | test.rs:154:13:154:18 | mut f3 | provenance |  |
 | test.rs:154:101:154:104 | open | test.rs:154:22:154:114 | ... .open(...) [Ok] | provenance | Src:MaD:6  |
-| test.rs:156:22:156:23 | f3 | test.rs:156:30:156:40 | [post] &mut buffer [&ref] | provenance | MaD:24 |
+| test.rs:156:22:156:23 | f3 | test.rs:156:30:156:40 | [post] &mut buffer [&ref] | provenance | MaD:22 |
 | test.rs:156:30:156:40 | [post] &mut buffer [&ref] | test.rs:156:35:156:40 | [post] buffer | provenance |  |
 | test.rs:156:35:156:40 | [post] buffer | test.rs:157:15:157:20 | buffer | provenance |  |
 | test.rs:157:15:157:20 | buffer | test.rs:157:14:157:20 | &buffer | provenance |  |
@@ -167,10 +151,10 @@ edges
 | test.rs:165:21:165:59 | ...::open(...) [Ok] | test.rs:165:21:165:60 | TryExpr | provenance |  |
 | test.rs:165:21:165:60 | TryExpr | test.rs:165:13:165:17 | file2 | provenance |  |
 | test.rs:166:13:166:22 | mut reader | test.rs:167:9:167:14 | reader | provenance |  |
-| test.rs:166:26:166:30 | file1 | test.rs:166:26:166:43 | file1.chain(...) | provenance | MaD:23 |
+| test.rs:166:26:166:30 | file1 | test.rs:166:26:166:43 | file1.chain(...) | provenance | MaD:21 |
 | test.rs:166:26:166:43 | file1.chain(...) | test.rs:166:13:166:22 | mut reader | provenance |  |
-| test.rs:166:38:166:42 | file2 | test.rs:166:26:166:43 | file1.chain(...) | provenance | MaD:22 |
+| test.rs:166:38:166:42 | file2 | test.rs:166:26:166:43 | file1.chain(...) | provenance | MaD:20 |
-| test.rs:167:9:167:14 | reader | test.rs:167:31:167:41 | [post] &mut buffer [&ref] | provenance | MaD:27 |
+| test.rs:167:9:167:14 | reader | test.rs:167:31:167:41 | [post] &mut buffer [&ref] | provenance | MaD:25 |
 | test.rs:167:31:167:41 | [post] &mut buffer [&ref] | test.rs:167:36:167:41 | [post] buffer | provenance |  |
 | test.rs:167:36:167:41 | [post] buffer | test.rs:168:15:168:20 | buffer | provenance |  |
 | test.rs:168:15:168:20 | buffer | test.rs:168:14:168:20 | &buffer | provenance |  |
@@ -179,9 +163,9 @@ edges
 | test.rs:173:21:173:51 | ...::open(...) [Ok] | test.rs:173:21:173:52 | TryExpr | provenance |  |
 | test.rs:173:21:173:52 | TryExpr | test.rs:173:13:173:17 | file1 | provenance |  |
 | test.rs:174:13:174:22 | mut reader | test.rs:175:9:175:14 | reader | provenance |  |
-| test.rs:174:26:174:30 | file1 | test.rs:174:26:174:40 | file1.take(...) | provenance | MaD:28 |
+| test.rs:174:26:174:30 | file1 | test.rs:174:26:174:40 | file1.take(...) | provenance | MaD:26 |
 | test.rs:174:26:174:40 | file1.take(...) | test.rs:174:13:174:22 | mut reader | provenance |  |
-| test.rs:175:9:175:14 | reader | test.rs:175:31:175:41 | [post] &mut buffer [&ref] | provenance | MaD:27 |
+| test.rs:175:9:175:14 | reader | test.rs:175:31:175:41 | [post] &mut buffer [&ref] | provenance | MaD:25 |
 | test.rs:175:31:175:41 | [post] &mut buffer [&ref] | test.rs:175:36:175:41 | [post] buffer | provenance |  |
 | test.rs:175:36:175:41 | [post] buffer | test.rs:176:15:176:20 | buffer | provenance |  |
 | test.rs:176:15:176:20 | buffer | test.rs:176:14:176:20 | &buffer | provenance |  |
@@ -198,43 +182,43 @@ edges
 | test.rs:185:20:185:52 | ...::open(...) [future, Ok] | test.rs:185:20:185:58 | await ... [Ok] | provenance |  |
 | test.rs:185:20:185:58 | await ... [Ok] | test.rs:185:20:185:59 | TryExpr | provenance |  |
 | test.rs:185:20:185:59 | TryExpr | test.rs:185:9:185:16 | mut file | provenance |  |
-| test.rs:189:22:189:25 | file | test.rs:189:32:189:42 | [post] &mut buffer [&ref] | provenance | MaD:29 |
+| test.rs:189:22:189:25 | file | test.rs:189:32:189:42 | [post] &mut buffer [&ref] | provenance | MaD:27 |
 | test.rs:189:32:189:42 | [post] &mut buffer [&ref] | test.rs:189:37:189:42 | [post] buffer | provenance |  |
 | test.rs:189:37:189:42 | [post] buffer | test.rs:190:15:190:20 | buffer | provenance |  |
 | test.rs:190:15:190:20 | buffer | test.rs:190:14:190:20 | &buffer | provenance |  |
-| test.rs:195:22:195:25 | file | test.rs:195:39:195:49 | [post] &mut buffer [&ref] | provenance | MaD:35 |
+| test.rs:195:22:195:25 | file | test.rs:195:39:195:49 | [post] &mut buffer [&ref] | provenance | MaD:33 |
 | test.rs:195:39:195:49 | [post] &mut buffer [&ref] | test.rs:195:44:195:49 | [post] buffer | provenance |  |
 | test.rs:195:44:195:49 | [post] buffer | test.rs:196:15:196:20 | buffer | provenance |  |
 | test.rs:196:15:196:20 | buffer | test.rs:196:14:196:20 | &buffer | provenance |  |
-| test.rs:201:22:201:25 | file | test.rs:201:42:201:52 | [post] &mut buffer [&ref] | provenance | MaD:36 |
+| test.rs:201:22:201:25 | file | test.rs:201:42:201:52 | [post] &mut buffer [&ref] | provenance | MaD:34 |
 | test.rs:201:42:201:52 | [post] &mut buffer [&ref] | test.rs:201:47:201:52 | [post] buffer | provenance |  |
 | test.rs:201:47:201:52 | [post] buffer | test.rs:202:15:202:20 | buffer | provenance |  |
 | test.rs:202:15:202:20 | buffer | test.rs:202:14:202:20 | &buffer | provenance |  |
-| test.rs:207:9:207:12 | file | test.rs:207:25:207:35 | [post] &mut buffer [&ref] | provenance | MaD:31 |
+| test.rs:207:9:207:12 | file | test.rs:207:25:207:35 | [post] &mut buffer [&ref] | provenance | MaD:29 |
 | test.rs:207:25:207:35 | [post] &mut buffer [&ref] | test.rs:207:30:207:35 | [post] buffer | provenance |  |
 | test.rs:207:30:207:35 | [post] buffer | test.rs:208:15:208:20 | buffer | provenance |  |
 | test.rs:208:15:208:20 | buffer | test.rs:208:14:208:20 | &buffer | provenance |  |
 | test.rs:212:13:212:14 | v1 | test.rs:216:14:216:15 | v1 | provenance |  |
-| test.rs:212:18:212:21 | file | test.rs:212:18:212:31 | file.read_u8() [future, Ok] | provenance | MaD:37 |
+| test.rs:212:18:212:21 | file | test.rs:212:18:212:31 | file.read_u8() [future, Ok] | provenance | MaD:35 |
 | test.rs:212:18:212:31 | file.read_u8() [future, Ok] | test.rs:212:18:212:37 | await ... [Ok] | provenance |  |
 | test.rs:212:18:212:37 | await ... [Ok] | test.rs:212:18:212:38 | TryExpr | provenance |  |
 | test.rs:212:18:212:38 | TryExpr | test.rs:212:13:212:14 | v1 | provenance |  |
 | test.rs:213:13:213:14 | v2 | test.rs:217:14:217:15 | v2 | provenance |  |
-| test.rs:213:18:213:21 | file | test.rs:213:18:213:32 | file.read_i16() [future, Ok] | provenance | MaD:33 |
+| test.rs:213:18:213:21 | file | test.rs:213:18:213:32 | file.read_i16() [future, Ok] | provenance | MaD:31 |
 | test.rs:213:18:213:32 | file.read_i16() [future, Ok] | test.rs:213:18:213:38 | await ... [Ok] | provenance |  |
 | test.rs:213:18:213:38 | await ... [Ok] | test.rs:213:18:213:39 | TryExpr | provenance |  |
 | test.rs:213:18:213:39 | TryExpr | test.rs:213:13:213:14 | v2 | provenance |  |
 | test.rs:214:13:214:14 | v3 | test.rs:218:14:218:15 | v3 | provenance |  |
-| test.rs:214:18:214:21 | file | test.rs:214:18:214:32 | file.read_f32() [future, Ok] | provenance | MaD:32 |
+| test.rs:214:18:214:21 | file | test.rs:214:18:214:32 | file.read_f32() [future, Ok] | provenance | MaD:30 |
 | test.rs:214:18:214:32 | file.read_f32() [future, Ok] | test.rs:214:18:214:38 | await ... [Ok] | provenance |  |
 | test.rs:214:18:214:38 | await ... [Ok] | test.rs:214:18:214:39 | TryExpr | provenance |  |
 | test.rs:214:18:214:39 | TryExpr | test.rs:214:13:214:14 | v3 | provenance |  |
 | test.rs:215:13:215:14 | v4 | test.rs:219:14:219:15 | v4 | provenance |  |
-| test.rs:215:18:215:21 | file | test.rs:215:18:215:35 | file.read_i64_le() [future, Ok] | provenance | MaD:34 |
+| test.rs:215:18:215:21 | file | test.rs:215:18:215:35 | file.read_i64_le() [future, Ok] | provenance | MaD:32 |
 | test.rs:215:18:215:35 | file.read_i64_le() [future, Ok] | test.rs:215:18:215:41 | await ... [Ok] | provenance |  |
 | test.rs:215:18:215:41 | await ... [Ok] | test.rs:215:18:215:42 | TryExpr | provenance |  |
 | test.rs:215:18:215:42 | TryExpr | test.rs:215:13:215:14 | v4 | provenance |  |
-| test.rs:224:9:224:12 | file | test.rs:224:23:224:33 | [post] &mut buffer [&ref] | provenance | MaD:30 |
+| test.rs:224:9:224:12 | file | test.rs:224:23:224:33 | [post] &mut buffer [&ref] | provenance | MaD:28 |
 | test.rs:224:23:224:33 | [post] &mut buffer [&ref] | test.rs:224:28:224:33 | [post] buffer | provenance |  |
 | test.rs:224:28:224:33 | [post] buffer | test.rs:225:15:225:20 | buffer | provenance |  |
 | test.rs:225:15:225:20 | buffer | test.rs:225:14:225:20 | &buffer | provenance |  |
@@ -243,7 +227,7 @@ edges
 | test.rs:231:22:231:71 | await ... [Ok] | test.rs:231:22:231:72 | TryExpr | provenance |  |
 | test.rs:231:22:231:72 | TryExpr | test.rs:231:13:231:18 | mut f1 | provenance |  |
 | test.rs:231:52:231:55 | open | test.rs:231:22:231:65 | ... .open(...) [future, Ok] | provenance | Src:MaD:8  |
-| test.rs:233:22:233:23 | f1 | test.rs:233:30:233:40 | [post] &mut buffer [&ref] | provenance | MaD:29 |
+| test.rs:233:22:233:23 | f1 | test.rs:233:30:233:40 | [post] &mut buffer [&ref] | provenance | MaD:27 |
 | test.rs:233:30:233:40 | [post] &mut buffer [&ref] | test.rs:233:35:233:40 | [post] buffer | provenance |  |
 | test.rs:233:35:233:40 | [post] buffer | test.rs:234:15:234:20 | buffer | provenance |  |
 | test.rs:234:15:234:20 | buffer | test.rs:234:14:234:20 | &buffer | provenance |  |
@@ -252,7 +236,7 @@ edges
 | test.rs:262:20:262:56 | ...::open(...) [future, Ok] | test.rs:262:20:262:62 | await ... [Ok] | provenance |  |
 | test.rs:262:20:262:62 | await ... [Ok] | test.rs:262:20:262:63 | TryExpr | provenance |  |
 | test.rs:262:20:262:63 | TryExpr | test.rs:262:9:262:16 | mut file | provenance |  |
-| test.rs:266:22:266:25 | file | test.rs:266:32:266:42 | [post] &mut buffer [&ref] | provenance | MaD:19 |
+| test.rs:266:22:266:25 | file | test.rs:266:32:266:42 | [post] &mut buffer [&ref] | provenance | MaD:17 |
 | test.rs:266:32:266:42 | [post] &mut buffer [&ref] | test.rs:266:37:266:42 | [post] buffer | provenance |  |
 | test.rs:266:37:266:42 | [post] buffer | test.rs:267:15:267:20 | buffer | provenance |  |
 | test.rs:267:15:267:20 | buffer | test.rs:267:14:267:20 | &buffer | provenance |  |
@@ -261,32 +245,23 @@ edges
 | test.rs:273:22:273:75 | await ... [Ok] | test.rs:273:22:273:76 | TryExpr | provenance |  |
 | test.rs:273:22:273:76 | TryExpr | test.rs:273:13:273:18 | mut f1 | provenance |  |
 | test.rs:273:56:273:59 | open | test.rs:273:22:273:69 | ... .open(...) [future, Ok] | provenance | Src:MaD:2  |
-| test.rs:275:22:275:23 | f1 | test.rs:275:30:275:40 | [post] &mut buffer [&ref] | provenance | MaD:19 |
+| test.rs:275:22:275:23 | f1 | test.rs:275:30:275:40 | [post] &mut buffer [&ref] | provenance | MaD:17 |
 | test.rs:275:30:275:40 | [post] &mut buffer [&ref] | test.rs:275:35:275:40 | [post] buffer | provenance |  |
 | test.rs:275:35:275:40 | [post] buffer | test.rs:276:15:276:20 | buffer | provenance |  |
 | test.rs:276:15:276:20 | buffer | test.rs:276:14:276:20 | &buffer | provenance |  |
 nodes
 | test.rs:12:13:12:18 | buffer | semmle.label | buffer |
 | test.rs:12:31:12:43 | ...::read | semmle.label | ...::read |
-| test.rs:12:31:12:43 | ...::read | semmle.label | ...::read |
-| test.rs:12:31:12:43 | ...::read [Ok] | semmle.label | ...::read [Ok] |
-| test.rs:12:31:12:55 | ...::read(...) | semmle.label | ...::read(...) |
 | test.rs:12:31:12:55 | ...::read(...) [Ok] | semmle.label | ...::read(...) [Ok] |
 | test.rs:12:31:12:56 | TryExpr | semmle.label | TryExpr |
 | test.rs:13:14:13:19 | buffer | semmle.label | buffer |
 | test.rs:17:13:17:18 | buffer | semmle.label | buffer |
 | test.rs:17:31:17:38 | ...::read | semmle.label | ...::read |
-| test.rs:17:31:17:38 | ...::read | semmle.label | ...::read |
-| test.rs:17:31:17:38 | ...::read [Ok] | semmle.label | ...::read [Ok] |
-| test.rs:17:31:17:50 | ...::read(...) | semmle.label | ...::read(...) |
 | test.rs:17:31:17:50 | ...::read(...) [Ok] | semmle.label | ...::read(...) [Ok] |
 | test.rs:17:31:17:51 | TryExpr | semmle.label | TryExpr |
 | test.rs:18:14:18:19 | buffer | semmle.label | buffer |
 | test.rs:22:13:22:18 | buffer | semmle.label | buffer |
 | test.rs:22:22:22:39 | ...::read_to_string | semmle.label | ...::read_to_string |
-| test.rs:22:22:22:39 | ...::read_to_string | semmle.label | ...::read_to_string |
-| test.rs:22:22:22:39 | ...::read_to_string [Ok] | semmle.label | ...::read_to_string [Ok] |
-| test.rs:22:22:22:51 | ...::read_to_string(...) | semmle.label | ...::read_to_string(...) |
 | test.rs:22:22:22:51 | ...::read_to_string(...) [Ok] | semmle.label | ...::read_to_string(...) [Ok] |
 | test.rs:22:22:22:52 | TryExpr | semmle.label | TryExpr |
 | test.rs:23:14:23:19 | buffer | semmle.label | buffer |
@@ -331,11 +306,9 @@ nodes
 | test.rs:90:13:90:16 | path | semmle.label | path |
 | test.rs:90:20:90:31 | entry.path() | semmle.label | entry.path() |
 | test.rs:90:26:90:29 | path | semmle.label | path |
-| test.rs:90:26:90:29 | path | semmle.label | path |
 | test.rs:91:13:91:21 | file_name | semmle.label | file_name |
 | test.rs:91:25:91:41 | entry.file_name() | semmle.label | entry.file_name() |
 | test.rs:91:31:91:39 | file_name | semmle.label | file_name |
-| test.rs:91:31:91:39 | file_name | semmle.label | file_name |
 | test.rs:92:14:92:17 | path | semmle.label | path |
 | test.rs:93:14:93:22 | file_name | semmle.label | file_name |
 | test.rs:97:13:97:18 | target | semmle.label | target |
@@ -515,10 +488,7 @@ subpaths
 testFailures
 #select
 | test.rs:13:14:13:19 | buffer | test.rs:12:31:12:43 | ...::read | test.rs:13:14:13:19 | buffer | $@ | test.rs:12:31:12:43 | ...::read | ...::read |
-| test.rs:13:14:13:19 | buffer | test.rs:12:31:12:43 | ...::read | test.rs:13:14:13:19 | buffer | $@ | test.rs:12:31:12:43 | ...::read | ...::read |
 | test.rs:18:14:18:19 | buffer | test.rs:17:31:17:38 | ...::read | test.rs:18:14:18:19 | buffer | $@ | test.rs:17:31:17:38 | ...::read | ...::read |
-| test.rs:18:14:18:19 | buffer | test.rs:17:31:17:38 | ...::read | test.rs:18:14:18:19 | buffer | $@ | test.rs:17:31:17:38 | ...::read | ...::read |
-| test.rs:23:14:23:19 | buffer | test.rs:22:22:22:39 | ...::read_to_string | test.rs:23:14:23:19 | buffer | $@ | test.rs:22:22:22:39 | ...::read_to_string | ...::read_to_string |
 | test.rs:23:14:23:19 | buffer | test.rs:22:22:22:39 | ...::read_to_string | test.rs:23:14:23:19 | buffer | $@ | test.rs:22:22:22:39 | ...::read_to_string | ...::read_to_string |
 | test.rs:30:14:30:25 | path.clone() | test.rs:29:22:29:25 | path | test.rs:30:14:30:25 | path.clone() | $@ | test.rs:29:22:29:25 | path | path |
 | test.rs:31:14:31:35 | ... .as_path() | test.rs:29:22:29:25 | path | test.rs:31:14:31:35 | ... .as_path() | $@ | test.rs:29:22:29:25 | path | path |
@@ -530,8 +500,6 @@ testFailures
 | test.rs:80:14:80:19 | buffer | test.rs:79:31:79:45 | ...::read | test.rs:80:14:80:19 | buffer | $@ | test.rs:79:31:79:45 | ...::read | ...::read |
 | test.rs:85:14:85:19 | buffer | test.rs:84:22:84:46 | ...::read_to_string | test.rs:85:14:85:19 | buffer | $@ | test.rs:84:22:84:46 | ...::read_to_string | ...::read_to_string |
 | test.rs:92:14:92:17 | path | test.rs:90:26:90:29 | path | test.rs:92:14:92:17 | path | $@ | test.rs:90:26:90:29 | path | path |
-| test.rs:92:14:92:17 | path | test.rs:90:26:90:29 | path | test.rs:92:14:92:17 | path | $@ | test.rs:90:26:90:29 | path | path |
-| test.rs:93:14:93:22 | file_name | test.rs:91:31:91:39 | file_name | test.rs:93:14:93:22 | file_name | $@ | test.rs:91:31:91:39 | file_name | file_name |
 | test.rs:93:14:93:22 | file_name | test.rs:91:31:91:39 | file_name | test.rs:93:14:93:22 | file_name | $@ | test.rs:91:31:91:39 | file_name | file_name |
 | test.rs:98:14:98:19 | target | test.rs:97:22:97:41 | ...::read_link | test.rs:98:14:98:19 | target | $@ | test.rs:97:22:97:41 | ...::read_link | ...::read_link |
 | test.rs:112:14:112:20 | &buffer | test.rs:107:20:107:38 | ...::open | test.rs:112:14:112:20 | &buffer | $@ | test.rs:107:20:107:38 | ...::open | ...::open |

rust/ql/test/library-tests/dataflow/sources/file/TaintSources.expected

@@ -1,8 +1,5 @@
 | test.rs:12:31:12:43 | ...::read | Flow source 'FileSource' of type file (DEFAULT). |
-| test.rs:12:31:12:43 | ...::read | Flow source 'FileSource' of type file (DEFAULT). |
 | test.rs:17:31:17:38 | ...::read | Flow source 'FileSource' of type file (DEFAULT). |
-| test.rs:17:31:17:38 | ...::read | Flow source 'FileSource' of type file (DEFAULT). |
-| test.rs:22:22:22:39 | ...::read_to_string | Flow source 'FileSource' of type file (DEFAULT). |
 | test.rs:22:22:22:39 | ...::read_to_string | Flow source 'FileSource' of type file (DEFAULT). |
 | test.rs:26:18:26:29 | ...::read_dir | Flow source 'FileSource' of type file (DEFAULT). |
 | test.rs:29:22:29:25 | path | Flow source 'FileSource' of type file (DEFAULT). |
@@ -15,8 +12,6 @@
 | test.rs:79:31:79:45 | ...::read | Flow source 'FileSource' of type file (DEFAULT). |
 | test.rs:84:22:84:46 | ...::read_to_string | Flow source 'FileSource' of type file (DEFAULT). |
 | test.rs:90:26:90:29 | path | Flow source 'FileSource' of type file (DEFAULT). |
-| test.rs:90:26:90:29 | path | Flow source 'FileSource' of type file (DEFAULT). |
-| test.rs:91:31:91:39 | file_name | Flow source 'FileSource' of type file (DEFAULT). |
 | test.rs:91:31:91:39 | file_name | Flow source 'FileSource' of type file (DEFAULT). |
 | test.rs:97:22:97:41 | ...::read_link | Flow source 'FileSource' of type file (DEFAULT). |
 | test.rs:107:20:107:38 | ...::open | Flow source 'FileSource' of type file (DEFAULT). |

rust/ql/test/library-tests/type-inference/type-inference.expected

@@ -2754,9 +2754,7 @@ inferCertainType
 | main.rs:2224:18:2224:21 | SelfParam |  | main.rs:2221:5:2221:14 | S1 |
 | main.rs:2224:24:2224:25 | { ... } |  | {EXTERNAL LOCATION} | () |
 | main.rs:2227:25:2229:5 | { ... } |  | main.rs:2221:5:2221:14 | S1 |
-| main.rs:2231:41:2233:5 | { ... } |  | main.rs:2231:16:2231:39 | impl ... |
 | main.rs:2232:9:2232:20 | { ... } |  | {EXTERNAL LOCATION} | dyn Future |
-| main.rs:2235:41:2237:5 | { ... } |  | main.rs:2235:16:2235:39 | impl ... |
 | main.rs:2236:9:2236:16 | { ... } |  | {EXTERNAL LOCATION} | dyn Future |
 | main.rs:2236:9:2236:16 | { ... } | dyn(Output) | {EXTERNAL LOCATION} | () |
 | main.rs:2245:13:2245:42 | SelfParam |  | {EXTERNAL LOCATION} | Pin |
@@ -2766,7 +2764,6 @@ inferCertainType
 | main.rs:2246:13:2246:15 | _cx | TRef | {EXTERNAL LOCATION} | Context |
 | main.rs:2247:44:2249:9 | { ... } |  | {EXTERNAL LOCATION} | Poll |
 | main.rs:2247:44:2249:9 | { ... } | T | main.rs:2221:5:2221:14 | S1 |
-| main.rs:2252:41:2254:5 | { ... } |  | main.rs:2252:16:2252:39 | impl ... |
 | main.rs:2256:22:2264:5 | { ... } |  | {EXTERNAL LOCATION} | () |
 | main.rs:2257:9:2257:12 | f1(...) |  | {EXTERNAL LOCATION} | dyn Future |
 | main.rs:2257:9:2257:12 | f1(...) | dyn(Output) | main.rs:2221:5:2221:14 | S1 |
@@ -2788,7 +2785,6 @@ inferCertainType
 | main.rs:2286:15:2286:19 | SelfParam |  | {EXTERNAL LOCATION} | & |
 | main.rs:2286:15:2286:19 | SelfParam | TRef | main.rs:2268:5:2269:14 | S1 |
 | main.rs:2286:22:2286:23 | { ... } |  | {EXTERNAL LOCATION} | () |
-| main.rs:2289:37:2291:5 | { ... } |  | main.rs:2289:16:2289:35 | impl ... + ... |
 | main.rs:2294:18:2294:22 | SelfParam |  | {EXTERNAL LOCATION} | & |
 | main.rs:2294:18:2294:22 | SelfParam | TRef | main.rs:2293:5:2295:5 | Self [trait MyTrait] |
 | main.rs:2298:18:2298:22 | SelfParam |  | {EXTERNAL LOCATION} | & |
@@ -2801,7 +2797,6 @@ inferCertainType
 | main.rs:2305:25:2305:28 | self |  | {EXTERNAL LOCATION} | & |
 | main.rs:2305:25:2305:28 | self | TRef | main.rs:2271:5:2271:22 | S3 |
 | main.rs:2305:25:2305:28 | self | TRef.T3 | main.rs:2303:10:2303:17 | T |
-| main.rs:2310:45:2312:5 | { ... } |  | main.rs:2310:28:2310:43 | impl ... |
 | main.rs:2314:41:2314:41 | t |  | main.rs:2314:26:2314:38 | B |
 | main.rs:2314:52:2316:5 | { ... } |  | main.rs:2314:23:2314:23 | A |
 | main.rs:2315:9:2315:9 | t |  | main.rs:2314:26:2314:38 | B |
@@ -9386,11 +9381,13 @@ inferType
 | main.rs:2224:24:2224:25 | { ... } |  | {EXTERNAL LOCATION} | () |
 | main.rs:2227:25:2229:5 | { ... } |  | main.rs:2221:5:2221:14 | S1 |
 | main.rs:2228:9:2228:10 | S1 |  | main.rs:2221:5:2221:14 | S1 |
-| main.rs:2231:41:2233:5 | { ... } |  | main.rs:2231:16:2231:39 | impl ... |
+| main.rs:2231:41:2233:5 | { ... } |  | {EXTERNAL LOCATION} | dyn Future |
+| main.rs:2231:41:2233:5 | { ... } | dyn(Output) | main.rs:2221:5:2221:14 | S1 |
 | main.rs:2232:9:2232:20 | { ... } |  | {EXTERNAL LOCATION} | dyn Future |
 | main.rs:2232:9:2232:20 | { ... } | dyn(Output) | main.rs:2221:5:2221:14 | S1 |
 | main.rs:2232:17:2232:18 | S1 |  | main.rs:2221:5:2221:14 | S1 |
-| main.rs:2235:41:2237:5 | { ... } |  | main.rs:2235:16:2235:39 | impl ... |
+| main.rs:2235:41:2237:5 | { ... } |  | {EXTERNAL LOCATION} | dyn Future |
+| main.rs:2235:41:2237:5 | { ... } | dyn(Output) | {EXTERNAL LOCATION} | () |
 | main.rs:2236:9:2236:16 | { ... } |  | {EXTERNAL LOCATION} | dyn Future |
 | main.rs:2236:9:2236:16 | { ... } | dyn(Output) | {EXTERNAL LOCATION} | () |
 | main.rs:2245:13:2245:42 | SelfParam |  | {EXTERNAL LOCATION} | Pin |
@@ -9403,9 +9400,8 @@ inferType
 | main.rs:2248:13:2248:38 | ...::Ready(...) |  | {EXTERNAL LOCATION} | Poll |
 | main.rs:2248:13:2248:38 | ...::Ready(...) | T | main.rs:2221:5:2221:14 | S1 |
 | main.rs:2248:36:2248:37 | S1 |  | main.rs:2221:5:2221:14 | S1 |
-| main.rs:2252:41:2254:5 | { ... } |  | main.rs:2252:16:2252:39 | impl ... |
+| main.rs:2252:41:2254:5 | { ... } |  | main.rs:2239:5:2239:14 | S2 |
 | main.rs:2253:9:2253:10 | S2 |  | main.rs:2239:5:2239:14 | S2 |
-| main.rs:2253:9:2253:10 | S2 |  | main.rs:2252:16:2252:39 | impl ... |
 | main.rs:2256:22:2264:5 | { ... } |  | {EXTERNAL LOCATION} | () |
 | main.rs:2257:9:2257:12 | f1(...) |  | {EXTERNAL LOCATION} | dyn Future |
 | main.rs:2257:9:2257:12 | f1(...) | dyn(Output) | main.rs:2221:5:2221:14 | S1 |
@@ -9443,9 +9439,8 @@ inferType
 | main.rs:2286:15:2286:19 | SelfParam |  | {EXTERNAL LOCATION} | & |
 | main.rs:2286:15:2286:19 | SelfParam | TRef | main.rs:2268:5:2269:14 | S1 |
 | main.rs:2286:22:2286:23 | { ... } |  | {EXTERNAL LOCATION} | () |
-| main.rs:2289:37:2291:5 | { ... } |  | main.rs:2289:16:2289:35 | impl ... + ... |
+| main.rs:2289:37:2291:5 | { ... } |  | main.rs:2268:5:2269:14 | S1 |
 | main.rs:2290:9:2290:10 | S1 |  | main.rs:2268:5:2269:14 | S1 |
-| main.rs:2290:9:2290:10 | S1 |  | main.rs:2289:16:2289:35 | impl ... + ... |
 | main.rs:2294:18:2294:22 | SelfParam |  | {EXTERNAL LOCATION} | & |
 | main.rs:2294:18:2294:22 | SelfParam | TRef | main.rs:2293:5:2295:5 | Self [trait MyTrait] |
 | main.rs:2298:18:2298:22 | SelfParam |  | {EXTERNAL LOCATION} | & |
@@ -9464,9 +9459,8 @@ inferType
 | main.rs:2305:25:2305:28 | self | TRef | main.rs:2271:5:2271:22 | S3 |
 | main.rs:2305:25:2305:28 | self | TRef.T3 | main.rs:2303:10:2303:17 | T |
 | main.rs:2306:13:2306:21 | t.clone() |  | main.rs:2303:10:2303:17 | T |
-| main.rs:2310:45:2312:5 | { ... } |  | main.rs:2310:28:2310:43 | impl ... |
+| main.rs:2310:45:2312:5 | { ... } |  | main.rs:2268:5:2269:14 | S1 |
 | main.rs:2311:9:2311:10 | S1 |  | main.rs:2268:5:2269:14 | S1 |
-| main.rs:2311:9:2311:10 | S1 |  | main.rs:2310:28:2310:43 | impl ... |
 | main.rs:2314:41:2314:41 | t |  | main.rs:2314:26:2314:38 | B |
 | main.rs:2314:52:2316:5 | { ... } |  | main.rs:2314:23:2314:23 | A |
 | main.rs:2315:9:2315:9 | t |  | main.rs:2314:26:2314:38 | B |

rust/ql/test/query-tests/security/CWE-312/CleartextLogging.expected

@@ -49,118 +49,117 @@
 | test_logging.rs:223:13:223:28 | ...::assert_failed | test_logging.rs:223:52:223:59 | password | test_logging.rs:223:13:223:28 | ...::assert_failed | This operation writes $@ to a log file. | test_logging.rs:223:52:223:59 | password | password |
 | test_logging.rs:226:13:226:28 | ...::assert_failed | test_logging.rs:226:52:226:59 | password | test_logging.rs:226:13:226:28 | ...::assert_failed | This operation writes $@ to a log file. | test_logging.rs:226:52:226:59 | password | password |
 | test_logging.rs:229:23:229:28 | expect | test_logging.rs:229:54:229:61 | password | test_logging.rs:229:23:229:28 | expect | This operation writes $@ to a log file. | test_logging.rs:229:54:229:61 | password | password |
-| test_logging.rs:229:23:229:28 | expect | test_logging.rs:229:54:229:61 | password | test_logging.rs:229:23:229:28 | expect | This operation writes $@ to a log file. | test_logging.rs:229:54:229:61 | password | password |
 | test_logging.rs:242:10:242:14 | write | test_logging.rs:242:42:242:49 | password | test_logging.rs:242:10:242:14 | write | This operation writes $@ to a log file. | test_logging.rs:242:42:242:49 | password | password |
 | test_logging.rs:245:10:245:18 | write_all | test_logging.rs:245:46:245:53 | password | test_logging.rs:245:10:245:18 | write_all | This operation writes $@ to a log file. | test_logging.rs:245:46:245:53 | password | password |
 | test_logging.rs:248:9:248:13 | write | test_logging.rs:248:41:248:48 | password | test_logging.rs:248:9:248:13 | write | This operation writes $@ to a log file. | test_logging.rs:248:41:248:48 | password | password |
 | test_logging.rs:251:9:251:13 | write | test_logging.rs:251:41:251:48 | password | test_logging.rs:251:9:251:13 | write | This operation writes $@ to a log file. | test_logging.rs:251:41:251:48 | password | password |
 edges
-| test_logging.rs:42:12:42:35 | MacroExpr | test_logging.rs:42:5:42:10 | ...::log | provenance | MaD:12 Sink:MaD:12 |
+| test_logging.rs:42:12:42:35 | MacroExpr | test_logging.rs:42:5:42:10 | ...::log | provenance | MaD:11 Sink:MaD:11 |
 | test_logging.rs:42:28:42:35 | password | test_logging.rs:42:12:42:35 | MacroExpr | provenance |  |
-| test_logging.rs:43:12:43:35 | MacroExpr | test_logging.rs:43:5:43:10 | ...::log | provenance | MaD:12 Sink:MaD:12 |
+| test_logging.rs:43:12:43:35 | MacroExpr | test_logging.rs:43:5:43:10 | ...::log | provenance | MaD:11 Sink:MaD:11 |
 | test_logging.rs:43:28:43:35 | password | test_logging.rs:43:12:43:35 | MacroExpr | provenance |  |
-| test_logging.rs:44:11:44:34 | MacroExpr | test_logging.rs:44:5:44:9 | ...::log | provenance | MaD:12 Sink:MaD:12 |
+| test_logging.rs:44:11:44:34 | MacroExpr | test_logging.rs:44:5:44:9 | ...::log | provenance | MaD:11 Sink:MaD:11 |
 | test_logging.rs:44:27:44:34 | password | test_logging.rs:44:11:44:34 | MacroExpr | provenance |  |
-| test_logging.rs:45:12:45:35 | MacroExpr | test_logging.rs:45:5:45:10 | ...::log | provenance | MaD:12 Sink:MaD:12 |
+| test_logging.rs:45:12:45:35 | MacroExpr | test_logging.rs:45:5:45:10 | ...::log | provenance | MaD:11 Sink:MaD:11 |
 | test_logging.rs:45:28:45:35 | password | test_logging.rs:45:12:45:35 | MacroExpr | provenance |  |
-| test_logging.rs:46:11:46:34 | MacroExpr | test_logging.rs:46:5:46:9 | ...::log | provenance | MaD:12 Sink:MaD:12 |
+| test_logging.rs:46:11:46:34 | MacroExpr | test_logging.rs:46:5:46:9 | ...::log | provenance | MaD:11 Sink:MaD:11 |
 | test_logging.rs:46:27:46:34 | password | test_logging.rs:46:11:46:34 | MacroExpr | provenance |  |
-| test_logging.rs:47:24:47:47 | MacroExpr | test_logging.rs:47:5:47:8 | ...::log | provenance | MaD:12 Sink:MaD:12 |
+| test_logging.rs:47:24:47:47 | MacroExpr | test_logging.rs:47:5:47:8 | ...::log | provenance | MaD:11 Sink:MaD:11 |
 | test_logging.rs:47:40:47:47 | password | test_logging.rs:47:24:47:47 | MacroExpr | provenance |  |
-| test_logging.rs:52:12:52:35 | MacroExpr | test_logging.rs:52:5:52:10 | ...::log | provenance | MaD:12 Sink:MaD:12 |
+| test_logging.rs:52:12:52:35 | MacroExpr | test_logging.rs:52:5:52:10 | ...::log | provenance | MaD:11 Sink:MaD:11 |
 | test_logging.rs:52:28:52:35 | password | test_logging.rs:52:12:52:35 | MacroExpr | provenance |  |
-| test_logging.rs:54:12:54:48 | MacroExpr | test_logging.rs:54:5:54:10 | ...::log | provenance | MaD:12 Sink:MaD:12 |
+| test_logging.rs:54:12:54:48 | MacroExpr | test_logging.rs:54:5:54:10 | ...::log | provenance | MaD:11 Sink:MaD:11 |
 | test_logging.rs:54:41:54:48 | password | test_logging.rs:54:12:54:48 | MacroExpr | provenance |  |
-| test_logging.rs:56:12:56:46 | MacroExpr | test_logging.rs:56:5:56:10 | ...::log | provenance | MaD:12 Sink:MaD:12 |
+| test_logging.rs:56:12:56:46 | MacroExpr | test_logging.rs:56:5:56:10 | ...::log | provenance | MaD:11 Sink:MaD:11 |
 | test_logging.rs:56:39:56:46 | password | test_logging.rs:56:12:56:46 | MacroExpr | provenance |  |
-| test_logging.rs:57:12:57:33 | MacroExpr | test_logging.rs:57:5:57:10 | ...::log | provenance | MaD:12 Sink:MaD:12 |
+| test_logging.rs:57:12:57:33 | MacroExpr | test_logging.rs:57:5:57:10 | ...::log | provenance | MaD:11 Sink:MaD:11 |
 | test_logging.rs:57:24:57:31 | password | test_logging.rs:57:12:57:33 | MacroExpr | provenance |  |
-| test_logging.rs:58:12:58:35 | MacroExpr | test_logging.rs:58:5:58:10 | ...::log | provenance | MaD:12 Sink:MaD:12 |
+| test_logging.rs:58:12:58:35 | MacroExpr | test_logging.rs:58:5:58:10 | ...::log | provenance | MaD:11 Sink:MaD:11 |
 | test_logging.rs:58:24:58:31 | password | test_logging.rs:58:12:58:35 | MacroExpr | provenance |  |
-| test_logging.rs:60:30:60:53 | MacroExpr | test_logging.rs:60:5:60:10 | ...::log | provenance | MaD:12 Sink:MaD:12 |
+| test_logging.rs:60:30:60:53 | MacroExpr | test_logging.rs:60:5:60:10 | ...::log | provenance | MaD:11 Sink:MaD:11 |
 | test_logging.rs:60:46:60:53 | password | test_logging.rs:60:30:60:53 | MacroExpr | provenance |  |
-| test_logging.rs:61:20:61:28 | &... [&ref, tuple.0, &ref] | test_logging.rs:61:5:61:10 | ...::log | provenance | MaD:13 Sink:MaD:13 Sink:MaD:13 |
+| test_logging.rs:61:20:61:28 | &... [&ref, tuple.0, &ref] | test_logging.rs:61:5:61:10 | ...::log | provenance | MaD:12 Sink:MaD:12 Sink:MaD:12 |
-| test_logging.rs:61:20:61:28 | &... [&ref, tuple.0, &ref] | test_logging.rs:61:5:61:10 | ...::log | provenance | MaD:13 Sink:MaD:13 Sink:MaD:13 Sink:MaD:13 |
+| test_logging.rs:61:20:61:28 | &... [&ref, tuple.0, &ref] | test_logging.rs:61:5:61:10 | ...::log | provenance | MaD:12 Sink:MaD:12 Sink:MaD:12 Sink:MaD:12 |
-| test_logging.rs:61:20:61:28 | &... [&ref, tuple.0] | test_logging.rs:61:5:61:10 | ...::log | provenance | MaD:13 Sink:MaD:13 Sink:MaD:13 |
+| test_logging.rs:61:20:61:28 | &... [&ref, tuple.0] | test_logging.rs:61:5:61:10 | ...::log | provenance | MaD:12 Sink:MaD:12 Sink:MaD:12 |
 | test_logging.rs:61:20:61:28 | &password | test_logging.rs:61:20:61:28 | TupleExpr [tuple.0] | provenance |  |
 | test_logging.rs:61:20:61:28 | &password [&ref] | test_logging.rs:61:20:61:28 | TupleExpr [tuple.0, &ref] | provenance |  |
 | test_logging.rs:61:20:61:28 | TupleExpr [tuple.0, &ref] | test_logging.rs:61:20:61:28 | &... [&ref, tuple.0, &ref] | provenance |  |
 | test_logging.rs:61:20:61:28 | TupleExpr [tuple.0] | test_logging.rs:61:20:61:28 | &... [&ref, tuple.0] | provenance |  |
 | test_logging.rs:61:21:61:28 | password | test_logging.rs:61:20:61:28 | &password | provenance | Config |
 | test_logging.rs:61:21:61:28 | password | test_logging.rs:61:20:61:28 | &password [&ref] | provenance |  |
-| test_logging.rs:65:24:65:47 | MacroExpr | test_logging.rs:65:5:65:8 | ...::log | provenance | MaD:12 Sink:MaD:12 |
+| test_logging.rs:65:24:65:47 | MacroExpr | test_logging.rs:65:5:65:8 | ...::log | provenance | MaD:11 Sink:MaD:11 |
 | test_logging.rs:65:40:65:47 | password | test_logging.rs:65:24:65:47 | MacroExpr | provenance |  |
-| test_logging.rs:67:42:67:65 | MacroExpr | test_logging.rs:67:5:67:8 | ...::log | provenance | MaD:12 Sink:MaD:12 |
+| test_logging.rs:67:42:67:65 | MacroExpr | test_logging.rs:67:5:67:8 | ...::log | provenance | MaD:11 Sink:MaD:11 |
 | test_logging.rs:67:58:67:65 | password | test_logging.rs:67:42:67:65 | MacroExpr | provenance |  |
-| test_logging.rs:68:18:68:26 | &... [&ref, tuple.0, &ref] | test_logging.rs:68:5:68:8 | ...::log | provenance | MaD:13 Sink:MaD:13 Sink:MaD:13 |
+| test_logging.rs:68:18:68:26 | &... [&ref, tuple.0, &ref] | test_logging.rs:68:5:68:8 | ...::log | provenance | MaD:12 Sink:MaD:12 Sink:MaD:12 |
-| test_logging.rs:68:18:68:26 | &... [&ref, tuple.0, &ref] | test_logging.rs:68:5:68:8 | ...::log | provenance | MaD:13 Sink:MaD:13 Sink:MaD:13 Sink:MaD:13 |
+| test_logging.rs:68:18:68:26 | &... [&ref, tuple.0, &ref] | test_logging.rs:68:5:68:8 | ...::log | provenance | MaD:12 Sink:MaD:12 Sink:MaD:12 Sink:MaD:12 |
-| test_logging.rs:68:18:68:26 | &... [&ref, tuple.0] | test_logging.rs:68:5:68:8 | ...::log | provenance | MaD:13 Sink:MaD:13 Sink:MaD:13 |
+| test_logging.rs:68:18:68:26 | &... [&ref, tuple.0] | test_logging.rs:68:5:68:8 | ...::log | provenance | MaD:12 Sink:MaD:12 Sink:MaD:12 |
 | test_logging.rs:68:18:68:26 | &password | test_logging.rs:68:18:68:26 | TupleExpr [tuple.0] | provenance |  |
 | test_logging.rs:68:18:68:26 | &password [&ref] | test_logging.rs:68:18:68:26 | TupleExpr [tuple.0, &ref] | provenance |  |
 | test_logging.rs:68:18:68:26 | TupleExpr [tuple.0, &ref] | test_logging.rs:68:18:68:26 | &... [&ref, tuple.0, &ref] | provenance |  |
 | test_logging.rs:68:18:68:26 | TupleExpr [tuple.0] | test_logging.rs:68:18:68:26 | &... [&ref, tuple.0] | provenance |  |
 | test_logging.rs:68:19:68:26 | password | test_logging.rs:68:18:68:26 | &password | provenance | Config |
 | test_logging.rs:68:19:68:26 | password | test_logging.rs:68:18:68:26 | &password [&ref] | provenance |  |
-| test_logging.rs:72:23:72:46 | MacroExpr | test_logging.rs:72:5:72:10 | ...::log | provenance | MaD:12 Sink:MaD:12 |
+| test_logging.rs:72:23:72:46 | MacroExpr | test_logging.rs:72:5:72:10 | ...::log | provenance | MaD:11 Sink:MaD:11 |
 | test_logging.rs:72:39:72:46 | password | test_logging.rs:72:23:72:46 | MacroExpr | provenance |  |
-| test_logging.rs:74:41:74:64 | MacroExpr | test_logging.rs:74:5:74:10 | ...::log | provenance | MaD:12 Sink:MaD:12 |
+| test_logging.rs:74:41:74:64 | MacroExpr | test_logging.rs:74:5:74:10 | ...::log | provenance | MaD:11 Sink:MaD:11 |
 | test_logging.rs:74:57:74:64 | password | test_logging.rs:74:41:74:64 | MacroExpr | provenance |  |
-| test_logging.rs:75:20:75:28 | &... [&ref, tuple.0, &ref] | test_logging.rs:75:5:75:10 | ...::log | provenance | MaD:13 Sink:MaD:13 Sink:MaD:13 |
+| test_logging.rs:75:20:75:28 | &... [&ref, tuple.0, &ref] | test_logging.rs:75:5:75:10 | ...::log | provenance | MaD:12 Sink:MaD:12 Sink:MaD:12 |
-| test_logging.rs:75:20:75:28 | &... [&ref, tuple.0, &ref] | test_logging.rs:75:5:75:10 | ...::log | provenance | MaD:13 Sink:MaD:13 Sink:MaD:13 Sink:MaD:13 |
+| test_logging.rs:75:20:75:28 | &... [&ref, tuple.0, &ref] | test_logging.rs:75:5:75:10 | ...::log | provenance | MaD:12 Sink:MaD:12 Sink:MaD:12 Sink:MaD:12 |
-| test_logging.rs:75:20:75:28 | &... [&ref, tuple.0] | test_logging.rs:75:5:75:10 | ...::log | provenance | MaD:13 Sink:MaD:13 Sink:MaD:13 |
+| test_logging.rs:75:20:75:28 | &... [&ref, tuple.0] | test_logging.rs:75:5:75:10 | ...::log | provenance | MaD:12 Sink:MaD:12 Sink:MaD:12 |
 | test_logging.rs:75:20:75:28 | &password | test_logging.rs:75:20:75:28 | TupleExpr [tuple.0] | provenance |  |
 | test_logging.rs:75:20:75:28 | &password [&ref] | test_logging.rs:75:20:75:28 | TupleExpr [tuple.0, &ref] | provenance |  |
 | test_logging.rs:75:20:75:28 | TupleExpr [tuple.0, &ref] | test_logging.rs:75:20:75:28 | &... [&ref, tuple.0, &ref] | provenance |  |
 | test_logging.rs:75:20:75:28 | TupleExpr [tuple.0] | test_logging.rs:75:20:75:28 | &... [&ref, tuple.0] | provenance |  |
 | test_logging.rs:75:21:75:28 | password | test_logging.rs:75:20:75:28 | &password | provenance | Config |
 | test_logging.rs:75:21:75:28 | password | test_logging.rs:75:20:75:28 | &password [&ref] | provenance |  |
-| test_logging.rs:76:23:76:46 | MacroExpr | test_logging.rs:76:5:76:10 | ...::log | provenance | MaD:12 Sink:MaD:12 |
+| test_logging.rs:76:23:76:46 | MacroExpr | test_logging.rs:76:5:76:10 | ...::log | provenance | MaD:11 Sink:MaD:11 |
 | test_logging.rs:76:39:76:46 | password | test_logging.rs:76:23:76:46 | MacroExpr | provenance |  |
-| test_logging.rs:82:20:82:43 | MacroExpr | test_logging.rs:82:5:82:10 | ...::log | provenance | MaD:12 Sink:MaD:12 |
+| test_logging.rs:82:20:82:43 | MacroExpr | test_logging.rs:82:5:82:10 | ...::log | provenance | MaD:11 Sink:MaD:11 |
 | test_logging.rs:82:36:82:43 | password | test_logging.rs:82:20:82:43 | MacroExpr | provenance |  |
-| test_logging.rs:84:38:84:61 | MacroExpr | test_logging.rs:84:5:84:10 | ...::log | provenance | MaD:12 Sink:MaD:12 |
+| test_logging.rs:84:38:84:61 | MacroExpr | test_logging.rs:84:5:84:10 | ...::log | provenance | MaD:11 Sink:MaD:11 |
 | test_logging.rs:84:54:84:61 | password | test_logging.rs:84:38:84:61 | MacroExpr | provenance |  |
-| test_logging.rs:85:20:85:28 | &... [&ref, tuple.0, &ref] | test_logging.rs:85:5:85:10 | ...::log | provenance | MaD:13 Sink:MaD:13 Sink:MaD:13 |
+| test_logging.rs:85:20:85:28 | &... [&ref, tuple.0, &ref] | test_logging.rs:85:5:85:10 | ...::log | provenance | MaD:12 Sink:MaD:12 Sink:MaD:12 |
-| test_logging.rs:85:20:85:28 | &... [&ref, tuple.0, &ref] | test_logging.rs:85:5:85:10 | ...::log | provenance | MaD:13 Sink:MaD:13 Sink:MaD:13 Sink:MaD:13 |
+| test_logging.rs:85:20:85:28 | &... [&ref, tuple.0, &ref] | test_logging.rs:85:5:85:10 | ...::log | provenance | MaD:12 Sink:MaD:12 Sink:MaD:12 Sink:MaD:12 |
-| test_logging.rs:85:20:85:28 | &... [&ref, tuple.0] | test_logging.rs:85:5:85:10 | ...::log | provenance | MaD:13 Sink:MaD:13 Sink:MaD:13 |
+| test_logging.rs:85:20:85:28 | &... [&ref, tuple.0] | test_logging.rs:85:5:85:10 | ...::log | provenance | MaD:12 Sink:MaD:12 Sink:MaD:12 |
 | test_logging.rs:85:20:85:28 | &password | test_logging.rs:85:20:85:28 | TupleExpr [tuple.0] | provenance |  |
 | test_logging.rs:85:20:85:28 | &password [&ref] | test_logging.rs:85:20:85:28 | TupleExpr [tuple.0, &ref] | provenance |  |
 | test_logging.rs:85:20:85:28 | TupleExpr [tuple.0, &ref] | test_logging.rs:85:20:85:28 | &... [&ref, tuple.0, &ref] | provenance |  |
 | test_logging.rs:85:20:85:28 | TupleExpr [tuple.0] | test_logging.rs:85:20:85:28 | &... [&ref, tuple.0] | provenance |  |
 | test_logging.rs:85:21:85:28 | password | test_logging.rs:85:20:85:28 | &password | provenance | Config |
 | test_logging.rs:85:21:85:28 | password | test_logging.rs:85:20:85:28 | &password [&ref] | provenance |  |
-| test_logging.rs:86:20:86:43 | MacroExpr | test_logging.rs:86:5:86:10 | ...::log | provenance | MaD:12 Sink:MaD:12 |
+| test_logging.rs:86:20:86:43 | MacroExpr | test_logging.rs:86:5:86:10 | ...::log | provenance | MaD:11 Sink:MaD:11 |
 | test_logging.rs:86:36:86:43 | password | test_logging.rs:86:20:86:43 | MacroExpr | provenance |  |
 | test_logging.rs:93:9:93:10 | m1 | test_logging.rs:94:11:94:28 | MacroExpr | provenance |  |
 | test_logging.rs:93:14:93:22 | &password | test_logging.rs:93:9:93:10 | m1 | provenance |  |
 | test_logging.rs:93:15:93:22 | password | test_logging.rs:93:14:93:22 | &password | provenance | Config |
-| test_logging.rs:94:11:94:28 | MacroExpr | test_logging.rs:94:5:94:9 | ...::log | provenance | MaD:12 Sink:MaD:12 |
+| test_logging.rs:94:11:94:28 | MacroExpr | test_logging.rs:94:5:94:9 | ...::log | provenance | MaD:11 Sink:MaD:11 |
 | test_logging.rs:96:9:96:10 | m2 | test_logging.rs:97:11:97:18 | MacroExpr | provenance |  |
 | test_logging.rs:96:14:96:49 | ... + ... | test_logging.rs:96:9:96:10 | m2 | provenance |  |
-| test_logging.rs:96:41:96:49 | &password | test_logging.rs:96:14:96:49 | ... + ... | provenance | MaD:18 |
 | test_logging.rs:96:41:96:49 | &password | test_logging.rs:96:14:96:49 | ... + ... | provenance | MaD:17 |
-| test_logging.rs:96:41:96:49 | &password [&ref] | test_logging.rs:96:14:96:49 | ... + ... | provenance | MaD:17 |
+| test_logging.rs:96:41:96:49 | &password | test_logging.rs:96:14:96:49 | ... + ... | provenance | MaD:16 |
+| test_logging.rs:96:41:96:49 | &password [&ref] | test_logging.rs:96:14:96:49 | ... + ... | provenance | MaD:16 |
 | test_logging.rs:96:42:96:49 | password | test_logging.rs:96:41:96:49 | &password | provenance | Config |
 | test_logging.rs:96:42:96:49 | password | test_logging.rs:96:41:96:49 | &password [&ref] | provenance |  |
-| test_logging.rs:97:11:97:18 | MacroExpr | test_logging.rs:97:5:97:9 | ...::log | provenance | MaD:12 Sink:MaD:12 |
+| test_logging.rs:97:11:97:18 | MacroExpr | test_logging.rs:97:5:97:9 | ...::log | provenance | MaD:11 Sink:MaD:11 |
 | test_logging.rs:99:9:99:10 | m3 | test_logging.rs:100:11:100:18 | MacroExpr | provenance |  |
 | test_logging.rs:99:22:99:45 | ...::format(...) | test_logging.rs:99:22:99:45 | { ... } | provenance |  |
 | test_logging.rs:99:22:99:45 | ...::must_use(...) | test_logging.rs:99:9:99:10 | m3 | provenance |  |
-| test_logging.rs:99:22:99:45 | MacroExpr | test_logging.rs:99:22:99:45 | ...::format(...) | provenance | MaD:21 |
+| test_logging.rs:99:22:99:45 | MacroExpr | test_logging.rs:99:22:99:45 | ...::format(...) | provenance | MaD:20 |
-| test_logging.rs:99:22:99:45 | { ... } | test_logging.rs:99:22:99:45 | ...::must_use(...) | provenance | MaD:22 |
+| test_logging.rs:99:22:99:45 | { ... } | test_logging.rs:99:22:99:45 | ...::must_use(...) | provenance | MaD:21 |
 | test_logging.rs:99:38:99:45 | password | test_logging.rs:99:22:99:45 | MacroExpr | provenance |  |
-| test_logging.rs:100:11:100:18 | MacroExpr | test_logging.rs:100:5:100:9 | ...::log | provenance | MaD:12 Sink:MaD:12 |
+| test_logging.rs:100:11:100:18 | MacroExpr | test_logging.rs:100:5:100:9 | ...::log | provenance | MaD:11 Sink:MaD:11 |
-| test_logging.rs:118:12:118:41 | MacroExpr | test_logging.rs:118:5:118:10 | ...::log | provenance | MaD:12 Sink:MaD:12 |
+| test_logging.rs:118:12:118:41 | MacroExpr | test_logging.rs:118:5:118:10 | ...::log | provenance | MaD:11 Sink:MaD:11 |
 | test_logging.rs:118:28:118:41 | get_password(...) | test_logging.rs:118:12:118:41 | MacroExpr | provenance |  |
 | test_logging.rs:129:9:129:10 | t1 [tuple.1] | test_logging.rs:131:28:131:29 | t1 [tuple.1] | provenance |  |
 | test_logging.rs:129:14:129:33 | TupleExpr [tuple.1] | test_logging.rs:129:9:129:10 | t1 [tuple.1] | provenance |  |
 | test_logging.rs:129:25:129:32 | password | test_logging.rs:129:14:129:33 | TupleExpr [tuple.1] | provenance |  |
-| test_logging.rs:131:12:131:31 | MacroExpr | test_logging.rs:131:5:131:10 | ...::log | provenance | MaD:12 Sink:MaD:12 |
+| test_logging.rs:131:12:131:31 | MacroExpr | test_logging.rs:131:5:131:10 | ...::log | provenance | MaD:11 Sink:MaD:11 |
 | test_logging.rs:131:28:131:29 | t1 [tuple.1] | test_logging.rs:131:28:131:31 | t1.1 | provenance |  |
 | test_logging.rs:131:28:131:31 | t1.1 | test_logging.rs:131:12:131:31 | MacroExpr | provenance |  |
-| test_logging.rs:141:11:141:37 | MacroExpr | test_logging.rs:141:5:141:9 | ...::log | provenance | MaD:12 Sink:MaD:12 |
+| test_logging.rs:141:11:141:37 | MacroExpr | test_logging.rs:141:5:141:9 | ...::log | provenance | MaD:11 Sink:MaD:11 |
 | test_logging.rs:141:27:141:37 | s1.password | test_logging.rs:141:11:141:37 | MacroExpr | provenance |  |
-| test_logging.rs:151:11:151:37 | MacroExpr | test_logging.rs:151:5:151:9 | ...::log | provenance | MaD:12 Sink:MaD:12 |
+| test_logging.rs:151:11:151:37 | MacroExpr | test_logging.rs:151:5:151:9 | ...::log | provenance | MaD:11 Sink:MaD:11 |
 | test_logging.rs:151:27:151:37 | s2.password | test_logging.rs:151:11:151:37 | MacroExpr | provenance |  |
 | test_logging.rs:176:33:176:79 | &... | test_logging.rs:176:22:176:31 | log_expect | provenance | MaD:1 Sink:MaD:1 |
 | test_logging.rs:176:33:176:79 | &... [&ref] | test_logging.rs:176:22:176:31 | log_expect | provenance | MaD:1 Sink:MaD:1 |
@@ -168,8 +167,8 @@ edges
 | test_logging.rs:176:34:176:79 | MacroExpr | test_logging.rs:176:33:176:79 | &... [&ref] | provenance |  |
 | test_logging.rs:176:42:176:78 | ...::format(...) | test_logging.rs:176:42:176:78 | { ... } | provenance |  |
 | test_logging.rs:176:42:176:78 | ...::must_use(...) | test_logging.rs:176:34:176:79 | MacroExpr | provenance |  |
-| test_logging.rs:176:42:176:78 | MacroExpr | test_logging.rs:176:42:176:78 | ...::format(...) | provenance | MaD:21 |
+| test_logging.rs:176:42:176:78 | MacroExpr | test_logging.rs:176:42:176:78 | ...::format(...) | provenance | MaD:20 |
-| test_logging.rs:176:42:176:78 | { ... } | test_logging.rs:176:42:176:78 | ...::must_use(...) | provenance | MaD:22 |
+| test_logging.rs:176:42:176:78 | { ... } | test_logging.rs:176:42:176:78 | ...::must_use(...) | provenance | MaD:21 |
 | test_logging.rs:176:70:176:78 | password2 | test_logging.rs:176:42:176:78 | MacroExpr | provenance |  |
 | test_logging.rs:180:35:180:81 | &... | test_logging.rs:180:24:180:33 | log_expect | provenance | MaD:3 Sink:MaD:3 |
 | test_logging.rs:180:35:180:81 | &... [&ref] | test_logging.rs:180:24:180:33 | log_expect | provenance | MaD:3 Sink:MaD:3 |
@@ -177,93 +176,84 @@ edges
 | test_logging.rs:180:36:180:81 | MacroExpr | test_logging.rs:180:35:180:81 | &... [&ref] | provenance |  |
 | test_logging.rs:180:44:180:80 | ...::format(...) | test_logging.rs:180:44:180:80 | { ... } | provenance |  |
 | test_logging.rs:180:44:180:80 | ...::must_use(...) | test_logging.rs:180:36:180:81 | MacroExpr | provenance |  |
-| test_logging.rs:180:44:180:80 | MacroExpr | test_logging.rs:180:44:180:80 | ...::format(...) | provenance | MaD:21 |
+| test_logging.rs:180:44:180:80 | MacroExpr | test_logging.rs:180:44:180:80 | ...::format(...) | provenance | MaD:20 |
-| test_logging.rs:180:44:180:80 | { ... } | test_logging.rs:180:44:180:80 | ...::must_use(...) | provenance | MaD:22 |
+| test_logging.rs:180:44:180:80 | { ... } | test_logging.rs:180:44:180:80 | ...::must_use(...) | provenance | MaD:21 |
 | test_logging.rs:180:72:180:80 | password2 | test_logging.rs:180:44:180:80 | MacroExpr | provenance |  |
 | test_logging.rs:183:9:183:19 | err_result2 [Err] | test_logging.rs:184:13:184:23 | err_result2 [Err] | provenance |  |
 | test_logging.rs:183:47:183:68 | Err(...) [Err] | test_logging.rs:183:9:183:19 | err_result2 [Err] | provenance |  |
-| test_logging.rs:183:51:183:59 | password2 | test_logging.rs:183:51:183:67 | password2.clone() | provenance | MaD:16 |
+| test_logging.rs:183:51:183:59 | password2 | test_logging.rs:183:51:183:67 | password2.clone() | provenance | MaD:15 |
 | test_logging.rs:183:51:183:67 | password2.clone() | test_logging.rs:183:47:183:68 | Err(...) [Err] | provenance |  |
 | test_logging.rs:184:13:184:23 | err_result2 [Err] | test_logging.rs:184:25:184:34 | log_expect | provenance | MaD:4 Sink:MaD:4 |
 | test_logging.rs:187:9:187:19 | err_result3 [Err] | test_logging.rs:188:13:188:23 | err_result3 [Err] | provenance |  |
 | test_logging.rs:187:47:187:60 | Err(...) [Err] | test_logging.rs:187:9:187:19 | err_result3 [Err] | provenance |  |
 | test_logging.rs:187:51:187:59 | password2 | test_logging.rs:187:47:187:60 | Err(...) [Err] | provenance |  |
 | test_logging.rs:188:13:188:23 | err_result3 [Err] | test_logging.rs:188:25:188:34 | log_unwrap | provenance | MaD:5 Sink:MaD:5 |
-| test_logging.rs:192:12:192:37 | MacroExpr | test_logging.rs:192:5:192:10 | ...::_print | provenance | MaD:15 Sink:MaD:15 |
+| test_logging.rs:192:12:192:37 | MacroExpr | test_logging.rs:192:5:192:10 | ...::_print | provenance | MaD:14 Sink:MaD:14 |
 | test_logging.rs:192:30:192:37 | password | test_logging.rs:192:12:192:37 | MacroExpr | provenance |  |
-| test_logging.rs:193:14:193:37 | MacroExpr | test_logging.rs:193:5:193:12 | ...::_print | provenance | MaD:15 Sink:MaD:15 |
+| test_logging.rs:193:14:193:37 | MacroExpr | test_logging.rs:193:5:193:12 | ...::_print | provenance | MaD:14 Sink:MaD:14 |
 | test_logging.rs:193:30:193:37 | password | test_logging.rs:193:14:193:37 | MacroExpr | provenance |  |
-| test_logging.rs:194:13:194:38 | MacroExpr | test_logging.rs:194:5:194:11 | ...::_eprint | provenance | MaD:14 Sink:MaD:14 |
+| test_logging.rs:194:13:194:38 | MacroExpr | test_logging.rs:194:5:194:11 | ...::_eprint | provenance | MaD:13 Sink:MaD:13 |
 | test_logging.rs:194:31:194:38 | password | test_logging.rs:194:13:194:38 | MacroExpr | provenance |  |
-| test_logging.rs:195:15:195:38 | MacroExpr | test_logging.rs:195:5:195:13 | ...::_eprint | provenance | MaD:14 Sink:MaD:14 |
+| test_logging.rs:195:15:195:38 | MacroExpr | test_logging.rs:195:5:195:13 | ...::_eprint | provenance | MaD:13 Sink:MaD:13 |
 | test_logging.rs:195:31:195:38 | password | test_logging.rs:195:15:195:38 | MacroExpr | provenance |  |
-| test_logging.rs:199:20:199:43 | MacroExpr | test_logging.rs:199:13:199:18 | ...::panic_fmt | provenance | MaD:11 Sink:MaD:11 |
+| test_logging.rs:199:20:199:43 | MacroExpr | test_logging.rs:199:13:199:18 | ...::panic_fmt | provenance | MaD:10 Sink:MaD:10 |
 | test_logging.rs:199:36:199:43 | password | test_logging.rs:199:20:199:43 | MacroExpr | provenance |  |
-| test_logging.rs:202:19:202:42 | MacroExpr | test_logging.rs:202:13:202:17 | ...::panic_fmt | provenance | MaD:11 Sink:MaD:11 |
+| test_logging.rs:202:19:202:42 | MacroExpr | test_logging.rs:202:13:202:17 | ...::panic_fmt | provenance | MaD:10 Sink:MaD:10 |
 | test_logging.rs:202:35:202:42 | password | test_logging.rs:202:19:202:42 | MacroExpr | provenance |  |
-| test_logging.rs:205:28:205:51 | MacroExpr | test_logging.rs:205:13:205:26 | ...::panic_fmt | provenance | MaD:11 Sink:MaD:11 |
+| test_logging.rs:205:28:205:51 | MacroExpr | test_logging.rs:205:13:205:26 | ...::panic_fmt | provenance | MaD:10 Sink:MaD:10 |
 | test_logging.rs:205:44:205:51 | password | test_logging.rs:205:28:205:51 | MacroExpr | provenance |  |
-| test_logging.rs:208:26:208:49 | MacroExpr | test_logging.rs:208:13:208:24 | ...::panic_fmt | provenance | MaD:11 Sink:MaD:11 |
+| test_logging.rs:208:26:208:49 | MacroExpr | test_logging.rs:208:13:208:24 | ...::panic_fmt | provenance | MaD:10 Sink:MaD:10 |
 | test_logging.rs:208:42:208:49 | password | test_logging.rs:208:26:208:49 | MacroExpr | provenance |  |
-| test_logging.rs:211:28:211:51 | MacroExpr | test_logging.rs:211:13:211:19 | ...::panic_fmt | provenance | MaD:11 Sink:MaD:11 |
+| test_logging.rs:211:28:211:51 | MacroExpr | test_logging.rs:211:13:211:19 | ...::panic_fmt | provenance | MaD:10 Sink:MaD:10 |
 | test_logging.rs:211:44:211:51 | password | test_logging.rs:211:28:211:51 | MacroExpr | provenance |  |
-| test_logging.rs:214:13:214:22 | ...::assert_failed [Some] | test_logging.rs:214:13:214:22 | ...::assert_failed | provenance | Sink:MaD:9 |
 | test_logging.rs:214:30:214:53 | ...::Some(...) [Some] | test_logging.rs:214:13:214:22 | ...::assert_failed | provenance | MaD:9 Sink:MaD:9 |
-| test_logging.rs:214:30:214:53 | ...::Some(...) [Some] | test_logging.rs:214:13:214:22 | ...::assert_failed [Some] | provenance | MaD:10 |
 | test_logging.rs:214:30:214:53 | MacroExpr | test_logging.rs:214:30:214:53 | ...::Some(...) [Some] | provenance |  |
 | test_logging.rs:214:46:214:53 | password | test_logging.rs:214:30:214:53 | MacroExpr | provenance |  |
-| test_logging.rs:217:13:217:22 | ...::assert_failed [Some] | test_logging.rs:217:13:217:22 | ...::assert_failed | provenance | Sink:MaD:9 |
 | test_logging.rs:217:30:217:53 | ...::Some(...) [Some] | test_logging.rs:217:13:217:22 | ...::assert_failed | provenance | MaD:9 Sink:MaD:9 |
-| test_logging.rs:217:30:217:53 | ...::Some(...) [Some] | test_logging.rs:217:13:217:22 | ...::assert_failed [Some] | provenance | MaD:10 |
 | test_logging.rs:217:30:217:53 | MacroExpr | test_logging.rs:217:30:217:53 | ...::Some(...) [Some] | provenance |  |
 | test_logging.rs:217:46:217:53 | password | test_logging.rs:217:30:217:53 | MacroExpr | provenance |  |
-| test_logging.rs:220:34:220:57 | MacroExpr | test_logging.rs:220:13:220:25 | ...::panic_fmt | provenance | MaD:11 Sink:MaD:11 |
+| test_logging.rs:220:34:220:57 | MacroExpr | test_logging.rs:220:13:220:25 | ...::panic_fmt | provenance | MaD:10 Sink:MaD:10 |
 | test_logging.rs:220:50:220:57 | password | test_logging.rs:220:34:220:57 | MacroExpr | provenance |  |
-| test_logging.rs:223:13:223:28 | ...::assert_failed [Some] | test_logging.rs:223:13:223:28 | ...::assert_failed | provenance | Sink:MaD:9 |
 | test_logging.rs:223:36:223:59 | ...::Some(...) [Some] | test_logging.rs:223:13:223:28 | ...::assert_failed | provenance | MaD:9 Sink:MaD:9 |
-| test_logging.rs:223:36:223:59 | ...::Some(...) [Some] | test_logging.rs:223:13:223:28 | ...::assert_failed [Some] | provenance | MaD:10 |
 | test_logging.rs:223:36:223:59 | MacroExpr | test_logging.rs:223:36:223:59 | ...::Some(...) [Some] | provenance |  |
 | test_logging.rs:223:52:223:59 | password | test_logging.rs:223:36:223:59 | MacroExpr | provenance |  |
-| test_logging.rs:226:13:226:28 | ...::assert_failed [Some] | test_logging.rs:226:13:226:28 | ...::assert_failed | provenance | Sink:MaD:9 |
 | test_logging.rs:226:36:226:59 | ...::Some(...) [Some] | test_logging.rs:226:13:226:28 | ...::assert_failed | provenance | MaD:9 Sink:MaD:9 |
-| test_logging.rs:226:36:226:59 | ...::Some(...) [Some] | test_logging.rs:226:13:226:28 | ...::assert_failed [Some] | provenance | MaD:10 |
 | test_logging.rs:226:36:226:59 | MacroExpr | test_logging.rs:226:36:226:59 | ...::Some(...) [Some] | provenance |  |
 | test_logging.rs:226:52:226:59 | password | test_logging.rs:226:36:226:59 | MacroExpr | provenance |  |
-| test_logging.rs:229:30:229:62 | MacroExpr | test_logging.rs:229:30:229:71 | ... .as_str() [&ref] | provenance | MaD:20 |
+| test_logging.rs:229:30:229:62 | MacroExpr | test_logging.rs:229:30:229:71 | ... .as_str() [&ref] | provenance | MaD:19 |
-| test_logging.rs:229:30:229:71 | ... .as_str() [&ref] | test_logging.rs:229:23:229:28 | expect | provenance | MaD:2 Sink:MaD:2 |
 | test_logging.rs:229:30:229:71 | ... .as_str() [&ref] | test_logging.rs:229:23:229:28 | expect | provenance | MaD:2 Sink:MaD:2 |
 | test_logging.rs:229:38:229:61 | ...::format(...) | test_logging.rs:229:38:229:61 | { ... } | provenance |  |
 | test_logging.rs:229:38:229:61 | ...::must_use(...) | test_logging.rs:229:30:229:62 | MacroExpr | provenance |  |
-| test_logging.rs:229:38:229:61 | MacroExpr | test_logging.rs:229:38:229:61 | ...::format(...) | provenance | MaD:21 |
+| test_logging.rs:229:38:229:61 | MacroExpr | test_logging.rs:229:38:229:61 | ...::format(...) | provenance | MaD:20 |
-| test_logging.rs:229:38:229:61 | { ... } | test_logging.rs:229:38:229:61 | ...::must_use(...) | provenance | MaD:22 |
+| test_logging.rs:229:38:229:61 | { ... } | test_logging.rs:229:38:229:61 | ...::must_use(...) | provenance | MaD:21 |
 | test_logging.rs:229:54:229:61 | password | test_logging.rs:229:38:229:61 | MacroExpr | provenance |  |
-| test_logging.rs:242:16:242:50 | MacroExpr | test_logging.rs:242:16:242:61 | ... .as_bytes() [&ref] | provenance | MaD:19 |
+| test_logging.rs:242:16:242:50 | MacroExpr | test_logging.rs:242:16:242:61 | ... .as_bytes() [&ref] | provenance | MaD:18 |
 | test_logging.rs:242:16:242:61 | ... .as_bytes() [&ref] | test_logging.rs:242:10:242:14 | write | provenance | MaD:7 Sink:MaD:7 |
 | test_logging.rs:242:24:242:49 | ...::format(...) | test_logging.rs:242:24:242:49 | { ... } | provenance |  |
 | test_logging.rs:242:24:242:49 | ...::must_use(...) | test_logging.rs:242:16:242:50 | MacroExpr | provenance |  |
-| test_logging.rs:242:24:242:49 | MacroExpr | test_logging.rs:242:24:242:49 | ...::format(...) | provenance | MaD:21 |
+| test_logging.rs:242:24:242:49 | MacroExpr | test_logging.rs:242:24:242:49 | ...::format(...) | provenance | MaD:20 |
-| test_logging.rs:242:24:242:49 | { ... } | test_logging.rs:242:24:242:49 | ...::must_use(...) | provenance | MaD:22 |
+| test_logging.rs:242:24:242:49 | { ... } | test_logging.rs:242:24:242:49 | ...::must_use(...) | provenance | MaD:21 |
 | test_logging.rs:242:42:242:49 | password | test_logging.rs:242:24:242:49 | MacroExpr | provenance |  |
-| test_logging.rs:245:20:245:54 | MacroExpr | test_logging.rs:245:20:245:65 | ... .as_bytes() [&ref] | provenance | MaD:19 |
+| test_logging.rs:245:20:245:54 | MacroExpr | test_logging.rs:245:20:245:65 | ... .as_bytes() [&ref] | provenance | MaD:18 |
 | test_logging.rs:245:20:245:65 | ... .as_bytes() [&ref] | test_logging.rs:245:10:245:18 | write_all | provenance | MaD:8 Sink:MaD:8 |
 | test_logging.rs:245:28:245:53 | ...::format(...) | test_logging.rs:245:28:245:53 | { ... } | provenance |  |
 | test_logging.rs:245:28:245:53 | ...::must_use(...) | test_logging.rs:245:20:245:54 | MacroExpr | provenance |  |
-| test_logging.rs:245:28:245:53 | MacroExpr | test_logging.rs:245:28:245:53 | ...::format(...) | provenance | MaD:21 |
+| test_logging.rs:245:28:245:53 | MacroExpr | test_logging.rs:245:28:245:53 | ...::format(...) | provenance | MaD:20 |
-| test_logging.rs:245:28:245:53 | { ... } | test_logging.rs:245:28:245:53 | ...::must_use(...) | provenance | MaD:22 |
+| test_logging.rs:245:28:245:53 | { ... } | test_logging.rs:245:28:245:53 | ...::must_use(...) | provenance | MaD:21 |
 | test_logging.rs:245:46:245:53 | password | test_logging.rs:245:28:245:53 | MacroExpr | provenance |  |
-| test_logging.rs:248:15:248:49 | MacroExpr | test_logging.rs:248:15:248:60 | ... .as_bytes() [&ref] | provenance | MaD:19 |
+| test_logging.rs:248:15:248:49 | MacroExpr | test_logging.rs:248:15:248:60 | ... .as_bytes() [&ref] | provenance | MaD:18 |
 | test_logging.rs:248:15:248:60 | ... .as_bytes() [&ref] | test_logging.rs:248:9:248:13 | write | provenance | MaD:7 Sink:MaD:7 |
 | test_logging.rs:248:23:248:48 | ...::format(...) | test_logging.rs:248:23:248:48 | { ... } | provenance |  |
 | test_logging.rs:248:23:248:48 | ...::must_use(...) | test_logging.rs:248:15:248:49 | MacroExpr | provenance |  |
-| test_logging.rs:248:23:248:48 | MacroExpr | test_logging.rs:248:23:248:48 | ...::format(...) | provenance | MaD:21 |
+| test_logging.rs:248:23:248:48 | MacroExpr | test_logging.rs:248:23:248:48 | ...::format(...) | provenance | MaD:20 |
-| test_logging.rs:248:23:248:48 | { ... } | test_logging.rs:248:23:248:48 | ...::must_use(...) | provenance | MaD:22 |
+| test_logging.rs:248:23:248:48 | { ... } | test_logging.rs:248:23:248:48 | ...::must_use(...) | provenance | MaD:21 |
 | test_logging.rs:248:41:248:48 | password | test_logging.rs:248:23:248:48 | MacroExpr | provenance |  |
-| test_logging.rs:251:15:251:49 | MacroExpr | test_logging.rs:251:15:251:60 | ... .as_bytes() [&ref] | provenance | MaD:19 |
+| test_logging.rs:251:15:251:49 | MacroExpr | test_logging.rs:251:15:251:60 | ... .as_bytes() [&ref] | provenance | MaD:18 |
 | test_logging.rs:251:15:251:60 | ... .as_bytes() [&ref] | test_logging.rs:251:9:251:13 | write | provenance | MaD:6 Sink:MaD:6 |
 | test_logging.rs:251:23:251:48 | ...::format(...) | test_logging.rs:251:23:251:48 | { ... } | provenance |  |
 | test_logging.rs:251:23:251:48 | ...::must_use(...) | test_logging.rs:251:15:251:49 | MacroExpr | provenance |  |
-| test_logging.rs:251:23:251:48 | MacroExpr | test_logging.rs:251:23:251:48 | ...::format(...) | provenance | MaD:21 |
+| test_logging.rs:251:23:251:48 | MacroExpr | test_logging.rs:251:23:251:48 | ...::format(...) | provenance | MaD:20 |
-| test_logging.rs:251:23:251:48 | { ... } | test_logging.rs:251:23:251:48 | ...::must_use(...) | provenance | MaD:22 |
+| test_logging.rs:251:23:251:48 | { ... } | test_logging.rs:251:23:251:48 | ...::must_use(...) | provenance | MaD:21 |
 | test_logging.rs:251:41:251:48 | password | test_logging.rs:251:23:251:48 | MacroExpr | provenance |  |
 models
 | 1 | Sink: <core::option::Option as log_err::LogErrOption>::log_expect; Argument[0]; log-injection |
@@ -275,19 +265,18 @@ models
 | 7 | Sink: <std::io::stdio::StdoutLock as std::io::Write>::write; Argument[0]; log-injection |
 | 8 | Sink: <std::io::stdio::StdoutLock as std::io::Write>::write_all; Argument[0]; log-injection |
 | 9 | Sink: core::panicking::assert_failed; Argument[3].Field[core::option::Option::Some(0)]; log-injection |
-| 10 | Sink: core::panicking::assert_failed; Argument[3]; log-injection |
+| 10 | Sink: core::panicking::panic_fmt; Argument[0]; log-injection |
-| 11 | Sink: core::panicking::panic_fmt; Argument[0]; log-injection |
+| 11 | Sink: log::__private_api::log; Argument[1]; log-injection |
-| 12 | Sink: log::__private_api::log; Argument[1]; log-injection |
+| 12 | Sink: log::__private_api::log; Argument[3]; log-injection |
-| 13 | Sink: log::__private_api::log; Argument[3]; log-injection |
+| 13 | Sink: std::io::stdio::_eprint; Argument[0]; log-injection |
-| 14 | Sink: std::io::stdio::_eprint; Argument[0]; log-injection |
+| 14 | Sink: std::io::stdio::_print; Argument[0]; log-injection |
-| 15 | Sink: std::io::stdio::_print; Argument[0]; log-injection |
+| 15 | Summary: <_ as core::clone::Clone>::clone; Argument[self].Reference; ReturnValue; value |
-| 16 | Summary: <_ as core::clone::Clone>::clone; Argument[self].Reference; ReturnValue; value |
+| 16 | Summary: <_ as core::ops::arith::Add>::add; Argument[0].Reference; ReturnValue; taint |
-| 17 | Summary: <_ as core::ops::arith::Add>::add; Argument[0].Reference; ReturnValue; taint |
+| 17 | Summary: <_ as core::ops::arith::Add>::add; Argument[0]; ReturnValue; taint |
-| 18 | Summary: <_ as core::ops::arith::Add>::add; Argument[0]; ReturnValue; taint |
+| 18 | Summary: <alloc::string::String>::as_bytes; Argument[self]; ReturnValue; value |
-| 19 | Summary: <alloc::string::String>::as_bytes; Argument[self]; ReturnValue; value |
+| 19 | Summary: <alloc::string::String>::as_str; Argument[self]; ReturnValue; value |
-| 20 | Summary: <alloc::string::String>::as_str; Argument[self]; ReturnValue; value |
+| 20 | Summary: alloc::fmt::format; Argument[0]; ReturnValue; taint |
-| 21 | Summary: alloc::fmt::format; Argument[0]; ReturnValue; taint |
+| 21 | Summary: core::hint::must_use; Argument[0]; ReturnValue; value |
-| 22 | Summary: core::hint::must_use; Argument[0]; ReturnValue; value |
 nodes
 | test_logging.rs:42:5:42:10 | ...::log | semmle.label | ...::log |
 | test_logging.rs:42:12:42:35 | MacroExpr | semmle.label | MacroExpr |
@@ -474,12 +463,10 @@ nodes
 | test_logging.rs:211:28:211:51 | MacroExpr | semmle.label | MacroExpr |
 | test_logging.rs:211:44:211:51 | password | semmle.label | password |
 | test_logging.rs:214:13:214:22 | ...::assert_failed | semmle.label | ...::assert_failed |
-| test_logging.rs:214:13:214:22 | ...::assert_failed [Some] | semmle.label | ...::assert_failed [Some] |
 | test_logging.rs:214:30:214:53 | ...::Some(...) [Some] | semmle.label | ...::Some(...) [Some] |
 | test_logging.rs:214:30:214:53 | MacroExpr | semmle.label | MacroExpr |
 | test_logging.rs:214:46:214:53 | password | semmle.label | password |
 | test_logging.rs:217:13:217:22 | ...::assert_failed | semmle.label | ...::assert_failed |
-| test_logging.rs:217:13:217:22 | ...::assert_failed [Some] | semmle.label | ...::assert_failed [Some] |
 | test_logging.rs:217:30:217:53 | ...::Some(...) [Some] | semmle.label | ...::Some(...) [Some] |
 | test_logging.rs:217:30:217:53 | MacroExpr | semmle.label | MacroExpr |
 | test_logging.rs:217:46:217:53 | password | semmle.label | password |
@@ -487,17 +474,14 @@ nodes
 | test_logging.rs:220:34:220:57 | MacroExpr | semmle.label | MacroExpr |
 | test_logging.rs:220:50:220:57 | password | semmle.label | password |
 | test_logging.rs:223:13:223:28 | ...::assert_failed | semmle.label | ...::assert_failed |
-| test_logging.rs:223:13:223:28 | ...::assert_failed [Some] | semmle.label | ...::assert_failed [Some] |
 | test_logging.rs:223:36:223:59 | ...::Some(...) [Some] | semmle.label | ...::Some(...) [Some] |
 | test_logging.rs:223:36:223:59 | MacroExpr | semmle.label | MacroExpr |
 | test_logging.rs:223:52:223:59 | password | semmle.label | password |
 | test_logging.rs:226:13:226:28 | ...::assert_failed | semmle.label | ...::assert_failed |
-| test_logging.rs:226:13:226:28 | ...::assert_failed [Some] | semmle.label | ...::assert_failed [Some] |
 | test_logging.rs:226:36:226:59 | ...::Some(...) [Some] | semmle.label | ...::Some(...) [Some] |
 | test_logging.rs:226:36:226:59 | MacroExpr | semmle.label | MacroExpr |
 | test_logging.rs:226:52:226:59 | password | semmle.label | password |
 | test_logging.rs:229:23:229:28 | expect | semmle.label | expect |
-| test_logging.rs:229:23:229:28 | expect | semmle.label | expect |
 | test_logging.rs:229:30:229:62 | MacroExpr | semmle.label | MacroExpr |
 | test_logging.rs:229:30:229:71 | ... .as_str() [&ref] | semmle.label | ... .as_str() [&ref] |
 | test_logging.rs:229:38:229:61 | ...::format(...) | semmle.label | ...::format(...) |

rust/ql/test/query-tests/security/CWE-825/AccessInvalidPointer.expected

@@ -10,7 +10,6 @@
 | deallocation.rs:95:5:95:31 | ...::write::<...> | deallocation.rs:70:3:70:21 | ...::dealloc | deallocation.rs:95:5:95:31 | ...::write::<...> | This operation dereferences a pointer that may be $@. | deallocation.rs:70:3:70:21 | ...::dealloc | invalid |
 | deallocation.rs:115:13:115:18 | my_ptr | deallocation.rs:112:3:112:12 | ...::free | deallocation.rs:115:13:115:18 | my_ptr | This operation dereferences a pointer that may be $@. | deallocation.rs:112:3:112:12 | ...::free | invalid |
 | deallocation.rs:130:14:130:15 | p1 | deallocation.rs:123:23:123:40 | ...::dangling | deallocation.rs:130:14:130:15 | p1 | This operation dereferences a pointer that may be $@. | deallocation.rs:123:23:123:40 | ...::dangling | invalid |
-| deallocation.rs:130:14:130:15 | p1 | deallocation.rs:123:23:123:40 | ...::dangling | deallocation.rs:130:14:130:15 | p1 | This operation dereferences a pointer that may be $@. | deallocation.rs:123:23:123:40 | ...::dangling | invalid |
 | deallocation.rs:131:14:131:15 | p2 | deallocation.rs:124:21:124:42 | ...::dangling_mut | deallocation.rs:131:14:131:15 | p2 | This operation dereferences a pointer that may be $@. | deallocation.rs:124:21:124:42 | ...::dangling_mut | invalid |
 | deallocation.rs:132:14:132:15 | p3 | deallocation.rs:125:23:125:36 | ...::null | deallocation.rs:132:14:132:15 | p3 | This operation dereferences a pointer that may be $@. | deallocation.rs:125:23:125:36 | ...::null | invalid |
 | deallocation.rs:163:13:163:15 | ptr | deallocation.rs:159:9:159:26 | ...::null_mut | deallocation.rs:163:13:163:15 | ptr | This operation dereferences a pointer that may be $@. | deallocation.rs:159:9:159:26 | ...::null_mut | invalid |
@@ -27,8 +26,6 @@
 | deallocation.rs:210:7:210:9 | ptr | deallocation.rs:207:9:207:26 | ...::null_mut | deallocation.rs:210:7:210:9 | ptr | This operation dereferences a pointer that may be $@. | deallocation.rs:207:9:207:26 | ...::null_mut | invalid |
 | deallocation.rs:226:13:226:21 | const_ptr | deallocation.rs:219:15:219:32 | ...::null_mut | deallocation.rs:226:13:226:21 | const_ptr | This operation dereferences a pointer that may be $@. | deallocation.rs:219:15:219:32 | ...::null_mut | invalid |
 | deallocation.rs:274:15:274:16 | p1 | deallocation.rs:270:3:270:25 | ...::drop_in_place | deallocation.rs:274:15:274:16 | p1 | This operation dereferences a pointer that may be $@. | deallocation.rs:270:3:270:25 | ...::drop_in_place | invalid |
-| deallocation.rs:274:15:274:16 | p1 | deallocation.rs:270:3:270:25 | ...::drop_in_place | deallocation.rs:274:15:274:16 | p1 | This operation dereferences a pointer that may be $@. | deallocation.rs:270:3:270:25 | ...::drop_in_place | invalid |
-| deallocation.rs:342:18:342:20 | ptr | deallocation.rs:336:3:336:25 | ...::drop_in_place | deallocation.rs:342:18:342:20 | ptr | This operation dereferences a pointer that may be $@. | deallocation.rs:336:3:336:25 | ...::drop_in_place | invalid |
 | deallocation.rs:342:18:342:20 | ptr | deallocation.rs:336:3:336:25 | ...::drop_in_place | deallocation.rs:342:18:342:20 | ptr | This operation dereferences a pointer that may be $@. | deallocation.rs:336:3:336:25 | ...::drop_in_place | invalid |
 edges
 | deallocation.rs:20:3:20:21 | ...::dealloc | deallocation.rs:20:23:20:24 | [post] m1 | provenance | Src:MaD:3 MaD:3 |
@@ -49,7 +46,6 @@ edges
 | deallocation.rs:112:14:112:40 | [post] my_ptr as ... | deallocation.rs:115:13:115:18 | my_ptr | provenance |  |
 | deallocation.rs:123:6:123:7 | p1 | deallocation.rs:130:14:130:15 | p1 | provenance |  |
 | deallocation.rs:123:23:123:40 | ...::dangling | deallocation.rs:123:23:123:42 | ...::dangling(...) | provenance | Src:MaD:4 MaD:4 |
-| deallocation.rs:123:23:123:40 | ...::dangling | deallocation.rs:123:23:123:42 | ...::dangling(...) | provenance | Src:MaD:4 MaD:4 |
 | deallocation.rs:123:23:123:42 | ...::dangling(...) | deallocation.rs:123:6:123:7 | p1 | provenance |  |
 | deallocation.rs:124:6:124:7 | p2 | deallocation.rs:131:14:131:15 | p2 | provenance |  |
 | deallocation.rs:124:21:124:42 | ...::dangling_mut | deallocation.rs:124:21:124:44 | ...::dangling_mut(...) | provenance | Src:MaD:5 MaD:5 |
@@ -83,10 +79,8 @@ edges
 | deallocation.rs:219:15:219:32 | ...::null_mut | deallocation.rs:219:15:219:34 | ...::null_mut(...) | provenance | Src:MaD:8 MaD:8 |
 | deallocation.rs:219:15:219:34 | ...::null_mut(...) | deallocation.rs:219:3:219:11 | const_ptr | provenance |  |
 | deallocation.rs:270:3:270:25 | ...::drop_in_place | deallocation.rs:270:27:270:28 | [post] p1 | provenance | Src:MaD:6 MaD:6 |
-| deallocation.rs:270:3:270:25 | ...::drop_in_place | deallocation.rs:270:27:270:28 | [post] p1 | provenance | Src:MaD:6 MaD:6 |
 | deallocation.rs:270:27:270:28 | [post] p1 | deallocation.rs:274:15:274:16 | p1 | provenance |  |
 | deallocation.rs:336:3:336:25 | ...::drop_in_place | deallocation.rs:336:27:336:29 | [post] ptr | provenance | Src:MaD:6 MaD:6 |
-| deallocation.rs:336:3:336:25 | ...::drop_in_place | deallocation.rs:336:27:336:29 | [post] ptr | provenance | Src:MaD:6 MaD:6 |
 | deallocation.rs:336:27:336:29 | [post] ptr | deallocation.rs:342:18:342:20 | ptr | provenance |  |
 models
 | 1 | Sink: core::ptr::read; Argument[0]; pointer-access |
@@ -120,7 +114,6 @@ nodes
 | deallocation.rs:115:13:115:18 | my_ptr | semmle.label | my_ptr |
 | deallocation.rs:123:6:123:7 | p1 | semmle.label | p1 |
 | deallocation.rs:123:23:123:40 | ...::dangling | semmle.label | ...::dangling |
-| deallocation.rs:123:23:123:40 | ...::dangling | semmle.label | ...::dangling |
 | deallocation.rs:123:23:123:42 | ...::dangling(...) | semmle.label | ...::dangling(...) |
 | deallocation.rs:124:6:124:7 | p2 | semmle.label | p2 |
 | deallocation.rs:124:21:124:42 | ...::dangling_mut | semmle.label | ...::dangling_mut |
@@ -160,11 +153,9 @@ nodes
 | deallocation.rs:219:15:219:34 | ...::null_mut(...) | semmle.label | ...::null_mut(...) |
 | deallocation.rs:226:13:226:21 | const_ptr | semmle.label | const_ptr |
 | deallocation.rs:270:3:270:25 | ...::drop_in_place | semmle.label | ...::drop_in_place |
-| deallocation.rs:270:3:270:25 | ...::drop_in_place | semmle.label | ...::drop_in_place |
 | deallocation.rs:270:27:270:28 | [post] p1 | semmle.label | [post] p1 |
 | deallocation.rs:274:15:274:16 | p1 | semmle.label | p1 |
 | deallocation.rs:336:3:336:25 | ...::drop_in_place | semmle.label | ...::drop_in_place |
-| deallocation.rs:336:3:336:25 | ...::drop_in_place | semmle.label | ...::drop_in_place |
 | deallocation.rs:336:27:336:29 | [post] ptr | semmle.label | [post] ptr |
 | deallocation.rs:342:18:342:20 | ptr | semmle.label | ptr |
 subpaths

shared/dataflow/codeql/dataflow/internal/FlowSummaryImpl.qll

@@ -215,6 +215,35 @@ module Make<
         ]
     }
 
+    class AcceptingValue extends string {
+      AcceptingValue() {
+        this =
+          [
+            "true",
+            "false",
+            "no-exception",
+            "zero",
+            "not-zero",
+            "null",
+            "not-null",
+          ]
+      }
+
+      predicate isTrue() { this = "true" }
+
+      predicate isFalse() { this = "false" }
+
+      predicate isNoException() { this = "no-exception" }
+
+      predicate isZero() { this = "zero" }
+
+      predicate isNotZero() { this = "not-zero" }
+
+      predicate isNull() { this = "null" }
+
+      predicate isNotNull() { this = "not-null" }
+    }
+
     /**
      * A class used to represent provenance values for MaD models.
      *
@@ -633,6 +662,30 @@ module Make<
       unsupportedCallable(callable, _, _, _)
     }
 
+    private predicate isRelevantSource(
+      SourceElement e, string output, string kind, Provenance provenance, string model
+    ) {
+      e.isSource(output, kind, provenance, model) and
+      (
+        provenance.isManual()
+        or
+        provenance.isGenerated() and
+        not exists(Provenance p | p.isManual() and e.isSource(_, kind, p, _))
+      )
+    }
+
+    private predicate isRelevantSink(
+      SinkElement e, string input, string kind, Provenance provenance, string model
+    ) {
+      e.isSink(input, kind, provenance, model) and
+      (
+        provenance.isManual()
+        or
+        provenance.isGenerated() and
+        not exists(Provenance p | p.isManual() and e.isSink(_, kind, p, _))
+      )
+    }
+
     private predicate summarySpec(string spec) {
       exists(SummarizedCallable c |
         c.propagatesFlow(spec, _, _, _)
@@ -640,9 +693,9 @@ module Make<
         c.propagatesFlow(_, spec, _, _)
       )
       or
-      any(SourceElement s).isSource(spec, _, _, _)
+      isRelevantSource(_, spec, _, _, _)
       or
-      any(SinkElement s).isSink(spec, _, _, _)
+      isRelevantSink(_, spec, _, _, _)
     }
 
     import AccessPathSyntax::AccessPath<summarySpec/1>
@@ -1005,7 +1058,7 @@ module Make<
       SourceElement source, SummaryComponentStack s, string kind, string model
     ) {
       exists(string outSpec |
-        source.isSource(outSpec, kind, _, model) and
+        isRelevantSource(source, outSpec, kind, _, model) and
         External::interpretSpec(outSpec, s)
       )
     }
@@ -1028,7 +1081,7 @@ module Make<
       SinkElement sink, SummaryComponentStack s, string kind, string model
     ) {
       exists(string inSpec |
-        sink.isSink(inSpec, kind, _, model) and
+        isRelevantSink(sink, inSpec, kind, _, model) and
         External::interpretSpec(inSpec, s)
       )
     }
@@ -2015,6 +2068,12 @@ module Make<
         not exists(interpretComponent(c))
       }
 
+      /** Holds if `acceptingvalue` is not a valid barrier guard accepting-value. */
+      bindingset[acceptingvalue]
+      predicate invalidAcceptingValue(string acceptingvalue) {
+        not acceptingvalue instanceof AcceptingValue
+      }
+
       /** Holds if `provenance` is not a valid provenance value. */
       bindingset[provenance]
       predicate invalidProvenance(string provenance) { not provenance instanceof Provenance }
@@ -2052,6 +2111,23 @@ module Make<
           Element n, string input, string kind, Provenance provenance, string model
         );
 
+        /**
+         * Holds if an external barrier specification exists for `n` with output specification
+         * `output` and kind `kind`.
+         */
+        predicate barrierElement(
+          Element n, string output, string kind, Provenance provenance, string model
+        );
+
+        /**
+         * Holds if an external barrier guard specification exists for `n` with input
+         * specification `input`, accepting value `acceptingvalue`, and kind `kind`.
+         */
+        predicate barrierGuardElement(
+          Element n, string input, AcceptingValue acceptingvalue, string kind,
+          Provenance provenance, string model
+        );
+
         class SourceOrSinkElement extends Element;
 
         /** An entity used to interpret a source/sink specification. */
@@ -2105,7 +2181,9 @@ module Make<
 
         private predicate sourceSinkSpec(string spec) {
           sourceElement(_, spec, _, _, _) or
-          sinkElement(_, spec, _, _, _)
+          sinkElement(_, spec, _, _, _) or
+          barrierElement(_, spec, _, _, _) or
+          barrierGuardElement(_, spec, _, _, _, _)
         }
 
         private module AccessPath = AccessPathSyntax::AccessPath<sourceSinkSpec/1>;
@@ -2160,11 +2238,34 @@ module Make<
           )
         }
 
+        private predicate barrierElementRef(
+          InterpretNode ref, SourceSinkAccessPath output, string kind, string model
+        ) {
+          exists(SourceOrSinkElement e |
+            barrierElement(e, output, kind, _, model) and
+            if outputNeedsReferenceExt(output.getToken(0))
+            then e = ref.getCallTarget()
+            else e = ref.asElement()
+          )
+        }
+
+        private predicate barrierGuardElementRef(
+          InterpretNode ref, SourceSinkAccessPath input, AcceptingValue acceptingvalue, string kind,
+          string model
+        ) {
+          exists(SourceOrSinkElement e |
+            barrierGuardElement(e, input, acceptingvalue, kind, _, model) and
+            if inputNeedsReferenceExt(input.getToken(0))
+            then e = ref.getCallTarget()
+            else e = ref.asElement()
+          )
+        }
+
         /** Holds if the first `n` tokens of `output` resolve to the given interpretation. */
         private predicate interpretOutput(
           SourceSinkAccessPath output, int n, InterpretNode ref, InterpretNode node
         ) {
-          sourceElementRef(ref, output, _, _) and
+          (sourceElementRef(ref, output, _, _) or barrierElementRef(ref, output, _, _)) and
           n = 0 and
           (
             if output = ""
@@ -2220,7 +2321,7 @@ module Make<
         private predicate interpretInput(
           SourceSinkAccessPath input, int n, InterpretNode ref, InterpretNode node
         ) {
-          sinkElementRef(ref, input, _, _) and
+          (sinkElementRef(ref, input, _, _) or barrierGuardElementRef(ref, input, _, _, _)) and
           n = 0 and
           (
             if input = ""
@@ -2280,6 +2381,30 @@ module Make<
           )
         }
 
+        /**
+         * Holds if `node` is specified as a barrier with the given kind in a MaD flow
+         * model.
+         */
+        predicate isBarrierNode(InterpretNode node, string kind, string model) {
+          exists(InterpretNode ref, SourceSinkAccessPath output |
+            barrierElementRef(ref, output, kind, model) and
+            interpretOutput(output, output.getNumToken(), ref, node)
+          )
+        }
+
+        /**
+         * Holds if `node` is specified as a barrier guard argument with the
+         * given kind in a MaD flow model.
+         */
+        predicate isBarrierGuardNode(
+          InterpretNode node, AcceptingValue acceptingvalue, string kind, string model
+        ) {
+          exists(InterpretNode ref, SourceSinkAccessPath input |
+            barrierGuardElementRef(ref, input, acceptingvalue, kind, model) and
+            interpretInput(input, input.getNumToken(), ref, node)
+          )
+        }
+
         final private class SourceOrSinkElementFinal = SourceOrSinkElement;
 
         signature predicate sourceOrSinkElementSig(

shared/mad/codeql/mad/ModelValidation.qll

@@ -173,7 +173,7 @@ module KindValidation<KindValidationConfigSig Config> {
     or
     exists(string kind, string msg | Config::sinkKind(kind) |
       not kind instanceof ValidSinkKind and
-      msg = "Invalid kind \"" + kind + "\" in sink model." and
+      msg = "Invalid kind \"" + kind + "\" in sink or barrier model." and
       // The part of this message that refers to outdated sink kinds can be deleted after June 1st, 2024.
       if kind instanceof OutdatedSinkKind
       then result = msg + " " + kind.(OutdatedSinkKind).outdatedMessage()

swift/ql/lib/codeql/swift/dataflow/internal/FlowSummaryImpl.qll

@@ -159,6 +159,19 @@ module SourceSinkInterpretationInput implements
     )
   }
 
+  predicate barrierElement(
+    Element n, string output, string kind, Public::Provenance provenance, string model
+  ) {
+    none()
+  }
+
+  predicate barrierGuardElement(
+    Element n, string input, Public::AcceptingValue acceptingvalue, string kind,
+    Public::Provenance provenance, string model
+  ) {
+    none()
+  }
+
   private newtype TInterpretNode =
     TElement_(Element n) or
     TNode_(Node n) or