hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-07-20 10:48:17 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'main' into sensitive-improvements

Browse Source
This commit is contained in:
Rasmus Wriedt Larsen
2021-06-10 15:11:09 +02:00
parent ea0c1d7db3 716627c1dd
commit 04db33513e
280 changed files with 9670 additions and 4880 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
.codeqlmanifest.json
View File

@@ -1,5 +1,6 @@
{ "provide": [ "*/ql/src/qlpack.yml",
"*/ql/test/qlpack.yml",
"cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/qlpack.yml",
"*/ql/examples/qlpack.yml",
"*/upgrades/qlpack.yml",
"misc/legacy-support/*/qlpack.yml",

1
cpp/ql/src/Security/CWE/CWE-190/TaintedAllocationSize.ql
View File

@@ -9,6 +9,7 @@
* @tags reliability
* security
* external/cwe/cwe-190
* external/cwe/cwe-789
*/
import cpp

123
cpp/ql/src/Security/CWE/CWE-327/BrokenCryptoAlgorithm.ql
View File

@@ -28,7 +28,7 @@ Function getAnInsecureEncryptionFunction() {
/**
* A function with additional evidence it is related to encryption.
*/
Function getAdditionalEvidenceFunction() {
Function getAnAdditionalEvidenceFunction() {
(
isEncryptionAdditionalEvidence(result.getName()) or
isEncryptionAdditionalEvidence(result.getAParameter().getName())
@@ -47,7 +47,7 @@ Macro getAnInsecureEncryptionMacro() {
/**
* A macro with additional evidence it is related to encryption.
*/
Macro getAdditionalEvidenceMacro() {
Macro getAnAdditionalEvidenceMacro() {
isEncryptionAdditionalEvidence(result.getName()) and
exists(result.getAnInvocation())
}
@@ -63,61 +63,78 @@ EnumConstant getAnInsecureEncryptionEnumConst() { isInsecureEncryption(result.ge
EnumConstant getAdditionalEvidenceEnumConst() { isEncryptionAdditionalEvidence(result.getName()) }
/**
* A function call we have a high confidence is related to use of an insecure
* encryption algorithm.
* A function call we have a high confidence is related to use of an insecure encryption algorithm, along
* with an associated `Element` which might be the best point to blame, and a description of that element.
*/
class InsecureFunctionCall extends FunctionCall {
Element blame;
string explain;
predicate getInsecureEncryptionEvidence(FunctionCall fc, Element blame, string description) {
// find use of an insecure algorithm name
(
fc.getTarget() = getAnInsecureEncryptionFunction() and
blame = fc and
description = "call to " + fc.getTarget().getName()
or
exists(MacroInvocation mi |
(
mi.getAnExpandedElement() = fc or
mi.getAnExpandedElement() = fc.getAnArgument()
) and
mi.getMacro() = getAnInsecureEncryptionMacro() and
blame = mi and
description = "invocation of macro " + mi.getMacro().getName()
)
or
exists(EnumConstantAccess ec |
ec = fc.getAnArgument() and
ec.getTarget() = getAnInsecureEncryptionEnumConst() and
blame = ec and
description = "access of enum constant " + ec.getTarget().getName()
)
) and
// find additional evidence that this function is related to encryption.
(
fc.getTarget() = getAnAdditionalEvidenceFunction()
or
exists(MacroInvocation mi |
(
mi.getAnExpandedElement() = fc or
mi.getAnExpandedElement() = fc.getAnArgument()
) and
mi.getMacro() = getAnAdditionalEvidenceMacro()
)
or
exists(EnumConstantAccess ec |
ec = fc.getAnArgument() and
ec.getTarget() = getAdditionalEvidenceEnumConst()
)
)
}
InsecureFunctionCall() {
// find use of an insecure algorithm name
(
getTarget() = getAnInsecureEncryptionFunction() and
blame = this and
explain = "function call"
or
exists(MacroInvocation mi |
(
mi.getAnExpandedElement() = this or
mi.getAnExpandedElement() = this.getAnArgument()
) and
mi.getMacro() = getAnInsecureEncryptionMacro() and
blame = mi and
explain = "macro invocation"
)
or
exists(EnumConstantAccess ec |
ec = this.getAnArgument() and
ec.getTarget() = getAnInsecureEncryptionEnumConst() and
blame = ec and
explain = "enum constant access"
)
) and
// find additional evidence that this function is related to encryption.
(
getTarget() = getAdditionalEvidenceFunction()
or
exists(MacroInvocation mi |
(
mi.getAnExpandedElement() = this or
mi.getAnExpandedElement() = this.getAnArgument()
) and
mi.getMacro() = getAdditionalEvidenceMacro()
)
or
exists(EnumConstantAccess ec |
ec = this.getAnArgument() and
ec.getTarget() = getAdditionalEvidenceEnumConst()
)
/**
* An element that is the `blame` of an `InsecureFunctionCall`.
*/
class BlamedElement extends Element {
string description;
BlamedElement() { getInsecureEncryptionEvidence(_, this, description) }
/**
* Holds if this is the `num`-th `BlamedElement` in `f`.
*/
predicate hasFileRank(File f, int num) {
exists(int loc |
getLocation().charLoc(f, loc, _) and
loc =
rank[num](BlamedElement other, int loc2 | other.getLocation().charLoc(f, loc2, _) | loc2)
)
}
Element getBlame() { result = blame }
string getDescription() { result = explain }
string getDescription() { result = description }
}
from InsecureFunctionCall c
select c.getBlame(),
"This " + c.getDescription() + " specifies a broken or weak cryptographic algorithm."
from File f, BlamedElement firstResult, BlamedElement thisResult
where
firstResult.hasFileRank(f, 1) and
thisResult.hasFileRank(f, _)
select firstResult,
"This file makes use of a broken or weak cryptographic algorithm (specified by $@).", thisResult,
thisResult.getDescription()

4
cpp/ql/src/semmle/code/cpp/Location.qll
View File

@@ -128,7 +128,9 @@ deprecated library class LocationExpr extends Location, @location_expr { }
* Gets the length of the longest line in file `f`.
*/
pragma[nomagic]
private int maxCols(File f) { result = max(Location l | l.getFile() = f | l.getEndColumn()) }
private int maxCols(File f) {
result = max(Location l | l.getFile() = f | l.getStartColumn().maximum(l.getEndColumn()))
}
/**
* A C/C++ element that has a location in a file

2
cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasAnalysis.qll
View File

@@ -411,7 +411,7 @@ predicate addressOperandAllocationAndOffset(
allocation.getABaseInstruction() = base and
hasBaseAndOffset(addrOperand, base, bitOffset) and
not exists(Instruction previousBase |
hasBaseAndOffset(addrOperand, previousBase, _) and
hasBaseAndOffset(addrOperand, pragma[only_bind_out](previousBase), _) and
previousBase = base.getAnOperand().getDef()
)
)

60
cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/SideEffects.qll
View File

@@ -10,6 +10,64 @@ private import semmle.code.cpp.ir.implementation.Opcode
private import semmle.code.cpp.models.interfaces.PointerWrapper
private import semmle.code.cpp.models.interfaces.SideEffect
private predicate isDeeplyConst(Type t) {
t.isConst() and
isDeeplyConstBelow(t)
or
isDeeplyConst(t.(Decltype).getBaseType())
or
isDeeplyConst(t.(ReferenceType).getBaseType())
or
exists(SpecifiedType specType | specType = t |
specType.getASpecifier().getName() = "const" and
isDeeplyConstBelow(specType.getBaseType())
)
or
isDeeplyConst(t.(ArrayType).getBaseType())
}
private predicate isDeeplyConstBelow(Type t) {
t instanceof BuiltInType
or
not t instanceof PointerWrapper and
t instanceof Class
or
t instanceof Enum
or
isDeeplyConstBelow(t.(Decltype).getBaseType())
or
isDeeplyConst(t.(PointerType).getBaseType())
or
isDeeplyConst(t.(ReferenceType).getBaseType())
or
isDeeplyConstBelow(t.(SpecifiedType).getBaseType())
or
isDeeplyConst(t.(ArrayType).getBaseType())
or
isDeeplyConst(t.(GNUVectorType).getBaseType())
or
isDeeplyConst(t.(FunctionPointerIshType).getBaseType())
or
isDeeplyConst(t.(PointerWrapper).getTemplateArgument(0))
or
isDeeplyConst(t.(PointerToMemberType).getBaseType())
or
isDeeplyConstBelow(t.(TypedefType).getBaseType())
}
private predicate isConstPointerLike(Type t) {
(
t instanceof PointerWrapper
or
t instanceof PointerType
or
t instanceof ArrayType
or
t instanceof ReferenceType
) and
isDeeplyConstBelow(t)
}
/**
* Holds if the specified call has a side effect that does not come from a `SideEffectFunction`
* model.
@@ -45,7 +103,7 @@ private predicate hasDefaultSideEffect(Call call, ParameterIndex i, boolean buff
) and
(
isWrite = true and
not call.getTarget().getParameter(i).getType().isDeeplyConstBelow()
not isConstPointerLike(call.getTarget().getParameter(i).getUnderlyingType())
or
isWrite = false
)

2
cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/AliasAnalysis.qll
View File

@@ -411,7 +411,7 @@ predicate addressOperandAllocationAndOffset(
allocation.getABaseInstruction() = base and
hasBaseAndOffset(addrOperand, base, bitOffset) and
not exists(Instruction previousBase |
hasBaseAndOffset(addrOperand, previousBase, _) and
hasBaseAndOffset(addrOperand, pragma[only_bind_out](previousBase), _) and
previousBase = base.getAnOperand().getDef()
)
)

139
cpp/ql/test/library-tests/ir/ir/PrintAST.expected
View File

@@ -11445,6 +11445,145 @@ smart_ptr.cpp:
# 19| Type = [ClassTemplateInstantiation] shared_ptr<float>
# 19| ValueCategory = lvalue
# 20| getStmt(2): [ReturnStmt] return ...
# 22| [TopLevelFunction] void shared_ptr_const_int(std::shared_ptr<int const>)
# 22| <params>:
# 22| getParameter(0): [Parameter] (unnamed parameter 0)
# 22| Type = [ClassTemplateInstantiation] shared_ptr<const int>
# 23| [TopLevelFunction] void shared_ptr_const_int_ptr(std::shared_ptr<int* const>)
# 23| <params>:
# 23| getParameter(0): [Parameter] (unnamed parameter 0)
# 23| Type = [ClassTemplateInstantiation] shared_ptr<int *const>
# 24| [TopLevelFunction] void shared_ptr_shared_ptr_const_int(std::shared_ptr<std::shared_ptr<int const>>)
# 24| <params>:
# 24| getParameter(0): [Parameter] (unnamed parameter 0)
# 24| Type = [ClassTemplateInstantiation] shared_ptr<shared_ptr<const int>>
# 25| [TopLevelFunction] void shared_ptr_const_shared_ptr_int(std::shared_ptr<std::shared_ptr<int> const>)
# 25| <params>:
# 25| getParameter(0): [Parameter] (unnamed parameter 0)
# 25| Type = [ClassTemplateInstantiation] shared_ptr<const shared_ptr<int>>
# 26| [TopLevelFunction] void shared_ptr_const_shared_ptr_const_int(std::shared_ptr<std::shared_ptr<int const> const>)
# 26| <params>:
# 26| getParameter(0): [Parameter] (unnamed parameter 0)
# 26| Type = [ClassTemplateInstantiation] shared_ptr<const shared_ptr<const int>>
# 28| [TopLevelFunction] void call_shared_ptr_consts()
# 28| <params>:
# 28| getEntryPoint(): [BlockStmt] { ... }
# 29| getStmt(0): [DeclStmt] declaration
# 29| getDeclarationEntry(0): [VariableDeclarationEntry] definition of sp_const_int
# 29| Type = [ClassTemplateInstantiation] shared_ptr<const int>
# 31| getStmt(1): [ExprStmt] ExprStmt
# 31| getExpr(): [FunctionCall] call to shared_ptr_const_int
# 31| Type = [VoidType] void
# 31| ValueCategory = prvalue
# 31| getArgument(0): [ConstructorCall] call to shared_ptr
# 31| Type = [VoidType] void
# 31| ValueCategory = prvalue
# 31| getArgument(0): [VariableAccess] sp_const_int
# 31| Type = [ClassTemplateInstantiation] shared_ptr<const int>
# 31| ValueCategory = lvalue
# 31| getArgument(0).getFullyConverted(): [ReferenceToExpr] (reference to)
# 31| Type = [LValueReferenceType] const shared_ptr<const int> &
# 31| ValueCategory = prvalue
# 31| getExpr(): [CStyleCast] (const shared_ptr<const int>)...
# 31| Conversion = [GlvalueConversion] glvalue conversion
# 31| Type = [SpecifiedType] const shared_ptr<const int>
# 31| ValueCategory = lvalue
# 31| getArgument(0).getFullyConverted(): [TemporaryObjectExpr] temporary object
# 31| Type = [ClassTemplateInstantiation] shared_ptr<const int>
# 31| ValueCategory = lvalue
# 33| getStmt(2): [DeclStmt] declaration
# 33| getDeclarationEntry(0): [VariableDeclarationEntry] definition of sp_const_int_pointer
# 33| Type = [ClassTemplateInstantiation] shared_ptr<int *const>
# 35| getStmt(3): [ExprStmt] ExprStmt
# 35| getExpr(): [FunctionCall] call to shared_ptr_const_int_ptr
# 35| Type = [VoidType] void
# 35| ValueCategory = prvalue
# 35| getArgument(0): [ConstructorCall] call to shared_ptr
# 35| Type = [VoidType] void
# 35| ValueCategory = prvalue
# 35| getArgument(0): [VariableAccess] sp_const_int_pointer
# 35| Type = [ClassTemplateInstantiation] shared_ptr<int *const>
# 35| ValueCategory = lvalue
# 35| getArgument(0).getFullyConverted(): [ReferenceToExpr] (reference to)
# 35| Type = [LValueReferenceType] const shared_ptr<int *const> &
# 35| ValueCategory = prvalue
# 35| getExpr(): [CStyleCast] (const shared_ptr<int *const>)...
# 35| Conversion = [GlvalueConversion] glvalue conversion
# 35| Type = [SpecifiedType] const shared_ptr<int *const>
# 35| ValueCategory = lvalue
# 35| getArgument(0).getFullyConverted(): [TemporaryObjectExpr] temporary object
# 35| Type = [ClassTemplateInstantiation] shared_ptr<int *const>
# 35| ValueCategory = lvalue
# 37| getStmt(4): [DeclStmt] declaration
# 37| getDeclarationEntry(0): [VariableDeclarationEntry] definition of sp_sp_const_int
# 37| Type = [ClassTemplateInstantiation] shared_ptr<shared_ptr<const int>>
# 39| getStmt(5): [ExprStmt] ExprStmt
# 39| getExpr(): [FunctionCall] call to shared_ptr_shared_ptr_const_int
# 39| Type = [VoidType] void
# 39| ValueCategory = prvalue
# 39| getArgument(0): [ConstructorCall] call to shared_ptr
# 39| Type = [VoidType] void
# 39| ValueCategory = prvalue
# 39| getArgument(0): [VariableAccess] sp_sp_const_int
# 39| Type = [ClassTemplateInstantiation] shared_ptr<shared_ptr<const int>>
# 39| ValueCategory = lvalue
# 39| getArgument(0).getFullyConverted(): [ReferenceToExpr] (reference to)
# 39| Type = [LValueReferenceType] const shared_ptr<shared_ptr<const int>> &
# 39| ValueCategory = prvalue
# 39| getExpr(): [CStyleCast] (const shared_ptr<shared_ptr<const int>>)...
# 39| Conversion = [GlvalueConversion] glvalue conversion
# 39| Type = [SpecifiedType] const shared_ptr<shared_ptr<const int>>
# 39| ValueCategory = lvalue
# 39| getArgument(0).getFullyConverted(): [TemporaryObjectExpr] temporary object
# 39| Type = [ClassTemplateInstantiation] shared_ptr<shared_ptr<const int>>
# 39| ValueCategory = lvalue
# 41| getStmt(6): [DeclStmt] declaration
# 41| getDeclarationEntry(0): [VariableDeclarationEntry] definition of sp_const_sp_int
# 41| Type = [ClassTemplateInstantiation] shared_ptr<const shared_ptr<int>>
# 43| getStmt(7): [ExprStmt] ExprStmt
# 43| getExpr(): [FunctionCall] call to shared_ptr_const_shared_ptr_int
# 43| Type = [VoidType] void
# 43| ValueCategory = prvalue
# 43| getArgument(0): [ConstructorCall] call to shared_ptr
# 43| Type = [VoidType] void
# 43| ValueCategory = prvalue
# 43| getArgument(0): [VariableAccess] sp_const_sp_int
# 43| Type = [ClassTemplateInstantiation] shared_ptr<const shared_ptr<int>>
# 43| ValueCategory = lvalue
# 43| getArgument(0).getFullyConverted(): [ReferenceToExpr] (reference to)
# 43| Type = [LValueReferenceType] const shared_ptr<const shared_ptr<int>> &
# 43| ValueCategory = prvalue
# 43| getExpr(): [CStyleCast] (const shared_ptr<const shared_ptr<int>>)...
# 43| Conversion = [GlvalueConversion] glvalue conversion
# 43| Type = [SpecifiedType] const shared_ptr<const shared_ptr<int>>
# 43| ValueCategory = lvalue
# 43| getArgument(0).getFullyConverted(): [TemporaryObjectExpr] temporary object
# 43| Type = [ClassTemplateInstantiation] shared_ptr<const shared_ptr<int>>
# 43| ValueCategory = lvalue
# 45| getStmt(8): [DeclStmt] declaration
# 45| getDeclarationEntry(0): [VariableDeclarationEntry] definition of sp_const_sp_const_int
# 45| Type = [ClassTemplateInstantiation] shared_ptr<const shared_ptr<const int>>
# 47| getStmt(9): [ExprStmt] ExprStmt
# 47| getExpr(): [FunctionCall] call to shared_ptr_const_shared_ptr_const_int
# 47| Type = [VoidType] void
# 47| ValueCategory = prvalue
# 47| getArgument(0): [ConstructorCall] call to shared_ptr
# 47| Type = [VoidType] void
# 47| ValueCategory = prvalue
# 47| getArgument(0): [VariableAccess] sp_const_sp_const_int
# 47| Type = [ClassTemplateInstantiation] shared_ptr<const shared_ptr<const int>>
# 47| ValueCategory = lvalue
# 47| getArgument(0).getFullyConverted(): [ReferenceToExpr] (reference to)
# 47| Type = [LValueReferenceType] const shared_ptr<const shared_ptr<const int>> &
# 47| ValueCategory = prvalue
# 47| getExpr(): [CStyleCast] (const shared_ptr<const shared_ptr<const int>>)...
# 47| Conversion = [GlvalueConversion] glvalue conversion
# 47| Type = [SpecifiedType] const shared_ptr<const shared_ptr<const int>>
# 47| ValueCategory = lvalue
# 47| getArgument(0).getFullyConverted(): [TemporaryObjectExpr] temporary object
# 47| Type = [ClassTemplateInstantiation] shared_ptr<const shared_ptr<const int>>
# 47| ValueCategory = lvalue
# 48| getStmt(10): [ReturnStmt] return ...
struct_init.cpp:
# 1| [TopLevelFunction] int handler1(void*)
# 1| <params>:

100
cpp/ql/test/library-tests/ir/ir/raw_ir.expected
View File

@@ -7933,6 +7933,7 @@ smart_ptr.cpp:
# 12| v12_10(void) = Call[unique_ptr_arg] : func:r12_1, 0:r12_9
# 12| mu12_11(unknown) = ^CallSideEffect : ~m?
# 12| v12_12(void) = ^BufferReadSideEffect[0] : &:r12_9, ~m?
# 12| mu12_13(unknown) = ^BufferMayWriteSideEffect[0] : &:r12_9
# 13| v13_1(void) = NoOp :
# 10| v10_8(void) = ReturnIndirection[p] : &:r10_6, ~m?
# 10| v10_9(void) = ReturnVoid :
@@ -7971,12 +7972,111 @@ smart_ptr.cpp:
# 19| v19_13(void) = Call[shared_ptr_arg] : func:r19_1, 0:r19_12
# 19| mu19_14(unknown) = ^CallSideEffect : ~m?
# 19| v19_15(void) = ^BufferReadSideEffect[0] : &:r19_12, ~m?
# 19| mu19_16(unknown) = ^BufferMayWriteSideEffect[0] : &:r19_12
# 20| v20_1(void) = NoOp :
# 17| v17_8(void) = ReturnIndirection[p] : &:r17_6, ~m?
# 17| v17_9(void) = ReturnVoid :
# 17| v17_10(void) = AliasedUse : ~m?
# 17| v17_11(void) = ExitFunction :
# 28| void call_shared_ptr_consts()
# 28| Block 0
# 28| v28_1(void) = EnterFunction :
# 28| mu28_2(unknown) = AliasedDefinition :
# 28| mu28_3(unknown) = InitializeNonLocal :
# 29| r29_1(glval<shared_ptr<const int>>) = VariableAddress[sp_const_int] :
# 29| mu29_2(shared_ptr<const int>) = Uninitialized[sp_const_int] : &:r29_1
# 31| r31_1(glval<unknown>) = FunctionAddress[shared_ptr_const_int] :
# 31| r31_2(glval<shared_ptr<const int>>) = VariableAddress[#temp31:26] :
# 31| mu31_3(shared_ptr<const int>) = Uninitialized[#temp31:26] : &:r31_2
# 31| r31_4(glval<unknown>) = FunctionAddress[shared_ptr] :
# 31| r31_5(glval<shared_ptr<const int>>) = VariableAddress[sp_const_int] :
# 31| r31_6(glval<shared_ptr<const int>>) = Convert : r31_5
# 31| r31_7(shared_ptr<const int> &) = CopyValue : r31_6
# 31| v31_8(void) = Call[shared_ptr] : func:r31_4, this:r31_2, 0:r31_7
# 31| mu31_9(unknown) = ^CallSideEffect : ~m?
# 31| mu31_10(shared_ptr<const int>) = ^IndirectMustWriteSideEffect[-1] : &:r31_2
# 31| v31_11(void) = ^IndirectReadSideEffect[0] : &:r31_7, ~m?
# 31| r31_12(shared_ptr<const int>) = Load[#temp31:26] : &:r31_2, ~m?
# 31| v31_13(void) = Call[shared_ptr_const_int] : func:r31_1, 0:r31_12
# 31| mu31_14(unknown) = ^CallSideEffect : ~m?
# 31| v31_15(void) = ^BufferReadSideEffect[0] : &:r31_12, ~m?
# 33| r33_1(glval<shared_ptr<int *const>>) = VariableAddress[sp_const_int_pointer] :
# 33| mu33_2(shared_ptr<int *const>) = Uninitialized[sp_const_int_pointer] : &:r33_1
# 35| r35_1(glval<unknown>) = FunctionAddress[shared_ptr_const_int_ptr] :
# 35| r35_2(glval<shared_ptr<int *const>>) = VariableAddress[#temp35:30] :
# 35| mu35_3(shared_ptr<int *const>) = Uninitialized[#temp35:30] : &:r35_2
# 35| r35_4(glval<unknown>) = FunctionAddress[shared_ptr] :
# 35| r35_5(glval<shared_ptr<int *const>>) = VariableAddress[sp_const_int_pointer] :
# 35| r35_6(glval<shared_ptr<int *const>>) = Convert : r35_5
# 35| r35_7(shared_ptr<int *const> &) = CopyValue : r35_6
# 35| v35_8(void) = Call[shared_ptr] : func:r35_4, this:r35_2, 0:r35_7
# 35| mu35_9(unknown) = ^CallSideEffect : ~m?
# 35| mu35_10(shared_ptr<int *const>) = ^IndirectMustWriteSideEffect[-1] : &:r35_2
# 35| v35_11(void) = ^IndirectReadSideEffect[0] : &:r35_7, ~m?
# 35| r35_12(shared_ptr<int *const>) = Load[#temp35:30] : &:r35_2, ~m?
# 35| v35_13(void) = Call[shared_ptr_const_int_ptr] : func:r35_1, 0:r35_12
# 35| mu35_14(unknown) = ^CallSideEffect : ~m?
# 35| v35_15(void) = ^BufferReadSideEffect[0] : &:r35_12, ~m?
# 35| mu35_16(unknown) = ^BufferMayWriteSideEffect[0] : &:r35_12
# 37| r37_1(glval<shared_ptr<shared_ptr<const int>>>) = VariableAddress[sp_sp_const_int] :
# 37| mu37_2(shared_ptr<shared_ptr<const int>>) = Uninitialized[sp_sp_const_int] : &:r37_1
# 39| r39_1(glval<unknown>) = FunctionAddress[shared_ptr_shared_ptr_const_int] :
# 39| r39_2(glval<shared_ptr<shared_ptr<const int>>>) = VariableAddress[#temp39:37] :
# 39| mu39_3(shared_ptr<shared_ptr<const int>>) = Uninitialized[#temp39:37] : &:r39_2
# 39| r39_4(glval<unknown>) = FunctionAddress[shared_ptr] :
# 39| r39_5(glval<shared_ptr<shared_ptr<const int>>>) = VariableAddress[sp_sp_const_int] :
# 39| r39_6(glval<shared_ptr<shared_ptr<const int>>>) = Convert : r39_5
# 39| r39_7(shared_ptr<shared_ptr<const int>> &) = CopyValue : r39_6
# 39| v39_8(void) = Call[shared_ptr] : func:r39_4, this:r39_2, 0:r39_7
# 39| mu39_9(unknown) = ^CallSideEffect : ~m?
# 39| mu39_10(shared_ptr<shared_ptr<const int>>) = ^IndirectMustWriteSideEffect[-1] : &:r39_2
# 39| v39_11(void) = ^IndirectReadSideEffect[0] : &:r39_7, ~m?
# 39| r39_12(shared_ptr<shared_ptr<const int>>) = Load[#temp39:37] : &:r39_2, ~m?
# 39| v39_13(void) = Call[shared_ptr_shared_ptr_const_int] : func:r39_1, 0:r39_12
# 39| mu39_14(unknown) = ^CallSideEffect : ~m?
# 39| v39_15(void) = ^BufferReadSideEffect[0] : &:r39_12, ~m?
# 39| mu39_16(unknown) = ^BufferMayWriteSideEffect[0] : &:r39_12
# 41| r41_1(glval<shared_ptr<const shared_ptr<int>>>) = VariableAddress[sp_const_sp_int] :
# 41| mu41_2(shared_ptr<const shared_ptr<int>>) = Uninitialized[sp_const_sp_int] : &:r41_1
# 43| r43_1(glval<unknown>) = FunctionAddress[shared_ptr_const_shared_ptr_int] :
# 43| r43_2(glval<shared_ptr<const shared_ptr<int>>>) = VariableAddress[#temp43:37] :
# 43| mu43_3(shared_ptr<const shared_ptr<int>>) = Uninitialized[#temp43:37] : &:r43_2
# 43| r43_4(glval<unknown>) = FunctionAddress[shared_ptr] :
# 43| r43_5(glval<shared_ptr<const shared_ptr<int>>>) = VariableAddress[sp_const_sp_int] :
# 43| r43_6(glval<shared_ptr<const shared_ptr<int>>>) = Convert : r43_5
# 43| r43_7(shared_ptr<const shared_ptr<int>> &) = CopyValue : r43_6
# 43| v43_8(void) = Call[shared_ptr] : func:r43_4, this:r43_2, 0:r43_7
# 43| mu43_9(unknown) = ^CallSideEffect : ~m?
# 43| mu43_10(shared_ptr<const shared_ptr<int>>) = ^IndirectMustWriteSideEffect[-1] : &:r43_2
# 43| v43_11(void) = ^IndirectReadSideEffect[0] : &:r43_7, ~m?
# 43| r43_12(shared_ptr<const shared_ptr<int>>) = Load[#temp43:37] : &:r43_2, ~m?
# 43| v43_13(void) = Call[shared_ptr_const_shared_ptr_int] : func:r43_1, 0:r43_12
# 43| mu43_14(unknown) = ^CallSideEffect : ~m?
# 43| v43_15(void) = ^BufferReadSideEffect[0] : &:r43_12, ~m?
# 43| mu43_16(unknown) = ^BufferMayWriteSideEffect[0] : &:r43_12
# 45| r45_1(glval<shared_ptr<const shared_ptr<const int>>>) = VariableAddress[sp_const_sp_const_int] :
# 45| mu45_2(shared_ptr<const shared_ptr<const int>>) = Uninitialized[sp_const_sp_const_int] : &:r45_1
# 47| r47_1(glval<unknown>) = FunctionAddress[shared_ptr_const_shared_ptr_const_int] :
# 47| r47_2(glval<shared_ptr<const shared_ptr<const int>>>) = VariableAddress[#temp47:43] :
# 47| mu47_3(shared_ptr<const shared_ptr<const int>>) = Uninitialized[#temp47:43] : &:r47_2
# 47| r47_4(glval<unknown>) = FunctionAddress[shared_ptr] :
# 47| r47_5(glval<shared_ptr<const shared_ptr<const int>>>) = VariableAddress[sp_const_sp_const_int] :
# 47| r47_6(glval<shared_ptr<const shared_ptr<const int>>>) = Convert : r47_5
# 47| r47_7(shared_ptr<const shared_ptr<const int>> &) = CopyValue : r47_6
# 47| v47_8(void) = Call[shared_ptr] : func:r47_4, this:r47_2, 0:r47_7
# 47| mu47_9(unknown) = ^CallSideEffect : ~m?
# 47| mu47_10(shared_ptr<const shared_ptr<const int>>) = ^IndirectMustWriteSideEffect[-1] : &:r47_2
# 47| v47_11(void) = ^IndirectReadSideEffect[0] : &:r47_7, ~m?
# 47| r47_12(shared_ptr<const shared_ptr<const int>>) = Load[#temp47:43] : &:r47_2, ~m?
# 47| v47_13(void) = Call[shared_ptr_const_shared_ptr_const_int] : func:r47_1, 0:r47_12
# 47| mu47_14(unknown) = ^CallSideEffect : ~m?
# 47| v47_15(void) = ^BufferReadSideEffect[0] : &:r47_12, ~m?
# 48| v48_1(void) = NoOp :
# 28| v28_4(void) = ReturnVoid :
# 28| v28_5(void) = AliasedUse : ~m?
# 28| v28_6(void) = ExitFunction :
struct_init.cpp:
# 16| void let_info_escape(Info*)
# 16| Block 0

28
cpp/ql/test/library-tests/ir/ir/smart_ptr.cpp
View File

@@ -18,3 +18,31 @@ void call_shared_ptr_arg(float* p) {
shared_ptr<float> sp(p);
shared_ptr_arg(sp);
}
void shared_ptr_const_int(shared_ptr<const int>);
void shared_ptr_const_int_ptr(shared_ptr<int* const>);
void shared_ptr_shared_ptr_const_int(shared_ptr<shared_ptr<const int>>);
void shared_ptr_const_shared_ptr_int(shared_ptr<const shared_ptr<int>>);
void shared_ptr_const_shared_ptr_const_int(shared_ptr<const shared_ptr<const int>>);
void call_shared_ptr_consts() {
shared_ptr<const int> sp_const_int;
// cannot modify *sp_const_int
shared_ptr_const_int(sp_const_int);
shared_ptr<int* const> sp_const_int_pointer;
// can modify **sp_const_int_pointer
shared_ptr_const_int_ptr(sp_const_int_pointer);
shared_ptr<shared_ptr<const int>> sp_sp_const_int;
// can modify *sp_const_int_pointer
shared_ptr_shared_ptr_const_int(sp_sp_const_int);
shared_ptr<const shared_ptr<int>> sp_const_sp_int;
// can modify **sp_const_int_pointer
shared_ptr_const_shared_ptr_int(sp_const_sp_int);
shared_ptr<const shared_ptr<const int>> sp_const_sp_const_int;
// cannot modify *sp_const_int_pointer or **sp_const_int_pointer
shared_ptr_const_shared_ptr_const_int(sp_const_sp_const_int);
}

8
cpp/ql/test/library-tests/locations/charloc/charloc.cpp Normal file
View File

@@ -0,0 +1,8 @@
void test()
{
1;
2 + 3;
(
4);
}

6
cpp/ql/test/library-tests/locations/charloc/charloc.expected Normal file
View File

@@ -0,0 +1,6 @@
| charloc.cpp | 1 | 47 | 47 | 1 |
| charloc.cpp | 2 | 58 | 58 | 2 |
| charloc.cpp | 3 | 62 | 62 | 3 |
| charloc.cpp | 4 | 78 | 78 | 4 |
| charloc.cpp | (...) | 77 | 79 | (...), 4 |
| charloc.cpp | ... + ... | 58 | 62 | ... + ..., 2, 3 |

8
cpp/ql/test/library-tests/locations/charloc/charloc.ql Normal file
View File

@@ -0,0 +1,8 @@
import cpp
from File f, Expr e, Location l, int start, int end
where
e.getLocation() = l and
l.charLoc(f, start, end)
select f.getBaseName(), e.toString(), start, end,
concat(Expr e2, Location l2 | e2.getLocation() = l2 and l.subsumes(l2) | e2.toString(), ", ")

2
cpp/ql/test/library-tests/variables/getanassignedvalue/getanassignedvalue.expected
View File

@@ -1,4 +1,3 @@
| file://:0:0:0:0 | abc | test.cpp:53:6:53:11 | chars1 |
| file://:0:0:0:0 | {...} | test.cpp:38:22:38:22 | v |
| test.cpp:4:9:4:11 | 10 | test.cpp:4:6:4:6 | v |
| test.cpp:5:15:5:16 | & ... | test.cpp:5:7:5:11 | ptr_v |
@@ -23,5 +22,6 @@
| test.cpp:48:18:48:18 | 4 | test.cpp:31:6:31:8 | num |
| test.cpp:48:21:48:26 | Four | test.cpp:32:14:32:16 | str |
| test.cpp:52:19:52:27 | {...} | test.cpp:52:5:52:11 | myArray |
| test.cpp:53:17:53:21 | abc | test.cpp:53:6:53:11 | chars1 |
| test.cpp:54:17:54:31 | {...} | test.cpp:54:6:54:11 | chars2 |
| test.cpp:55:16:55:20 | abc | test.cpp:55:7:55:12 | chars3 |

2
cpp/ql/test/library-tests/variables/getanassignedvalue/test.cpp
View File

@@ -50,6 +50,6 @@ myStruct2 v3 = {{4, "Four"}}; // assigments to `v3`, `ms2`, `num`, `str`
// ---
int myArray[10] = {1, 2, 3}; // assigment to `myArray`
char chars1[] = "abc"; // assignment to `chars1` (literal "abc" has no location)
char chars1[] = "abc"; // assignment to `chars1`
char chars2[] = {'a', 'b', 'c'}; // assigment to `chars2`
char *chars3 = "abc"; // assigment to `chars3`

6
cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/qlpack.yml Normal file
View File

@@ -0,0 +1,6 @@
# This directory has its own qlpack for reasons detailed in commit 2550788598010fa2117274607c9d58f64f997f34
name: codeql-cpp-tests-cwe-190-tainted
version: 0.0.0
libraryPathDependencies: codeql-cpp
extractor: cpp
tests: .

1
cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/queries.xml
View File

@@ -1 +0,0 @@
<queries language="cpp"/>

50
cpp/ql/test/query-tests/Security/CWE/CWE-327/BrokenCryptoAlgorithm.expected
View File

@@ -1,25 +1,25 @@
| test2.cpp:49:4:49:24 | call to my_des_implementation | This function call specifies a broken or weak cryptographic algorithm. |
| test2.cpp:62:33:62:40 | ALGO_DES | This macro invocation specifies a broken or weak cryptographic algorithm. |
| test2.cpp:124:4:124:24 | call to my_des_implementation | This function call specifies a broken or weak cryptographic algorithm. |
| test2.cpp:144:27:144:29 | DES | This enum constant access specifies a broken or weak cryptographic algorithm. |
| test2.cpp:172:28:172:35 | ALGO_DES | This macro invocation specifies a broken or weak cryptographic algorithm. |
| test2.cpp:175:28:175:34 | USE_DES | This enum constant access specifies a broken or weak cryptographic algorithm. |
| test2.cpp:182:38:182:45 | ALGO_DES | This macro invocation specifies a broken or weak cryptographic algorithm. |
| test2.cpp:185:38:185:44 | USE_DES | This enum constant access specifies a broken or weak cryptographic algorithm. |
| test2.cpp:238:2:238:20 | call to encrypt | This function call specifies a broken or weak cryptographic algorithm. |
| test2.cpp:245:5:245:11 | call to encrypt | This function call specifies a broken or weak cryptographic algorithm. |
| test.cpp:38:2:38:31 | ENCRYPT_WITH_DES(data,amount) | This macro invocation specifies a broken or weak cryptographic algorithm. |
| test.cpp:39:2:39:31 | ENCRYPT_WITH_RC2(data,amount) | This macro invocation specifies a broken or weak cryptographic algorithm. |
| test.cpp:41:2:41:32 | ENCRYPT_WITH_3DES(data,amount) | This macro invocation specifies a broken or weak cryptographic algorithm. |
| test.cpp:42:2:42:38 | ENCRYPT_WITH_TRIPLE_DES(data,amount) | This macro invocation specifies a broken or weak cryptographic algorithm. |
| test.cpp:51:2:51:32 | DES_DO_ENCRYPTION(data,amount) | This macro invocation specifies a broken or weak cryptographic algorithm. |
| test.cpp:52:2:52:31 | RUN_DES_ENCODING(data,amount) | This macro invocation specifies a broken or weak cryptographic algorithm. |
| test.cpp:53:2:53:25 | DES_ENCODE(data,amount) | This macro invocation specifies a broken or weak cryptographic algorithm. |
| test.cpp:54:2:54:26 | DES_SET_KEY(data,amount) | This macro invocation specifies a broken or weak cryptographic algorithm. |
| test.cpp:88:2:88:11 | call to encryptDES | This function call specifies a broken or weak cryptographic algorithm. |
| test.cpp:89:2:89:11 | call to encryptRC2 | This function call specifies a broken or weak cryptographic algorithm. |
| test.cpp:91:2:91:12 | call to encrypt3DES | This function call specifies a broken or weak cryptographic algorithm. |
| test.cpp:92:2:92:17 | call to encryptTripleDES | This function call specifies a broken or weak cryptographic algorithm. |
| test.cpp:101:2:101:15 | call to do_des_encrypt | This function call specifies a broken or weak cryptographic algorithm. |
| test.cpp:102:2:102:12 | call to DES_Set_Key | This function call specifies a broken or weak cryptographic algorithm. |
| test.cpp:121:2:121:24 | INIT_ENCRYPT_WITH_DES() | This macro invocation specifies a broken or weak cryptographic algorithm. |
| test2.cpp:49:4:49:24 | call to my_des_implementation | This file makes use of a broken or weak cryptographic algorithm (specified by $@). | test2.cpp:49:4:49:24 | call to my_des_implementation | call to my_des_implementation |
| test2.cpp:49:4:49:24 | call to my_des_implementation | This file makes use of a broken or weak cryptographic algorithm (specified by $@). | test2.cpp:62:33:62:40 | ALGO_DES | invocation of macro ALGO_DES |
| test2.cpp:49:4:49:24 | call to my_des_implementation | This file makes use of a broken or weak cryptographic algorithm (specified by $@). | test2.cpp:124:4:124:24 | call to my_des_implementation | call to my_des_implementation |
| test2.cpp:49:4:49:24 | call to my_des_implementation | This file makes use of a broken or weak cryptographic algorithm (specified by $@). | test2.cpp:144:27:144:29 | DES | access of enum constant DES |
| test2.cpp:49:4:49:24 | call to my_des_implementation | This file makes use of a broken or weak cryptographic algorithm (specified by $@). | test2.cpp:172:28:172:35 | ALGO_DES | invocation of macro ALGO_DES |
| test2.cpp:49:4:49:24 | call to my_des_implementation | This file makes use of a broken or weak cryptographic algorithm (specified by $@). | test2.cpp:175:28:175:34 | USE_DES | access of enum constant USE_DES |
| test2.cpp:49:4:49:24 | call to my_des_implementation | This file makes use of a broken or weak cryptographic algorithm (specified by $@). | test2.cpp:182:38:182:45 | ALGO_DES | invocation of macro ALGO_DES |
| test2.cpp:49:4:49:24 | call to my_des_implementation | This file makes use of a broken or weak cryptographic algorithm (specified by $@). | test2.cpp:185:38:185:44 | USE_DES | access of enum constant USE_DES |
| test2.cpp:49:4:49:24 | call to my_des_implementation | This file makes use of a broken or weak cryptographic algorithm (specified by $@). | test2.cpp:238:2:238:20 | call to encrypt | call to encrypt |
| test2.cpp:49:4:49:24 | call to my_des_implementation | This file makes use of a broken or weak cryptographic algorithm (specified by $@). | test2.cpp:245:5:245:11 | call to encrypt | call to encrypt |
| test.cpp:38:2:38:31 | ENCRYPT_WITH_DES(data,amount) | This file makes use of a broken or weak cryptographic algorithm (specified by $@). | test.cpp:38:2:38:31 | ENCRYPT_WITH_DES(data,amount) | invocation of macro ENCRYPT_WITH_DES |
| test.cpp:38:2:38:31 | ENCRYPT_WITH_DES(data,amount) | This file makes use of a broken or weak cryptographic algorithm (specified by $@). | test.cpp:39:2:39:31 | ENCRYPT_WITH_RC2(data,amount) | invocation of macro ENCRYPT_WITH_RC2 |
| test.cpp:38:2:38:31 | ENCRYPT_WITH_DES(data,amount) | This file makes use of a broken or weak cryptographic algorithm (specified by $@). | test.cpp:41:2:41:32 | ENCRYPT_WITH_3DES(data,amount) | invocation of macro ENCRYPT_WITH_3DES |
| test.cpp:38:2:38:31 | ENCRYPT_WITH_DES(data,amount) | This file makes use of a broken or weak cryptographic algorithm (specified by $@). | test.cpp:42:2:42:38 | ENCRYPT_WITH_TRIPLE_DES(data,amount) | invocation of macro ENCRYPT_WITH_TRIPLE_DES |
| test.cpp:38:2:38:31 | ENCRYPT_WITH_DES(data,amount) | This file makes use of a broken or weak cryptographic algorithm (specified by $@). | test.cpp:51:2:51:32 | DES_DO_ENCRYPTION(data,amount) | invocation of macro DES_DO_ENCRYPTION |
| test.cpp:38:2:38:31 | ENCRYPT_WITH_DES(data,amount) | This file makes use of a broken or weak cryptographic algorithm (specified by $@). | test.cpp:52:2:52:31 | RUN_DES_ENCODING(data,amount) | invocation of macro RUN_DES_ENCODING |
| test.cpp:38:2:38:31 | ENCRYPT_WITH_DES(data,amount) | This file makes use of a broken or weak cryptographic algorithm (specified by $@). | test.cpp:53:2:53:25 | DES_ENCODE(data,amount) | invocation of macro DES_ENCODE |
| test.cpp:38:2:38:31 | ENCRYPT_WITH_DES(data,amount) | This file makes use of a broken or weak cryptographic algorithm (specified by $@). | test.cpp:54:2:54:26 | DES_SET_KEY(data,amount) | invocation of macro DES_SET_KEY |
| test.cpp:38:2:38:31 | ENCRYPT_WITH_DES(data,amount) | This file makes use of a broken or weak cryptographic algorithm (specified by $@). | test.cpp:88:2:88:11 | call to encryptDES | call to encryptDES |
| test.cpp:38:2:38:31 | ENCRYPT_WITH_DES(data,amount) | This file makes use of a broken or weak cryptographic algorithm (specified by $@). | test.cpp:89:2:89:11 | call to encryptRC2 | call to encryptRC2 |
| test.cpp:38:2:38:31 | ENCRYPT_WITH_DES(data,amount) | This file makes use of a broken or weak cryptographic algorithm (specified by $@). | test.cpp:91:2:91:12 | call to encrypt3DES | call to encrypt3DES |
| test.cpp:38:2:38:31 | ENCRYPT_WITH_DES(data,amount) | This file makes use of a broken or weak cryptographic algorithm (specified by $@). | test.cpp:92:2:92:17 | call to encryptTripleDES | call to encryptTripleDES |
| test.cpp:38:2:38:31 | ENCRYPT_WITH_DES(data,amount) | This file makes use of a broken or weak cryptographic algorithm (specified by $@). | test.cpp:101:2:101:15 | call to do_des_encrypt | call to do_des_encrypt |
| test.cpp:38:2:38:31 | ENCRYPT_WITH_DES(data,amount) | This file makes use of a broken or weak cryptographic algorithm (specified by $@). | test.cpp:102:2:102:12 | call to DES_Set_Key | call to DES_Set_Key |
| test.cpp:38:2:38:31 | ENCRYPT_WITH_DES(data,amount) | This file makes use of a broken or weak cryptographic algorithm (specified by $@). | test.cpp:121:2:121:24 | INIT_ENCRYPT_WITH_DES() | invocation of macro INIT_ENCRYPT_WITH_DES |

4
cpp/ql/test/query-tests/definitions/locationInfo.ql
View File

@@ -11,7 +11,9 @@ class Link extends Top {
* Gets the length of the longest line in file `f`.
*/
pragma[nomagic]
private int maxCols(File f) { result = max(Location l | l.getFile() = f | l.getEndColumn()) }
private int maxCols(File f) {
result = max(Location l | l.getFile() = f | l.getStartColumn().maximum(l.getEndColumn()))
}
/**
* Gets the location of an element that has a link-to-definition (in a similar manner to

2
csharp/change-notes/2021-06-04-tuple-members.md Normal file
View File

@@ -0,0 +1,2 @@
lgtm,codescanning
* Members extracted from `TupleTypes` have been fixed to be assigned to the underlying ``struct ValueTuple`N``.

6
csharp/extractor/Semmle.Extraction.CSharp/Entities/CachedSymbol.cs
View File

@@ -16,7 +16,11 @@ namespace Semmle.Extraction.CSharp.Entities
{
}
public virtual Type? ContainingType => Symbol.ContainingType is not null ? Type.Create(Context, Symbol.ContainingType) : null;
public virtual Type? ContainingType => Symbol.ContainingType is not null
? Symbol.ContainingType.IsTupleType
? NamedType.CreateNamedTypeFromTupleType(Context, Symbol.ContainingType)
: Type.Create(Context, Symbol.ContainingType)
: null;
public void PopulateModifiers(TextWriter trapFile)
{

9
csharp/extractor/Semmle.Extraction.CSharp/Entities/Constructor.cs
View File

@@ -146,6 +146,15 @@ namespace Semmle.Extraction.CSharp.Entities
public override void WriteId(EscapingTextWriter trapFile)
{
if (!SymbolEqualityComparer.Default.Equals(Symbol, Symbol.OriginalDefinition))
{
trapFile.WriteSubId(ContainingType!);
trapFile.Write(".");
trapFile.WriteSubId(OriginalDefinition);
trapFile.Write(";constructor");
return;
}
if (Symbol.IsStatic)
trapFile.Write("static");
trapFile.WriteSubId(ContainingType!);

84
csharp/extractor/Semmle.Extraction.CSharp/Entities/Method.cs
View File

@@ -20,26 +20,6 @@ namespace Semmle.Extraction.CSharp.Entities
IEnumerable<IParameterSymbol> parameters = Symbol.Parameters;
IEnumerable<IParameterSymbol> originalParameters = originalMethod.Symbol.Parameters;
if (IsReducedExtension)
{
if (this == originalMethod)
{
// Non-generic reduced extensions must be extracted exactly like the
// non-reduced counterparts
parameters = Symbol.ReducedFrom!.Parameters;
}
else
{
// Constructed reduced extensions are special because their non-reduced
// counterparts are not constructed. Therefore, we need to manually add
// the `this` parameter based on the type of the receiver
var originalThisParamSymbol = originalMethod.Symbol.Parameters.First();
var originalThisParam = Parameter.Create(Context, originalThisParamSymbol, originalMethod);
ConstructedExtensionParameter.Create(Context, this, originalThisParam);
originalParameters = originalParameters.Skip(1);
}
}
foreach (var p in parameters.Zip(originalParameters, (paramSymbol, originalParam) => new { paramSymbol, originalParam }))
{
var original = SymbolEqualityComparer.Default.Equals(p.paramSymbol, p.originalParam)
@@ -129,6 +109,30 @@ namespace Semmle.Extraction.CSharp.Entities
/// </summary>
private static void BuildMethodId(Method m, EscapingTextWriter trapFile)
{
if (!SymbolEqualityComparer.Default.Equals(m.Symbol, m.Symbol.OriginalDefinition))
{
if (!SymbolEqualityComparer.Default.Equals(m.Symbol, m.ConstructedFromSymbol))
{
trapFile.WriteSubId(Create(m.Context, m.ConstructedFromSymbol));
trapFile.Write('<');
// Encode the nullability of the type arguments in the label.
// Type arguments with different nullability can result in
// a constructed method with different nullability of its parameters and return type,
// so we need to create a distinct database entity for it.
trapFile.BuildList(",", m.Symbol.GetAnnotatedTypeArguments(), ta => { ta.Symbol.BuildOrWriteId(m.Context, trapFile, m.Symbol); trapFile.Write((int)ta.Nullability); });
trapFile.Write('>');
}
else
{
trapFile.WriteSubId(m.ContainingType!);
trapFile.Write(".");
trapFile.WriteSubId(m.OriginalDefinition);
}
WritePostfix(m, trapFile);
return;
}
m.Symbol.ReturnType.BuildOrWriteId(m.Context, trapFile, m.Symbol);
trapFile.Write(" ");
@@ -141,24 +145,16 @@ namespace Semmle.Extraction.CSharp.Entities
if (m.Symbol.IsGenericMethod)
{
if (SymbolEqualityComparer.Default.Equals(m.Symbol, m.Symbol.OriginalDefinition))
{
trapFile.Write('`');
trapFile.Write(m.Symbol.TypeParameters.Length);
}
else
{
trapFile.Write('<');
// Encode the nullability of the type arguments in the label.
// Type arguments with different nullability can result in
// a constructed method with different nullability of its parameters and return type,
// so we need to create a distinct database entity for it.
trapFile.BuildList(",", m.Symbol.GetAnnotatedTypeArguments(), ta => { ta.Symbol.BuildOrWriteId(m.Context, trapFile, m.Symbol); trapFile.Write((int)ta.Nullability); });
trapFile.Write('>');
}
trapFile.Write('`');
trapFile.Write(m.Symbol.TypeParameters.Length);
}
AddParametersToId(m.Context, trapFile, m.Symbol);
WritePostfix(m, trapFile);
}
private static void WritePostfix(Method m, EscapingTextWriter trapFile)
{
switch (m.Symbol.MethodKind)
{
case MethodKind.PropertyGet:
@@ -192,9 +188,7 @@ namespace Semmle.Extraction.CSharp.Entities
trapFile.Write('(');
var index = 0;
var @params = method.MethodKind == MethodKind.ReducedExtension
? method.ReducedFrom!.Parameters
: method.Parameters;
var @params = method.Parameters;
foreach (var param in @params)
{
@@ -256,6 +250,11 @@ namespace Semmle.Extraction.CSharp.Entities
case MethodKind.Constructor:
return Constructor.Create(cx, methodDecl);
case MethodKind.ReducedExtension:
if (SymbolEqualityComparer.Default.Equals(methodDecl, methodDecl.ConstructedFrom))
{
return OrdinaryMethod.Create(cx, methodDecl.ReducedFrom!);
}
return OrdinaryMethod.Create(cx, methodDecl.ReducedFrom!.Construct(methodDecl.TypeArguments, methodDecl.TypeArgumentNullableAnnotations));
case MethodKind.Ordinary:
case MethodKind.DelegateInvoke:
return OrdinaryMethod.Create(cx, methodDecl);
@@ -281,10 +280,7 @@ namespace Semmle.Extraction.CSharp.Entities
}
}
public Method OriginalDefinition =>
IsReducedExtension
? Create(Context, Symbol.ReducedFrom!)
: Create(Context, Symbol.OriginalDefinition);
public Method OriginalDefinition => Create(Context, Symbol.OriginalDefinition);
public override Location? FullLocation => ReportingLocation;
@@ -302,9 +298,7 @@ namespace Semmle.Extraction.CSharp.Entities
public bool IsBoundGeneric => IsGeneric && !IsUnboundGeneric;
private bool IsReducedExtension => Symbol.MethodKind == MethodKind.ReducedExtension;
protected IMethodSymbol ConstructedFromSymbol => Symbol.ConstructedFrom.ReducedFrom ?? Symbol.ConstructedFrom;
protected IMethodSymbol ConstructedFromSymbol => Symbol.ConstructedFrom;
bool IExpressionParentEntity.IsTopLevelParent => true;

19
csharp/extractor/Semmle.Extraction.CSharp/Entities/OrdinaryMethod.cs
View File

@@ -15,14 +15,7 @@ namespace Semmle.Extraction.CSharp.Entities
protected override IMethodSymbol BodyDeclaringSymbol => Symbol.PartialImplementationPart ?? Symbol;
public IMethodSymbol SourceDeclaration
{
get
{
var reducedFrom = Symbol.ReducedFrom ?? Symbol;
return reducedFrom.OriginalDefinition;
}
}
public IMethodSymbol SourceDeclaration => Symbol.OriginalDefinition;
public override Microsoft.CodeAnalysis.Location ReportingLocation => Symbol.GetSymbolLocation();
@@ -53,7 +46,15 @@ namespace Semmle.Extraction.CSharp.Entities
ExtractCompilerGenerated(trapFile);
}
public static new OrdinaryMethod Create(Context cx, IMethodSymbol method) => OrdinaryMethodFactory.Instance.CreateEntityFromSymbol(cx, method);
public static new OrdinaryMethod Create(Context cx, IMethodSymbol method)
{
if (method.MethodKind == MethodKind.ReducedExtension)
{
cx.Extractor.Logger.Log(Util.Logging.Severity.Warning, "Reduced extension method symbols should not be directly extracted.");
}
return OrdinaryMethodFactory.Instance.CreateEntityFromSymbol(cx, method);
}
private class OrdinaryMethodFactory : CachedEntityFactory<IMethodSymbol, OrdinaryMethod>
{

44
csharp/extractor/Semmle.Extraction.CSharp/Entities/Parameter.cs
View File

@@ -27,20 +27,7 @@ namespace Semmle.Extraction.CSharp.Entities
None, Ref, Out, Params, This, In
}
protected virtual int Ordinal
{
get
{
// For some reason, methods of kind ReducedExtension
// omit the "this" parameter, so the parameters are
// actually numbered from 1.
// This is to be consistent from the original (unreduced) extension method.
var isReducedExtension =
Symbol.ContainingSymbol is IMethodSymbol method &&
method.MethodKind == MethodKind.ReducedExtension;
return Symbol.Ordinal + (isReducedExtension ? 1 : 0);
}
}
protected virtual int Ordinal => Symbol.Ordinal;
private Kind ParamKind
{
@@ -270,33 +257,4 @@ namespace Semmle.Extraction.CSharp.Entities
public override VarargsParam Create(Context cx, Method init) => new VarargsParam(cx, init);
}
}
internal class ConstructedExtensionParameter : Parameter
{
private readonly ITypeSymbol constructedType;
private ConstructedExtensionParameter(Context cx, Method method, Parameter original)
: base(cx, original.Symbol, method, original)
{
constructedType = method.Symbol.ReceiverType!;
}
public override void Populate(TextWriter trapFile)
{
var typeKey = Type.Create(Context, constructedType);
trapFile.@params(this, Original.Symbol.Name, typeKey.TypeRef, 0, Kind.This, Parent!, Original);
trapFile.param_location(this, Original.Location);
}
public static ConstructedExtensionParameter Create(Context cx, Method method, Parameter parameter) =>
ExtensionParamFactory.Instance.CreateEntity(cx, (new SymbolEqualityWrapper(parameter.Symbol), new SymbolEqualityWrapper(method.Symbol.ReceiverType!)), (method, parameter));
private class ExtensionParamFactory : CachedEntityFactory<(Method, Parameter), ConstructedExtensionParameter>
{
public static ExtensionParamFactory Instance { get; } = new ExtensionParamFactory();
public override ConstructedExtensionParameter Create(Context cx, (Method, Parameter) init) =>
new ConstructedExtensionParameter(cx, init.Item1, init.Item2);
}
}
}

7
csharp/extractor/Semmle.Extraction.CSharp/Extractor/Extractor.cs
View File

@@ -416,9 +416,10 @@ namespace Semmle.Extraction.CSharp
compilerArguments.CompilationName,
syntaxTrees,
references,
compilerArguments.CompilationOptions.
WithAssemblyIdentityComparer(DesktopAssemblyIdentityComparer.Default).
WithStrongNameProvider(new DesktopStrongNameProvider(compilerArguments.KeyFileSearchPaths))
compilerArguments.CompilationOptions
.WithAssemblyIdentityComparer(DesktopAssemblyIdentityComparer.Default)
.WithStrongNameProvider(new DesktopStrongNameProvider(compilerArguments.KeyFileSearchPaths))
.WithMetadataImportOptions(MetadataImportOptions.All)
);
},
(compilation, options) => analyser.EndInitialize(compilerArguments, options, compilation),

2
csharp/ql/src/experimental/ir/implementation/unaliased_ssa/internal/AliasAnalysis.qll
View File

@@ -411,7 +411,7 @@ predicate addressOperandAllocationAndOffset(
allocation.getABaseInstruction() = base and
hasBaseAndOffset(addrOperand, base, bitOffset) and
not exists(Instruction previousBase |
hasBaseAndOffset(addrOperand, previousBase, _) and
hasBaseAndOffset(addrOperand, pragma[only_bind_out](previousBase), _) and
previousBase = base.getAnOperand().getDef()
)
)

11
csharp/ql/src/semmle/code/csharp/dataflow/LibraryTypeDataFlow.qll
View File

@@ -1848,8 +1848,15 @@ class SystemTupleFlow extends LibraryTypeDataFlow, ValueOrRefType {
c.(Constructor).getDeclaringType() = this and
t = this
or
c = this.getAMethod(any(string name | name.regexpMatch("Create(<,*>)?"))) and
t = c.getReturnType().getUnboundDeclaration()
exists(ValueOrRefType namedType |
namedType = this or namedType = this.(TupleType).getUnderlyingType()
|
c = namedType.getAMethod(any(string name | name.regexpMatch("Create(<,*>)?"))) and
(
t = c.getReturnType().getUnboundDeclaration() or
t = c.getReturnType().(TupleType).getUnderlyingType().getUnboundDeclaration()
)
)
)
or
c =

121
csharp/ql/src/semmle/code/csharp/dataflow/internal/FlowSummaryImpl.qll
View File

@@ -9,6 +9,7 @@
private import FlowSummaryImplSpecific
private import DataFlowImplSpecific::Private
private import DataFlowImplSpecific::Public
private import DataFlowImplCommon as DataFlowImplCommon
/** Provides classes and predicates for defining flow summaries. */
module Public {
@@ -178,7 +179,6 @@ module Public {
*/
module Private {
private import Public
private import DataFlowImplCommon as DataFlowImplCommon
newtype TSummaryComponent =
TContentSummaryComponent(Content c) or
@@ -580,6 +580,14 @@ module Private {
* summaries into a `SummarizedCallable`s.
*/
module External {
/** Holds if `spec` is a relevant external specification. */
private predicate relevantSpec(string spec) {
summaryElement(_, spec, _, _) or
summaryElement(_, _, spec, _) or
sourceElement(_, spec, _) or
sinkElement(_, spec, _)
}
/** Holds if the `n`th component of specification `s` is `c`. */
predicate specSplit(string s, string c, int n) { relevantSpec(s) and s.splitAt(" of ", n) = c }
@@ -629,6 +637,8 @@ module Private {
or
exists(int pos | parseParam(c, pos) and result = SummaryComponent::parameter(pos))
or
c = "ReturnValue" and result = SummaryComponent::return(getReturnValueKind())
or
result = interpretComponentSpecific(c)
)
}
@@ -664,13 +674,13 @@ module Private {
}
private class SummarizedCallableExternal extends SummarizedCallable {
SummarizedCallableExternal() { externalSummary(this, _, _, _) }
SummarizedCallableExternal() { summaryElement(this, _, _, _) }
override predicate propagatesFlow(
SummaryComponentStack input, SummaryComponentStack output, boolean preservesValue
) {
exists(string inSpec, string outSpec, string kind |
externalSummary(this, inSpec, outSpec, kind) and
summaryElement(this, inSpec, outSpec, kind) and
interpretSpec(inSpec, 0, input) and
interpretSpec(outSpec, 0, output)
|
@@ -686,6 +696,111 @@ module Private {
specSplit(spec, c, _) and
not exists(interpretComponent(c))
}
private predicate inputNeedsReference(string c) {
c = "Argument" or
parseArg(c, _)
}
private predicate outputNeedsReference(string c) {
c = "Argument" or
parseArg(c, _) or
c = "ReturnValue"
}
private predicate sourceElementRef(InterpretNode ref, string output, string kind) {
exists(SourceOrSinkElement e |
sourceElement(e, output, kind) and
if outputNeedsReference(specLast(output))
then e = ref.getCallTarget()
else e = ref.asElement()
)
}
private predicate sinkElementRef(InterpretNode ref, string input, string kind) {
exists(SourceOrSinkElement e |
sinkElement(e, input, kind) and
if inputNeedsReference(specLast(input))
then e = ref.getCallTarget()
else e = ref.asElement()
)
}
private predicate interpretOutput(string output, int idx, InterpretNode ref, InterpretNode node) {
sourceElementRef(ref, output, _) and
specLength(output, idx) and
node = ref
or
exists(InterpretNode mid, string c |
interpretOutput(output, idx + 1, ref, mid) and
specSplit(output, c, idx)
|
exists(int pos |
node.asNode()
.(PostUpdateNode)
.getPreUpdateNode()
.(ArgumentNode)
.argumentOf(mid.asCall(), pos)
|
c = "Argument" or parseArg(c, pos)
)
or
exists(int pos | node.asNode().(ParameterNode).isParameterOf(mid.asCallable(), pos) |
c = "Parameter" or parseParam(c, pos)
)
or
c = "ReturnValue" and
node.asNode() = getAnOutNode(mid.asCall(), getReturnValueKind())
or
interpretOutputSpecific(c, mid, node)
)
}
private predicate interpretInput(string input, int idx, InterpretNode ref, InterpretNode node) {
sinkElementRef(ref, input, _) and
specLength(input, idx) and
node = ref
or
exists(InterpretNode mid, string c |
interpretInput(input, idx + 1, ref, mid) and
specSplit(input, c, idx)
|
exists(int pos | node.asNode().(ArgumentNode).argumentOf(mid.asCall(), pos) |
c = "Argument" or parseArg(c, pos)
)
or
exists(ReturnNode ret |
c = "ReturnValue" and
ret = node.asNode() and
ret.getKind() = getReturnValueKind() and
mid.asCallable() = DataFlowImplCommon::getNodeEnclosingCallable(ret)
)
or
interpretInputSpecific(c, mid, node)
)
}
/**
* Holds if `node` is specified as a source with the given kind in a CSV flow
* model.
*/
predicate isSourceNode(InterpretNode node, string kind) {
exists(InterpretNode ref, string output |
sourceElementRef(ref, output, kind) and
interpretOutput(output, 0, ref, node)
)
}
/**
* Holds if `node` is specified as a sink with the given kind in a CSV flow
* model.
*/
predicate isSinkNode(InterpretNode node, string kind) {
exists(InterpretNode ref, string input |
sinkElementRef(ref, input, kind) and
interpretInput(input, 0, ref, node)
)
}
}
/** Provides a query predicate for outputting a set of relevant flow summaries. */

85
csharp/ql/src/semmle/code/csharp/dataflow/internal/FlowSummaryImplSpecific.qll
View File

@@ -78,20 +78,15 @@ DataFlowType getCallbackReturnType(DataFlowType t, ReturnKind rk) {
)
}
/** Holds if `spec` is a relevant external specification. */
predicate relevantSpec(string spec) { none() }
/**
* Holds if an external flow summary exists for `c` with input specification
* `input`, output specification `output`, and kind `kind`.
*/
predicate externalSummary(DataFlowCallable c, string input, string output, string kind) { none() }
predicate summaryElement(DataFlowCallable c, string input, string output, string kind) { none() }
/** Gets the summary component for specification component `c`, if any. */
bindingset[c]
SummaryComponent interpretComponentSpecific(string c) {
c = "ReturnValue" and result = SummaryComponent::return(any(NormalReturnKind nrk))
or
c = "Element" and result = SummaryComponent::content(any(ElementContent ec))
or
exists(Field f |
@@ -104,3 +99,81 @@ SummaryComponent interpretComponentSpecific(string c) {
result = SummaryComponent::content(any(PropertyContent pc | pc.getProperty() = p))
)
}
class SourceOrSinkElement = Element;
/**
* Holds if an external source specification exists for `e` with output specification
* `output` and kind `kind`.
*/
predicate sourceElement(Element e, string output, string kind) { none() }
/**
* Holds if an external sink specification exists for `n` with input specification
* `input` and kind `kind`.
*/
predicate sinkElement(Element e, string input, string kind) { none() }
/** Gets the return kind corresponding to specification `"ReturnValue"`. */
NormalReturnKind getReturnValueKind() { any() }
private newtype TInterpretNode =
TElement_(Element n) or
TNode_(Node n) or
TDataFlowCall_(DataFlowCall c)
/** An entity used to interpret a source/sink specification. */
class InterpretNode extends TInterpretNode {
/** Gets the element that this node corresponds to, if any. */
SourceOrSinkElement asElement() { this = TElement_(result) }
/** Gets the data-flow node that this node corresponds to, if any. */
Node asNode() { this = TNode_(result) }
/** Gets the call that this node corresponds to, if any. */
DataFlowCall asCall() { this = TDataFlowCall_(result) }
/** Gets the callable that this node corresponds to, if any. */
DataFlowCallable asCallable() { result = this.asElement() }
/** Gets the target of this call, if any. */
Callable getCallTarget() { result = this.asCall().getARuntimeTarget() }
/** Gets a textual representation of this node. */
string toString() {
result = this.asElement().toString()
or
result = this.asNode().toString()
or
result = this.asCall().toString()
}
/** Gets the location of this node. */
Location getLocation() {
result = this.asElement().getLocation()
or
result = this.asNode().getLocation()
or
result = this.asCall().getLocation()
}
}
/** Provides additional sink specification logic required for attributes. */
predicate interpretOutputSpecific(string c, InterpretNode mid, InterpretNode node) {
exists(Node n | n = node.asNode() |
(c = "Parameter" or c = "") and
n.asParameter() = mid.asElement()
or
c = "" and
n.asExpr().(AssignableRead).getTarget().getUnboundDeclaration() = mid.asElement()
)
}
/** Provides additional sink specification logic required for attributes. */
predicate interpretInputSpecific(string c, InterpretNode mid, InterpretNode n) {
c = "" and
exists(Assignable a |
n.asNode().asExpr() = a.getAnAssignedValue() and
a.getUnboundDeclaration() = mid.asElement()
)
}

9
csharp/ql/test/library-tests/conversion/reftype/RefType.expected
View File

@@ -1,5 +1,7 @@
| Byte[] | Object |
| Byte[] | dynamic |
| Byte[][] | Object |
| Byte[][] | dynamic |
| C1 | Object |
| C1 | dynamic |
| C1[] | ICollection<C1> |
@@ -183,6 +185,8 @@
| IReadOnlyList<T4> | dynamic |
| Int16[] | Object |
| Int16[] | dynamic |
| Int32[,] | Object |
| Int32[,] | dynamic |
| Int32[] | Object |
| Int32[] | dynamic |
| Int64[] | Object |
@@ -221,12 +225,15 @@
| T5 | C1 |
| T5 | Object |
| T5 | dynamic |
| UInt16[][] | Object |
| UInt16[][] | dynamic |
| UInt32[] | Object |
| UInt32[] | dynamic |
| UInt64[] | Object |
| UInt64[] | dynamic |
| dynamic | Object |
| null | Byte[] |
| null | Byte[][] |
| null | C1 |
| null | C1[] |
| null | C2 |
@@ -279,6 +286,7 @@
| null | IReadOnlyList<T3> |
| null | IReadOnlyList<T4> |
| null | Int16[] |
| null | Int32[,] |
| null | Int32[] |
| null | Int64[] |
| null | Object |
@@ -289,6 +297,7 @@
| null | T4 |
| null | T4[] |
| null | T5 |
| null | UInt16[][] |
| null | UInt32[] |
| null | UInt64[] |
| null | dynamic |

4
csharp/ql/test/library-tests/csharp7/TupleTypes.expected
View File

@@ -3,8 +3,8 @@
| (Int32,Double) | (int, double) | ValueTuple<Int32, Double> | 2 | 0 | CSharp7.cs:215:6:215:8 | Item1 |
| (Int32,Double) | (int, double) | ValueTuple<Int32, Double> | 2 | 1 | CSharp7.cs:215:11:215:16 | Item2 |
| (Int32,Int32) | (int, int) | ValueTuple<Int32, Int32> | 2 | 0 | CSharp7.cs:64:10:64:10 | Item1 |
| (Int32,Int32) | (int, int) | ValueTuple<Int32, Int32> | 2 | 1 | file://:0:0:0:0 | Item2 |
| (Int32,Int32) | (int, int) | ValueTuple<Int32, Int32> | 2 | 1 | CSharp7.cs:64:17:64:17 | Item2 |
| (String,Int32) | (string, int) | ValueTuple<String, Int32> | 2 | 0 | CSharp7.cs:84:17:84:17 | Item1 |
| (String,Int32) | (string, int) | ValueTuple<String, Int32> | 2 | 1 | file://:0:0:0:0 | Item2 |
| (String,Int32) | (string, int) | ValueTuple<String, Int32> | 2 | 1 | CSharp7.cs:84:23:84:23 | Item2 |
| (String,String) | (string, string) | ValueTuple<String, String> | 2 | 0 | CSharp7.cs:89:19:89:27 | Item1 |
| (String,String) | (string, string) | ValueTuple<String, String> | 2 | 1 | CSharp7.cs:89:30:89:33 | Item2 |

2
csharp/ql/test/library-tests/csharp8/UnmanagedGenericStructs.ql
View File

@@ -1,5 +1,5 @@
import csharp
from TypeParameter tp
where tp.getConstraints().hasUnmanagedTypeConstraint()
where tp.getConstraints().hasUnmanagedTypeConstraint() and tp.fromSource()
select tp, "This type parameter is unmanaged."

6
csharp/ql/test/library-tests/dataflow/global/GetAnOutNode.expected
View File

@@ -227,6 +227,10 @@
| file://:0:0:0:0 | [summary] call to continuationFunction in ContinueWith | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 0 in ContinueWith |
| file://:0:0:0:0 | [summary] call to continuationFunction in ContinueWith | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 0 in ContinueWith |
| file://:0:0:0:0 | [summary] call to continuationFunction in ContinueWith | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 0 in ContinueWith |
| file://:0:0:0:0 | [summary] call to continuationFunction in ContinueWith | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 0 in ContinueWith |
| file://:0:0:0:0 | [summary] call to continuationFunction in ContinueWith | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 0 in ContinueWith |
| file://:0:0:0:0 | [summary] call to continuationFunction in ContinueWith | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 0 in ContinueWith |
| file://:0:0:0:0 | [summary] call to continuationFunction in ContinueWith | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 0 in ContinueWith |
| file://:0:0:0:0 | [summary] call to elementSelector in GroupBy | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 2 in GroupBy |
| file://:0:0:0:0 | [summary] call to elementSelector in GroupBy | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 2 in GroupBy |
| file://:0:0:0:0 | [summary] call to elementSelector in GroupBy | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 2 in GroupBy |
@@ -313,3 +317,5 @@
| file://:0:0:0:0 | [summary] call to valueFactory in Lazy | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 0 in Lazy |
| file://:0:0:0:0 | [summary] call to valueFactory in Lazy | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 0 in Lazy |
| file://:0:0:0:0 | [summary] call to valueFactory in Lazy | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 0 in Lazy |
| file://:0:0:0:0 | [summary] call to valueFactory in Lazy | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 0 in Lazy |
| file://:0:0:0:0 | [summary] call to valueSelector in Task | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 0 in Task |

253
csharp/ql/test/library-tests/dataflow/library/FlowSummaries.expected
View File

@@ -1,96 +1,4 @@
| MS.Internal.Xml.Linq.ComponentModel.XDeferredAxis<>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
| System.().Create<T1, T2, T3, T4, T5, T6, T7, T8>(T1, T2, T3, T4, T5, T6, T7, T8) | argument 0 -> field Item1 of return (normal) | true |
| System.().Create<T1, T2, T3, T4, T5, T6, T7, T8>(T1, T2, T3, T4, T5, T6, T7, T8) | argument 1 -> field Item2 of return (normal) | true |
| System.().Create<T1, T2, T3, T4, T5, T6, T7, T8>(T1, T2, T3, T4, T5, T6, T7, T8) | argument 2 -> field Item3 of return (normal) | true |
| System.().Create<T1, T2, T3, T4, T5, T6, T7, T8>(T1, T2, T3, T4, T5, T6, T7, T8) | argument 3 -> field Item4 of return (normal) | true |
| System.().Create<T1, T2, T3, T4, T5, T6, T7, T8>(T1, T2, T3, T4, T5, T6, T7, T8) | argument 4 -> field Item5 of return (normal) | true |
| System.().Create<T1, T2, T3, T4, T5, T6, T7, T8>(T1, T2, T3, T4, T5, T6, T7, T8) | argument 5 -> field Item6 of return (normal) | true |
| System.().Create<T1, T2, T3, T4, T5, T6, T7, T8>(T1, T2, T3, T4, T5, T6, T7, T8) | argument 6 -> field Item7 of return (normal) | true |
| System.().Create<T1, T2, T3, T4, T5, T6, T7, T8>(T1, T2, T3, T4, T5, T6, T7, T8) | argument 7 -> field Item8 of return (normal) | true |
| System.().Create<T1, T2, T3, T4, T5, T6, T7>(T1, T2, T3, T4, T5, T6, T7) | argument 0 -> field Item1 of return (normal) | true |
| System.().Create<T1, T2, T3, T4, T5, T6, T7>(T1, T2, T3, T4, T5, T6, T7) | argument 1 -> field Item2 of return (normal) | true |
| System.().Create<T1, T2, T3, T4, T5, T6, T7>(T1, T2, T3, T4, T5, T6, T7) | argument 2 -> field Item3 of return (normal) | true |
| System.().Create<T1, T2, T3, T4, T5, T6, T7>(T1, T2, T3, T4, T5, T6, T7) | argument 3 -> field Item4 of return (normal) | true |
| System.().Create<T1, T2, T3, T4, T5, T6, T7>(T1, T2, T3, T4, T5, T6, T7) | argument 4 -> field Item5 of return (normal) | true |
| System.().Create<T1, T2, T3, T4, T5, T6, T7>(T1, T2, T3, T4, T5, T6, T7) | argument 5 -> field Item6 of return (normal) | true |
| System.().Create<T1, T2, T3, T4, T5, T6, T7>(T1, T2, T3, T4, T5, T6, T7) | argument 6 -> field Item7 of return (normal) | true |
| System.().Create<T1, T2, T3, T4, T5, T6>(T1, T2, T3, T4, T5, T6) | argument 0 -> field Item1 of return (normal) | true |
| System.().Create<T1, T2, T3, T4, T5, T6>(T1, T2, T3, T4, T5, T6) | argument 1 -> field Item2 of return (normal) | true |
| System.().Create<T1, T2, T3, T4, T5, T6>(T1, T2, T3, T4, T5, T6) | argument 2 -> field Item3 of return (normal) | true |
| System.().Create<T1, T2, T3, T4, T5, T6>(T1, T2, T3, T4, T5, T6) | argument 3 -> field Item4 of return (normal) | true |
| System.().Create<T1, T2, T3, T4, T5, T6>(T1, T2, T3, T4, T5, T6) | argument 4 -> field Item5 of return (normal) | true |
| System.().Create<T1, T2, T3, T4, T5, T6>(T1, T2, T3, T4, T5, T6) | argument 5 -> field Item6 of return (normal) | true |
| System.().Create<T1, T2, T3, T4, T5>(T1, T2, T3, T4, T5) | argument 0 -> field Item1 of return (normal) | true |
| System.().Create<T1, T2, T3, T4, T5>(T1, T2, T3, T4, T5) | argument 1 -> field Item2 of return (normal) | true |
| System.().Create<T1, T2, T3, T4, T5>(T1, T2, T3, T4, T5) | argument 2 -> field Item3 of return (normal) | true |
| System.().Create<T1, T2, T3, T4, T5>(T1, T2, T3, T4, T5) | argument 3 -> field Item4 of return (normal) | true |
| System.().Create<T1, T2, T3, T4, T5>(T1, T2, T3, T4, T5) | argument 4 -> field Item5 of return (normal) | true |
| System.().Create<T1, T2, T3, T4>(T1, T2, T3, T4) | argument 0 -> field Item1 of return (normal) | true |
| System.().Create<T1, T2, T3, T4>(T1, T2, T3, T4) | argument 1 -> field Item2 of return (normal) | true |
| System.().Create<T1, T2, T3, T4>(T1, T2, T3, T4) | argument 2 -> field Item3 of return (normal) | true |
| System.().Create<T1, T2, T3, T4>(T1, T2, T3, T4) | argument 3 -> field Item4 of return (normal) | true |
| System.().Create<T1, T2, T3>(T1, T2, T3) | argument 0 -> field Item1 of return (normal) | true |
| System.().Create<T1, T2, T3>(T1, T2, T3) | argument 1 -> field Item2 of return (normal) | true |
| System.().Create<T1, T2, T3>(T1, T2, T3) | argument 2 -> field Item3 of return (normal) | true |
| System.().Create<T1, T2>(T1, T2) | argument 0 -> field Item1 of return (normal) | true |
| System.().Create<T1, T2>(T1, T2) | argument 1 -> field Item2 of return (normal) | true |
| System.().Create<T1>(T1) | argument 0 -> field Item1 of return (normal) | true |
| System.(T1).ValueTuple(T1) | argument 0 -> field Item1 of return (normal) | true |
| System.(T1).get_Item(int) | field Item1 of argument -1 -> return (normal) | true |
| System.(T1,T2).ValueTuple(T1, T2) | argument 0 -> field Item1 of return (normal) | true |
| System.(T1,T2).ValueTuple(T1, T2) | argument 1 -> field Item2 of return (normal) | true |
| System.(T1,T2).get_Item(int) | field Item1 of argument -1 -> return (normal) | true |
| System.(T1,T2).get_Item(int) | field Item2 of argument -1 -> return (normal) | true |
| System.(T1,T2,T3).ValueTuple(T1, T2, T3) | argument 0 -> field Item1 of return (normal) | true |
| System.(T1,T2,T3).ValueTuple(T1, T2, T3) | argument 1 -> field Item2 of return (normal) | true |
| System.(T1,T2,T3).ValueTuple(T1, T2, T3) | argument 2 -> field Item3 of return (normal) | true |
| System.(T1,T2,T3).get_Item(int) | field Item1 of argument -1 -> return (normal) | true |
| System.(T1,T2,T3).get_Item(int) | field Item2 of argument -1 -> return (normal) | true |
| System.(T1,T2,T3).get_Item(int) | field Item3 of argument -1 -> return (normal) | true |
| System.(T1,T2,T3,T4).ValueTuple(T1, T2, T3, T4) | argument 0 -> field Item1 of return (normal) | true |
| System.(T1,T2,T3,T4).ValueTuple(T1, T2, T3, T4) | argument 1 -> field Item2 of return (normal) | true |
| System.(T1,T2,T3,T4).ValueTuple(T1, T2, T3, T4) | argument 2 -> field Item3 of return (normal) | true |
| System.(T1,T2,T3,T4).ValueTuple(T1, T2, T3, T4) | argument 3 -> field Item4 of return (normal) | true |
| System.(T1,T2,T3,T4).get_Item(int) | field Item1 of argument -1 -> return (normal) | true |
| System.(T1,T2,T3,T4).get_Item(int) | field Item2 of argument -1 -> return (normal) | true |
| System.(T1,T2,T3,T4).get_Item(int) | field Item3 of argument -1 -> return (normal) | true |
| System.(T1,T2,T3,T4).get_Item(int) | field Item4 of argument -1 -> return (normal) | true |
| System.(T1,T2,T3,T4,T5).ValueTuple(T1, T2, T3, T4, T5) | argument 0 -> field Item1 of return (normal) | true |
| System.(T1,T2,T3,T4,T5).ValueTuple(T1, T2, T3, T4, T5) | argument 1 -> field Item2 of return (normal) | true |
| System.(T1,T2,T3,T4,T5).ValueTuple(T1, T2, T3, T4, T5) | argument 2 -> field Item3 of return (normal) | true |
| System.(T1,T2,T3,T4,T5).ValueTuple(T1, T2, T3, T4, T5) | argument 3 -> field Item4 of return (normal) | true |
| System.(T1,T2,T3,T4,T5).ValueTuple(T1, T2, T3, T4, T5) | argument 4 -> field Item5 of return (normal) | true |
| System.(T1,T2,T3,T4,T5).get_Item(int) | field Item1 of argument -1 -> return (normal) | true |
| System.(T1,T2,T3,T4,T5).get_Item(int) | field Item2 of argument -1 -> return (normal) | true |
| System.(T1,T2,T3,T4,T5).get_Item(int) | field Item3 of argument -1 -> return (normal) | true |
| System.(T1,T2,T3,T4,T5).get_Item(int) | field Item4 of argument -1 -> return (normal) | true |
| System.(T1,T2,T3,T4,T5).get_Item(int) | field Item5 of argument -1 -> return (normal) | true |
| System.(T1,T2,T3,T4,T5,T6).ValueTuple(T1, T2, T3, T4, T5, T6) | argument 0 -> field Item1 of return (normal) | true |
| System.(T1,T2,T3,T4,T5,T6).ValueTuple(T1, T2, T3, T4, T5, T6) | argument 1 -> field Item2 of return (normal) | true |
| System.(T1,T2,T3,T4,T5,T6).ValueTuple(T1, T2, T3, T4, T5, T6) | argument 2 -> field Item3 of return (normal) | true |
| System.(T1,T2,T3,T4,T5,T6).ValueTuple(T1, T2, T3, T4, T5, T6) | argument 3 -> field Item4 of return (normal) | true |
| System.(T1,T2,T3,T4,T5,T6).ValueTuple(T1, T2, T3, T4, T5, T6) | argument 4 -> field Item5 of return (normal) | true |
| System.(T1,T2,T3,T4,T5,T6).ValueTuple(T1, T2, T3, T4, T5, T6) | argument 5 -> field Item6 of return (normal) | true |
| System.(T1,T2,T3,T4,T5,T6).get_Item(int) | field Item1 of argument -1 -> return (normal) | true |
| System.(T1,T2,T3,T4,T5,T6).get_Item(int) | field Item2 of argument -1 -> return (normal) | true |
| System.(T1,T2,T3,T4,T5,T6).get_Item(int) | field Item3 of argument -1 -> return (normal) | true |
| System.(T1,T2,T3,T4,T5,T6).get_Item(int) | field Item4 of argument -1 -> return (normal) | true |
| System.(T1,T2,T3,T4,T5,T6).get_Item(int) | field Item5 of argument -1 -> return (normal) | true |
| System.(T1,T2,T3,T4,T5,T6).get_Item(int) | field Item6 of argument -1 -> return (normal) | true |
| System.(T1,T2,T3,T4,T5,T6,T7).ValueTuple(T1, T2, T3, T4, T5, T6, T7) | argument 0 -> field Item1 of return (normal) | true |
| System.(T1,T2,T3,T4,T5,T6,T7).ValueTuple(T1, T2, T3, T4, T5, T6, T7) | argument 1 -> field Item2 of return (normal) | true |
| System.(T1,T2,T3,T4,T5,T6,T7).ValueTuple(T1, T2, T3, T4, T5, T6, T7) | argument 2 -> field Item3 of return (normal) | true |
| System.(T1,T2,T3,T4,T5,T6,T7).ValueTuple(T1, T2, T3, T4, T5, T6, T7) | argument 3 -> field Item4 of return (normal) | true |
| System.(T1,T2,T3,T4,T5,T6,T7).ValueTuple(T1, T2, T3, T4, T5, T6, T7) | argument 4 -> field Item5 of return (normal) | true |
| System.(T1,T2,T3,T4,T5,T6,T7).ValueTuple(T1, T2, T3, T4, T5, T6, T7) | argument 5 -> field Item6 of return (normal) | true |
| System.(T1,T2,T3,T4,T5,T6,T7).ValueTuple(T1, T2, T3, T4, T5, T6, T7) | argument 6 -> field Item7 of return (normal) | true |
| System.(T1,T2,T3,T4,T5,T6,T7).get_Item(int) | field Item1 of argument -1 -> return (normal) | true |
| System.(T1,T2,T3,T4,T5,T6,T7).get_Item(int) | field Item2 of argument -1 -> return (normal) | true |
| System.(T1,T2,T3,T4,T5,T6,T7).get_Item(int) | field Item3 of argument -1 -> return (normal) | true |
| System.(T1,T2,T3,T4,T5,T6,T7).get_Item(int) | field Item4 of argument -1 -> return (normal) | true |
| System.(T1,T2,T3,T4,T5,T6,T7).get_Item(int) | field Item5 of argument -1 -> return (normal) | true |
| System.(T1,T2,T3,T4,T5,T6,T7).get_Item(int) | field Item6 of argument -1 -> return (normal) | true |
| System.(T1,T2,T3,T4,T5,T6,T7).get_Item(int) | field Item7 of argument -1 -> return (normal) | true |
| System.Array.Add(object) | argument 0 -> element of argument -1 | true |
| System.Array.AsReadOnly<T>(T[]) | element of argument 0 -> element of return (normal) | true |
| System.Array.Clone() | element of argument 0 -> element of return (normal) | true |
@@ -255,6 +163,7 @@
| System.Collections.Concurrent.ConcurrentStack<>.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
| System.Collections.Concurrent.ConcurrentStack<>.CopyTo(T[], int) | element of argument -1 -> element of return (out parameter 0) | true |
| System.Collections.Concurrent.ConcurrentStack<>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
| System.Collections.Concurrent.ConcurrentStack<>.GetEnumerator(Node) | element of argument -1 -> property Current of return (normal) | true |
| System.Collections.Concurrent.IProducerConsumerCollection<>.CopyTo(T[], int) | element of argument -1 -> element of return (out parameter 0) | true |
| System.Collections.Concurrent.OrderablePartitioner<>.EnumerableDropIndices.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
| System.Collections.Concurrent.Partitioner.<CreateRanges>d__7.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
@@ -405,6 +314,7 @@
| System.Collections.Generic.SortedList<,>.Add(object, object) | argument 1 -> property Value of element of argument -1 | true |
| System.Collections.Generic.SortedList<,>.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
| System.Collections.Generic.SortedList<,>.CopyTo(KeyValuePair<TKey,TValue>[], int) | element of argument -1 -> element of return (out parameter 0) | true |
| System.Collections.Generic.SortedList<,>.GetByIndex(int) | property Value of element of argument -1 -> return (normal) | true |
| System.Collections.Generic.SortedList<,>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
| System.Collections.Generic.SortedList<,>.KeyList.Add(TKey) | argument 0 -> element of argument -1 | true |
| System.Collections.Generic.SortedList<,>.KeyList.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
@@ -467,6 +377,8 @@
| System.Collections.Hashtable.SyncHashtable.Clone() | element of argument 0 -> element of return (normal) | true |
| System.Collections.Hashtable.SyncHashtable.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
| System.Collections.Hashtable.SyncHashtable.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
| System.Collections.Hashtable.SyncHashtable.SyncHashtable(Hashtable) | property Key of element of argument 0 -> property Key of element of return (normal) | true |
| System.Collections.Hashtable.SyncHashtable.SyncHashtable(Hashtable) | property Value of element of argument 0 -> property Value of element of return (normal) | true |
| System.Collections.Hashtable.SyncHashtable.get_Item(object) | property Value of element of argument -1 -> return (normal) | true |
| System.Collections.Hashtable.SyncHashtable.get_Keys() | property Key of element of argument -1 -> element of return (normal) | true |
| System.Collections.Hashtable.SyncHashtable.get_Values() | property Value of element of argument -1 -> element of return (normal) | true |
@@ -585,6 +497,8 @@
| System.Collections.SortedList.SyncSortedList.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
| System.Collections.SortedList.SyncSortedList.GetByIndex(int) | property Value of element of argument -1 -> return (normal) | true |
| System.Collections.SortedList.SyncSortedList.GetValueList() | property Value of element of argument -1 -> element of return (normal) | true |
| System.Collections.SortedList.SyncSortedList.SyncSortedList(SortedList) | property Key of element of argument 0 -> property Key of element of return (normal) | true |
| System.Collections.SortedList.SyncSortedList.SyncSortedList(SortedList) | property Value of element of argument 0 -> property Value of element of return (normal) | true |
| System.Collections.SortedList.SyncSortedList.get_Item(object) | property Value of element of argument -1 -> return (normal) | true |
| System.Collections.SortedList.SyncSortedList.set_Item(object, object) | argument 0 -> property Key of element of argument -1 | true |
| System.Collections.SortedList.SyncSortedList.set_Item(object, object) | argument 1 -> property Value of element of argument -1 | true |
@@ -633,6 +547,8 @@
| System.Collections.Specialized.OrderedDictionary.AsReadOnly() | element of argument 0 -> element of return (normal) | true |
| System.Collections.Specialized.OrderedDictionary.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
| System.Collections.Specialized.OrderedDictionary.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
| System.Collections.Specialized.OrderedDictionary.OrderedDictionary(OrderedDictionary) | property Key of element of argument 0 -> property Key of element of return (normal) | true |
| System.Collections.Specialized.OrderedDictionary.OrderedDictionary(OrderedDictionary) | property Value of element of argument 0 -> property Value of element of return (normal) | true |
| System.Collections.Specialized.OrderedDictionary.OrderedDictionaryKeyValueCollection.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
| System.Collections.Specialized.OrderedDictionary.OrderedDictionaryKeyValueCollection.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
| System.Collections.Specialized.OrderedDictionary.get_Item(int) | property Value of element of argument -1 -> return (normal) | true |
@@ -725,6 +641,10 @@
| System.ComponentModel.PropertyDescriptorCollection.PropertyDescriptorCollection(PropertyDescriptor[]) | property Value of element of argument 0 -> property Value of element of return (normal) | true |
| System.ComponentModel.PropertyDescriptorCollection.PropertyDescriptorCollection(PropertyDescriptor[], bool) | property Key of element of argument 0 -> property Key of element of return (normal) | true |
| System.ComponentModel.PropertyDescriptorCollection.PropertyDescriptorCollection(PropertyDescriptor[], bool) | property Value of element of argument 0 -> property Value of element of return (normal) | true |
| System.ComponentModel.PropertyDescriptorCollection.PropertyDescriptorCollection(PropertyDescriptor[], int, String[], IComparer) | property Key of element of argument 0 -> property Key of element of return (normal) | true |
| System.ComponentModel.PropertyDescriptorCollection.PropertyDescriptorCollection(PropertyDescriptor[], int, String[], IComparer) | property Key of element of argument 2 -> property Key of element of return (normal) | true |
| System.ComponentModel.PropertyDescriptorCollection.PropertyDescriptorCollection(PropertyDescriptor[], int, String[], IComparer) | property Value of element of argument 0 -> property Value of element of return (normal) | true |
| System.ComponentModel.PropertyDescriptorCollection.PropertyDescriptorCollection(PropertyDescriptor[], int, String[], IComparer) | property Value of element of argument 2 -> property Value of element of return (normal) | true |
| System.ComponentModel.PropertyDescriptorCollection.get_Item(int) | element of argument -1 -> return (normal) | true |
| System.ComponentModel.PropertyDescriptorCollection.get_Item(int) | property Value of element of argument -1 -> return (normal) | true |
| System.ComponentModel.PropertyDescriptorCollection.get_Item(object) | element of argument -1 -> return (normal) | true |
@@ -747,12 +667,28 @@
| System.Convert.ChangeType(object, Type, IFormatProvider) | argument 0 -> return (normal) | false |
| System.Convert.ChangeType(object, TypeCode) | argument 0 -> return (normal) | false |
| System.Convert.ChangeType(object, TypeCode, IFormatProvider) | argument 0 -> return (normal) | false |
| System.Convert.ConvertToBase64Array(char*, byte*, int, int, bool) | argument 0 -> return (normal) | false |
| System.Convert.CopyToTempBufferWithoutWhiteSpace(ReadOnlySpan<Char>, Span<Char>, out int, out int) | argument 0 -> return (normal) | false |
| System.Convert.Decode(ref char, ref sbyte) | argument 0 -> return (normal) | false |
| System.Convert.DefaultToType(IConvertible, Type, IFormatProvider) | argument 0 -> return (normal) | false |
| System.Convert.FromBase64CharArray(Char[], int, int) | argument 0 -> return (normal) | false |
| System.Convert.FromBase64CharPtr(char*, int) | argument 0 -> return (normal) | false |
| System.Convert.FromBase64String(string) | argument 0 -> return (normal) | false |
| System.Convert.FromBase64_ComputeResultLength(char*, int) | argument 0 -> return (normal) | false |
| System.Convert.FromHexString(ReadOnlySpan<Char>) | argument 0 -> return (normal) | false |
| System.Convert.FromHexString(string) | argument 0 -> return (normal) | false |
| System.Convert.GetTypeCode(object) | argument 0 -> return (normal) | false |
| System.Convert.IsDBNull(object) | argument 0 -> return (normal) | false |
| System.Convert.IsSpace(char) | argument 0 -> return (normal) | false |
| System.Convert.ThrowByteOverflowException() | argument 0 -> return (normal) | false |
| System.Convert.ThrowCharOverflowException() | argument 0 -> return (normal) | false |
| System.Convert.ThrowInt16OverflowException() | argument 0 -> return (normal) | false |
| System.Convert.ThrowInt32OverflowException() | argument 0 -> return (normal) | false |
| System.Convert.ThrowInt64OverflowException() | argument 0 -> return (normal) | false |
| System.Convert.ThrowSByteOverflowException() | argument 0 -> return (normal) | false |
| System.Convert.ThrowUInt16OverflowException() | argument 0 -> return (normal) | false |
| System.Convert.ThrowUInt32OverflowException() | argument 0 -> return (normal) | false |
| System.Convert.ThrowUInt64OverflowException() | argument 0 -> return (normal) | false |
| System.Convert.ToBase64CharArray(Byte[], int, int, Char[], int) | argument 0 -> return (normal) | false |
| System.Convert.ToBase64CharArray(Byte[], int, int, Char[], int, Base64FormattingOptions) | argument 0 -> return (normal) | false |
| System.Convert.ToBase64String(Byte[]) | argument 0 -> return (normal) | false |
@@ -760,6 +696,7 @@
| System.Convert.ToBase64String(Byte[], int, int) | argument 0 -> return (normal) | false |
| System.Convert.ToBase64String(Byte[], int, int, Base64FormattingOptions) | argument 0 -> return (normal) | false |
| System.Convert.ToBase64String(ReadOnlySpan<Byte>, Base64FormattingOptions) | argument 0 -> return (normal) | false |
| System.Convert.ToBase64_CalculateAndValidateOutputLength(int, bool) | argument 0 -> return (normal) | false |
| System.Convert.ToBoolean(DateTime) | argument 0 -> return (normal) | false |
| System.Convert.ToBoolean(bool) | argument 0 -> return (normal) | false |
| System.Convert.ToBoolean(byte) | argument 0 -> return (normal) | false |
@@ -1059,9 +996,11 @@
| System.Convert.ToUInt64(uint) | argument 0 -> return (normal) | false |
| System.Convert.ToUInt64(ulong) | argument 0 -> return (normal) | false |
| System.Convert.ToUInt64(ushort) | argument 0 -> return (normal) | false |
| System.Convert.TryDecodeFromUtf16(ReadOnlySpan<Char>, Span<Byte>, out int, out int) | argument 0 -> return (normal) | false |
| System.Convert.TryFromBase64Chars(ReadOnlySpan<Char>, Span<Byte>, out int) | argument 0 -> return (normal) | false |
| System.Convert.TryFromBase64String(string, Span<Byte>, out int) | argument 0 -> return (normal) | false |
| System.Convert.TryToBase64Chars(ReadOnlySpan<Byte>, Span<Char>, out int, Base64FormattingOptions) | argument 0 -> return (normal) | false |
| System.Convert.WriteThreeLowOrderBytes(ref byte, int) | argument 0 -> return (normal) | false |
| System.Diagnostics.Tracing.CounterPayload.<get_ForEnumeration>d__51.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
| System.Diagnostics.Tracing.CounterPayload.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
| System.Diagnostics.Tracing.EventPayload.Add(KeyValuePair<String, Object>) | argument 0 -> element of argument -1 | true |
@@ -1070,6 +1009,10 @@
| System.Diagnostics.Tracing.EventPayload.Add(string, object) | argument 0 -> property Key of element of argument -1 | true |
| System.Diagnostics.Tracing.EventPayload.Add(string, object) | argument 1 -> property Value of element of argument -1 | true |
| System.Diagnostics.Tracing.EventPayload.CopyTo(KeyValuePair<String,Object>[], int) | element of argument -1 -> element of return (out parameter 0) | true |
| System.Diagnostics.Tracing.EventPayload.EventPayload(List<String>, List<Object>) | property Key of element of argument 0 -> property Key of element of return (normal) | true |
| System.Diagnostics.Tracing.EventPayload.EventPayload(List<String>, List<Object>) | property Key of element of argument 1 -> property Key of element of return (normal) | true |
| System.Diagnostics.Tracing.EventPayload.EventPayload(List<String>, List<Object>) | property Value of element of argument 0 -> property Value of element of return (normal) | true |
| System.Diagnostics.Tracing.EventPayload.EventPayload(List<String>, List<Object>) | property Value of element of argument 1 -> property Value of element of return (normal) | true |
| System.Diagnostics.Tracing.EventPayload.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
| System.Diagnostics.Tracing.EventPayload.get_Item(string) | property Value of element of argument -1 -> return (normal) | true |
| System.Diagnostics.Tracing.EventPayload.get_Keys() | property Key of element of argument -1 -> element of return (normal) | true |
@@ -1126,8 +1069,11 @@
| System.IO.Compression.DeflateStream.CopyToStream.WriteAsync(Byte[], int, int, CancellationToken) | argument 0 -> argument -1 | false |
| System.IO.Compression.DeflateStream.DeflateStream(Stream, CompressionLevel) | argument 0 -> return (normal) | false |
| System.IO.Compression.DeflateStream.DeflateStream(Stream, CompressionLevel, bool) | argument 0 -> return (normal) | false |
| System.IO.Compression.DeflateStream.DeflateStream(Stream, CompressionLevel, bool, int) | argument 0 -> return (normal) | false |
| System.IO.Compression.DeflateStream.DeflateStream(Stream, CompressionMode) | argument 0 -> return (normal) | false |
| System.IO.Compression.DeflateStream.DeflateStream(Stream, CompressionMode, bool) | argument 0 -> return (normal) | false |
| System.IO.Compression.DeflateStream.DeflateStream(Stream, CompressionMode, bool, int, long) | argument 0 -> return (normal) | false |
| System.IO.Compression.DeflateStream.DeflateStream(Stream, CompressionMode, long) | argument 0 -> return (normal) | false |
| System.IO.Compression.DeflateStream.Read(Byte[], int, int) | argument -1 -> return (out parameter 0) | false |
| System.IO.Compression.DeflateStream.ReadAsync(Byte[], int, int, CancellationToken) | argument -1 -> return (out parameter 0) | false |
| System.IO.Compression.DeflateStream.Write(Byte[], int, int) | argument 0 -> argument -1 | false |
@@ -1181,6 +1127,7 @@
| System.IO.Path.Combine(string, string, string, string) | argument 3 -> return (normal) | false |
| System.IO.Path.GetDirectoryName(ReadOnlySpan<Char>) | argument 0 -> return (normal) | false |
| System.IO.Path.GetDirectoryName(string) | argument 0 -> return (normal) | false |
| System.IO.Path.GetDirectoryNameOffset(ReadOnlySpan<Char>) | argument 0 -> return (normal) | false |
| System.IO.Path.GetExtension(ReadOnlySpan<Char>) | argument 0 -> return (normal) | false |
| System.IO.Path.GetExtension(string) | argument 0 -> return (normal) | false |
| System.IO.Path.GetFileName(ReadOnlySpan<Char>) | argument 0 -> return (normal) | false |
@@ -1192,20 +1139,28 @@
| System.IO.Path.GetPathRoot(ReadOnlySpan<Char>) | argument 0 -> return (normal) | false |
| System.IO.Path.GetPathRoot(string) | argument 0 -> return (normal) | false |
| System.IO.Path.GetRelativePath(string, string) | argument 1 -> return (normal) | false |
| System.IO.Path.GetRelativePath(string, string, StringComparison) | argument 1 -> return (normal) | false |
| System.IO.Pipes.PipeStream.BeginRead(Byte[], int, int, AsyncCallback, object) | argument -1 -> return (out parameter 0) | false |
| System.IO.Pipes.PipeStream.BeginWrite(Byte[], int, int, AsyncCallback, object) | argument 0 -> argument -1 | false |
| System.IO.Pipes.PipeStream.Read(Byte[], int, int) | argument -1 -> return (out parameter 0) | false |
| System.IO.Pipes.PipeStream.ReadAsync(Byte[], int, int, CancellationToken) | argument -1 -> return (out parameter 0) | false |
| System.IO.Pipes.PipeStream.Write(Byte[], int, int) | argument 0 -> argument -1 | false |
| System.IO.Pipes.PipeStream.WriteAsync(Byte[], int, int, CancellationToken) | argument 0 -> argument -1 | false |
| System.IO.Stream.BeginEndReadAsync(Byte[], int, int) | argument -1 -> return (out parameter 0) | false |
| System.IO.Stream.BeginEndWriteAsync(Byte[], int, int) | argument 0 -> argument -1 | false |
| System.IO.Stream.BeginRead(Byte[], int, int, AsyncCallback, object) | argument -1 -> return (out parameter 0) | false |
| System.IO.Stream.BeginReadInternal(Byte[], int, int, AsyncCallback, object, bool, bool) | argument -1 -> return (out parameter 0) | false |
| System.IO.Stream.BeginWrite(Byte[], int, int, AsyncCallback, object) | argument 0 -> argument -1 | false |
| System.IO.Stream.BeginWriteInternal(Byte[], int, int, AsyncCallback, object, bool, bool) | argument 0 -> argument -1 | false |
| System.IO.Stream.BlockingBeginRead(Byte[], int, int, AsyncCallback, object) | argument -1 -> return (out parameter 0) | false |
| System.IO.Stream.BlockingBeginWrite(Byte[], int, int, AsyncCallback, object) | argument 0 -> argument -1 | false |
| System.IO.Stream.CopyTo(Stream) | argument -1 -> return (out parameter 0) | false |
| System.IO.Stream.CopyTo(Stream, int) | argument -1 -> return (out parameter 0) | false |
| System.IO.Stream.CopyToAsync(Stream) | argument -1 -> return (out parameter 0) | false |
| System.IO.Stream.CopyToAsync(Stream, CancellationToken) | argument -1 -> return (out parameter 0) | false |
| System.IO.Stream.CopyToAsync(Stream, int) | argument -1 -> return (out parameter 0) | false |
| System.IO.Stream.CopyToAsync(Stream, int, CancellationToken) | argument -1 -> return (out parameter 0) | false |
| System.IO.Stream.CopyToAsyncInternal(Stream, int, CancellationToken) | argument -1 -> return (out parameter 0) | false |
| System.IO.Stream.NullStream.BeginRead(Byte[], int, int, AsyncCallback, object) | argument -1 -> return (out parameter 0) | false |
| System.IO.Stream.NullStream.BeginWrite(Byte[], int, int, AsyncCallback, object) | argument 0 -> argument -1 | false |
| System.IO.Stream.NullStream.CopyTo(Stream, int) | argument -1 -> return (out parameter 0) | false |
@@ -1247,6 +1202,7 @@
| System.IO.TextReader.ReadBlock(Span<Char>) | argument -1 -> return (normal) | false |
| System.IO.TextReader.ReadBlockAsync(Char[], int, int) | argument -1 -> return (normal) | false |
| System.IO.TextReader.ReadBlockAsync(Memory<Char>, CancellationToken) | argument -1 -> return (normal) | false |
| System.IO.TextReader.ReadBlockAsyncInternal(Memory<Char>, CancellationToken) | argument -1 -> return (normal) | false |
| System.IO.TextReader.ReadLine() | argument -1 -> return (normal) | false |
| System.IO.TextReader.ReadLineAsync() | argument -1 -> return (normal) | false |
| System.IO.TextReader.ReadToEnd() | argument -1 -> return (normal) | false |
@@ -1271,6 +1227,7 @@
| System.Int32.TryParse(string, out int) | argument 0 -> return (out parameter 1) | false |
| System.Lazy<>.Lazy(Func<T>) | return (normal) of argument 0 -> property Value of return (normal) | true |
| System.Lazy<>.Lazy(Func<T>, LazyThreadSafetyMode) | return (normal) of argument 0 -> property Value of return (normal) | true |
| System.Lazy<>.Lazy(Func<T>, LazyThreadSafetyMode, bool) | return (normal) of argument 0 -> property Value of return (normal) | true |
| System.Lazy<>.Lazy(Func<T>, bool) | return (normal) of argument 0 -> property Value of return (normal) | true |
| System.Lazy<>.get_Value() | argument -1 -> return (normal) | false |
| System.Linq.EmptyPartition<>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
@@ -1529,13 +1486,16 @@
| System.Linq.Lookup<,>.<ApplyResultSelector>d__19<>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
| System.Linq.Lookup<,>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
| System.Linq.OrderedEnumerable<>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
| System.Linq.OrderedEnumerable<>.GetEnumerator(int, int) | element of argument -1 -> property Current of return (normal) | true |
| System.Linq.OrderedPartition<>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
| System.Linq.Parallel.CancellableEnumerable.<Wrap>d__0<>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
| System.Linq.Parallel.EnumerableWrapperWeakToStrong.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
| System.Linq.Parallel.ExceptionAggregator.<WrapEnumerable>d__0<>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
| System.Linq.Parallel.ExceptionAggregator.<WrapQueryEnumerator>d__1<,>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
| System.Linq.Parallel.GroupByGrouping<,>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
| System.Linq.Parallel.ListChunk<>.Add(TInputOutput) | argument 0 -> element of argument -1 | true |
| System.Linq.Parallel.ListChunk<>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
| System.Linq.Parallel.Lookup<,>.Add(IGrouping<TKey, TElement>) | argument 0 -> element of argument -1 | true |
| System.Linq.Parallel.Lookup<,>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
| System.Linq.Parallel.MergeExecutor<>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
| System.Linq.Parallel.OrderedGroupByGrouping<,,>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
@@ -1556,8 +1516,12 @@
| System.Linq.ParallelEnumerable.Aggregate<TSource, TAccumulate>(ParallelQuery<TSource>, TAccumulate, Func<TAccumulate, TSource, TAccumulate>) | argument 1 -> parameter 0 of argument 2 | true |
| System.Linq.ParallelEnumerable.Aggregate<TSource, TAccumulate>(ParallelQuery<TSource>, TAccumulate, Func<TAccumulate, TSource, TAccumulate>) | element of argument 0 -> parameter 1 of argument 2 | true |
| System.Linq.ParallelEnumerable.Aggregate<TSource, TAccumulate>(ParallelQuery<TSource>, TAccumulate, Func<TAccumulate, TSource, TAccumulate>) | return (normal) of argument 2 -> return (normal) | true |
| System.Linq.ParallelEnumerable.Aggregate<TSource, TAccumulate>(ParallelQuery<TSource>, TAccumulate, Func<TAccumulate, TSource, TAccumulate>, QueryAggregationOptions) | argument 1 -> parameter 0 of argument 2 | true |
| System.Linq.ParallelEnumerable.Aggregate<TSource, TAccumulate>(ParallelQuery<TSource>, TAccumulate, Func<TAccumulate, TSource, TAccumulate>, QueryAggregationOptions) | element of argument 0 -> parameter 1 of argument 2 | true |
| System.Linq.ParallelEnumerable.Aggregate<TSource, TAccumulate>(ParallelQuery<TSource>, TAccumulate, Func<TAccumulate, TSource, TAccumulate>, QueryAggregationOptions) | return (normal) of argument 3 -> return (normal) | true |
| System.Linq.ParallelEnumerable.Aggregate<TSource>(ParallelQuery<TSource>, Func<TSource, TSource, TSource>) | element of argument 0 -> parameter 1 of argument 1 | true |
| System.Linq.ParallelEnumerable.Aggregate<TSource>(ParallelQuery<TSource>, Func<TSource, TSource, TSource>) | return (normal) of argument 1 -> return (normal) | true |
| System.Linq.ParallelEnumerable.Aggregate<TSource>(ParallelQuery<TSource>, Func<TSource, TSource, TSource>, QueryAggregationOptions) | return (normal) of argument 2 -> return (normal) | true |
| System.Linq.ParallelEnumerable.All<TSource>(ParallelQuery<TSource>, Func<TSource, Boolean>) | element of argument 0 -> parameter 0 of argument 1 | true |
| System.Linq.ParallelEnumerable.Any<TSource>(ParallelQuery<TSource>, Func<TSource, Boolean>) | element of argument 0 -> parameter 0 of argument 1 | true |
| System.Linq.ParallelEnumerable.AsEnumerable<TSource>(ParallelQuery<TSource>) | element of argument 0 -> element of return (normal) | true |
@@ -2000,6 +1964,7 @@
| System.Net.Security.SslStream.ReadAsync(Byte[], int, int, CancellationToken) | argument -1 -> return (out parameter 0) | false |
| System.Net.Security.SslStream.Write(Byte[], int, int) | argument 0 -> argument -1 | false |
| System.Net.Security.SslStream.WriteAsync(Byte[], int, int, CancellationToken) | argument 0 -> argument -1 | false |
| System.Net.WebUtility.HtmlEncode(ReadOnlySpan<Char>, ref ValueStringBuilder) | argument 0 -> return (normal) | false |
| System.Net.WebUtility.HtmlEncode(string) | argument 0 -> return (normal) | false |
| System.Net.WebUtility.HtmlEncode(string, TextWriter) | argument 0 -> return (normal) | false |
| System.Net.WebUtility.UrlEncode(string) | argument 0 -> return (normal) | false |
@@ -2305,6 +2270,7 @@
| System.Threading.Tasks.Task.ContinueWith(Action<Task, Object>, object, CancellationToken, TaskContinuationOptions, TaskScheduler) | argument 1 -> parameter 1 of argument 0 | true |
| System.Threading.Tasks.Task.ContinueWith(Action<Task, Object>, object, TaskContinuationOptions) | argument 1 -> parameter 1 of argument 0 | true |
| System.Threading.Tasks.Task.ContinueWith(Action<Task, Object>, object, TaskScheduler) | argument 1 -> parameter 1 of argument 0 | true |
| System.Threading.Tasks.Task.ContinueWith(Action<Task, Object>, object, TaskScheduler, CancellationToken, TaskContinuationOptions) | argument 1 -> parameter 1 of argument 0 | true |
| System.Threading.Tasks.Task.ContinueWith<TResult>(Func<Task, Object, TResult>, object) | argument 1 -> parameter 1 of argument 0 | true |
| System.Threading.Tasks.Task.ContinueWith<TResult>(Func<Task, Object, TResult>, object) | return (normal) of argument 0 -> property Result of return (normal) | true |
| System.Threading.Tasks.Task.ContinueWith<TResult>(Func<Task, Object, TResult>, object, CancellationToken) | argument 1 -> parameter 1 of argument 0 | true |
@@ -2315,11 +2281,14 @@
| System.Threading.Tasks.Task.ContinueWith<TResult>(Func<Task, Object, TResult>, object, TaskContinuationOptions) | return (normal) of argument 0 -> property Result of return (normal) | true |
| System.Threading.Tasks.Task.ContinueWith<TResult>(Func<Task, Object, TResult>, object, TaskScheduler) | argument 1 -> parameter 1 of argument 0 | true |
| System.Threading.Tasks.Task.ContinueWith<TResult>(Func<Task, Object, TResult>, object, TaskScheduler) | return (normal) of argument 0 -> property Result of return (normal) | true |
| System.Threading.Tasks.Task.ContinueWith<TResult>(Func<Task, Object, TResult>, object, TaskScheduler, CancellationToken, TaskContinuationOptions) | argument 1 -> parameter 1 of argument 0 | true |
| System.Threading.Tasks.Task.ContinueWith<TResult>(Func<Task, Object, TResult>, object, TaskScheduler, CancellationToken, TaskContinuationOptions) | return (normal) of argument 0 -> property Result of return (normal) | true |
| System.Threading.Tasks.Task.ContinueWith<TResult>(Func<Task, TResult>) | return (normal) of argument 0 -> property Result of return (normal) | true |
| System.Threading.Tasks.Task.ContinueWith<TResult>(Func<Task, TResult>, CancellationToken) | return (normal) of argument 0 -> property Result of return (normal) | true |
| System.Threading.Tasks.Task.ContinueWith<TResult>(Func<Task, TResult>, CancellationToken, TaskContinuationOptions, TaskScheduler) | return (normal) of argument 0 -> property Result of return (normal) | true |
| System.Threading.Tasks.Task.ContinueWith<TResult>(Func<Task, TResult>, TaskContinuationOptions) | return (normal) of argument 0 -> property Result of return (normal) | true |
| System.Threading.Tasks.Task.ContinueWith<TResult>(Func<Task, TResult>, TaskScheduler) | return (normal) of argument 0 -> property Result of return (normal) | true |
| System.Threading.Tasks.Task.ContinueWith<TResult>(Func<Task, TResult>, TaskScheduler, CancellationToken, TaskContinuationOptions) | return (normal) of argument 0 -> property Result of return (normal) | true |
| System.Threading.Tasks.Task.FromResult<TResult>(TResult) | argument 0 -> property Result of return (normal) | true |
| System.Threading.Tasks.Task.Run<TResult>(Func<TResult>) | return (normal) of argument 0 -> property Result of return (normal) | true |
| System.Threading.Tasks.Task.Run<TResult>(Func<TResult>, CancellationToken) | return (normal) of argument 0 -> property Result of return (normal) | true |
@@ -2346,11 +2315,14 @@
| System.Threading.Tasks.Task<>.ContinueWith(Action<Task<>, Object>, object, TaskContinuationOptions) | argument -1 -> parameter 0 of argument 0 | true |
| System.Threading.Tasks.Task<>.ContinueWith(Action<Task<>, Object>, object, TaskScheduler) | argument 1 -> parameter 1 of argument 0 | true |
| System.Threading.Tasks.Task<>.ContinueWith(Action<Task<>, Object>, object, TaskScheduler) | argument -1 -> parameter 0 of argument 0 | true |
| System.Threading.Tasks.Task<>.ContinueWith(Action<Task<>, Object>, object, TaskScheduler, CancellationToken, TaskContinuationOptions) | argument 1 -> parameter 1 of argument 0 | true |
| System.Threading.Tasks.Task<>.ContinueWith(Action<Task<>, Object>, object, TaskScheduler, CancellationToken, TaskContinuationOptions) | argument -1 -> parameter 0 of argument 0 | true |
| System.Threading.Tasks.Task<>.ContinueWith(Action<Task<>>) | argument -1 -> parameter 0 of argument 0 | true |
| System.Threading.Tasks.Task<>.ContinueWith(Action<Task<>>, CancellationToken) | argument -1 -> parameter 0 of argument 0 | true |
| System.Threading.Tasks.Task<>.ContinueWith(Action<Task<>>, CancellationToken, TaskContinuationOptions, TaskScheduler) | argument -1 -> parameter 0 of argument 0 | true |
| System.Threading.Tasks.Task<>.ContinueWith(Action<Task<>>, TaskContinuationOptions) | argument -1 -> parameter 0 of argument 0 | true |
| System.Threading.Tasks.Task<>.ContinueWith(Action<Task<>>, TaskScheduler) | argument -1 -> parameter 0 of argument 0 | true |
| System.Threading.Tasks.Task<>.ContinueWith(Action<Task<>>, TaskScheduler, CancellationToken, TaskContinuationOptions) | argument -1 -> parameter 0 of argument 0 | true |
| System.Threading.Tasks.Task<>.ContinueWith<TNewResult>(Func<Task<>, Object, TNewResult>, object) | argument 1 -> parameter 1 of argument 0 | true |
| System.Threading.Tasks.Task<>.ContinueWith<TNewResult>(Func<Task<>, Object, TNewResult>, object) | argument -1 -> parameter 0 of argument 0 | true |
| System.Threading.Tasks.Task<>.ContinueWith<TNewResult>(Func<Task<>, Object, TNewResult>, object) | return (normal) of argument 0 -> property Result of return (normal) | true |
@@ -2366,6 +2338,9 @@
| System.Threading.Tasks.Task<>.ContinueWith<TNewResult>(Func<Task<>, Object, TNewResult>, object, TaskScheduler) | argument 1 -> parameter 1 of argument 0 | true |
| System.Threading.Tasks.Task<>.ContinueWith<TNewResult>(Func<Task<>, Object, TNewResult>, object, TaskScheduler) | argument -1 -> parameter 0 of argument 0 | true |
| System.Threading.Tasks.Task<>.ContinueWith<TNewResult>(Func<Task<>, Object, TNewResult>, object, TaskScheduler) | return (normal) of argument 0 -> property Result of return (normal) | true |
| System.Threading.Tasks.Task<>.ContinueWith<TNewResult>(Func<Task<>, Object, TNewResult>, object, TaskScheduler, CancellationToken, TaskContinuationOptions) | argument 1 -> parameter 1 of argument 0 | true |
| System.Threading.Tasks.Task<>.ContinueWith<TNewResult>(Func<Task<>, Object, TNewResult>, object, TaskScheduler, CancellationToken, TaskContinuationOptions) | argument -1 -> parameter 0 of argument 0 | true |
| System.Threading.Tasks.Task<>.ContinueWith<TNewResult>(Func<Task<>, Object, TNewResult>, object, TaskScheduler, CancellationToken, TaskContinuationOptions) | return (normal) of argument 0 -> property Result of return (normal) | true |
| System.Threading.Tasks.Task<>.ContinueWith<TNewResult>(Func<Task<>, TNewResult>) | argument -1 -> parameter 0 of argument 0 | true |
| System.Threading.Tasks.Task<>.ContinueWith<TNewResult>(Func<Task<>, TNewResult>) | return (normal) of argument 0 -> property Result of return (normal) | true |
| System.Threading.Tasks.Task<>.ContinueWith<TNewResult>(Func<Task<>, TNewResult>, CancellationToken) | argument -1 -> parameter 0 of argument 0 | true |
@@ -2376,6 +2351,8 @@
| System.Threading.Tasks.Task<>.ContinueWith<TNewResult>(Func<Task<>, TNewResult>, TaskContinuationOptions) | return (normal) of argument 0 -> property Result of return (normal) | true |
| System.Threading.Tasks.Task<>.ContinueWith<TNewResult>(Func<Task<>, TNewResult>, TaskScheduler) | argument -1 -> parameter 0 of argument 0 | true |
| System.Threading.Tasks.Task<>.ContinueWith<TNewResult>(Func<Task<>, TNewResult>, TaskScheduler) | return (normal) of argument 0 -> property Result of return (normal) | true |
| System.Threading.Tasks.Task<>.ContinueWith<TNewResult>(Func<Task<>, TNewResult>, TaskScheduler, CancellationToken, TaskContinuationOptions) | argument -1 -> parameter 0 of argument 0 | true |
| System.Threading.Tasks.Task<>.ContinueWith<TNewResult>(Func<Task<>, TNewResult>, TaskScheduler, CancellationToken, TaskContinuationOptions) | return (normal) of argument 0 -> property Result of return (normal) | true |
| System.Threading.Tasks.Task<>.GetAwaiter() | argument -1 -> field m_task of return (normal) | true |
| System.Threading.Tasks.Task<>.Task(Func<Object, TResult>, object) | argument 1 -> parameter 0 of argument 0 | true |
| System.Threading.Tasks.Task<>.Task(Func<Object, TResult>, object) | return (normal) of argument 0 -> property Result of return (normal) | true |
@@ -2388,6 +2365,7 @@
| System.Threading.Tasks.Task<>.Task(Func<TResult>) | return (normal) of argument 0 -> property Result of return (normal) | true |
| System.Threading.Tasks.Task<>.Task(Func<TResult>, CancellationToken) | return (normal) of argument 0 -> property Result of return (normal) | true |
| System.Threading.Tasks.Task<>.Task(Func<TResult>, CancellationToken, TaskCreationOptions) | return (normal) of argument 0 -> property Result of return (normal) | true |
| System.Threading.Tasks.Task<>.Task(Func<TResult>, Task, CancellationToken, TaskCreationOptions, InternalTaskOptions, TaskScheduler) | return (normal) of argument 0 -> property Result of return (normal) | true |
| System.Threading.Tasks.Task<>.Task(Func<TResult>, TaskCreationOptions) | return (normal) of argument 0 -> property Result of return (normal) | true |
| System.Threading.Tasks.Task<>.get_Result() | argument -1 -> return (normal) | false |
| System.Threading.Tasks.TaskFactory.ContinueWhenAll<TAntecedentResult, TResult>(Task<TAntecedentResult>[], Func<Task, TResult>) | argument 0 -> parameter 0 of argument 1 | true |
@@ -2715,6 +2693,41 @@
| System.Uri.get_OriginalString() | argument -1 -> return (normal) | false |
| System.Uri.get_PathAndQuery() | argument -1 -> return (normal) | false |
| System.Uri.get_Query() | argument -1 -> return (normal) | false |
| System.ValueTuple.Create<T1, T2, T3, T4, T5, T6, T7, T8>(T1, T2, T3, T4, T5, T6, T7, T8) | argument 0 -> field Item1 of return (normal) | true |
| System.ValueTuple.Create<T1, T2, T3, T4, T5, T6, T7, T8>(T1, T2, T3, T4, T5, T6, T7, T8) | argument 1 -> field Item2 of return (normal) | true |
| System.ValueTuple.Create<T1, T2, T3, T4, T5, T6, T7, T8>(T1, T2, T3, T4, T5, T6, T7, T8) | argument 2 -> field Item3 of return (normal) | true |
| System.ValueTuple.Create<T1, T2, T3, T4, T5, T6, T7, T8>(T1, T2, T3, T4, T5, T6, T7, T8) | argument 3 -> field Item4 of return (normal) | true |
| System.ValueTuple.Create<T1, T2, T3, T4, T5, T6, T7, T8>(T1, T2, T3, T4, T5, T6, T7, T8) | argument 4 -> field Item5 of return (normal) | true |
| System.ValueTuple.Create<T1, T2, T3, T4, T5, T6, T7, T8>(T1, T2, T3, T4, T5, T6, T7, T8) | argument 5 -> field Item6 of return (normal) | true |
| System.ValueTuple.Create<T1, T2, T3, T4, T5, T6, T7, T8>(T1, T2, T3, T4, T5, T6, T7, T8) | argument 6 -> field Item7 of return (normal) | true |
| System.ValueTuple.Create<T1, T2, T3, T4, T5, T6, T7>(T1, T2, T3, T4, T5, T6, T7) | argument 0 -> field Item1 of return (normal) | true |
| System.ValueTuple.Create<T1, T2, T3, T4, T5, T6, T7>(T1, T2, T3, T4, T5, T6, T7) | argument 1 -> field Item2 of return (normal) | true |
| System.ValueTuple.Create<T1, T2, T3, T4, T5, T6, T7>(T1, T2, T3, T4, T5, T6, T7) | argument 2 -> field Item3 of return (normal) | true |
| System.ValueTuple.Create<T1, T2, T3, T4, T5, T6, T7>(T1, T2, T3, T4, T5, T6, T7) | argument 3 -> field Item4 of return (normal) | true |
| System.ValueTuple.Create<T1, T2, T3, T4, T5, T6, T7>(T1, T2, T3, T4, T5, T6, T7) | argument 4 -> field Item5 of return (normal) | true |
| System.ValueTuple.Create<T1, T2, T3, T4, T5, T6, T7>(T1, T2, T3, T4, T5, T6, T7) | argument 5 -> field Item6 of return (normal) | true |
| System.ValueTuple.Create<T1, T2, T3, T4, T5, T6, T7>(T1, T2, T3, T4, T5, T6, T7) | argument 6 -> field Item7 of return (normal) | true |
| System.ValueTuple.Create<T1, T2, T3, T4, T5, T6>(T1, T2, T3, T4, T5, T6) | argument 0 -> field Item1 of return (normal) | true |
| System.ValueTuple.Create<T1, T2, T3, T4, T5, T6>(T1, T2, T3, T4, T5, T6) | argument 1 -> field Item2 of return (normal) | true |
| System.ValueTuple.Create<T1, T2, T3, T4, T5, T6>(T1, T2, T3, T4, T5, T6) | argument 2 -> field Item3 of return (normal) | true |
| System.ValueTuple.Create<T1, T2, T3, T4, T5, T6>(T1, T2, T3, T4, T5, T6) | argument 3 -> field Item4 of return (normal) | true |
| System.ValueTuple.Create<T1, T2, T3, T4, T5, T6>(T1, T2, T3, T4, T5, T6) | argument 4 -> field Item5 of return (normal) | true |
| System.ValueTuple.Create<T1, T2, T3, T4, T5, T6>(T1, T2, T3, T4, T5, T6) | argument 5 -> field Item6 of return (normal) | true |
| System.ValueTuple.Create<T1, T2, T3, T4, T5>(T1, T2, T3, T4, T5) | argument 0 -> field Item1 of return (normal) | true |
| System.ValueTuple.Create<T1, T2, T3, T4, T5>(T1, T2, T3, T4, T5) | argument 1 -> field Item2 of return (normal) | true |
| System.ValueTuple.Create<T1, T2, T3, T4, T5>(T1, T2, T3, T4, T5) | argument 2 -> field Item3 of return (normal) | true |
| System.ValueTuple.Create<T1, T2, T3, T4, T5>(T1, T2, T3, T4, T5) | argument 3 -> field Item4 of return (normal) | true |
| System.ValueTuple.Create<T1, T2, T3, T4, T5>(T1, T2, T3, T4, T5) | argument 4 -> field Item5 of return (normal) | true |
| System.ValueTuple.Create<T1, T2, T3, T4>(T1, T2, T3, T4) | argument 0 -> field Item1 of return (normal) | true |
| System.ValueTuple.Create<T1, T2, T3, T4>(T1, T2, T3, T4) | argument 1 -> field Item2 of return (normal) | true |
| System.ValueTuple.Create<T1, T2, T3, T4>(T1, T2, T3, T4) | argument 2 -> field Item3 of return (normal) | true |
| System.ValueTuple.Create<T1, T2, T3, T4>(T1, T2, T3, T4) | argument 3 -> field Item4 of return (normal) | true |
| System.ValueTuple.Create<T1, T2, T3>(T1, T2, T3) | argument 0 -> field Item1 of return (normal) | true |
| System.ValueTuple.Create<T1, T2, T3>(T1, T2, T3) | argument 1 -> field Item2 of return (normal) | true |
| System.ValueTuple.Create<T1, T2, T3>(T1, T2, T3) | argument 2 -> field Item3 of return (normal) | true |
| System.ValueTuple.Create<T1, T2>(T1, T2) | argument 0 -> field Item1 of return (normal) | true |
| System.ValueTuple.Create<T1, T2>(T1, T2) | argument 1 -> field Item2 of return (normal) | true |
| System.ValueTuple.Create<T1>(T1) | argument 0 -> field Item1 of return (normal) | true |
| System.ValueTuple<,,,,,,,>.ValueTuple(T1, T2, T3, T4, T5, T6, T7, TRest) | argument 0 -> field Item1 of return (normal) | true |
| System.ValueTuple<,,,,,,,>.ValueTuple(T1, T2, T3, T4, T5, T6, T7, TRest) | argument 1 -> field Item2 of return (normal) | true |
| System.ValueTuple<,,,,,,,>.ValueTuple(T1, T2, T3, T4, T5, T6, T7, TRest) | argument 2 -> field Item3 of return (normal) | true |
@@ -2729,6 +2742,62 @@
| System.ValueTuple<,,,,,,,>.get_Item(int) | field Item5 of argument -1 -> return (normal) | true |
| System.ValueTuple<,,,,,,,>.get_Item(int) | field Item6 of argument -1 -> return (normal) | true |
| System.ValueTuple<,,,,,,,>.get_Item(int) | field Item7 of argument -1 -> return (normal) | true |
| System.ValueTuple<,,,,,,>.ValueTuple(T1, T2, T3, T4, T5, T6, T7) | argument 0 -> field Item1 of return (normal) | true |
| System.ValueTuple<,,,,,,>.ValueTuple(T1, T2, T3, T4, T5, T6, T7) | argument 1 -> field Item2 of return (normal) | true |
| System.ValueTuple<,,,,,,>.ValueTuple(T1, T2, T3, T4, T5, T6, T7) | argument 2 -> field Item3 of return (normal) | true |
| System.ValueTuple<,,,,,,>.ValueTuple(T1, T2, T3, T4, T5, T6, T7) | argument 3 -> field Item4 of return (normal) | true |
| System.ValueTuple<,,,,,,>.ValueTuple(T1, T2, T3, T4, T5, T6, T7) | argument 4 -> field Item5 of return (normal) | true |
| System.ValueTuple<,,,,,,>.ValueTuple(T1, T2, T3, T4, T5, T6, T7) | argument 5 -> field Item6 of return (normal) | true |
| System.ValueTuple<,,,,,,>.ValueTuple(T1, T2, T3, T4, T5, T6, T7) | argument 6 -> field Item7 of return (normal) | true |
| System.ValueTuple<,,,,,,>.get_Item(int) | field Item1 of argument -1 -> return (normal) | true |
| System.ValueTuple<,,,,,,>.get_Item(int) | field Item2 of argument -1 -> return (normal) | true |
| System.ValueTuple<,,,,,,>.get_Item(int) | field Item3 of argument -1 -> return (normal) | true |
| System.ValueTuple<,,,,,,>.get_Item(int) | field Item4 of argument -1 -> return (normal) | true |
| System.ValueTuple<,,,,,,>.get_Item(int) | field Item5 of argument -1 -> return (normal) | true |
| System.ValueTuple<,,,,,,>.get_Item(int) | field Item6 of argument -1 -> return (normal) | true |
| System.ValueTuple<,,,,,,>.get_Item(int) | field Item7 of argument -1 -> return (normal) | true |
| System.ValueTuple<,,,,,>.ValueTuple(T1, T2, T3, T4, T5, T6) | argument 0 -> field Item1 of return (normal) | true |
| System.ValueTuple<,,,,,>.ValueTuple(T1, T2, T3, T4, T5, T6) | argument 1 -> field Item2 of return (normal) | true |
| System.ValueTuple<,,,,,>.ValueTuple(T1, T2, T3, T4, T5, T6) | argument 2 -> field Item3 of return (normal) | true |
| System.ValueTuple<,,,,,>.ValueTuple(T1, T2, T3, T4, T5, T6) | argument 3 -> field Item4 of return (normal) | true |
| System.ValueTuple<,,,,,>.ValueTuple(T1, T2, T3, T4, T5, T6) | argument 4 -> field Item5 of return (normal) | true |
| System.ValueTuple<,,,,,>.ValueTuple(T1, T2, T3, T4, T5, T6) | argument 5 -> field Item6 of return (normal) | true |
| System.ValueTuple<,,,,,>.get_Item(int) | field Item1 of argument -1 -> return (normal) | true |
| System.ValueTuple<,,,,,>.get_Item(int) | field Item2 of argument -1 -> return (normal) | true |
| System.ValueTuple<,,,,,>.get_Item(int) | field Item3 of argument -1 -> return (normal) | true |
| System.ValueTuple<,,,,,>.get_Item(int) | field Item4 of argument -1 -> return (normal) | true |
| System.ValueTuple<,,,,,>.get_Item(int) | field Item5 of argument -1 -> return (normal) | true |
| System.ValueTuple<,,,,,>.get_Item(int) | field Item6 of argument -1 -> return (normal) | true |
| System.ValueTuple<,,,,>.ValueTuple(T1, T2, T3, T4, T5) | argument 0 -> field Item1 of return (normal) | true |
| System.ValueTuple<,,,,>.ValueTuple(T1, T2, T3, T4, T5) | argument 1 -> field Item2 of return (normal) | true |
| System.ValueTuple<,,,,>.ValueTuple(T1, T2, T3, T4, T5) | argument 2 -> field Item3 of return (normal) | true |
| System.ValueTuple<,,,,>.ValueTuple(T1, T2, T3, T4, T5) | argument 3 -> field Item4 of return (normal) | true |
| System.ValueTuple<,,,,>.ValueTuple(T1, T2, T3, T4, T5) | argument 4 -> field Item5 of return (normal) | true |
| System.ValueTuple<,,,,>.get_Item(int) | field Item1 of argument -1 -> return (normal) | true |
| System.ValueTuple<,,,,>.get_Item(int) | field Item2 of argument -1 -> return (normal) | true |
| System.ValueTuple<,,,,>.get_Item(int) | field Item3 of argument -1 -> return (normal) | true |
| System.ValueTuple<,,,,>.get_Item(int) | field Item4 of argument -1 -> return (normal) | true |
| System.ValueTuple<,,,,>.get_Item(int) | field Item5 of argument -1 -> return (normal) | true |
| System.ValueTuple<,,,>.ValueTuple(T1, T2, T3, T4) | argument 0 -> field Item1 of return (normal) | true |
| System.ValueTuple<,,,>.ValueTuple(T1, T2, T3, T4) | argument 1 -> field Item2 of return (normal) | true |
| System.ValueTuple<,,,>.ValueTuple(T1, T2, T3, T4) | argument 2 -> field Item3 of return (normal) | true |
| System.ValueTuple<,,,>.ValueTuple(T1, T2, T3, T4) | argument 3 -> field Item4 of return (normal) | true |
| System.ValueTuple<,,,>.get_Item(int) | field Item1 of argument -1 -> return (normal) | true |
| System.ValueTuple<,,,>.get_Item(int) | field Item2 of argument -1 -> return (normal) | true |
| System.ValueTuple<,,,>.get_Item(int) | field Item3 of argument -1 -> return (normal) | true |
| System.ValueTuple<,,,>.get_Item(int) | field Item4 of argument -1 -> return (normal) | true |
| System.ValueTuple<,,>.ValueTuple(T1, T2, T3) | argument 0 -> field Item1 of return (normal) | true |
| System.ValueTuple<,,>.ValueTuple(T1, T2, T3) | argument 1 -> field Item2 of return (normal) | true |
| System.ValueTuple<,,>.ValueTuple(T1, T2, T3) | argument 2 -> field Item3 of return (normal) | true |
| System.ValueTuple<,,>.get_Item(int) | field Item1 of argument -1 -> return (normal) | true |
| System.ValueTuple<,,>.get_Item(int) | field Item2 of argument -1 -> return (normal) | true |
| System.ValueTuple<,,>.get_Item(int) | field Item3 of argument -1 -> return (normal) | true |
| System.ValueTuple<,>.ValueTuple(T1, T2) | argument 0 -> field Item1 of return (normal) | true |
| System.ValueTuple<,>.ValueTuple(T1, T2) | argument 1 -> field Item2 of return (normal) | true |
| System.ValueTuple<,>.get_Item(int) | field Item1 of argument -1 -> return (normal) | true |
| System.ValueTuple<,>.get_Item(int) | field Item2 of argument -1 -> return (normal) | true |
| System.ValueTuple<>.ValueTuple(T1) | argument 0 -> field Item1 of return (normal) | true |
| System.ValueTuple<>.get_Item(int) | field Item1 of argument -1 -> return (normal) | true |
| System.Web.HttpCookie.get_Value() | argument -1 -> return (normal) | false |
| System.Web.HttpCookie.get_Values() | argument -1 -> return (normal) | false |
| System.Web.HttpServerUtility.UrlEncode(string) | argument 0 -> return (normal) | false |

42
csharp/ql/test/library-tests/extension-method-call/ExtensionMethodCalls.expected Normal file
View File

@@ -0,0 +1,42 @@
methodCallTargets
| methods.cs:14:60:14:73 | call to method Ext3 | methods.cs:14:28:14:34 | Ext3 | Ext3<T>(T, int) |
| methods.cs:16:60:16:74 | call to method Ext4 | methods.cs:16:28:16:34 | Ext4 | Ext4<T>(T, int) |
| methods.cs:23:13:23:22 | call to method Ext0 | methods.cs:8:28:8:34 | Ext0 | Ext0<int>(string, int) |
| methods.cs:24:13:24:27 | call to method Ext0 | methods.cs:8:28:8:34 | Ext0 | Ext0<int>(string, int) |
| methods.cs:25:13:25:30 | call to method Ext0 | methods.cs:8:28:8:34 | Ext0 | Ext0<double>(string, double) |
| methods.cs:26:13:26:33 | call to method Ext0 | methods.cs:8:28:8:34 | Ext0 | Ext0<object>(string, object) |
| methods.cs:27:13:27:34 | call to method Ext0 | methods.cs:8:28:8:34 | Ext0 | Ext0<int>(string, int) |
| methods.cs:28:13:28:39 | call to method Ext0 | methods.cs:8:28:8:34 | Ext0 | Ext0<int>(string, int) |
| methods.cs:29:13:29:42 | call to method Ext0 | methods.cs:8:28:8:34 | Ext0 | Ext0<double>(string, double) |
| methods.cs:30:13:30:45 | call to method Ext0 | methods.cs:8:28:8:34 | Ext0 | Ext0<object>(string, object) |
| methods.cs:32:13:32:22 | call to method Ext1 | methods.cs:10:28:10:31 | Ext1 | Ext1(string, int) |
| methods.cs:33:13:33:34 | call to method Ext1 | methods.cs:10:28:10:31 | Ext1 | Ext1(string, int) |
| methods.cs:35:13:35:21 | call to method Ext2 | methods.cs:12:28:12:34 | Ext2 | Ext2<int>(int, int) |
| methods.cs:36:13:36:26 | call to method Ext2 | methods.cs:12:28:12:34 | Ext2 | Ext2<int>(int, int) |
| methods.cs:37:13:37:22 | call to method Ext2 | methods.cs:12:28:12:34 | Ext2 | Ext2<string>(string, int) |
| methods.cs:38:13:38:30 | call to method Ext2 | methods.cs:12:28:12:34 | Ext2 | Ext2<string>(string, int) |
| methods.cs:39:13:39:30 | call to method Ext2 | methods.cs:12:28:12:34 | Ext2 | Ext2<object>(object, int) |
| methods.cs:40:13:40:33 | call to method Ext2 | methods.cs:12:28:12:34 | Ext2 | Ext2<int>(int, int) |
| methods.cs:41:13:41:38 | call to method Ext2 | methods.cs:12:28:12:34 | Ext2 | Ext2<int>(int, int) |
| methods.cs:42:13:42:34 | call to method Ext2 | methods.cs:12:28:12:34 | Ext2 | Ext2<string>(string, int) |
| methods.cs:43:13:43:42 | call to method Ext2 | methods.cs:12:28:12:34 | Ext2 | Ext2<string>(string, int) |
| methods.cs:44:13:44:42 | call to method Ext2 | methods.cs:12:28:12:34 | Ext2 | Ext2<object>(object, int) |
genericMethodCallTargets
| methods.cs:23:13:23:22 | call to method Ext0 | methods.cs:8:28:8:34 | Ext0 | Ext0<int>(string, int) | methods.cs:8:28:8:34 | Ext0 | Ext0<T>(string, T) |
| methods.cs:24:13:24:27 | call to method Ext0 | methods.cs:8:28:8:34 | Ext0 | Ext0<int>(string, int) | methods.cs:8:28:8:34 | Ext0 | Ext0<T>(string, T) |
| methods.cs:25:13:25:30 | call to method Ext0 | methods.cs:8:28:8:34 | Ext0 | Ext0<double>(string, double) | methods.cs:8:28:8:34 | Ext0 | Ext0<T>(string, T) |
| methods.cs:26:13:26:33 | call to method Ext0 | methods.cs:8:28:8:34 | Ext0 | Ext0<object>(string, object) | methods.cs:8:28:8:34 | Ext0 | Ext0<T>(string, T) |
| methods.cs:27:13:27:34 | call to method Ext0 | methods.cs:8:28:8:34 | Ext0 | Ext0<int>(string, int) | methods.cs:8:28:8:34 | Ext0 | Ext0<T>(string, T) |
| methods.cs:28:13:28:39 | call to method Ext0 | methods.cs:8:28:8:34 | Ext0 | Ext0<int>(string, int) | methods.cs:8:28:8:34 | Ext0 | Ext0<T>(string, T) |
| methods.cs:29:13:29:42 | call to method Ext0 | methods.cs:8:28:8:34 | Ext0 | Ext0<double>(string, double) | methods.cs:8:28:8:34 | Ext0 | Ext0<T>(string, T) |
| methods.cs:30:13:30:45 | call to method Ext0 | methods.cs:8:28:8:34 | Ext0 | Ext0<object>(string, object) | methods.cs:8:28:8:34 | Ext0 | Ext0<T>(string, T) |
| methods.cs:35:13:35:21 | call to method Ext2 | methods.cs:12:28:12:34 | Ext2 | Ext2<int>(int, int) | methods.cs:12:28:12:34 | Ext2 | Ext2<T>(T, int) |
| methods.cs:36:13:36:26 | call to method Ext2 | methods.cs:12:28:12:34 | Ext2 | Ext2<int>(int, int) | methods.cs:12:28:12:34 | Ext2 | Ext2<T>(T, int) |
| methods.cs:37:13:37:22 | call to method Ext2 | methods.cs:12:28:12:34 | Ext2 | Ext2<string>(string, int) | methods.cs:12:28:12:34 | Ext2 | Ext2<T>(T, int) |
| methods.cs:38:13:38:30 | call to method Ext2 | methods.cs:12:28:12:34 | Ext2 | Ext2<string>(string, int) | methods.cs:12:28:12:34 | Ext2 | Ext2<T>(T, int) |
| methods.cs:39:13:39:30 | call to method Ext2 | methods.cs:12:28:12:34 | Ext2 | Ext2<object>(object, int) | methods.cs:12:28:12:34 | Ext2 | Ext2<T>(T, int) |
| methods.cs:40:13:40:33 | call to method Ext2 | methods.cs:12:28:12:34 | Ext2 | Ext2<int>(int, int) | methods.cs:12:28:12:34 | Ext2 | Ext2<T>(T, int) |
| methods.cs:41:13:41:38 | call to method Ext2 | methods.cs:12:28:12:34 | Ext2 | Ext2<int>(int, int) | methods.cs:12:28:12:34 | Ext2 | Ext2<T>(T, int) |
| methods.cs:42:13:42:34 | call to method Ext2 | methods.cs:12:28:12:34 | Ext2 | Ext2<string>(string, int) | methods.cs:12:28:12:34 | Ext2 | Ext2<T>(T, int) |
| methods.cs:43:13:43:42 | call to method Ext2 | methods.cs:12:28:12:34 | Ext2 | Ext2<string>(string, int) | methods.cs:12:28:12:34 | Ext2 | Ext2<T>(T, int) |
| methods.cs:44:13:44:42 | call to method Ext2 | methods.cs:12:28:12:34 | Ext2 | Ext2<object>(object, int) | methods.cs:12:28:12:34 | Ext2 | Ext2<T>(T, int) |

14
csharp/ql/test/library-tests/extension-method-call/ExtensionMethodCalls.ql Normal file
View File

@@ -0,0 +1,14 @@
import csharp
query predicate methodCallTargets(MethodCall mc, Method m, string sig) {
m = mc.getTarget() and sig = m.toStringWithTypes()
}
query predicate genericMethodCallTargets(
MethodCall mc, ConstructedMethod cm, string sig1, UnboundGenericMethod ugm, string sig2
) {
cm = mc.getTarget() and
sig1 = cm.toStringWithTypes() and
ugm = cm.getUnboundGeneric() and
sig2 = ugm.toStringWithTypes()
}

47
csharp/ql/test/library-tests/extension-method-call/methods.cs Normal file
View File

@@ -0,0 +1,47 @@
using System;
namespace Test
{
public static class Extensions
{
public static void Ext0<T>(this string self, T arg) { }
public static void Ext1(this string self, int arg) { }
public static void Ext2<T>(this T self, int arg) { }
public static void Ext3<T>(this T self, int arg) { self.Ext3(arg); }
public static void Ext4<T>(this T self, int arg) { Ext4(self, arg); }
}
public class Program
{
public static void M()
{
"".Ext0(1);
"".Ext0<int>(1);
"".Ext0<double>(1);
"".Ext0<object>(null);
Extensions.Ext0("", 1);
Extensions.Ext0<int>("", 1);
Extensions.Ext0<double>("", 1);
Extensions.Ext0<object>("", null);
"".Ext1(1);
Extensions.Ext1("", 1);
1.Ext2(1);
1.Ext2<int>(1);
"".Ext2(1);
"".Ext2<string>(1);
"".Ext2<object>(1);
Extensions.Ext2(1, 1);
Extensions.Ext2<int>(1, 1);
Extensions.Ext2("", 1);
Extensions.Ext2<string>("", 1);
Extensions.Ext2<object>("", 1);
}
}
}

24
csharp/ql/test/library-tests/methods/ExtensionMethods.expected
View File

@@ -1,12 +1,12 @@
| methods.cs:118:44:118:55 | call to method ToInt32 | 0 | methods.cs:118:52:118:54 | "0" |
| methods.cs:127:34:127:52 | call to method Slice | 0 | methods.cs:127:34:127:40 | access to local variable strings |
| methods.cs:127:34:127:52 | call to method Slice | 1 | methods.cs:127:48:127:48 | 1 |
| methods.cs:127:34:127:52 | call to method Slice | 2 | methods.cs:127:51:127:51 | 2 |
| methods.cs:129:42:129:52 | call to method ToInt32 | 0 | methods.cs:129:42:129:42 | access to local variable s |
| methods.cs:132:13:132:34 | call to method ToInt32 | 0 | methods.cs:132:32:132:33 | "" |
| methods.cs:132:13:132:34 | call to method ToInt32 | -1 | methods.cs:132:13:132:22 | access to type Extensions |
| methods.cs:134:13:134:49 | call to method ToBool | 0 | methods.cs:134:31:134:36 | "true" |
| methods.cs:134:13:134:49 | call to method ToBool | 1 | methods.cs:134:39:134:48 | delegate creation of type Func<String,Boolean> |
| methods.cs:134:13:134:49 | call to method ToBool | -1 | methods.cs:134:13:134:22 | access to type Extensions |
| methods.cs:180:20:180:39 | call to method SkipTwo | 0 | methods.cs:180:20:180:23 | access to parameter list |
| methods.cs:180:20:180:39 | call to method SkipTwo | 1 | methods.cs:180:38:180:38 | access to parameter i |
| methods.cs:119:44:119:55 | call to method ToInt32 | 0 | methods.cs:119:52:119:54 | "0" |
| methods.cs:128:34:128:52 | call to method Slice | 0 | methods.cs:128:34:128:40 | access to local variable strings |
| methods.cs:128:34:128:52 | call to method Slice | 1 | methods.cs:128:48:128:48 | 1 |
| methods.cs:128:34:128:52 | call to method Slice | 2 | methods.cs:128:51:128:51 | 2 |
| methods.cs:130:42:130:52 | call to method ToInt32 | 0 | methods.cs:130:42:130:42 | access to local variable s |
| methods.cs:133:13:133:34 | call to method ToInt32 | 0 | methods.cs:133:32:133:33 | "" |
| methods.cs:133:13:133:34 | call to method ToInt32 | -1 | methods.cs:133:13:133:22 | access to type Extensions |
| methods.cs:135:13:135:49 | call to method ToBool | 0 | methods.cs:135:31:135:36 | "true" |
| methods.cs:135:13:135:49 | call to method ToBool | 1 | methods.cs:135:39:135:48 | delegate creation of type Func<String,Boolean> |
| methods.cs:135:13:135:49 | call to method ToBool | -1 | methods.cs:135:13:135:22 | access to type Extensions |
| methods.cs:181:20:181:39 | call to method SkipTwo | 0 | methods.cs:181:20:181:23 | access to parameter list |
| methods.cs:181:20:181:39 | call to method SkipTwo | 1 | methods.cs:181:38:181:38 | access to parameter i |

2
csharp/ql/test/library-tests/methods/Methods1.expected
View File

@@ -1 +1 @@
| methods.cs:9:21:9:24 | Swap |
| methods.cs:10:21:10:24 | Swap |

3
csharp/ql/test/library-tests/methods/Methods1.ql
View File

@@ -7,5 +7,6 @@ import csharp
from Method s
where
s.hasName("Swap") and
s.isStatic()
s.isStatic() and
s.fromSource()
select s

2
csharp/ql/test/library-tests/methods/Methods2.expected
View File

@@ -1 +1 @@
| methods.cs:28:28:28:33 | Divide |
| methods.cs:29:28:29:33 | Divide |

2
csharp/ql/test/library-tests/methods/Methods3.expected
View File

@@ -1 +1 @@
| methods.cs:49:11:49:25 | TestOverloading |
| methods.cs:50:11:50:25 | TestOverloading |

2
csharp/ql/test/library-tests/methods/Methods4.expected
View File

@@ -1 +1 @@
| methods.cs:49:11:49:25 | TestOverloading | methods.cs:57:21:57:21 | F | Object |
| methods.cs:50:11:50:25 | TestOverloading | methods.cs:58:21:58:21 | F | Object |

50
csharp/ql/test/library-tests/methods/Methods5.expected
View File

@@ -1,22 +1,28 @@
| methods.cs:16:14:16:17 | Main | methods.cs:9:21:9:24 | Swap | methods.cs:6:18:6:24 | TestRef |
| methods.cs:16:14:16:17 | Main | methods.cs:46:28:46:36 | WriteLine | methods.cs:6:18:6:24 | TestRef |
| methods.cs:34:14:34:17 | Main | methods.cs:28:28:28:33 | Divide | methods.cs:25:18:25:24 | TestOut |
| methods.cs:34:14:34:17 | Main | methods.cs:46:28:46:36 | WriteLine | methods.cs:25:18:25:24 | TestOut |
| methods.cs:52:21:52:21 | F | methods.cs:46:28:46:36 | WriteLine | methods.cs:49:11:49:25 | TestOverloading |
| methods.cs:57:21:57:21 | F | methods.cs:46:28:46:36 | WriteLine | methods.cs:49:11:49:25 | TestOverloading |
| methods.cs:62:21:62:21 | F | methods.cs:46:28:46:36 | WriteLine | methods.cs:49:11:49:25 | TestOverloading |
| methods.cs:67:21:67:21 | F | methods.cs:46:28:46:36 | WriteLine | methods.cs:49:11:49:25 | TestOverloading |
| methods.cs:72:21:72:24 | F | methods.cs:46:28:46:36 | WriteLine | methods.cs:49:11:49:25 | TestOverloading |
| methods.cs:77:21:77:21 | F | methods.cs:46:28:46:36 | WriteLine | methods.cs:49:11:49:25 | TestOverloading |
| methods.cs:82:14:82:17 | Main | methods.cs:52:21:52:21 | F | methods.cs:49:11:49:25 | TestOverloading |
| methods.cs:82:14:82:17 | Main | methods.cs:57:21:57:21 | F | methods.cs:49:11:49:25 | TestOverloading |
| methods.cs:82:14:82:17 | Main | methods.cs:62:21:62:21 | F | methods.cs:49:11:49:25 | TestOverloading |
| methods.cs:82:14:82:17 | Main | methods.cs:67:21:67:21 | F | methods.cs:49:11:49:25 | TestOverloading |
| methods.cs:82:14:82:17 | Main | methods.cs:72:21:72:24 | F | methods.cs:49:11:49:25 | TestOverloading |
| methods.cs:82:14:82:17 | Main | methods.cs:72:21:72:24 | F | methods.cs:49:11:49:25 | TestOverloading |
| methods.cs:82:14:82:17 | Main | methods.cs:77:21:77:21 | F | methods.cs:49:11:49:25 | TestOverloading |
| methods.cs:118:27:118:37 | CallToInt32 | methods.cs:99:27:99:33 | ToInt32 | methods.cs:96:25:96:34 | Extensions |
| methods.cs:124:21:124:24 | Main | methods.cs:99:27:99:33 | ToInt32 | methods.cs:121:18:121:31 | TestExtensions |
| methods.cs:124:21:124:24 | Main | methods.cs:104:28:104:33 | ToBool | methods.cs:121:18:121:31 | TestExtensions |
| methods.cs:124:21:124:24 | Main | methods.cs:109:27:109:34 | Slice | methods.cs:121:18:121:31 | TestExtensions |
| methods.cs:178:67:178:76 | SkipTwoInt | methods.cs:173:65:173:74 | SkipTwo | methods.cs:166:18:166:47 | TestDefaultExtensionParameters |
| methods.cs:17:14:17:17 | Main | methods.cs:10:21:10:24 | Swap | methods.cs:7:18:7:24 | TestRef |
| methods.cs:17:14:17:17 | Main | methods.cs:47:28:47:36 | WriteLine | methods.cs:7:18:7:24 | TestRef |
| methods.cs:35:14:35:17 | Main | methods.cs:29:28:29:33 | Divide | methods.cs:26:18:26:24 | TestOut |
| methods.cs:35:14:35:17 | Main | methods.cs:47:28:47:36 | WriteLine | methods.cs:26:18:26:24 | TestOut |
| methods.cs:53:21:53:21 | F | methods.cs:47:28:47:36 | WriteLine | methods.cs:50:11:50:25 | TestOverloading |
| methods.cs:58:21:58:21 | F | methods.cs:47:28:47:36 | WriteLine | methods.cs:50:11:50:25 | TestOverloading |
| methods.cs:63:21:63:21 | F | methods.cs:47:28:47:36 | WriteLine | methods.cs:50:11:50:25 | TestOverloading |
| methods.cs:68:21:68:21 | F | methods.cs:47:28:47:36 | WriteLine | methods.cs:50:11:50:25 | TestOverloading |
| methods.cs:73:21:73:24 | F | methods.cs:47:28:47:36 | WriteLine | methods.cs:50:11:50:25 | TestOverloading |
| methods.cs:78:21:78:21 | F | methods.cs:47:28:47:36 | WriteLine | methods.cs:50:11:50:25 | TestOverloading |
| methods.cs:83:14:83:17 | Main | methods.cs:53:21:53:21 | F | methods.cs:50:11:50:25 | TestOverloading |
| methods.cs:83:14:83:17 | Main | methods.cs:58:21:58:21 | F | methods.cs:50:11:50:25 | TestOverloading |
| methods.cs:83:14:83:17 | Main | methods.cs:63:21:63:21 | F | methods.cs:50:11:50:25 | TestOverloading |
| methods.cs:83:14:83:17 | Main | methods.cs:68:21:68:21 | F | methods.cs:50:11:50:25 | TestOverloading |
| methods.cs:83:14:83:17 | Main | methods.cs:73:21:73:24 | F | methods.cs:50:11:50:25 | TestOverloading |
| methods.cs:83:14:83:17 | Main | methods.cs:73:21:73:24 | F | methods.cs:50:11:50:25 | TestOverloading |
| methods.cs:83:14:83:17 | Main | methods.cs:78:21:78:21 | F | methods.cs:50:11:50:25 | TestOverloading |
| methods.cs:119:27:119:37 | CallToInt32 | methods.cs:100:27:100:33 | ToInt32 | methods.cs:97:25:97:34 | Extensions |
| methods.cs:125:21:125:24 | Main | methods.cs:100:27:100:33 | ToInt32 | methods.cs:122:18:122:31 | TestExtensions |
| methods.cs:125:21:125:24 | Main | methods.cs:105:28:105:33 | ToBool | methods.cs:122:18:122:31 | TestExtensions |
| methods.cs:125:21:125:24 | Main | methods.cs:110:27:110:34 | Slice | methods.cs:122:18:122:31 | TestExtensions |
| methods.cs:179:67:179:76 | SkipTwoInt | methods.cs:174:65:174:74 | SkipTwo | methods.cs:167:18:167:47 | TestDefaultExtensionParameters |
| methods.cs:190:21:190:25 | Calls | methods.cs:187:21:187:21 | M | methods.cs:185:18:185:40 | TestCollidingMethods<> |
| methods.cs:190:21:190:25 | Calls | methods.cs:188:21:188:21 | M | methods.cs:185:18:185:40 | TestCollidingMethods<> |
| methods.cs:190:21:190:25 | Calls | methods.cs:188:21:188:21 | M | methods.cs:185:18:185:40 | TestCollidingMethods<> |
| methods.cs:203:20:203:25 | Nested | methods.cs:202:20:202:25 | Nested | methods.cs:200:22:200:27 | Nested |
| methods.cs:203:20:203:25 | Nested | methods.cs:202:20:202:25 | Nested | methods.cs:200:22:200:27 | Nested |
| methods.cs:203:20:203:25 | Nested | methods.cs:203:20:203:25 | Nested | methods.cs:200:22:200:27 | Nested |

4
csharp/ql/test/library-tests/methods/Parameters1.expected
View File

@@ -1,2 +1,2 @@
| methods.cs:9:21:9:24 | Swap | methods.cs:9:34:9:34 | x |
| methods.cs:9:21:9:24 | Swap | methods.cs:9:45:9:45 | y |
| methods.cs:10:21:10:24 | Swap | methods.cs:10:34:10:34 | x |
| methods.cs:10:21:10:24 | Swap | methods.cs:10:45:10:45 | y |

8
csharp/ql/test/library-tests/methods/Parameters2.expected
View File

@@ -1,4 +1,4 @@
| methods.cs:28:28:28:33 | Divide | methods.cs:28:39:28:39 | x |
| methods.cs:28:28:28:33 | Divide | methods.cs:28:46:28:46 | y |
| methods.cs:28:28:28:33 | Divide | methods.cs:28:57:28:62 | result |
| methods.cs:28:28:28:33 | Divide | methods.cs:28:73:28:81 | remainder |
| methods.cs:29:28:29:33 | Divide | methods.cs:29:39:29:39 | x |
| methods.cs:29:28:29:33 | Divide | methods.cs:29:46:29:46 | y |
| methods.cs:29:28:29:33 | Divide | methods.cs:29:57:29:62 | result |
| methods.cs:29:28:29:33 | Divide | methods.cs:29:73:29:81 | remainder |

4
csharp/ql/test/library-tests/methods/Parameters3.expected
View File

@@ -1,2 +1,2 @@
| methods.cs:45:28:45:32 | Write | Object[] |
| methods.cs:45:28:45:32 | Write | String |
| methods.cs:46:28:46:32 | Write | Object[] |
| methods.cs:46:28:46:32 | Write | String |

14
csharp/ql/test/library-tests/methods/Parameters5.expected
View File

@@ -1,7 +1,7 @@
| methods.cs:145:40:145:40 | c | methods.cs:145:44:145:44 | 1 | 1 |
| methods.cs:145:51:145:51 | d | methods.cs:145:55:145:55 | 2 | 2 |
| methods.cs:145:65:145:65 | e | methods.cs:145:69:145:77 | ... + ... | ab |
| methods.cs:153:45:153:45 | x | methods.cs:153:49:153:53 | "abc" | abc |
| methods.cs:153:63:153:63 | y | methods.cs:153:67:153:78 | object creation of type Double | 0 |
| methods.cs:159:36:159:36 | y | methods.cs:159:40:159:40 | 0 | 0 |
| methods.cs:159:36:159:36 | y | methods.cs:159:40:159:40 | 0 | 0 |
| methods.cs:146:40:146:40 | c | methods.cs:146:44:146:44 | 1 | 1 |
| methods.cs:146:51:146:51 | d | methods.cs:146:55:146:55 | 2 | 2 |
| methods.cs:146:65:146:65 | e | methods.cs:146:69:146:77 | ... + ... | ab |
| methods.cs:154:45:154:45 | x | methods.cs:154:49:154:53 | "abc" | abc |
| methods.cs:154:63:154:63 | y | methods.cs:154:67:154:78 | object creation of type Double | 0 |
| methods.cs:160:36:160:36 | y | methods.cs:160:40:160:40 | 0 | 0 |
| methods.cs:160:36:160:36 | y | methods.cs:160:40:160:40 | 0 | 0 |

4
csharp/ql/test/library-tests/methods/Parameters6.expected
View File

@@ -1,2 +1,2 @@
| methods.cs:157:40:157:40 | b | methods.cs:157:44:157:45 | 12 | 12 |
| methods.cs:157:55:157:55 | c | methods.cs:157:59:157:70 | object creation of type Double | 0 |
| methods.cs:158:40:158:40 | b | methods.cs:158:44:158:45 | 12 | 12 |
| methods.cs:158:55:158:55 | c | methods.cs:158:59:158:70 | object creation of type Double | 0 |

2
csharp/ql/test/library-tests/methods/Parameters7.expected
View File

@@ -1 +1 @@
| methods.cs:162:13:162:15 | value |
| methods.cs:163:13:163:15 | value |

97
csharp/ql/test/library-tests/methods/Parameters8.expected
View File

@@ -1,43 +1,54 @@
| methods.cs:9:21:9:24 | Swap | methods.cs:9:34:9:34 | x |
| methods.cs:9:21:9:24 | Swap | methods.cs:9:45:9:45 | y |
| methods.cs:28:28:28:33 | Divide | methods.cs:28:39:28:39 | x |
| methods.cs:28:28:28:33 | Divide | methods.cs:28:46:28:46 | y |
| methods.cs:28:28:28:33 | Divide | methods.cs:28:57:28:62 | result |
| methods.cs:28:28:28:33 | Divide | methods.cs:28:73:28:81 | remainder |
| methods.cs:45:28:45:32 | Write | methods.cs:45:41:45:43 | fmt |
| methods.cs:45:28:45:32 | Write | methods.cs:45:62:45:65 | args |
| methods.cs:46:28:46:36 | WriteLine | methods.cs:46:45:46:47 | fmt |
| methods.cs:46:28:46:36 | WriteLine | methods.cs:46:66:46:69 | args |
| methods.cs:57:21:57:21 | F | methods.cs:57:30:57:30 | x |
| methods.cs:62:21:62:21 | F | methods.cs:62:27:62:27 | x |
| methods.cs:67:21:67:21 | F | methods.cs:67:30:67:30 | x |
| methods.cs:72:21:72:24 | F | methods.cs:72:28:72:28 | x |
| methods.cs:72:21:72:24 | F | methods.cs:72:28:72:28 | x |
| methods.cs:72:21:72:24 | F | methods.cs:72:28:72:28 | x |
| methods.cs:77:21:77:21 | F | methods.cs:77:30:77:30 | x |
| methods.cs:77:21:77:21 | F | methods.cs:77:40:77:40 | y |
| methods.cs:99:27:99:33 | ToInt32 | methods.cs:99:35:99:47 | s |
| methods.cs:99:27:99:33 | ToInt32 | methods.cs:99:47:99:47 | s |
| methods.cs:104:28:104:33 | ToBool | methods.cs:104:47:104:47 | s |
| methods.cs:104:28:104:33 | ToBool | methods.cs:104:69:104:69 | f |
| methods.cs:109:27:109:34 | Slice | methods.cs:109:36:109:50 | source |
| methods.cs:109:27:109:34 | Slice | methods.cs:109:45:109:50 | source |
| methods.cs:109:27:109:34 | Slice | methods.cs:109:57:109:61 | index |
| methods.cs:109:27:109:34 | Slice | methods.cs:109:57:109:61 | index |
| methods.cs:109:27:109:34 | Slice | methods.cs:109:68:109:72 | count |
| methods.cs:109:27:109:34 | Slice | methods.cs:109:68:109:72 | count |
| methods.cs:141:14:141:20 | Method1 | methods.cs:141:26:141:26 | x |
| methods.cs:141:14:141:20 | Method1 | methods.cs:141:33:141:33 | y |
| methods.cs:145:14:145:20 | Method2 | methods.cs:145:26:145:26 | a |
| methods.cs:145:14:145:20 | Method2 | methods.cs:145:33:145:33 | b |
| methods.cs:145:14:145:20 | Method2 | methods.cs:145:40:145:40 | c |
| methods.cs:145:14:145:20 | Method2 | methods.cs:145:51:145:51 | d |
| methods.cs:145:14:145:20 | Method2 | methods.cs:145:65:145:65 | e |
| methods.cs:168:27:168:30 | Plus | methods.cs:168:41:168:44 | left |
| methods.cs:168:27:168:30 | Plus | methods.cs:168:51:168:55 | right |
| methods.cs:173:65:173:74 | SkipTwo | methods.cs:173:76:173:126 | list |
| methods.cs:173:65:173:74 | SkipTwo | methods.cs:173:123:173:126 | list |
| methods.cs:173:65:173:74 | SkipTwo | methods.cs:173:133:173:133 | i |
| methods.cs:173:65:173:74 | SkipTwo | methods.cs:173:133:173:133 | i |
| methods.cs:178:67:178:76 | SkipTwoInt | methods.cs:178:127:178:130 | list |
| methods.cs:178:67:178:76 | SkipTwoInt | methods.cs:178:137:178:137 | i |
| methods.cs:10:21:10:24 | Swap | methods.cs:10:34:10:34 | x |
| methods.cs:10:21:10:24 | Swap | methods.cs:10:45:10:45 | y |
| methods.cs:29:28:29:33 | Divide | methods.cs:29:39:29:39 | x |
| methods.cs:29:28:29:33 | Divide | methods.cs:29:46:29:46 | y |
| methods.cs:29:28:29:33 | Divide | methods.cs:29:57:29:62 | result |
| methods.cs:29:28:29:33 | Divide | methods.cs:29:73:29:81 | remainder |
| methods.cs:46:28:46:32 | Write | methods.cs:46:41:46:43 | fmt |
| methods.cs:46:28:46:32 | Write | methods.cs:46:62:46:65 | args |
| methods.cs:47:28:47:36 | WriteLine | methods.cs:47:45:47:47 | fmt |
| methods.cs:47:28:47:36 | WriteLine | methods.cs:47:66:47:69 | args |
| methods.cs:58:21:58:21 | F | methods.cs:58:30:58:30 | x |
| methods.cs:63:21:63:21 | F | methods.cs:63:27:63:27 | x |
| methods.cs:68:21:68:21 | F | methods.cs:68:30:68:30 | x |
| methods.cs:73:21:73:24 | F | methods.cs:73:28:73:28 | x |
| methods.cs:73:21:73:24 | F | methods.cs:73:28:73:28 | x |
| methods.cs:73:21:73:24 | F | methods.cs:73:28:73:28 | x |
| methods.cs:78:21:78:21 | F | methods.cs:78:30:78:30 | x |
| methods.cs:78:21:78:21 | F | methods.cs:78:40:78:40 | y |
| methods.cs:100:27:100:33 | ToInt32 | methods.cs:100:47:100:47 | s |
| methods.cs:105:28:105:33 | ToBool | methods.cs:105:47:105:47 | s |
| methods.cs:105:28:105:33 | ToBool | methods.cs:105:69:105:69 | f |
| methods.cs:110:27:110:34 | Slice | methods.cs:110:45:110:50 | source |
| methods.cs:110:27:110:34 | Slice | methods.cs:110:45:110:50 | source |
| methods.cs:110:27:110:34 | Slice | methods.cs:110:57:110:61 | index |
| methods.cs:110:27:110:34 | Slice | methods.cs:110:57:110:61 | index |
| methods.cs:110:27:110:34 | Slice | methods.cs:110:68:110:72 | count |
| methods.cs:110:27:110:34 | Slice | methods.cs:110:68:110:72 | count |
| methods.cs:142:14:142:20 | Method1 | methods.cs:142:26:142:26 | x |
| methods.cs:142:14:142:20 | Method1 | methods.cs:142:33:142:33 | y |
| methods.cs:146:14:146:20 | Method2 | methods.cs:146:26:146:26 | a |
| methods.cs:146:14:146:20 | Method2 | methods.cs:146:33:146:33 | b |
| methods.cs:146:14:146:20 | Method2 | methods.cs:146:40:146:40 | c |
| methods.cs:146:14:146:20 | Method2 | methods.cs:146:51:146:51 | d |
| methods.cs:146:14:146:20 | Method2 | methods.cs:146:65:146:65 | e |
| methods.cs:169:27:169:30 | Plus | methods.cs:169:41:169:44 | left |
| methods.cs:169:27:169:30 | Plus | methods.cs:169:51:169:55 | right |
| methods.cs:174:65:174:74 | SkipTwo | methods.cs:174:123:174:126 | list |
| methods.cs:174:65:174:74 | SkipTwo | methods.cs:174:123:174:126 | list |
| methods.cs:174:65:174:74 | SkipTwo | methods.cs:174:133:174:133 | i |
| methods.cs:174:65:174:74 | SkipTwo | methods.cs:174:133:174:133 | i |
| methods.cs:179:67:179:76 | SkipTwoInt | methods.cs:179:127:179:130 | list |
| methods.cs:179:67:179:76 | SkipTwoInt | methods.cs:179:137:179:137 | i |
| methods.cs:187:21:187:21 | M | methods.cs:187:25:187:26 | p1 |
| methods.cs:187:21:187:21 | M | methods.cs:187:25:187:26 | p1 |
| methods.cs:187:21:187:21 | M | methods.cs:187:25:187:26 | p1 |
| methods.cs:187:21:187:21 | M | methods.cs:187:33:187:34 | p2 |
| methods.cs:187:21:187:21 | M | methods.cs:187:33:187:34 | p2 |
| methods.cs:187:21:187:21 | M | methods.cs:187:33:187:34 | p2 |
| methods.cs:188:21:188:21 | M | methods.cs:188:27:188:28 | p1 |
| methods.cs:188:21:188:21 | M | methods.cs:188:27:188:28 | p1 |
| methods.cs:188:21:188:21 | M | methods.cs:188:27:188:28 | p1 |
| methods.cs:188:21:188:21 | M | methods.cs:188:35:188:36 | p2 |
| methods.cs:188:21:188:21 | M | methods.cs:188:35:188:36 | p2 |
| methods.cs:188:21:188:21 | M | methods.cs:188:35:188:36 | p2 |

14
csharp/ql/test/library-tests/methods/Parameters9.expected
View File

@@ -1,7 +1,7 @@
| methods.cs:145:40:145:40 | c | methods.cs:145:44:145:44 | 1 | Method2(int, int, int, int, string) |
| methods.cs:145:51:145:51 | d | methods.cs:145:55:145:55 | 2 | Method2(int, int, int, int, string) |
| methods.cs:145:65:145:65 | e | methods.cs:145:69:145:77 | ... + ... | Method2(int, int, int, int, string) |
| methods.cs:168:51:168:55 | right | methods.cs:168:59:168:59 | 0 | Plus(int, int) |
| methods.cs:173:133:173:133 | i | methods.cs:173:137:173:137 | 1 | SkipTwo<T>(IEnumerable<T>, int) |
| methods.cs:173:133:173:133 | i | methods.cs:173:137:173:137 | 1 | SkipTwo<int>(IEnumerable<Int32>, int) |
| methods.cs:178:137:178:137 | i | methods.cs:178:141:178:141 | 1 | SkipTwoInt(IEnumerable<Int32>, int) |
| methods.cs:146:40:146:40 | c | methods.cs:146:44:146:44 | 1 | Method2(int, int, int, int, string) |
| methods.cs:146:51:146:51 | d | methods.cs:146:55:146:55 | 2 | Method2(int, int, int, int, string) |
| methods.cs:146:65:146:65 | e | methods.cs:146:69:146:77 | ... + ... | Method2(int, int, int, int, string) |
| methods.cs:169:51:169:55 | right | methods.cs:169:59:169:59 | 0 | Plus(int, int) |
| methods.cs:174:133:174:133 | i | methods.cs:174:137:174:137 | 1 | SkipTwo<T>(IEnumerable<T>, int) |
| methods.cs:174:133:174:133 | i | methods.cs:174:137:174:137 | 1 | SkipTwo<int>(IEnumerable<Int32>, int) |
| methods.cs:179:137:179:137 | i | methods.cs:179:141:179:141 | 1 | SkipTwoInt(IEnumerable<Int32>, int) |

931
csharp/ql/test/library-tests/methods/PrintAst.expected
View File

@@ -1,53 +1,44 @@
methods.cs:
# 3| [NamespaceDeclaration] namespace ... { ... }
# 6| 1: [Class] TestRef
# 9| 5: [Method] Swap
# 9| -1: [TypeMention] Void
# 4| [NamespaceDeclaration] namespace ... { ... }
# 7| 1: [Class] TestRef
# 10| 5: [Method] Swap
# 10| -1: [TypeMention] Void
#-----| 2: (Parameters)
# 9| 0: [Parameter] x
# 9| -1: [TypeMention] int
# 9| 1: [Parameter] y
# 9| -1: [TypeMention] int
# 10| 4: [BlockStmt] {...}
# 11| 0: [LocalVariableDeclStmt] ... ...;
# 11| 0: [LocalVariableDeclAndInitExpr] Int32 temp = ...
# 11| -1: [TypeMention] int
# 11| 0: [LocalVariableAccess] access to local variable temp
# 11| 1: [ParameterAccess] access to parameter x
# 12| 1: [ExprStmt] ...;
# 12| 0: [AssignExpr] ... = ...
# 12| 0: [ParameterAccess] access to parameter x
# 12| 1: [ParameterAccess] access to parameter y
# 13| 2: [ExprStmt] ...;
# 10| 0: [Parameter] x
# 10| -1: [TypeMention] int
# 10| 1: [Parameter] y
# 10| -1: [TypeMention] int
# 11| 4: [BlockStmt] {...}
# 12| 0: [LocalVariableDeclStmt] ... ...;
# 12| 0: [LocalVariableDeclAndInitExpr] Int32 temp = ...
# 12| -1: [TypeMention] int
# 12| 0: [LocalVariableAccess] access to local variable temp
# 12| 1: [ParameterAccess] access to parameter x
# 13| 1: [ExprStmt] ...;
# 13| 0: [AssignExpr] ... = ...
# 13| 0: [ParameterAccess] access to parameter y
# 13| 1: [LocalVariableAccess] access to local variable temp
# 16| 6: [Method] Main
# 16| -1: [TypeMention] Void
# 17| 4: [BlockStmt] {...}
# 18| 0: [LocalVariableDeclStmt] ... ...;
# 18| 0: [LocalVariableDeclAndInitExpr] Int32 i = ...
# 18| -1: [TypeMention] int
# 18| 0: [LocalVariableAccess] access to local variable i
# 18| 1: [IntLiteral] 1
# 18| 1: [LocalVariableDeclAndInitExpr] Int32 j = ...
# 18| -1: [TypeMention] int
# 18| 0: [LocalVariableAccess] access to local variable j
# 18| 1: [IntLiteral] 2
# 19| 1: [ExprStmt] ...;
# 19| 0: [MethodCall] call to method Swap
# 13| 0: [ParameterAccess] access to parameter x
# 13| 1: [ParameterAccess] access to parameter y
# 14| 2: [ExprStmt] ...;
# 14| 0: [AssignExpr] ... = ...
# 14| 0: [ParameterAccess] access to parameter y
# 14| 1: [LocalVariableAccess] access to local variable temp
# 17| 6: [Method] Main
# 17| -1: [TypeMention] Void
# 18| 4: [BlockStmt] {...}
# 19| 0: [LocalVariableDeclStmt] ... ...;
# 19| 0: [LocalVariableDeclAndInitExpr] Int32 i = ...
# 19| -1: [TypeMention] int
# 19| 0: [LocalVariableAccess] access to local variable i
# 19| 1: [LocalVariableAccess] access to local variable j
# 20| 2: [ExprStmt] ...;
# 20| 0: [MethodCall] call to method WriteLine
# 20| -1: [TypeAccess] access to type Console
# 20| 0: [TypeMention] Console
# 20| 0: [StringLiteral] "{0} {1}"
# 20| 1: [CastExpr] (...) ...
# 20| 1: [LocalVariableAccess] access to local variable i
# 20| 2: [CastExpr] (...) ...
# 20| 1: [LocalVariableAccess] access to local variable j
# 21| 3: [ExprStmt] ...;
# 19| 1: [IntLiteral] 1
# 19| 1: [LocalVariableDeclAndInitExpr] Int32 j = ...
# 19| -1: [TypeMention] int
# 19| 0: [LocalVariableAccess] access to local variable j
# 19| 1: [IntLiteral] 2
# 20| 1: [ExprStmt] ...;
# 20| 0: [MethodCall] call to method Swap
# 20| 0: [LocalVariableAccess] access to local variable i
# 20| 1: [LocalVariableAccess] access to local variable j
# 21| 2: [ExprStmt] ...;
# 21| 0: [MethodCall] call to method WriteLine
# 21| -1: [TypeAccess] access to type Console
# 21| 0: [TypeMention] Console
@@ -56,65 +47,65 @@ methods.cs:
# 21| 1: [LocalVariableAccess] access to local variable i
# 21| 2: [CastExpr] (...) ...
# 21| 1: [LocalVariableAccess] access to local variable j
# 25| 2: [Class] TestOut
# 28| 5: [Method] Divide
# 28| -1: [TypeMention] Void
# 22| 3: [ExprStmt] ...;
# 22| 0: [MethodCall] call to method WriteLine
# 22| -1: [TypeAccess] access to type Console
# 22| 0: [TypeMention] Console
# 22| 0: [StringLiteral] "{0} {1}"
# 22| 1: [CastExpr] (...) ...
# 22| 1: [LocalVariableAccess] access to local variable i
# 22| 2: [CastExpr] (...) ...
# 22| 1: [LocalVariableAccess] access to local variable j
# 26| 2: [Class] TestOut
# 29| 5: [Method] Divide
# 29| -1: [TypeMention] Void
#-----| 2: (Parameters)
# 28| 0: [Parameter] x
# 28| -1: [TypeMention] int
# 28| 1: [Parameter] y
# 28| -1: [TypeMention] int
# 28| 2: [Parameter] result
# 28| -1: [TypeMention] int
# 28| 3: [Parameter] remainder
# 28| -1: [TypeMention] int
# 29| 4: [BlockStmt] {...}
# 30| 0: [ExprStmt] ...;
# 30| 0: [AssignExpr] ... = ...
# 30| 0: [ParameterAccess] access to parameter result
# 30| 1: [DivExpr] ... / ...
# 30| 0: [ParameterAccess] access to parameter x
# 30| 1: [ParameterAccess] access to parameter y
# 31| 1: [ExprStmt] ...;
# 29| 0: [Parameter] x
# 29| -1: [TypeMention] int
# 29| 1: [Parameter] y
# 29| -1: [TypeMention] int
# 29| 2: [Parameter] result
# 29| -1: [TypeMention] int
# 29| 3: [Parameter] remainder
# 29| -1: [TypeMention] int
# 30| 4: [BlockStmt] {...}
# 31| 0: [ExprStmt] ...;
# 31| 0: [AssignExpr] ... = ...
# 31| 0: [ParameterAccess] access to parameter remainder
# 31| 1: [RemExpr] ... % ...
# 31| 0: [ParameterAccess] access to parameter result
# 31| 1: [DivExpr] ... / ...
# 31| 0: [ParameterAccess] access to parameter x
# 31| 1: [ParameterAccess] access to parameter y
# 34| 6: [Method] Main
# 34| -1: [TypeMention] Void
# 35| 4: [BlockStmt] {...}
# 36| 0: [LocalVariableDeclStmt] ... ...;
# 36| 0: [LocalVariableDeclExpr] Int32 res
# 36| 0: [TypeMention] int
# 36| 1: [LocalVariableDeclExpr] Int32 rem
# 36| 0: [TypeMention] int
# 37| 1: [ExprStmt] ...;
# 37| 0: [MethodCall] call to method Divide
# 37| 0: [IntLiteral] 10
# 37| 1: [IntLiteral] 3
# 37| 2: [LocalVariableAccess] access to local variable res
# 37| 3: [LocalVariableAccess] access to local variable rem
# 38| 2: [ExprStmt] ...;
# 38| 0: [MethodCall] call to method WriteLine
# 38| -1: [TypeAccess] access to type Console
# 38| 0: [TypeMention] Console
# 38| 0: [StringLiteral] "{0} {1}"
# 38| 1: [CastExpr] (...) ...
# 38| 1: [LocalVariableAccess] access to local variable res
# 38| 2: [CastExpr] (...) ...
# 38| 1: [LocalVariableAccess] access to local variable rem
# 42| 3: [Class] Console
# 45| 5: [Method] Write
# 45| -1: [TypeMention] Void
#-----| 2: (Parameters)
# 45| 0: [Parameter] fmt
# 45| -1: [TypeMention] string
# 45| 1: [Parameter] args
# 45| -1: [TypeMention] Object[]
# 45| 1: [TypeMention] object
# 45| 4: [BlockStmt] {...}
# 46| 6: [Method] WriteLine
# 32| 1: [ExprStmt] ...;
# 32| 0: [AssignExpr] ... = ...
# 32| 0: [ParameterAccess] access to parameter remainder
# 32| 1: [RemExpr] ... % ...
# 32| 0: [ParameterAccess] access to parameter x
# 32| 1: [ParameterAccess] access to parameter y
# 35| 6: [Method] Main
# 35| -1: [TypeMention] Void
# 36| 4: [BlockStmt] {...}
# 37| 0: [LocalVariableDeclStmt] ... ...;
# 37| 0: [LocalVariableDeclExpr] Int32 res
# 37| 0: [TypeMention] int
# 37| 1: [LocalVariableDeclExpr] Int32 rem
# 37| 0: [TypeMention] int
# 38| 1: [ExprStmt] ...;
# 38| 0: [MethodCall] call to method Divide
# 38| 0: [IntLiteral] 10
# 38| 1: [IntLiteral] 3
# 38| 2: [LocalVariableAccess] access to local variable res
# 38| 3: [LocalVariableAccess] access to local variable rem
# 39| 2: [ExprStmt] ...;
# 39| 0: [MethodCall] call to method WriteLine
# 39| -1: [TypeAccess] access to type Console
# 39| 0: [TypeMention] Console
# 39| 0: [StringLiteral] "{0} {1}"
# 39| 1: [CastExpr] (...) ...
# 39| 1: [LocalVariableAccess] access to local variable res
# 39| 2: [CastExpr] (...) ...
# 39| 1: [LocalVariableAccess] access to local variable rem
# 43| 3: [Class] Console
# 46| 5: [Method] Write
# 46| -1: [TypeMention] Void
#-----| 2: (Parameters)
# 46| 0: [Parameter] fmt
@@ -123,354 +114,452 @@ methods.cs:
# 46| -1: [TypeMention] Object[]
# 46| 1: [TypeMention] object
# 46| 4: [BlockStmt] {...}
# 49| 4: [Class] TestOverloading
# 52| 5: [Method] F
# 52| -1: [TypeMention] Void
# 53| 4: [BlockStmt] {...}
# 54| 0: [ExprStmt] ...;
# 54| 0: [MethodCall] call to method WriteLine
# 54| -1: [TypeAccess] access to type Console
# 54| 0: [TypeMention] Console
# 54| 0: [StringLiteral] "F()"
# 57| 6: [Method] F
# 57| -1: [TypeMention] Void
# 47| 6: [Method] WriteLine
# 47| -1: [TypeMention] Void
#-----| 2: (Parameters)
# 57| 0: [Parameter] x
# 57| -1: [TypeMention] object
# 58| 4: [BlockStmt] {...}
# 59| 0: [ExprStmt] ...;
# 59| 0: [MethodCall] call to method WriteLine
# 59| -1: [TypeAccess] access to type Console
# 59| 0: [TypeMention] Console
# 59| 0: [StringLiteral] "F(object)"
# 62| 7: [Method] F
# 62| -1: [TypeMention] Void
# 47| 0: [Parameter] fmt
# 47| -1: [TypeMention] string
# 47| 1: [Parameter] args
# 47| -1: [TypeMention] Object[]
# 47| 1: [TypeMention] object
# 47| 4: [BlockStmt] {...}
# 50| 4: [Class] TestOverloading
# 53| 5: [Method] F
# 53| -1: [TypeMention] Void
# 54| 4: [BlockStmt] {...}
# 55| 0: [ExprStmt] ...;
# 55| 0: [MethodCall] call to method WriteLine
# 55| -1: [TypeAccess] access to type Console
# 55| 0: [TypeMention] Console
# 55| 0: [StringLiteral] "F()"
# 58| 6: [Method] F
# 58| -1: [TypeMention] Void
#-----| 2: (Parameters)
# 62| 0: [Parameter] x
# 62| -1: [TypeMention] int
# 63| 4: [BlockStmt] {...}
# 64| 0: [ExprStmt] ...;
# 64| 0: [MethodCall] call to method WriteLine
# 64| -1: [TypeAccess] access to type Console
# 64| 0: [TypeMention] Console
# 64| 0: [StringLiteral] "F(int)"
# 67| 8: [Method] F
# 67| -1: [TypeMention] Void
# 58| 0: [Parameter] x
# 58| -1: [TypeMention] object
# 59| 4: [BlockStmt] {...}
# 60| 0: [ExprStmt] ...;
# 60| 0: [MethodCall] call to method WriteLine
# 60| -1: [TypeAccess] access to type Console
# 60| 0: [TypeMention] Console
# 60| 0: [StringLiteral] "F(object)"
# 63| 7: [Method] F
# 63| -1: [TypeMention] Void
#-----| 2: (Parameters)
# 67| 0: [Parameter] x
# 67| -1: [TypeMention] double
# 68| 4: [BlockStmt] {...}
# 69| 0: [ExprStmt] ...;
# 69| 0: [MethodCall] call to method WriteLine
# 69| -1: [TypeAccess] access to type Console
# 69| 0: [TypeMention] Console
# 69| 0: [StringLiteral] "F(double)"
# 72| 9: [Method] F
# 72| -1: [TypeMention] Void
# 63| 0: [Parameter] x
# 63| -1: [TypeMention] int
# 64| 4: [BlockStmt] {...}
# 65| 0: [ExprStmt] ...;
# 65| 0: [MethodCall] call to method WriteLine
# 65| -1: [TypeAccess] access to type Console
# 65| 0: [TypeMention] Console
# 65| 0: [StringLiteral] "F(int)"
# 68| 8: [Method] F
# 68| -1: [TypeMention] Void
#-----| 2: (Parameters)
# 68| 0: [Parameter] x
# 68| -1: [TypeMention] double
# 69| 4: [BlockStmt] {...}
# 70| 0: [ExprStmt] ...;
# 70| 0: [MethodCall] call to method WriteLine
# 70| -1: [TypeAccess] access to type Console
# 70| 0: [TypeMention] Console
# 70| 0: [StringLiteral] "F(double)"
# 73| 9: [Method] F
# 73| -1: [TypeMention] Void
#-----| 1: (Type parameters)
# 72| 0: [TypeParameter] T
# 73| 0: [TypeParameter] T
#-----| 2: (Parameters)
# 72| 0: [Parameter] x
# 72| -1: [TypeMention] T
# 73| 4: [BlockStmt] {...}
# 74| 0: [ExprStmt] ...;
# 74| 0: [MethodCall] call to method WriteLine
# 74| -1: [TypeAccess] access to type Console
# 74| 0: [TypeMention] Console
# 74| 0: [StringLiteral] "F<T>(T)"
# 77| 12: [Method] F
# 77| -1: [TypeMention] Void
# 73| 0: [Parameter] x
# 73| -1: [TypeMention] T
# 74| 4: [BlockStmt] {...}
# 75| 0: [ExprStmt] ...;
# 75| 0: [MethodCall] call to method WriteLine
# 75| -1: [TypeAccess] access to type Console
# 75| 0: [TypeMention] Console
# 75| 0: [StringLiteral] "F<T>(T)"
# 78| 12: [Method] F
# 78| -1: [TypeMention] Void
#-----| 2: (Parameters)
# 77| 0: [Parameter] x
# 77| -1: [TypeMention] double
# 77| 1: [Parameter] y
# 77| -1: [TypeMention] double
# 78| 4: [BlockStmt] {...}
# 79| 0: [ExprStmt] ...;
# 79| 0: [MethodCall] call to method WriteLine
# 79| -1: [TypeAccess] access to type Console
# 79| 0: [TypeMention] Console
# 79| 0: [StringLiteral] "F(double, double)"
# 82| 13: [Method] Main
# 82| -1: [TypeMention] Void
# 83| 4: [BlockStmt] {...}
# 84| 0: [ExprStmt] ...;
# 84| 0: [MethodCall] call to method F
# 85| 1: [ExprStmt] ...;
# 78| 0: [Parameter] x
# 78| -1: [TypeMention] double
# 78| 1: [Parameter] y
# 78| -1: [TypeMention] double
# 79| 4: [BlockStmt] {...}
# 80| 0: [ExprStmt] ...;
# 80| 0: [MethodCall] call to method WriteLine
# 80| -1: [TypeAccess] access to type Console
# 80| 0: [TypeMention] Console
# 80| 0: [StringLiteral] "F(double, double)"
# 83| 13: [Method] Main
# 83| -1: [TypeMention] Void
# 84| 4: [BlockStmt] {...}
# 85| 0: [ExprStmt] ...;
# 85| 0: [MethodCall] call to method F
# 85| 0: [IntLiteral] 1
# 86| 2: [ExprStmt] ...;
# 86| 1: [ExprStmt] ...;
# 86| 0: [MethodCall] call to method F
# 86| 0: [DoubleLiteral] 1
# 87| 3: [ExprStmt] ...;
# 86| 0: [IntLiteral] 1
# 87| 2: [ExprStmt] ...;
# 87| 0: [MethodCall] call to method F
# 87| 0: [StringLiteral] "abc"
# 88| 4: [ExprStmt] ...;
# 87| 0: [DoubleLiteral] 1
# 88| 3: [ExprStmt] ...;
# 88| 0: [MethodCall] call to method F
# 88| 0: [CastExpr] (...) ...
# 88| 0: [TypeAccess] access to type Double
# 88| 0: [TypeMention] double
# 88| 1: [IntLiteral] 1
# 89| 5: [ExprStmt] ...;
# 88| 0: [StringLiteral] "abc"
# 89| 4: [ExprStmt] ...;
# 89| 0: [MethodCall] call to method F
# 89| 0: [CastExpr] (...) ...
# 89| 0: [TypeAccess] access to type Object
# 89| 0: [TypeMention] object
# 89| 0: [TypeAccess] access to type Double
# 89| 0: [TypeMention] double
# 89| 1: [IntLiteral] 1
# 90| 6: [ExprStmt] ...;
# 90| 5: [ExprStmt] ...;
# 90| 0: [MethodCall] call to method F
# 90| 0: [IntLiteral] 1
# 91| 7: [ExprStmt] ...;
# 90| 0: [CastExpr] (...) ...
# 90| 0: [TypeAccess] access to type Object
# 90| 0: [TypeMention] object
# 90| 1: [IntLiteral] 1
# 91| 6: [ExprStmt] ...;
# 91| 0: [MethodCall] call to method F
# 91| 0: [CastExpr] (...) ...
# 91| 1: [IntLiteral] 1
# 91| 1: [CastExpr] (...) ...
# 91| 1: [IntLiteral] 1
# 96| 5: [Class] Extensions
# 99| 4: [ExtensionMethod] ToInt32
# 99| -1: [TypeMention] int
# 91| 0: [IntLiteral] 1
# 92| 7: [ExprStmt] ...;
# 92| 0: [MethodCall] call to method F
# 92| 0: [CastExpr] (...) ...
# 92| 1: [IntLiteral] 1
# 92| 1: [CastExpr] (...) ...
# 92| 1: [IntLiteral] 1
# 97| 5: [Class] Extensions
# 100| 4: [ExtensionMethod] ToInt32
# 100| -1: [TypeMention] int
#-----| 2: (Parameters)
# 99| 0: [Parameter] s
# 99| -1: [TypeMention] string
# 100| 4: [BlockStmt] {...}
# 101| 0: [ReturnStmt] return ...;
# 101| 0: [MethodCall] call to method Parse
# 101| -1: [TypeAccess] access to type Int32
# 101| 0: [TypeMention] int
# 101| 0: [ParameterAccess] access to parameter s
# 104| 5: [ExtensionMethod] ToBool
# 104| -1: [TypeMention] bool
# 100| 0: [Parameter] s
# 100| -1: [TypeMention] string
# 101| 4: [BlockStmt] {...}
# 102| 0: [ReturnStmt] return ...;
# 102| 0: [MethodCall] call to method Parse
# 102| -1: [TypeAccess] access to type Int32
# 102| 0: [TypeMention] int
# 102| 0: [ParameterAccess] access to parameter s
# 105| 5: [ExtensionMethod] ToBool
# 105| -1: [TypeMention] bool
#-----| 2: (Parameters)
# 104| 0: [Parameter] s
# 104| -1: [TypeMention] string
# 104| 1: [Parameter] f
# 104| -1: [TypeMention] Func<String, Boolean>
# 104| 1: [TypeMention] string
# 104| 2: [TypeMention] bool
# 105| 4: [BlockStmt] {...}
# 106| 0: [ReturnStmt] return ...;
# 106| 0: [DelegateCall] delegate call
# 106| -1: [ParameterAccess] access to parameter f
# 106| 0: [ParameterAccess] access to parameter s
# 109| 6: [ExtensionMethod] Slice
# 109| -1: [TypeMention] T[]
# 109| 1: [TypeMention] T
# 105| 0: [Parameter] s
# 105| -1: [TypeMention] string
# 105| 1: [Parameter] f
# 105| -1: [TypeMention] Func<String, Boolean>
# 105| 1: [TypeMention] string
# 105| 2: [TypeMention] bool
# 106| 4: [BlockStmt] {...}
# 107| 0: [ReturnStmt] return ...;
# 107| 0: [DelegateCall] delegate call
# 107| -1: [ParameterAccess] access to parameter f
# 107| 0: [ParameterAccess] access to parameter s
# 110| 6: [ExtensionMethod] Slice
# 110| -1: [TypeMention] T[]
# 110| 1: [TypeMention] T
#-----| 1: (Type parameters)
# 109| 0: [TypeParameter] T
# 110| 0: [TypeParameter] T
#-----| 2: (Parameters)
# 109| 0: [Parameter] source
# 109| -1: [TypeMention] T[]
# 109| 1: [TypeMention] T
# 109| 1: [Parameter] index
# 109| -1: [TypeMention] int
# 109| 2: [Parameter] count
# 109| -1: [TypeMention] int
# 110| 4: [BlockStmt] {...}
# 111| 0: [IfStmt] if (...) ...
# 111| 0: [LogicalOrExpr] ... || ...
# 111| 0: [LogicalOrExpr] ... || ...
# 111| 0: [LTExpr] ... < ...
# 111| 0: [ParameterAccess] access to parameter index
# 111| 1: [IntLiteral] 0
# 111| 1: [LTExpr] ... < ...
# 111| 0: [ParameterAccess] access to parameter count
# 111| 1: [IntLiteral] 0
# 111| 1: [LTExpr] ... < ...
# 111| 0: [SubExpr] ... - ...
# 111| 0: [PropertyCall] access to property Length
# 111| -1: [ParameterAccess] access to parameter source
# 111| 1: [ParameterAccess] access to parameter index
# 111| 1: [ParameterAccess] access to parameter count
# 112| 1: [ThrowStmt] throw ...;
# 112| 0: [ObjectCreation] object creation of type ArgumentException
# 112| 0: [TypeMention] ArgumentException
# 113| 1: [LocalVariableDeclStmt] ... ...;
# 113| 0: [LocalVariableDeclAndInitExpr] T[] result = ...
# 113| -1: [TypeMention] T[]
# 113| 1: [TypeMention] T
# 113| 0: [LocalVariableAccess] access to local variable result
# 113| 1: [ArrayCreation] array creation of type T[]
# 113| -1: [TypeMention] T[]
# 113| 1: [TypeMention] T
# 113| 0: [ParameterAccess] access to parameter count
# 114| 2: [ExprStmt] ...;
# 114| 0: [MethodCall] call to method Copy
# 114| -1: [TypeAccess] access to type Array
# 114| 0: [TypeMention] Array
# 114| 0: [ParameterAccess] access to parameter source
# 114| 1: [ParameterAccess] access to parameter index
# 114| 2: [LocalVariableAccess] access to local variable result
# 114| 3: [IntLiteral] 0
# 114| 4: [ParameterAccess] access to parameter count
# 115| 3: [ReturnStmt] return ...;
# 115| 0: [LocalVariableAccess] access to local variable result
# 118| 8: [Method] CallToInt32
# 118| -1: [TypeMention] int
# 118| 4: [MethodCall] call to method ToInt32
# 118| 0: [StringLiteral] "0"
# 121| 6: [Class] TestExtensions
# 124| 4: [Method] Main
# 124| -1: [TypeMention] Void
# 125| 4: [BlockStmt] {...}
# 126| 0: [LocalVariableDeclStmt] ... ...;
# 126| 0: [LocalVariableDeclAndInitExpr] String[] strings = ...
# 126| -1: [TypeMention] String[]
# 126| 1: [TypeMention] string
# 126| 0: [LocalVariableAccess] access to local variable strings
# 126| 1: [ArrayCreation] array creation of type String[]
# 126| -1: [ArrayInitializer] { ..., ... }
# 126| 0: [StringLiteral] "1"
# 126| 1: [StringLiteral] "22"
# 126| 2: [StringLiteral] "333"
# 126| 3: [StringLiteral] "4444"
# 127| 1: [ForeachStmt] foreach (... ... in ...) ...
# 127| 0: [LocalVariableDeclExpr] String s
# 127| 0: [TypeMention] string
# 127| 1: [MethodCall] call to method Slice
# 127| -1: [LocalVariableAccess] access to local variable strings
# 127| 0: [IntLiteral] 1
# 127| 1: [IntLiteral] 2
# 128| 2: [BlockStmt] {...}
# 129| 0: [ExprStmt] ...;
# 129| 0: [MethodCall] call to method WriteLine
# 129| -1: [TypeAccess] access to type Console
# 129| 0: [TypeMention] Console
# 129| 0: [MethodCall] call to method ToInt32
# 129| -1: [LocalVariableAccess] access to local variable s
# 132| 2: [ExprStmt] ...;
# 132| 0: [MethodCall] call to method ToInt32
# 132| -1: [TypeAccess] access to type Extensions
# 132| 0: [TypeMention] Extensions
# 132| 0: [StringLiteral] ""
# 134| 3: [ExprStmt] ...;
# 134| 0: [MethodCall] call to method ToBool
# 134| -1: [TypeAccess] access to type Extensions
# 134| 0: [TypeMention] Extensions
# 134| 0: [StringLiteral] "true"
# 134| 1: [ImplicitDelegateCreation] delegate creation of type Func<String,Boolean>
# 134| 0: [MethodAccess] access to method Parse
# 134| -1: [TypeAccess] access to type Boolean
# 134| 0: [TypeMention] bool
# 139| 7: [Class] TestDefaultParameters
# 141| 4: [Method] Method1
# 141| -1: [TypeMention] Void
# 110| 0: [Parameter] source
# 110| -1: [TypeMention] T[]
# 110| 1: [TypeMention] T
# 110| 1: [Parameter] index
# 110| -1: [TypeMention] int
# 110| 2: [Parameter] count
# 110| -1: [TypeMention] int
# 111| 4: [BlockStmt] {...}
# 112| 0: [IfStmt] if (...) ...
# 112| 0: [LogicalOrExpr] ... || ...
# 112| 0: [LogicalOrExpr] ... || ...
# 112| 0: [LTExpr] ... < ...
# 112| 0: [ParameterAccess] access to parameter index
# 112| 1: [IntLiteral] 0
# 112| 1: [LTExpr] ... < ...
# 112| 0: [ParameterAccess] access to parameter count
# 112| 1: [IntLiteral] 0
# 112| 1: [LTExpr] ... < ...
# 112| 0: [SubExpr] ... - ...
# 112| 0: [PropertyCall] access to property Length
# 112| -1: [ParameterAccess] access to parameter source
# 112| 1: [ParameterAccess] access to parameter index
# 112| 1: [ParameterAccess] access to parameter count
# 113| 1: [ThrowStmt] throw ...;
# 113| 0: [ObjectCreation] object creation of type ArgumentException
# 113| 0: [TypeMention] ArgumentException
# 114| 1: [LocalVariableDeclStmt] ... ...;
# 114| 0: [LocalVariableDeclAndInitExpr] T[] result = ...
# 114| -1: [TypeMention] T[]
# 114| 1: [TypeMention] T
# 114| 0: [LocalVariableAccess] access to local variable result
# 114| 1: [ArrayCreation] array creation of type T[]
# 114| -1: [TypeMention] T[]
# 114| 1: [TypeMention] T
# 114| 0: [ParameterAccess] access to parameter count
# 115| 2: [ExprStmt] ...;
# 115| 0: [MethodCall] call to method Copy
# 115| -1: [TypeAccess] access to type Array
# 115| 0: [TypeMention] Array
# 115| 0: [ParameterAccess] access to parameter source
# 115| 1: [ParameterAccess] access to parameter index
# 115| 2: [LocalVariableAccess] access to local variable result
# 115| 3: [IntLiteral] 0
# 115| 4: [ParameterAccess] access to parameter count
# 116| 3: [ReturnStmt] return ...;
# 116| 0: [LocalVariableAccess] access to local variable result
# 119| 8: [Method] CallToInt32
# 119| -1: [TypeMention] int
# 119| 4: [MethodCall] call to method ToInt32
# 119| 0: [StringLiteral] "0"
# 122| 6: [Class] TestExtensions
# 125| 4: [Method] Main
# 125| -1: [TypeMention] Void
# 126| 4: [BlockStmt] {...}
# 127| 0: [LocalVariableDeclStmt] ... ...;
# 127| 0: [LocalVariableDeclAndInitExpr] String[] strings = ...
# 127| -1: [TypeMention] String[]
# 127| 1: [TypeMention] string
# 127| 0: [LocalVariableAccess] access to local variable strings
# 127| 1: [ArrayCreation] array creation of type String[]
# 127| -1: [ArrayInitializer] { ..., ... }
# 127| 0: [StringLiteral] "1"
# 127| 1: [StringLiteral] "22"
# 127| 2: [StringLiteral] "333"
# 127| 3: [StringLiteral] "4444"
# 128| 1: [ForeachStmt] foreach (... ... in ...) ...
# 128| 0: [LocalVariableDeclExpr] String s
# 128| 0: [TypeMention] string
# 128| 1: [MethodCall] call to method Slice
# 128| -1: [LocalVariableAccess] access to local variable strings
# 128| 0: [IntLiteral] 1
# 128| 1: [IntLiteral] 2
# 129| 2: [BlockStmt] {...}
# 130| 0: [ExprStmt] ...;
# 130| 0: [MethodCall] call to method WriteLine
# 130| -1: [TypeAccess] access to type Console
# 130| 0: [TypeMention] Console
# 130| 0: [MethodCall] call to method ToInt32
# 130| -1: [LocalVariableAccess] access to local variable s
# 133| 2: [ExprStmt] ...;
# 133| 0: [MethodCall] call to method ToInt32
# 133| -1: [TypeAccess] access to type Extensions
# 133| 0: [TypeMention] Extensions
# 133| 0: [StringLiteral] ""
# 135| 3: [ExprStmt] ...;
# 135| 0: [MethodCall] call to method ToBool
# 135| -1: [TypeAccess] access to type Extensions
# 135| 0: [TypeMention] Extensions
# 135| 0: [StringLiteral] "true"
# 135| 1: [ImplicitDelegateCreation] delegate creation of type Func<String,Boolean>
# 135| 0: [MethodAccess] access to method Parse
# 135| -1: [TypeAccess] access to type Boolean
# 135| 0: [TypeMention] bool
# 140| 7: [Class] TestDefaultParameters
# 142| 4: [Method] Method1
# 142| -1: [TypeMention] Void
#-----| 2: (Parameters)
# 141| 0: [Parameter] x
# 141| -1: [TypeMention] int
# 141| 1: [Parameter] y
# 141| -1: [TypeMention] int
# 142| 4: [BlockStmt] {...}
# 145| 5: [Method] Method2
# 145| -1: [TypeMention] Void
# 142| 0: [Parameter] x
# 142| -1: [TypeMention] int
# 142| 1: [Parameter] y
# 142| -1: [TypeMention] int
# 143| 4: [BlockStmt] {...}
# 146| 5: [Method] Method2
# 146| -1: [TypeMention] Void
#-----| 2: (Parameters)
# 145| 0: [Parameter] a
# 145| -1: [TypeMention] int
# 145| 1: [Parameter] b
# 145| -1: [TypeMention] int
# 145| 2: [Parameter] c
# 145| -1: [TypeMention] int
# 145| 1: [IntLiteral] 1
# 145| 3: [Parameter] d
# 145| -1: [TypeMention] int
# 145| 1: [IntLiteral] 2
# 145| 4: [Parameter] e
# 145| -1: [TypeMention] string
# 145| 1: [AddExpr] ... + ...
# 145| 0: [StringLiteral] "a"
# 145| 1: [StringLiteral] "b"
# 146| 4: [BlockStmt] {...}
# 149| 6: [InstanceConstructor] TestDefaultParameters
# 146| 0: [Parameter] a
# 146| -1: [TypeMention] int
# 146| 1: [Parameter] b
# 146| -1: [TypeMention] int
# 146| 2: [Parameter] c
# 146| -1: [TypeMention] int
# 146| 1: [IntLiteral] 1
# 146| 3: [Parameter] d
# 146| -1: [TypeMention] int
# 146| 1: [IntLiteral] 2
# 146| 4: [Parameter] e
# 146| -1: [TypeMention] string
# 146| 1: [AddExpr] ... + ...
# 146| 0: [StringLiteral] "a"
# 146| 1: [StringLiteral] "b"
# 147| 4: [BlockStmt] {...}
# 150| 6: [InstanceConstructor] TestDefaultParameters
#-----| 2: (Parameters)
# 149| 0: [Parameter] x
# 149| -1: [TypeMention] int
# 150| 4: [BlockStmt] {...}
# 153| 7: [InstanceConstructor] TestDefaultParameters
# 150| 0: [Parameter] x
# 150| -1: [TypeMention] int
# 151| 4: [BlockStmt] {...}
# 154| 7: [InstanceConstructor] TestDefaultParameters
#-----| 2: (Parameters)
# 153| 0: [Parameter] x
# 153| -1: [TypeMention] string
# 153| 1: [StringLiteral] "abc"
# 153| 1: [Parameter] y
# 153| -1: [TypeMention] double
# 153| 1: [ObjectCreation] object creation of type Double
# 153| 0: [TypeMention] double
# 154| 4: [BlockStmt] {...}
# 157| 8: [DelegateType] Del
# 154| 0: [Parameter] x
# 154| -1: [TypeMention] string
# 154| 1: [StringLiteral] "abc"
# 154| 1: [Parameter] y
# 154| -1: [TypeMention] double
# 154| 1: [ObjectCreation] object creation of type Double
# 154| 0: [TypeMention] double
# 155| 4: [BlockStmt] {...}
# 158| 8: [DelegateType] Del
#-----| 2: (Parameters)
# 157| 0: [Parameter] a
# 157| -1: [TypeMention] string
# 157| 1: [Parameter] b
# 157| -1: [TypeMention] int
# 157| 1: [IntLiteral] 12
# 157| 2: [Parameter] c
# 157| -1: [TypeMention] double
# 157| 1: [ObjectCreation] object creation of type Double
# 157| 0: [TypeMention] double
# 159| 9: [Indexer] Item
# 159| -1: [TypeMention] int
# 158| 0: [Parameter] a
# 158| -1: [TypeMention] string
# 158| 1: [Parameter] b
# 158| -1: [TypeMention] int
# 158| 1: [IntLiteral] 12
# 158| 2: [Parameter] c
# 158| -1: [TypeMention] double
# 158| 1: [ObjectCreation] object creation of type Double
# 158| 0: [TypeMention] double
# 160| 9: [Indexer] Item
# 160| -1: [TypeMention] int
#-----| 1: (Parameters)
# 159| 0: [Parameter] x
# 159| -1: [TypeMention] int
# 159| 1: [Parameter] y
# 159| -1: [TypeMention] int
# 159| 1: [IntLiteral] 0
# 161| 3: [Getter] get_Item
# 160| 0: [Parameter] x
# 160| -1: [TypeMention] int
# 160| 1: [Parameter] y
# 160| -1: [TypeMention] int
# 160| 1: [IntLiteral] 0
# 162| 3: [Getter] get_Item
#-----| 2: (Parameters)
# 159| 0: [Parameter] x
# 159| 1: [Parameter] y
# 159| 1: [IntLiteral] 0
# 161| 4: [BlockStmt] {...}
# 161| 0: [ReturnStmt] return ...;
# 161| 0: [AddExpr] ... + ...
# 161| 0: [ParameterAccess] access to parameter x
# 161| 1: [ParameterAccess] access to parameter y
# 162| 4: [Setter] set_Item
#-----| 2: (Parameters)
# 159| 0: [Parameter] x
# 159| 1: [Parameter] y
# 159| 1: [IntLiteral] 0
# 162| 2: [Parameter] value
# 160| 0: [Parameter] x
# 160| 1: [Parameter] y
# 160| 1: [IntLiteral] 0
# 162| 4: [BlockStmt] {...}
# 166| 8: [Class] TestDefaultExtensionParameters
# 168| 4: [ExtensionMethod] Plus
# 168| -1: [TypeMention] int
# 162| 0: [ReturnStmt] return ...;
# 162| 0: [AddExpr] ... + ...
# 162| 0: [ParameterAccess] access to parameter x
# 162| 1: [ParameterAccess] access to parameter y
# 163| 4: [Setter] set_Item
#-----| 2: (Parameters)
# 160| 0: [Parameter] x
# 160| 1: [Parameter] y
# 160| 1: [IntLiteral] 0
# 163| 2: [Parameter] value
# 163| 4: [BlockStmt] {...}
# 167| 8: [Class] TestDefaultExtensionParameters
# 169| 4: [ExtensionMethod] Plus
# 169| -1: [TypeMention] int
#-----| 2: (Parameters)
# 168| 0: [Parameter] left
# 168| -1: [TypeMention] int
# 168| 1: [Parameter] right
# 168| -1: [TypeMention] int
# 168| 1: [IntLiteral] 0
# 169| 4: [BlockStmt] {...}
# 170| 0: [ReturnStmt] return ...;
# 170| 0: [AddExpr] ... + ...
# 170| 0: [ParameterAccess] access to parameter left
# 170| 1: [ParameterAccess] access to parameter right
# 173| 5: [ExtensionMethod] SkipTwo
# 173| -1: [TypeMention] IEnumerable<T>
# 173| 1: [TypeMention] T
# 169| 0: [Parameter] left
# 169| -1: [TypeMention] int
# 169| 1: [Parameter] right
# 169| -1: [TypeMention] int
# 169| 1: [IntLiteral] 0
# 170| 4: [BlockStmt] {...}
# 171| 0: [ReturnStmt] return ...;
# 171| 0: [AddExpr] ... + ...
# 171| 0: [ParameterAccess] access to parameter left
# 171| 1: [ParameterAccess] access to parameter right
# 174| 5: [ExtensionMethod] SkipTwo
# 174| -1: [TypeMention] IEnumerable<T>
# 174| 1: [TypeMention] T
#-----| 1: (Type parameters)
# 173| 0: [TypeParameter] T
# 174| 0: [TypeParameter] T
#-----| 2: (Parameters)
# 173| 0: [Parameter] list
# 173| -1: [TypeMention] IEnumerable<T>
# 173| 1: [TypeMention] T
# 173| 1: [Parameter] i
# 173| -1: [TypeMention] int
# 173| 1: [IntLiteral] 1
# 174| 4: [BlockStmt] {...}
# 175| 0: [ReturnStmt] return ...;
# 175| 0: [ParameterAccess] access to parameter list
# 178| 7: [ExtensionMethod] SkipTwoInt
# 178| -1: [TypeMention] IEnumerable<Int32>
# 178| 1: [TypeMention] int
# 174| 0: [Parameter] list
# 174| -1: [TypeMention] IEnumerable<T>
# 174| 1: [TypeMention] T
# 174| 1: [Parameter] i
# 174| -1: [TypeMention] int
# 174| 1: [IntLiteral] 1
# 175| 4: [BlockStmt] {...}
# 176| 0: [ReturnStmt] return ...;
# 176| 0: [ParameterAccess] access to parameter list
# 179| 7: [ExtensionMethod] SkipTwoInt
# 179| -1: [TypeMention] IEnumerable<Int32>
# 179| 1: [TypeMention] int
#-----| 2: (Parameters)
# 178| 0: [Parameter] list
# 178| -1: [TypeMention] IEnumerable<Int32>
# 178| 1: [TypeMention] int
# 178| 1: [Parameter] i
# 178| -1: [TypeMention] int
# 178| 1: [IntLiteral] 1
# 179| 4: [BlockStmt] {...}
# 180| 0: [ReturnStmt] return ...;
# 180| 0: [MethodCall] call to method SkipTwo
# 180| -1: [ParameterAccess] access to parameter list
# 180| 0: [ParameterAccess] access to parameter i
# 179| 0: [Parameter] list
# 179| -1: [TypeMention] IEnumerable<Int32>
# 179| 1: [TypeMention] int
# 179| 1: [Parameter] i
# 179| -1: [TypeMention] int
# 179| 1: [IntLiteral] 1
# 180| 4: [BlockStmt] {...}
# 181| 0: [ReturnStmt] return ...;
# 181| 0: [MethodCall] call to method SkipTwo
# 181| -1: [ParameterAccess] access to parameter list
# 181| 0: [ParameterAccess] access to parameter i
# 185| 9: [Class] TestCollidingMethods<>
#-----| 1: (Type parameters)
# 185| 0: [TypeParameter] T
# 187| 5: [Method] M
# 187| -1: [TypeMention] Void
#-----| 2: (Parameters)
# 187| 0: [Parameter] p1
# 187| -1: [TypeMention] T
# 187| 1: [Parameter] p2
# 187| -1: [TypeMention] int
# 187| 4: [BlockStmt] {...}
# 188| 6: [Method] M
# 188| -1: [TypeMention] Void
#-----| 2: (Parameters)
# 188| 0: [Parameter] p1
# 188| -1: [TypeMention] int
# 188| 1: [Parameter] p2
# 188| -1: [TypeMention] int
# 188| 4: [BlockStmt] {...}
# 190| 7: [Method] Calls
# 190| -1: [TypeMention] Void
# 191| 4: [BlockStmt] {...}
# 192| 0: [LocalVariableDeclStmt] ... ...;
# 192| 0: [LocalVariableDeclAndInitExpr] TestCollidingMethods<Int32> x = ...
# 192| -1: [TypeMention] TestCollidingMethods<Int32>
# 192| 0: [LocalVariableAccess] access to local variable x
# 192| 1: [ObjectCreation] object creation of type TestCollidingMethods<Int32>
# 192| 0: [TypeMention] TestCollidingMethods<Int32>
# 192| 1: [TypeMention] int
# 193| 1: [ExprStmt] ...;
# 193| 0: [MethodCall] call to method M
# 193| -1: [LocalVariableAccess] access to local variable x
# 193| 0: [IntLiteral] 1
# 193| 1: [IntLiteral] 1
# 195| 2: [LocalVariableDeclStmt] ... ...;
# 195| 0: [LocalVariableDeclAndInitExpr] TestCollidingMethods<Double> y = ...
# 195| -1: [TypeMention] TestCollidingMethods<Double>
# 195| 0: [LocalVariableAccess] access to local variable y
# 195| 1: [ObjectCreation] object creation of type TestCollidingMethods<Double>
# 195| 0: [TypeMention] TestCollidingMethods<Double>
# 195| 1: [TypeMention] double
# 196| 3: [ExprStmt] ...;
# 196| 0: [MethodCall] call to method M
# 196| -1: [LocalVariableAccess] access to local variable y
# 196| 0: [DoubleLiteral] 1
# 196| 1: [IntLiteral] 1
# 197| 4: [ExprStmt] ...;
# 197| 0: [MethodCall] call to method M
# 197| -1: [LocalVariableAccess] access to local variable y
# 197| 0: [IntLiteral] 1
# 197| 1: [IntLiteral] 1
# 200| 8: [Class] Nested
# 202| 4: [InstanceConstructor] Nested
#-----| 2: (Parameters)
# 202| 0: [Parameter] p1
# 202| -1: [TypeMention] int
# 202| 4: [BlockStmt] {...}
# 203| 5: [InstanceConstructor] Nested
#-----| 2: (Parameters)
# 203| 0: [Parameter] p1
# 203| -1: [TypeMention] T
# 204| 4: [BlockStmt] {...}
# 205| 0: [LocalVariableDeclStmt] ... ...;
# 205| 0: [LocalVariableDeclAndInitExpr] Nested x = ...
# 205| -1: [TypeMention] Nested
# 205| 0: [LocalVariableAccess] access to local variable x
# 205| 1: [ObjectCreation] object creation of type Nested
# 205| -1: [TypeMention] Nested
# 205| 1: [TypeMention] TestCollidingMethods<Int32>
# 205| 1: [TypeMention] int
# 205| 0: [IntLiteral] 1
# 206| 1: [LocalVariableDeclStmt] ... ...;
# 206| 0: [LocalVariableDeclAndInitExpr] Nested y = ...
# 206| -1: [TypeMention] Nested
# 206| 0: [LocalVariableAccess] access to local variable y
# 206| 1: [ObjectCreation] object creation of type Nested
# 206| -1: [TypeMention] Nested
# 206| 1: [TypeMention] TestCollidingMethods<Double>
# 206| 1: [TypeMention] double
# 206| 0: [DoubleLiteral] 1
# 207| 2: [LocalVariableDeclStmt] ... ...;
# 207| 0: [LocalVariableDeclAndInitExpr] Nested z = ...
# 207| -1: [TypeMention] Nested
# 207| 0: [LocalVariableAccess] access to local variable z
# 207| 1: [ObjectCreation] object creation of type Nested
# 207| -1: [TypeMention] Nested
# 207| 1: [TypeMention] TestCollidingMethods<Double>
# 207| 1: [TypeMention] double
# 207| 0: [IntLiteral] 1

28
csharp/ql/test/library-tests/methods/methods.cs
View File

@@ -1,4 +1,5 @@
using System;
using System.Collections.Generic;
namespace Methods
{
@@ -180,4 +181,31 @@ namespace Methods
return list.SkipTwo<int>(i);
}
}
public class TestCollidingMethods<T>
{
public void M(T p1, int p2) { }
public void M(int p1, int p2) { }
public void Calls()
{
var x = new TestCollidingMethods<int>();
x.M(1, 1);
var y = new TestCollidingMethods<double>();
y.M(1.0, 1);
y.M(1, 1);
}
public class Nested
{
public Nested(int p1) { }
public Nested(T p1)
{
var x = new TestCollidingMethods<int>.Nested(1);
var y = new TestCollidingMethods<double>.Nested(1.0);
var z = new TestCollidingMethods<double>.Nested(1);
}
}
}
}

21
csharp/ql/test/library-tests/tuples/tuple.cs Normal file
View File

@@ -0,0 +1,21 @@
using System;
public class Program
{
public static void Main()
{
var x = (1, 2);
Console.WriteLine(x.GetType());
x = new ValueTuple<int, int>(1, 2);
Console.WriteLine(x.GetType());
var y = (1, 2, 3, 4, 5, 6, 7);
Console.WriteLine(y.GetType());
var z = (1, 2, 3, 4, 5, 6, 7, 8);
Console.WriteLine(z.GetType());
var w = (1, 2, 3, 4, 5, 6, 7, 8, 9, 10);
Console.WriteLine(w.GetType());
}
}

91
csharp/ql/test/library-tests/tuples/tuples.expected Normal file
View File

@@ -0,0 +1,91 @@
members1
members2
| tuple.cs:7:17:7:22 | (Int32,Int32) | ValueTuple<Int32, Int32> | CompareTo((int, int)) |
| tuple.cs:7:17:7:22 | (Int32,Int32) | ValueTuple<Int32, Int32> | CompareTo(object) |
| tuple.cs:7:17:7:22 | (Int32,Int32) | ValueTuple<Int32, Int32> | CompareTo(object, IComparer) |
| tuple.cs:7:17:7:22 | (Int32,Int32) | ValueTuple<Int32, Int32> | Equals((int, int)) |
| tuple.cs:7:17:7:22 | (Int32,Int32) | ValueTuple<Int32, Int32> | Equals(object) |
| tuple.cs:7:17:7:22 | (Int32,Int32) | ValueTuple<Int32, Int32> | Equals(object, IEqualityComparer) |
| tuple.cs:7:17:7:22 | (Int32,Int32) | ValueTuple<Int32, Int32> | GetHashCode() |
| tuple.cs:7:17:7:22 | (Int32,Int32) | ValueTuple<Int32, Int32> | GetHashCode(IEqualityComparer) |
| tuple.cs:7:17:7:22 | (Int32,Int32) | ValueTuple<Int32, Int32> | GetHashCodeCore(IEqualityComparer) |
| tuple.cs:7:17:7:22 | (Int32,Int32) | ValueTuple<Int32, Int32> | Item1 |
| tuple.cs:7:17:7:22 | (Int32,Int32) | ValueTuple<Int32, Int32> | Item2 |
| tuple.cs:7:17:7:22 | (Int32,Int32) | ValueTuple<Int32, Int32> | Item[int] |
| tuple.cs:7:17:7:22 | (Int32,Int32) | ValueTuple<Int32, Int32> | Length |
| tuple.cs:7:17:7:22 | (Int32,Int32) | ValueTuple<Int32, Int32> | ToString() |
| tuple.cs:7:17:7:22 | (Int32,Int32) | ValueTuple<Int32, Int32> | ToStringEnd() |
| tuple.cs:7:17:7:22 | (Int32,Int32) | ValueTuple<Int32, Int32> | ValueTuple() |
| tuple.cs:7:17:7:22 | (Int32,Int32) | ValueTuple<Int32, Int32> | ValueTuple(int, int) |
| tuple.cs:12:17:12:37 | (Int32,Int32,Int32,Int32,Int32,Int32,Int32) | ValueTuple<Int32, Int32, Int32, Int32, Int32, Int32, Int32> | CompareTo((int, int, int, int, int, int, int)) |
| tuple.cs:12:17:12:37 | (Int32,Int32,Int32,Int32,Int32,Int32,Int32) | ValueTuple<Int32, Int32, Int32, Int32, Int32, Int32, Int32> | CompareTo(object) |
| tuple.cs:12:17:12:37 | (Int32,Int32,Int32,Int32,Int32,Int32,Int32) | ValueTuple<Int32, Int32, Int32, Int32, Int32, Int32, Int32> | CompareTo(object, IComparer) |
| tuple.cs:12:17:12:37 | (Int32,Int32,Int32,Int32,Int32,Int32,Int32) | ValueTuple<Int32, Int32, Int32, Int32, Int32, Int32, Int32> | Equals((int, int, int, int, int, int, int)) |
| tuple.cs:12:17:12:37 | (Int32,Int32,Int32,Int32,Int32,Int32,Int32) | ValueTuple<Int32, Int32, Int32, Int32, Int32, Int32, Int32> | Equals(object) |
| tuple.cs:12:17:12:37 | (Int32,Int32,Int32,Int32,Int32,Int32,Int32) | ValueTuple<Int32, Int32, Int32, Int32, Int32, Int32, Int32> | Equals(object, IEqualityComparer) |
| tuple.cs:12:17:12:37 | (Int32,Int32,Int32,Int32,Int32,Int32,Int32) | ValueTuple<Int32, Int32, Int32, Int32, Int32, Int32, Int32> | GetHashCode() |
| tuple.cs:12:17:12:37 | (Int32,Int32,Int32,Int32,Int32,Int32,Int32) | ValueTuple<Int32, Int32, Int32, Int32, Int32, Int32, Int32> | GetHashCode(IEqualityComparer) |
| tuple.cs:12:17:12:37 | (Int32,Int32,Int32,Int32,Int32,Int32,Int32) | ValueTuple<Int32, Int32, Int32, Int32, Int32, Int32, Int32> | GetHashCodeCore(IEqualityComparer) |
| tuple.cs:12:17:12:37 | (Int32,Int32,Int32,Int32,Int32,Int32,Int32) | ValueTuple<Int32, Int32, Int32, Int32, Int32, Int32, Int32> | Item1 |
| tuple.cs:12:17:12:37 | (Int32,Int32,Int32,Int32,Int32,Int32,Int32) | ValueTuple<Int32, Int32, Int32, Int32, Int32, Int32, Int32> | Item2 |
| tuple.cs:12:17:12:37 | (Int32,Int32,Int32,Int32,Int32,Int32,Int32) | ValueTuple<Int32, Int32, Int32, Int32, Int32, Int32, Int32> | Item3 |
| tuple.cs:12:17:12:37 | (Int32,Int32,Int32,Int32,Int32,Int32,Int32) | ValueTuple<Int32, Int32, Int32, Int32, Int32, Int32, Int32> | Item4 |
| tuple.cs:12:17:12:37 | (Int32,Int32,Int32,Int32,Int32,Int32,Int32) | ValueTuple<Int32, Int32, Int32, Int32, Int32, Int32, Int32> | Item5 |
| tuple.cs:12:17:12:37 | (Int32,Int32,Int32,Int32,Int32,Int32,Int32) | ValueTuple<Int32, Int32, Int32, Int32, Int32, Int32, Int32> | Item6 |
| tuple.cs:12:17:12:37 | (Int32,Int32,Int32,Int32,Int32,Int32,Int32) | ValueTuple<Int32, Int32, Int32, Int32, Int32, Int32, Int32> | Item7 |
| tuple.cs:12:17:12:37 | (Int32,Int32,Int32,Int32,Int32,Int32,Int32) | ValueTuple<Int32, Int32, Int32, Int32, Int32, Int32, Int32> | Item[int] |
| tuple.cs:12:17:12:37 | (Int32,Int32,Int32,Int32,Int32,Int32,Int32) | ValueTuple<Int32, Int32, Int32, Int32, Int32, Int32, Int32> | Length |
| tuple.cs:12:17:12:37 | (Int32,Int32,Int32,Int32,Int32,Int32,Int32) | ValueTuple<Int32, Int32, Int32, Int32, Int32, Int32, Int32> | ToString() |
| tuple.cs:12:17:12:37 | (Int32,Int32,Int32,Int32,Int32,Int32,Int32) | ValueTuple<Int32, Int32, Int32, Int32, Int32, Int32, Int32> | ToStringEnd() |
| tuple.cs:12:17:12:37 | (Int32,Int32,Int32,Int32,Int32,Int32,Int32) | ValueTuple<Int32, Int32, Int32, Int32, Int32, Int32, Int32> | ValueTuple() |
| tuple.cs:12:17:12:37 | (Int32,Int32,Int32,Int32,Int32,Int32,Int32) | ValueTuple<Int32, Int32, Int32, Int32, Int32, Int32, Int32> | ValueTuple(int, int, int, int, int, int, int) |
| tuple.cs:15:17:15:40 | (Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32) | ValueTuple<Int32, Int32, Int32, Int32, Int32, Int32, Int32, (Int32)> | CompareTo((int, int, int, int, int, int, int, int)) |
| tuple.cs:15:17:15:40 | (Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32) | ValueTuple<Int32, Int32, Int32, Int32, Int32, Int32, Int32, (Int32)> | CompareTo(object) |
| tuple.cs:15:17:15:40 | (Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32) | ValueTuple<Int32, Int32, Int32, Int32, Int32, Int32, Int32, (Int32)> | CompareTo(object, IComparer) |
| tuple.cs:15:17:15:40 | (Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32) | ValueTuple<Int32, Int32, Int32, Int32, Int32, Int32, Int32, (Int32)> | Equals((int, int, int, int, int, int, int, int)) |
| tuple.cs:15:17:15:40 | (Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32) | ValueTuple<Int32, Int32, Int32, Int32, Int32, Int32, Int32, (Int32)> | Equals(object) |
| tuple.cs:15:17:15:40 | (Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32) | ValueTuple<Int32, Int32, Int32, Int32, Int32, Int32, Int32, (Int32)> | Equals(object, IEqualityComparer) |
| tuple.cs:15:17:15:40 | (Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32) | ValueTuple<Int32, Int32, Int32, Int32, Int32, Int32, Int32, (Int32)> | GetHashCode() |
| tuple.cs:15:17:15:40 | (Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32) | ValueTuple<Int32, Int32, Int32, Int32, Int32, Int32, Int32, (Int32)> | GetHashCode(IEqualityComparer) |
| tuple.cs:15:17:15:40 | (Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32) | ValueTuple<Int32, Int32, Int32, Int32, Int32, Int32, Int32, (Int32)> | GetHashCodeCore(IEqualityComparer) |
| tuple.cs:15:17:15:40 | (Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32) | ValueTuple<Int32, Int32, Int32, Int32, Int32, Int32, Int32, (Int32)> | Item1 |
| tuple.cs:15:17:15:40 | (Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32) | ValueTuple<Int32, Int32, Int32, Int32, Int32, Int32, Int32, (Int32)> | Item2 |
| tuple.cs:15:17:15:40 | (Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32) | ValueTuple<Int32, Int32, Int32, Int32, Int32, Int32, Int32, (Int32)> | Item3 |
| tuple.cs:15:17:15:40 | (Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32) | ValueTuple<Int32, Int32, Int32, Int32, Int32, Int32, Int32, (Int32)> | Item4 |
| tuple.cs:15:17:15:40 | (Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32) | ValueTuple<Int32, Int32, Int32, Int32, Int32, Int32, Int32, (Int32)> | Item5 |
| tuple.cs:15:17:15:40 | (Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32) | ValueTuple<Int32, Int32, Int32, Int32, Int32, Int32, Int32, (Int32)> | Item6 |
| tuple.cs:15:17:15:40 | (Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32) | ValueTuple<Int32, Int32, Int32, Int32, Int32, Int32, Int32, (Int32)> | Item7 |
| tuple.cs:15:17:15:40 | (Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32) | ValueTuple<Int32, Int32, Int32, Int32, Int32, Int32, Int32, (Int32)> | Item8 |
| tuple.cs:15:17:15:40 | (Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32) | ValueTuple<Int32, Int32, Int32, Int32, Int32, Int32, Int32, (Int32)> | Item[int] |
| tuple.cs:15:17:15:40 | (Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32) | ValueTuple<Int32, Int32, Int32, Int32, Int32, Int32, Int32, (Int32)> | Length |
| tuple.cs:15:17:15:40 | (Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32) | ValueTuple<Int32, Int32, Int32, Int32, Int32, Int32, Int32, (Int32)> | Rest |
| tuple.cs:15:17:15:40 | (Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32) | ValueTuple<Int32, Int32, Int32, Int32, Int32, Int32, Int32, (Int32)> | ToString() |
| tuple.cs:15:17:15:40 | (Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32) | ValueTuple<Int32, Int32, Int32, Int32, Int32, Int32, Int32, (Int32)> | ToStringEnd() |
| tuple.cs:15:17:15:40 | (Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32) | ValueTuple<Int32, Int32, Int32, Int32, Int32, Int32, Int32, (Int32)> | ValueTuple() |
| tuple.cs:15:17:15:40 | (Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32) | ValueTuple<Int32, Int32, Int32, Int32, Int32, Int32, Int32, (Int32)> | ValueTuple(int, int, int, int, int, int, int, (int)) |
| tuple.cs:18:17:18:47 | (Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32) | ValueTuple<Int32, Int32, Int32, Int32, Int32, Int32, Int32, (Int32,Int32,Int32)> | CompareTo((int, int, int, int, int, int, int, int, int, int)) |
| tuple.cs:18:17:18:47 | (Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32) | ValueTuple<Int32, Int32, Int32, Int32, Int32, Int32, Int32, (Int32,Int32,Int32)> | CompareTo(object) |
| tuple.cs:18:17:18:47 | (Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32) | ValueTuple<Int32, Int32, Int32, Int32, Int32, Int32, Int32, (Int32,Int32,Int32)> | CompareTo(object, IComparer) |
| tuple.cs:18:17:18:47 | (Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32) | ValueTuple<Int32, Int32, Int32, Int32, Int32, Int32, Int32, (Int32,Int32,Int32)> | Equals((int, int, int, int, int, int, int, int, int, int)) |
| tuple.cs:18:17:18:47 | (Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32) | ValueTuple<Int32, Int32, Int32, Int32, Int32, Int32, Int32, (Int32,Int32,Int32)> | Equals(object) |
| tuple.cs:18:17:18:47 | (Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32) | ValueTuple<Int32, Int32, Int32, Int32, Int32, Int32, Int32, (Int32,Int32,Int32)> | Equals(object, IEqualityComparer) |
| tuple.cs:18:17:18:47 | (Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32) | ValueTuple<Int32, Int32, Int32, Int32, Int32, Int32, Int32, (Int32,Int32,Int32)> | GetHashCode() |
| tuple.cs:18:17:18:47 | (Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32) | ValueTuple<Int32, Int32, Int32, Int32, Int32, Int32, Int32, (Int32,Int32,Int32)> | GetHashCode(IEqualityComparer) |
| tuple.cs:18:17:18:47 | (Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32) | ValueTuple<Int32, Int32, Int32, Int32, Int32, Int32, Int32, (Int32,Int32,Int32)> | GetHashCodeCore(IEqualityComparer) |
| tuple.cs:18:17:18:47 | (Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32) | ValueTuple<Int32, Int32, Int32, Int32, Int32, Int32, Int32, (Int32,Int32,Int32)> | Item1 |
| tuple.cs:18:17:18:47 | (Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32) | ValueTuple<Int32, Int32, Int32, Int32, Int32, Int32, Int32, (Int32,Int32,Int32)> | Item2 |
| tuple.cs:18:17:18:47 | (Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32) | ValueTuple<Int32, Int32, Int32, Int32, Int32, Int32, Int32, (Int32,Int32,Int32)> | Item3 |
| tuple.cs:18:17:18:47 | (Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32) | ValueTuple<Int32, Int32, Int32, Int32, Int32, Int32, Int32, (Int32,Int32,Int32)> | Item4 |
| tuple.cs:18:17:18:47 | (Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32) | ValueTuple<Int32, Int32, Int32, Int32, Int32, Int32, Int32, (Int32,Int32,Int32)> | Item5 |
| tuple.cs:18:17:18:47 | (Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32) | ValueTuple<Int32, Int32, Int32, Int32, Int32, Int32, Int32, (Int32,Int32,Int32)> | Item6 |
| tuple.cs:18:17:18:47 | (Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32) | ValueTuple<Int32, Int32, Int32, Int32, Int32, Int32, Int32, (Int32,Int32,Int32)> | Item7 |
| tuple.cs:18:17:18:47 | (Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32) | ValueTuple<Int32, Int32, Int32, Int32, Int32, Int32, Int32, (Int32,Int32,Int32)> | Item8 |
| tuple.cs:18:17:18:47 | (Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32) | ValueTuple<Int32, Int32, Int32, Int32, Int32, Int32, Int32, (Int32,Int32,Int32)> | Item9 |
| tuple.cs:18:17:18:47 | (Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32) | ValueTuple<Int32, Int32, Int32, Int32, Int32, Int32, Int32, (Int32,Int32,Int32)> | Item10 |
| tuple.cs:18:17:18:47 | (Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32) | ValueTuple<Int32, Int32, Int32, Int32, Int32, Int32, Int32, (Int32,Int32,Int32)> | Item[int] |
| tuple.cs:18:17:18:47 | (Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32) | ValueTuple<Int32, Int32, Int32, Int32, Int32, Int32, Int32, (Int32,Int32,Int32)> | Length |
| tuple.cs:18:17:18:47 | (Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32) | ValueTuple<Int32, Int32, Int32, Int32, Int32, Int32, Int32, (Int32,Int32,Int32)> | Rest |
| tuple.cs:18:17:18:47 | (Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32) | ValueTuple<Int32, Int32, Int32, Int32, Int32, Int32, Int32, (Int32,Int32,Int32)> | ToString() |
| tuple.cs:18:17:18:47 | (Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32) | ValueTuple<Int32, Int32, Int32, Int32, Int32, Int32, Int32, (Int32,Int32,Int32)> | ToStringEnd() |
| tuple.cs:18:17:18:47 | (Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32) | ValueTuple<Int32, Int32, Int32, Int32, Int32, Int32, Int32, (Int32,Int32,Int32)> | ValueTuple() |
| tuple.cs:18:17:18:47 | (Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32,Int32) | ValueTuple<Int32, Int32, Int32, Int32, Int32, Int32, Int32, (Int32,Int32,Int32)> | ValueTuple(int, int, int, int, int, int, int, (int, int, int)) |

12
csharp/ql/test/library-tests/tuples/tuples.ql Normal file
View File

@@ -0,0 +1,12 @@
import csharp
query predicate members1(TupleType t, string m) {
t.fromSource() and
m = t.getAMember().toStringWithTypes()
}
query predicate members2(TupleType t, string s, string m) {
t.fromSource() and
s = t.getUnderlyingType().toStringWithTypes() and
m = t.getUnderlyingType().getAMember().toStringWithTypes()
}

2
csharp/ql/test/query-tests/Stubs/MinimalStubsFromSource.expected
View File

File diff suppressed because one or more lines are too long

10
docs/codeql/codeql-cli/analyzing-databases-with-the-codeql-cli.rst
View File

@@ -24,11 +24,12 @@ Before starting an analysis you must:
Running ``codeql database analyze``
------------------------------------
When you run ``database analyze``, it does two things:
When you run ``database analyze``, it:
#. Executes one or more query files, by running them over a CodeQL database.
#. Interprets the results, based on certain query metadata, so that alerts can be
displayed in the correct location in the source code.
#. Reports the results of any diagnostic and summary queries to standard output.
You can analyze a database by running the following command::
@@ -142,6 +143,13 @@ These are stored alongside the code scanning suites with names of the form: ``<l
For information about creating custom query suites, see ":doc:`Creating
CodeQL query suites <creating-codeql-query-suites>`."
Diagnostic and summary information
..................................
When you create a CodeQL database, the extractor stores diagnostic data in the database. The code scanning query suites include additional queries to report on this diagnostic data and calculate summary metrics. When the ``database analyze`` command completes, the CLI generates the results file and reports any diagnostic and summary data to standard output. If you choose to generate SARIF output, the additional data is also included in the SARIF file.
If the analysis found fewer results for standard queries than you expected, review the results of the diagnostic and summary queries to check whether the CodeQL database is likely to be a good representation of the codebase that you want to analyze.
Running all queries in a directory
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

6
docs/codeql/codeql-cli/using-custom-queries-with-the-codeql-cli.rst
View File

@@ -33,8 +33,10 @@ following two properties to ensure that the results are interpreted correctly:
- Query identifier (``@id``): a sequence of words composed of lowercase letters or
digits, delimited by ``/`` or ``-``, identifying and classifying the query.
- Query type (``@kind``): identifies the query is an alert (``@kind problem``)
or a path (``@kind path-problem``).
- Query type (``@kind``): identifies the query as a simple alert (``@kind problem``),
an alert documented by a sequence of code locations (``@kind path-problem``),
for extractor troubleshooting (``@kind diagnostic``), or a summary metric
(``@kind metric`` and ``@tags summary``).
For more information about these metadata properties, see ":ref:`Metadata for CodeQL queries
<metadata-for-codeql-queries>`" and the `Query metadata style guide

14
docs/codeql/ql-language-reference/expressions.rst
View File

@@ -308,7 +308,10 @@ The following aggregates are available in QL:
rank[4](int i | i = [5 .. 15] | i)
Note that the rank indices start at ``1``, so ``rank[0](...)`` returns no results.
.. pull-quote:: Note
- Rank indices start at ``1``, so ``rank[0](...)`` has no result.
- ``rank[1](...)`` is the same as ``min(...)``.
.. index:: strictconcat, strictcount, strictsum
@@ -530,14 +533,21 @@ The query produces these results:
+-----------+---------+------+
| variant | person | cost |
+-----------+---------+------+
+===========+=========+======+
| default | Alice | 201 |
+-----------+---------+------+
| default | Bob | 100 |
+-----------+---------+------+
| default | Charles | 100 |
+-----------+---------+------+
| default | Diane | 0 |
+-----------+---------+------+
| monotonic | Alice | 101 |
+-----------+---------+------+
| monotonic | Alice | 200 |
+-----------+---------+------+
| monotonic | Bob | 100 |
+-----------+---------+------+
| monotonic | Diane | 0 |
+-----------+---------+------+

6
docs/codeql/support/reusables/versions-compilers.rst
View File

@@ -17,18 +17,18 @@
.NET 5","``.sln``, ``.csproj``, ``.cs``, ``.cshtml``, ``.xaml``"
Go (aka Golang), "Go up to 1.16", "Go 1.11 or more recent", ``.go``
Java,"Java 7 to 15 [3]_","javac (OpenJDK and Oracle JDK),
Java,"Java 7 to 16 [3]_","javac (OpenJDK and Oracle JDK),
Eclipse compiler for Java (ECJ) [4]_",``.java``
JavaScript,ECMAScript 2021 or lower,Not applicable,"``.js``, ``.jsx``, ``.mjs``, ``.es``, ``.es6``, ``.htm``, ``.html``, ``.xhm``, ``.xhtml``, ``.vue``, ``.json``, ``.yaml``, ``.yml``, ``.raml``, ``.xml`` [5]_"
Python,"2.7, 3.5, 3.6, 3.7, 3.8",Not applicable,``.py``
Python,"2.7, 3.5, 3.6, 3.7, 3.8, 3.9",Not applicable,``.py``
TypeScript [6]_,"2.6-4.2",Standard TypeScript compiler,"``.ts``, ``.tsx``"
.. container:: footnote-group
.. [1] Support for the clang-cl compiler is preliminary.
.. [2] Support for the Arm Compiler (armcc) is preliminary.
.. [3] Builds that execute on Java 7 to 15 can be analyzed. The analysis understands Java 15 standard language features.
.. [3] Builds that execute on Java 7 to 16 can be analyzed. The analysis understands Java 15 standard language features.
.. [4] ECJ is supported when the build invokes it via the Maven Compiler plugin or the Takari Lifecycle plugin.
.. [5] JSX and Flow code, YAML, JSON, HTML, and XML files may also be analyzed with JavaScript files.
.. [6] TypeScript analysis is performed by running the JavaScript extractor with TypeScript enabled. This is the default for LGTM.

8
docs/codeql/writing-codeql-queries/about-codeql-queries.rst
View File

@@ -57,8 +57,10 @@ Query metadata is used to identify your custom queries when they are added to th
Queries that are contributed to the open source repository, added to a query pack in LGTM, or used to analyze a database with the :ref:`CodeQL CLI <codeql-cli>` must have a query type (``@kind``) specified. The ``@kind`` property indicates how to interpret and display the results of the query analysis:
- Alert query metadata must contain ``@kind problem``.
- Path query metadata must contain ``@kind path-problem``.
- Alert query metadata must contain ``@kind problem`` to identify the results as a simple alert.
- Path query metadata must contain ``@kind path-problem`` to identify the results as an alert documented by a sequence of code locations.
- Diagnostic query metadata must contain ``@kind diagnostic`` to identify the results as troubleshooting data about the extraction process.
- Summary query metadata must contain ``@kind metric`` and ``@tags summary`` to identify the results as summary metrics for the CodeQL database.
When you define the ``@kind`` property of a custom query you must also ensure that the rest of your query has the correct structure in order to be valid, as described below.
@@ -114,6 +116,8 @@ You can modify the alert message defined in the final column of the ``select`` s
Select clauses for path queries (``@kind path-problem``) are crafted to display both an alert and the source and sink of an associated path graph. For more information, see ":doc:`Creating path queries <creating-path-queries>`."
Select clauses for diagnostic queries (``@kind diagnostic``) and summary metric queries (``@kind metric`` and ``@tags summary``) have different requirements. For examples, see the `diagnostic queries <https://github.com/github/codeql/search?q=%22%40kind+diagnostic%22>`__ and the `summary metric queries <https://github.com/github/codeql/search?q=%22%40kind+metric%22+%22%40tags+summary%22>`__ in the CodeQL repository.
Viewing the standard CodeQL queries
***********************************

2
java/change-notes/2021-03-11-commons-strbuilder.md Normal file
View File

@@ -0,0 +1,2 @@
lgtm,codescanning
* Added support for the Apache Commons Lang and Commons Text StrBuilder class, and its successor TextStringBuilder.

2
java/change-notes/2021-03-18-commons-tostring-builder.md Normal file
View File

@@ -0,0 +1,2 @@
lgtm,codescanning
* Added models for Apache Commons Lang's `ToStringBuilder` class. This may lead to more results from any data-flow query where ToStringBuilder operations fall between the relevant untrusted source and vulnerable sink.

2
java/change-notes/2021-05-04-jexl-injection-query.md Normal file
View File

@@ -0,0 +1,2 @@
lgtm,codescanning
* The query "Expression language injection (JEXL)" (`java/jexl-expression-injection`) has been promoted from experimental to the main query pack. Its results will now appear by default. This query was originally [submitted as an experimental query by @artem-smotrakov](https://github.com/github/codeql/pull/4965)

5
java/change-notes/2021-06-01-collection-flow.md Normal file
View File

@@ -0,0 +1,5 @@
lgtm,codescanning
* Data flow now tracks steps through collections and arrays more precisely.
That means that collection and array read steps are now matched up with
preceding store steps. This results in increased precision for all flow-based
queries, in particular most of the security queries.

2
java/change-notes/2021-06-01-statement-toString.md Normal file
View File

@@ -0,0 +1,2 @@
lgtm,codescanning
* The CodeQL predicate `toString()` has been overridden for subclasses of `Stmt` to be more descriptive.

0
java/ql/src/experimental/Security/CWE/CWE-094/JexlInjection.qhelp → java/ql/src/Security/CWE/CWE-094/JexlInjection.qhelp
View File

37
java/ql/src/Security/CWE/CWE-094/JexlInjection.ql Normal file
View File

@@ -0,0 +1,37 @@
/**
* @name Expression language injection (JEXL)
* @description Evaluation of a user-controlled JEXL expression
* may lead to arbitrary code execution.
* @kind path-problem
* @problem.severity error
* @precision high
* @id java/jexl-expression-injection
* @tags security
* external/cwe/cwe-094
*/
import java
import semmle.code.java.dataflow.FlowSources
import semmle.code.java.security.JexlInjection
import DataFlow::PathGraph
/**
* A taint-tracking configuration for unsafe user input
* that is used to construct and evaluate a JEXL expression.
* It supports both JEXL 2 and 3.
*/
class JexlInjectionConfig extends TaintTracking::Configuration {
JexlInjectionConfig() { this = "JexlInjectionConfig" }
override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
override predicate isSink(DataFlow::Node sink) { sink instanceof JexlEvaluationSink }
override predicate isAdditionalTaintStep(DataFlow::Node node1, DataFlow::Node node2) {
any(JexlInjectionAdditionalTaintStep c).step(node1, node2)
}
}
from DataFlow::PathNode source, DataFlow::PathNode sink, JexlInjectionConfig conf
where conf.hasFlowPath(source, sink)
select sink.getNode(), source, sink, "JEXL injection from $@.", source.getNode(), "this user input"

0
java/ql/src/experimental/Security/CWE/CWE-094/SaferJexlExpressionEvaluationWithSandbox.java → java/ql/src/Security/CWE/CWE-094/SaferJexlExpressionEvaluationWithSandbox.java
View File

0
java/ql/src/experimental/Security/CWE/CWE-094/SaferJexlExpressionEvaluationWithUberspectSandbox.java → java/ql/src/Security/CWE/CWE-094/SaferJexlExpressionEvaluationWithUberspectSandbox.java
View File

0
java/ql/src/experimental/Security/CWE/CWE-094/UnsafeJexlExpressionEvaluation.java → java/ql/src/Security/CWE/CWE-094/UnsafeJexlExpressionEvaluation.java
View File

19
java/ql/src/experimental/Security/CWE/CWE-094/JexlInjection.ql
View File

@@ -1,19 +0,0 @@
/**
* @name Expression language injection (JEXL)
* @description Evaluation of a user-controlled JEXL expression
* may lead to arbitrary code execution.
* @kind path-problem
* @problem.severity error
* @precision high
* @id java/jexl-expression-injection
* @tags security
* external/cwe/cwe-094
*/
import java
import JexlInjectionLib
import DataFlow::PathGraph
from DataFlow::PathNode source, DataFlow::PathNode sink, JexlInjectionConfig conf
where conf.hasFlowPath(source, sink)
select sink.getNode(), source, sink, "JEXL injection from $@.", source.getNode(), "this user input"

277
java/ql/src/experimental/Security/CWE/CWE-094/JexlInjectionLib.qll
View File

@@ -1,277 +0,0 @@
import java
import FlowUtils
import semmle.code.java.dataflow.FlowSources
import semmle.code.java.dataflow.TaintTracking
/**
* A taint-tracking configuration for unsafe user input
* that is used to construct and evaluate a JEXL expression.
* It supports both JEXL 2 and 3.
*/
class JexlInjectionConfig extends TaintTracking::Configuration {
JexlInjectionConfig() { this = "JexlInjectionConfig" }
override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
override predicate isSink(DataFlow::Node sink) { sink instanceof JexlEvaluationSink }
override predicate isAdditionalTaintStep(DataFlow::Node fromNode, DataFlow::Node toNode) {
any(TaintPropagatingJexlMethodCall c).taintFlow(fromNode, toNode) or
hasGetterFlow(fromNode, toNode)
}
}
/**
* A sink for Expresssion Language injection vulnerabilities via Jexl,
* i.e. method calls that run evaluation of a JEXL expression.
*
* Creating a `Callable` from a tainted JEXL expression or script is considered as a sink
* although the tainted expression is not executed at this point.
* Here we assume that it will get executed at some point,
* maybe stored in an object field and then reached by a different flow.
*/
private class JexlEvaluationSink extends DataFlow::ExprNode {
JexlEvaluationSink() {
exists(MethodAccess ma, Method m, Expr taintFrom |
ma.getMethod() = m and taintFrom = this.asExpr()
|
m instanceof DirectJexlEvaluationMethod and ma.getQualifier() = taintFrom
or
m instanceof CreateJexlCallableMethod and ma.getQualifier() = taintFrom
or
m instanceof JexlEngineGetSetPropertyMethod and
taintFrom.getType() instanceof TypeString and
ma.getAnArgument() = taintFrom
)
}
}
/**
* Defines method calls that propagate tainted data via one of the methods
* from JEXL library.
*/
private class TaintPropagatingJexlMethodCall extends MethodAccess {
Expr taintFromExpr;
TaintPropagatingJexlMethodCall() {
exists(Method m, RefType taintType |
this.getMethod() = m and
taintType = taintFromExpr.getType()
|
isUnsafeEngine(this.getQualifier()) and
(
m instanceof CreateJexlScriptMethod and
taintFromExpr = this.getArgument(0) and
taintType instanceof TypeString
or
m instanceof CreateJexlExpressionMethod and
taintFromExpr = this.getAnArgument() and
taintType instanceof TypeString
or
m instanceof CreateJexlTemplateMethod and
(taintType instanceof TypeString or taintType instanceof Reader) and
taintFromExpr = this.getArgument([0, 1])
)
)
}
/**
* Holds if `fromNode` to `toNode` is a dataflow step that propagates
* tainted data.
*/
predicate taintFlow(DataFlow::Node fromNode, DataFlow::Node toNode) {
fromNode.asExpr() = taintFromExpr and toNode.asExpr() = this
}
}
/**
* Holds if `expr` is a JEXL engine that is not configured with a sandbox.
*/
private predicate isUnsafeEngine(Expr expr) {
not exists(SandboxedJexlFlowConfig config | config.hasFlowTo(DataFlow::exprNode(expr)))
}
/**
* A configuration for a tracking sandboxed JEXL engines.
*/
private class SandboxedJexlFlowConfig extends DataFlow2::Configuration {
SandboxedJexlFlowConfig() { this = "JexlInjection::SandboxedJexlFlowConfig" }
override predicate isSource(DataFlow::Node node) { node instanceof SandboxedJexlSource }
override predicate isSink(DataFlow::Node node) {
exists(MethodAccess ma, Method m | ma.getMethod() = m |
(
m instanceof CreateJexlScriptMethod or
m instanceof CreateJexlExpressionMethod or
m instanceof CreateJexlTemplateMethod
) and
ma.getQualifier() = node.asExpr()
)
}
override predicate isAdditionalFlowStep(DataFlow::Node fromNode, DataFlow::Node toNode) {
createsJexlEngine(fromNode, toNode)
}
}
/**
* Defines a data flow source for JEXL engines configured with a sandbox.
*/
private class SandboxedJexlSource extends DataFlow::ExprNode {
SandboxedJexlSource() {
exists(MethodAccess ma, Method m | m = ma.getMethod() |
m.getDeclaringType() instanceof JexlBuilder and
m.hasName(["uberspect", "sandbox"]) and
m.getReturnType() instanceof JexlBuilder and
this.asExpr() = [ma, ma.getQualifier()]
)
or
exists(ConstructorCall cc |
cc.getConstructedType() instanceof JexlEngine and
cc.getArgument(0).getType() instanceof JexlUberspect and
cc = this.asExpr()
)
}
}
/**
* Holds if `fromNode` to `toNode` is a dataflow step that creates one of the JEXL engines.
*/
private predicate createsJexlEngine(DataFlow::Node fromNode, DataFlow::Node toNode) {
exists(MethodAccess ma, Method m | m = ma.getMethod() |
(m.getDeclaringType() instanceof JexlBuilder or m.getDeclaringType() instanceof JexlEngine) and
m.hasName(["create", "createJxltEngine"]) and
ma.getQualifier() = fromNode.asExpr() and
ma = toNode.asExpr()
)
or
exists(ConstructorCall cc |
cc.getConstructedType() instanceof UnifiedJexl and
cc.getArgument(0) = fromNode.asExpr() and
cc = toNode.asExpr()
)
}
/**
* A methods in the `JexlEngine` class that gets or sets a property with a JEXL expression.
*/
private class JexlEngineGetSetPropertyMethod extends Method {
JexlEngineGetSetPropertyMethod() {
getDeclaringType() instanceof JexlEngine and
hasName(["getProperty", "setProperty"])
}
}
/**
* A method that triggers direct evaluation of JEXL expressions.
*/
private class DirectJexlEvaluationMethod extends Method {
DirectJexlEvaluationMethod() {
getDeclaringType() instanceof JexlExpression and hasName("evaluate")
or
getDeclaringType() instanceof JexlScript and hasName("execute")
or
getDeclaringType() instanceof JxltEngineExpression and hasName(["evaluate", "prepare"])
or
getDeclaringType() instanceof JxltEngineTemplate and hasName("evaluate")
or
getDeclaringType() instanceof UnifiedJexlExpression and hasName(["evaluate", "prepare"])
or
getDeclaringType() instanceof UnifiedJexlTemplate and hasName("evaluate")
}
}
/**
* A method that creates a JEXL script.
*/
private class CreateJexlScriptMethod extends Method {
CreateJexlScriptMethod() { getDeclaringType() instanceof JexlEngine and hasName("createScript") }
}
/**
* A method that creates a `Callable` for a JEXL expression or script.
*/
private class CreateJexlCallableMethod extends Method {
CreateJexlCallableMethod() {
(getDeclaringType() instanceof JexlExpression or getDeclaringType() instanceof JexlScript) and
hasName("callable")
}
}
/**
* A method that creates a JEXL template.
*/
private class CreateJexlTemplateMethod extends Method {
CreateJexlTemplateMethod() {
(getDeclaringType() instanceof JxltEngine or getDeclaringType() instanceof UnifiedJexl) and
hasName("createTemplate")
}
}
/**
* A method that creates a JEXL expression.
*/
private class CreateJexlExpressionMethod extends Method {
CreateJexlExpressionMethod() {
(getDeclaringType() instanceof JexlEngine or getDeclaringType() instanceof JxltEngine) and
hasName("createExpression")
or
getDeclaringType() instanceof UnifiedJexl and hasName("parse")
}
}
private class JexlRefType extends RefType {
JexlRefType() { getPackage().hasName(["org.apache.commons.jexl2", "org.apache.commons.jexl3"]) }
}
private class JexlExpression extends JexlRefType {
JexlExpression() { hasName(["Expression", "JexlExpression"]) }
}
private class JexlScript extends JexlRefType {
JexlScript() { hasName(["Script", "JexlScript"]) }
}
private class JexlBuilder extends JexlRefType {
JexlBuilder() { hasName("JexlBuilder") }
}
private class JexlEngine extends JexlRefType {
JexlEngine() { hasName("JexlEngine") }
}
private class JxltEngine extends JexlRefType {
JxltEngine() { hasName("JxltEngine") }
}
private class UnifiedJexl extends JexlRefType {
UnifiedJexl() { hasName("UnifiedJEXL") }
}
private class JexlUberspect extends Interface {
JexlUberspect() {
hasQualifiedName("org.apache.commons.jexl2.introspection", "Uberspect") or
hasQualifiedName("org.apache.commons.jexl3.introspection", "JexlUberspect")
}
}
private class JxltEngineExpression extends NestedType {
JxltEngineExpression() { getEnclosingType() instanceof JxltEngine and hasName("Expression") }
}
private class JxltEngineTemplate extends NestedType {
JxltEngineTemplate() { getEnclosingType() instanceof JxltEngine and hasName("Template") }
}
private class UnifiedJexlExpression extends NestedType {
UnifiedJexlExpression() { getEnclosingType() instanceof UnifiedJexl and hasName("Expression") }
}
private class UnifiedJexlTemplate extends NestedType {
UnifiedJexlTemplate() { getEnclosingType() instanceof UnifiedJexl and hasName("Template") }
}
private class Reader extends RefType {
Reader() { hasQualifiedName("java.io", "Reader") }
}

108
java/ql/src/semmle/code/java/Statement.qll
View File

@@ -73,10 +73,10 @@ class BlockStmt extends Stmt, @block {
/** Gets the last statement in this block. */
Stmt getLastStmt() { result = getStmt(getNumStmt() - 1) }
/** Gets a printable representation of this statement. May include more detail than `toString()`. */
override string pp() { result = "{ ... }" }
/** This statement's Halstead ID (used to compute Halstead metrics). */
override string toString() { result = "{ ... }" }
override string getHalsteadID() { result = "BlockStmt" }
override string getAPrimaryQlClass() { result = "BlockStmt" }
@@ -130,14 +130,14 @@ class IfStmt extends ConditionalStmt, @ifstmt {
/** Gets the `else` branch of this `if` statement. */
Stmt getElse() { result.isNthChildOf(this, 2) }
/** Gets a printable representation of this statement. May include more detail than `toString()`. */
override string pp() {
result = "if (...) " + this.getThen().pp() + " else " + this.getElse().pp()
or
not exists(this.getElse()) and result = "if (...) " + this.getThen().pp()
}
/** This statement's Halstead ID (used to compute Halstead metrics). */
override string toString() { result = "if (...)" }
override string getHalsteadID() { result = "IfStmt" }
override string getAPrimaryQlClass() { result = "IfStmt" }
@@ -201,10 +201,10 @@ class ForStmt extends ConditionalStmt, @forstmt {
getCondition().getAChildExpr*() = result.getAnAccess()
}
/** Gets a printable representation of this statement. May include more detail than `toString()`. */
override string pp() { result = "for (...;...;...) " + this.getStmt().pp() }
/** This statement's Halstead ID (used to compute Halstead metrics). */
override string toString() { result = "for (...;...;...)" }
override string getHalsteadID() { result = "ForStmt" }
override string getAPrimaryQlClass() { result = "ForStmt" }
@@ -221,10 +221,10 @@ class EnhancedForStmt extends Stmt, @enhancedforstmt {
/** Gets the body of this enhanced `for` loop. */
Stmt getStmt() { result.getParent() = this }
/** Gets a printable representation of this statement. May include more detail than `toString()`. */
override string pp() { result = "for (...) " + this.getStmt().pp() }
override string pp() { result = "for (... : ...) " + this.getStmt().pp() }
override string toString() { result = "for (... : ...)" }
/** This statement's Halstead ID (used to compute Halstead metrics). */
override string getHalsteadID() { result = "EnhancedForStmt" }
override string getAPrimaryQlClass() { result = "EnhancedForStmt" }
@@ -244,10 +244,10 @@ class WhileStmt extends ConditionalStmt, @whilestmt {
*/
deprecated override Stmt getTrueSuccessor() { result = getStmt() }
/** Gets a printable representation of this statement. May include more detail than `toString()`. */
override string pp() { result = "while (...) " + this.getStmt().pp() }
/** This statement's Halstead ID (used to compute Halstead metrics). */
override string toString() { result = "while (...)" }
override string getHalsteadID() { result = "WhileStmt" }
override string getAPrimaryQlClass() { result = "WhileStmt" }
@@ -267,10 +267,10 @@ class DoStmt extends ConditionalStmt, @dostmt {
*/
deprecated override Stmt getTrueSuccessor() { result = getStmt() }
/** Gets a printable representation of this statement. May include more detail than `toString()`. */
override string pp() { result = "do " + this.getStmt().pp() + " while (...)" }
/** This statement's Halstead ID (used to compute Halstead metrics). */
override string toString() { result = "do ... while (...)" }
override string getHalsteadID() { result = "DoStmt" }
override string getAPrimaryQlClass() { result = "DoStmt" }
@@ -356,10 +356,10 @@ class TryStmt extends Stmt, @trystmt {
result = getAResourceExpr().getVariable()
}
/** Gets a printable representation of this statement. May include more detail than `toString()`. */
override string pp() { result = "try " + this.getBlock().pp() + " catch (...)" }
/** This statement's Halstead ID (used to compute Halstead metrics). */
override string toString() { result = "try ..." }
override string getHalsteadID() { result = "TryStmt" }
override string getAPrimaryQlClass() { result = "TryStmt" }
@@ -387,10 +387,10 @@ class CatchClause extends Stmt, @catchclause {
)
}
/** Gets a printable representation of this statement. May include more detail than `toString()`. */
override string pp() { result = "catch (...) " + this.getBlock().pp() }
/** This statement's Halstead ID (used to compute Halstead metrics). */
override string toString() { result = "catch (...)" }
override string getHalsteadID() { result = "CatchClause" }
override string getAPrimaryQlClass() { result = "CatchClause" }
@@ -422,10 +422,10 @@ class SwitchStmt extends Stmt, @switchstmt {
/** Gets the expression of this `switch` statement. */
Expr getExpr() { result.getParent() = this }
/** Gets a printable representation of this statement. May include more detail than `toString()`. */
override string pp() { result = "switch (...)" }
/** This statement's Halstead ID (used to compute Halstead metrics). */
override string toString() { result = "switch (...)" }
override string getHalsteadID() { result = "SwitchStmt" }
override string getAPrimaryQlClass() { result = "SwitchStmt" }
@@ -485,10 +485,10 @@ class ConstCase extends SwitchCase {
*/
Expr getValue(int i) { result.getParent() = this and result.getIndex() = i and i >= 0 }
/** Gets a printable representation of this statement. May include more detail than `toString()`. */
override string pp() { result = "case ..." }
/** This statement's Halstead ID (used to compute Halstead metrics). */
override string toString() { result = "case ..." }
override string getHalsteadID() { result = "ConstCase" }
override string getAPrimaryQlClass() { result = "ConstCase" }
@@ -498,10 +498,10 @@ class ConstCase extends SwitchCase {
class DefaultCase extends SwitchCase {
DefaultCase() { not exists(Expr e | e.getParent() = this | e.getIndex() >= 0) }
/** Gets a printable representation of this statement. May include more detail than `toString()`. */
override string pp() { result = "default" }
/** This statement's Halstead ID (used to compute Halstead metrics). */
override string toString() { result = "default" }
override string getHalsteadID() { result = "DefaultCase" }
override string getAPrimaryQlClass() { result = "DefaultCase" }
@@ -515,10 +515,10 @@ class SynchronizedStmt extends Stmt, @synchronizedstmt {
/** Gets the block of this `synchronized` statement. */
Stmt getBlock() { result.getParent() = this }
/** Gets a printable representation of this statement. May include more detail than `toString()`. */
override string pp() { result = "synchronized (...) " + this.getBlock().pp() }
/** This statement's Halstead ID (used to compute Halstead metrics). */
override string toString() { result = "synchronized (...)" }
override string getHalsteadID() { result = "SynchronizedStmt" }
override string getAPrimaryQlClass() { result = "SynchronizedStmt" }
@@ -529,10 +529,10 @@ class ReturnStmt extends Stmt, @returnstmt {
/** Gets the expression returned by this `return` statement, if any. */
Expr getResult() { result.getParent() = this }
/** Gets a printable representation of this statement. May include more detail than `toString()`. */
override string pp() { result = "return ..." }
/** This statement's Halstead ID (used to compute Halstead metrics). */
override string toString() { result = "return ..." }
override string getHalsteadID() { result = "ReturnStmt" }
override string getAPrimaryQlClass() { result = "ReturnStmt" }
@@ -543,10 +543,10 @@ class ThrowStmt extends Stmt, @throwstmt {
/** Gets the expression thrown by this `throw` statement. */
Expr getExpr() { result.getParent() = this }
/** Gets a printable representation of this statement. May include more detail than `toString()`. */
override string pp() { result = "throw ..." }
/** This statement's Halstead ID (used to compute Halstead metrics). */
override string toString() { result = "throw ..." }
override string getHalsteadID() { result = "ThrowStmt" }
/** Gets the type of the expression thrown by this `throw` statement. */
@@ -638,12 +638,12 @@ class BreakStmt extends Stmt, @breakstmt {
/** Holds if this `break` statement has an explicit label. */
predicate hasLabel() { exists(string s | s = this.getLabel()) }
/** Gets a printable representation of this statement. May include more detail than `toString()`. */
override string pp() {
if this.hasLabel() then result = "break " + this.getLabel() else result = "break"
}
/** This statement's Halstead ID (used to compute Halstead metrics). */
override string toString() { result = "break" }
override string getHalsteadID() { result = "BreakStmt" }
override string getAPrimaryQlClass() { result = "BreakStmt" }
@@ -660,6 +660,8 @@ class YieldStmt extends Stmt, @yieldstmt {
override string pp() { result = "yield ..." }
override string toString() { result = "yield ..." }
override string getHalsteadID() { result = "YieldStmt" }
override string getAPrimaryQlClass() { result = "YieldStmt" }
@@ -673,12 +675,12 @@ class ContinueStmt extends Stmt, @continuestmt {
/** Holds if this `continue` statement has an explicit label. */
predicate hasLabel() { exists(string s | s = this.getLabel()) }
/** Gets a printable representation of this statement. May include more detail than `toString()`. */
override string pp() {
if this.hasLabel() then result = "continue " + this.getLabel() else result = "continue"
}
/** This statement's Halstead ID (used to compute Halstead metrics). */
override string toString() { result = "continue" }
override string getHalsteadID() { result = "ContinueStmt" }
override string getAPrimaryQlClass() { result = "ContinueStmt" }
@@ -686,10 +688,10 @@ class ContinueStmt extends Stmt, @continuestmt {
/** The empty statement. */
class EmptyStmt extends Stmt, @emptystmt {
/** Gets a printable representation of this statement. May include more detail than `toString()`. */
override string pp() { result = ";" }
/** This statement's Halstead ID (used to compute Halstead metrics). */
override string toString() { result = ";" }
override string getHalsteadID() { result = "EmptyStmt" }
override string getAPrimaryQlClass() { result = "EmptyStmt" }
@@ -704,10 +706,10 @@ class ExprStmt extends Stmt, @exprstmt {
/** Gets the expression of this expression statement. */
Expr getExpr() { result.getParent() = this }
/** Gets a printable representation of this statement. May include more detail than `toString()`. */
override string pp() { result = "...;" }
override string pp() { result = "<Expr>;" }
override string toString() { result = "<Expr>;" }
/** This statement's Halstead ID (used to compute Halstead metrics). */
override string getHalsteadID() { result = "ExprStmt" }
/** Holds if this statement represents a field declaration with an initializer. */
@@ -733,12 +735,12 @@ class LabeledStmt extends Stmt, @labeledstmt {
/** Gets the label of this labeled statement. */
string getLabel() { namestrings(result, _, this) }
/** Gets a printable representation of this statement. May include more detail than `toString()`. */
override string pp() { result = this.getLabel() + ": " + this.getStmt().pp() }
/** This statement's Halstead ID (used to compute Halstead metrics). */
override string getHalsteadID() { result = this.getLabel() + ":" }
override string toString() { result = "<Label>: ..." }
override string getAPrimaryQlClass() { result = "LabeledStmt" }
}
@@ -750,12 +752,12 @@ class AssertStmt extends Stmt, @assertstmt {
/** Gets the assertion message expression, if any. */
Expr getMessage() { exprs(result, _, _, this, _) and result.getIndex() = 1 }
/** Gets a printable representation of this statement. May include more detail than `toString()`. */
override string pp() {
if exists(this.getMessage()) then result = "assert ... : ..." else result = "assert ..."
}
/** This statement's Halstead ID (used to compute Halstead metrics). */
override string toString() { result = "assert ..." }
override string getHalsteadID() { result = "AssertStmt" }
override string getAPrimaryQlClass() { result = "AssertStmt" }
@@ -775,10 +777,10 @@ class LocalVariableDeclStmt extends Stmt, @localvariabledeclstmt {
/** Gets an index of a variable declared in this local variable declaration statement. */
int getAVariableIndex() { exists(getVariable(result)) }
/** Gets a printable representation of this statement. May include more detail than `toString()`. */
override string pp() { result = "local variable declaration" }
override string pp() { result = "var ...;" }
override string toString() { result = "var ...;" }
/** This statement's Halstead ID (used to compute Halstead metrics). */
override string getHalsteadID() { result = "LocalVariableDeclStmt" }
override string getAPrimaryQlClass() { result = "LocalVariableDeclStmt" }
@@ -789,10 +791,10 @@ class LocalClassDeclStmt extends Stmt, @localclassdeclstmt {
/** Gets the local class declared by this statement. */
LocalClass getLocalClass() { isLocalClass(result, this) }
/** Gets a printable representation of this statement. May include more detail than `toString()`. */
override string pp() { result = "local class declaration: " + this.getLocalClass().toString() }
override string pp() { result = "class " + this.getLocalClass().toString() }
override string toString() { result = "class ..." }
/** This statement's Halstead ID (used to compute Halstead metrics). */
override string getHalsteadID() { result = "LocalClassDeclStmt" }
override string getAPrimaryQlClass() { result = "LocalClassDeclStmt" }
@@ -829,13 +831,10 @@ class ThisConstructorInvocationStmt extends Stmt, ConstructorCall, @constructori
/** Gets the immediately enclosing statement of this constructor invocation. */
override Stmt getEnclosingStmt() { result = this }
/** Gets a printable representation of this statement. May include more detail than `toString()`. */
override string pp() { result = "this(...)" }
/** Gets a printable representation of this statement. */
override string toString() { result = pp() }
override string toString() { result = "this(...)" }
/** This statement's Halstead ID (used to compute Halstead metrics). */
override string getHalsteadID() { result = "ConstructorInvocationStmt" }
override string getAPrimaryQlClass() { result = "ThisConstructorInvocationStmt" }
@@ -873,13 +872,10 @@ class SuperConstructorInvocationStmt extends Stmt, ConstructorCall, @superconstr
/** Gets the immediately enclosing statement of this constructor invocation. */
override Stmt getEnclosingStmt() { result = this }
/** Gets a printable representation of this statement. May include more detail than `toString()`. */
override string pp() { result = "super(...)" }
/** Gets a printable representation of this statement. */
override string toString() { result = pp() }
override string toString() { result = "super(...)" }
/** This statement's Halstead ID (used to compute Halstead metrics). */
override string getHalsteadID() { result = "SuperConstructorInvocationStmt" }
override string getAPrimaryQlClass() { result = "SuperConstructorInvocationStmt" }

200
java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll
View File

@@ -68,6 +68,7 @@ import java
private import semmle.code.java.dataflow.DataFlow::DataFlow
private import internal.DataFlowPrivate
private import internal.FlowSummaryImpl::Private::External
private import internal.FlowSummaryImplSpecific
private import FlowSummary
/**
@@ -75,6 +76,7 @@ private import FlowSummary
* ensuring that they are visible to the taint tracking / data flow library.
*/
private module Frameworks {
private import internal.ContainerFlow
private import semmle.code.java.frameworks.ApacheHttp
private import semmle.code.java.frameworks.apache.Lang
private import semmle.code.java.frameworks.guava.Guava
@@ -84,6 +86,7 @@ private module Frameworks {
private import semmle.code.java.security.XSS
private import semmle.code.java.security.LdapInjection
private import semmle.code.java.security.XPath
private import semmle.code.java.security.JexlInjection
}
private predicate sourceModelCsv(string row) {
@@ -359,7 +362,8 @@ private predicate summaryModel(string row) {
any(SummaryModelCsv s).row(row)
}
private predicate sourceModel(
/** Holds if a source model exists for the given parameters. */
predicate sourceModel(
string namespace, string type, boolean subtypes, string name, string signature, string ext,
string output, string kind
) {
@@ -377,7 +381,8 @@ private predicate sourceModel(
)
}
private predicate sinkModel(
/** Holds if a sink model exists for the given parameters. */
predicate sinkModel(
string namespace, string type, boolean subtypes, string name, string signature, string ext,
string input, string kind
) {
@@ -395,7 +400,8 @@ private predicate sinkModel(
)
}
private predicate summaryModel(
/** Holds if a summary model exists for the given parameters. */
predicate summaryModel(
string namespace, string type, boolean subtypes, string name, string signature, string ext,
string input, string output, string kind
) {
@@ -482,7 +488,7 @@ module CsvValidation {
not namespace.regexpMatch("[a-zA-Z0-9_\\.]+") and
msg = "Dubious namespace \"" + namespace + "\" in " + pred + " model."
or
not type.regexpMatch("[a-zA-Z0-9_\\$]+") and
not type.regexpMatch("[a-zA-Z0-9_\\$<>]+") and
msg = "Dubious type \"" + type + "\" in " + pred + " model."
or
not name.regexpMatch("[a-zA-Z0-9_]*") and
@@ -566,7 +572,7 @@ private RefType interpretType(string namespace, string type, boolean subtypes) {
private string paramsStringPart(Callable c, int i) {
i = -1 and result = "("
or
exists(int n, string p | c.getParameterType(n).toString() = p |
exists(int n, string p | c.getParameterType(n).getErasure().toString() = p |
i = 2 * n and result = p
or
i = 2 * n - 1 and result = "," and n != 0
@@ -600,7 +606,8 @@ private Element interpretElement0(
)
}
private Element interpretElement(
/** Gets the source/sink/summary element corresponding to the supplied parameters. */
Element interpretElement(
string namespace, string type, boolean subtypes, string name, string signature, string ext
) {
elementSpec(namespace, type, subtypes, name, signature, ext) and
@@ -611,166 +618,25 @@ private Element interpretElement(
)
}
private predicate sourceElement(Element e, string output, string kind) {
exists(
string namespace, string type, boolean subtypes, string name, string signature, string ext
|
sourceModel(namespace, type, subtypes, name, signature, ext, output, kind) and
e = interpretElement(namespace, type, subtypes, name, signature, ext)
)
cached
private module Cached {
/**
* Holds if `node` is specified as a source with the given kind in a CSV flow
* model.
*/
cached
predicate sourceNode(Node node, string kind) {
exists(InterpretNode n | isSourceNode(n, kind) and n.asNode() = node)
}
/**
* Holds if `node` is specified as a sink with the given kind in a CSV flow
* model.
*/
cached
predicate sinkNode(Node node, string kind) {
exists(InterpretNode n | isSinkNode(n, kind) and n.asNode() = node)
}
}
private predicate sinkElement(Element e, string input, string kind) {
exists(
string namespace, string type, boolean subtypes, string name, string signature, string ext
|
sinkModel(namespace, type, subtypes, name, signature, ext, input, kind) and
e = interpretElement(namespace, type, subtypes, name, signature, ext)
)
}
/**
* Holds if an external flow summary exists for `e` with input specification
* `input`, output specification `output`, and kind `kind`.
*/
predicate summaryElement(Element e, string input, string output, string kind) {
exists(
string namespace, string type, boolean subtypes, string name, string signature, string ext
|
summaryModel(namespace, type, subtypes, name, signature, ext, input, output, kind) and
e = interpretElement(namespace, type, subtypes, name, signature, ext)
)
}
/** Gets a specification used in a source model, sink model, or summary model. */
string inOutSpec() {
sourceModel(_, _, _, _, _, _, result, _) or
sinkModel(_, _, _, _, _, _, result, _) or
summaryModel(_, _, _, _, _, _, result, _, _) or
summaryModel(_, _, _, _, _, _, _, result, _)
}
private predicate inputNeedsReference(string c) {
c = "Argument" or
parseArg(c, _)
}
private predicate outputNeedsReference(string c) {
c = "Argument" or
parseArg(c, _) or
c = "ReturnValue"
}
private predicate sourceElementRef(Top ref, string output, string kind) {
exists(Element e |
sourceElement(e, output, kind) and
if outputNeedsReference(specLast(output))
then ref.(Call).getCallee().getSourceDeclaration() = e
else ref = e
)
}
private predicate sinkElementRef(Top ref, string input, string kind) {
exists(Element e |
sinkElement(e, input, kind) and
if inputNeedsReference(specLast(input))
then ref.(Call).getCallee().getSourceDeclaration() = e
else ref = e
)
}
private predicate summaryElementRef(Top ref, string input, string output, string kind) {
exists(Element e |
summaryElement(e, input, output, kind) and
if inputNeedsReference(specLast(input))
then ref.(Call).getCallee().getSourceDeclaration() = e
else ref = e
)
}
private newtype TAstOrNode =
TAst(Top t) or
TNode(Node n)
private predicate interpretOutput(string output, int idx, Top ref, TAstOrNode node) {
(
sourceElementRef(ref, output, _) or
summaryElementRef(ref, _, output, _)
) and
specLength(output, idx) and
node = TAst(ref)
or
exists(Top mid, string c, Node n |
interpretOutput(output, idx + 1, ref, TAst(mid)) and
specSplit(output, c, idx) and
node = TNode(n)
|
exists(int pos | n.(PostUpdateNode).getPreUpdateNode().(ArgumentNode).argumentOf(mid, pos) |
c = "Argument" or parseArg(c, pos)
)
or
exists(int pos | n.(ParameterNode).isParameterOf(mid, pos) |
c = "Parameter" or parseParam(c, pos)
)
or
(c = "Parameter" or c = "") and
n.asParameter() = mid
or
c = "ReturnValue" and
n.asExpr().(Call) = mid
or
c = "" and
n.asExpr().(FieldRead).getField() = mid
)
}
private predicate interpretInput(string input, int idx, Top ref, TAstOrNode node) {
(
sinkElementRef(ref, input, _) or
summaryElementRef(ref, input, _, _)
) and
specLength(input, idx) and
node = TAst(ref)
or
exists(Top mid, string c, Node n |
interpretInput(input, idx + 1, ref, TAst(mid)) and
specSplit(input, c, idx) and
node = TNode(n)
|
exists(int pos | n.(ArgumentNode).argumentOf(mid, pos) | c = "Argument" or parseArg(c, pos))
or
exists(ReturnStmt ret |
c = "ReturnValue" and
n.asExpr() = ret.getResult() and
mid = ret.getEnclosingCallable()
)
or
exists(FieldWrite fw |
c = "" and
fw.getField() = mid and
n.asExpr() = fw.getRHS()
)
)
}
/**
* Holds if `node` is specified as a source with the given kind in a CSV flow
* model.
*/
predicate sourceNode(Node node, string kind) {
exists(Top ref, string output |
sourceElementRef(ref, output, kind) and
interpretOutput(output, 0, ref, TNode(node))
)
}
/**
* Holds if `node` is specified as a sink with the given kind in a CSV flow
* model.
*/
predicate sinkNode(Node node, string kind) {
exists(Top ref, string input |
sinkElementRef(ref, input, kind) and
interpretInput(input, 0, ref, TNode(node))
)
}
import Cached

338
java/ql/src/semmle/code/java/dataflow/internal/ContainerFlow.qll
View File

@@ -1,6 +1,9 @@
import java
import semmle.code.java.Collections
import semmle.code.java.Maps
private import semmle.code.java.dataflow.SSA
private import DataFlowUtil
private import semmle.code.java.dataflow.ExternalFlow
private class EntryType extends RefType {
EntryType() {
@@ -88,6 +91,286 @@ class ContainerType extends RefType {
}
}
private class ContainerFlowSummaries extends SummaryModelCsv {
override predicate row(string row) {
row =
[
"java.util;Map<>$Entry;true;getValue;;;MapValue of Argument[-1];ReturnValue;value",
"java.util;Map<>$Entry;true;setValue;;;MapValue of Argument[-1];ReturnValue;value",
"java.util;Map<>$Entry;true;setValue;;;Argument[0];MapValue of Argument[-1];value",
"java.lang;Iterable;true;iterator;();;Element of Argument[-1];Element of ReturnValue;value",
"java.lang;Iterable;true;spliterator;();;Element of Argument[-1];Element of ReturnValue;value",
"java.util;Iterator;true;next;;;Element of Argument[-1];ReturnValue;value",
"java.util;ListIterator;true;previous;;;Element of Argument[-1];ReturnValue;value",
"java.util;ListIterator;true;add;(Object);;Argument[0];Element of Argument[-1];value",
"java.util;ListIterator;true;set;(Object);;Argument[0];Element of Argument[-1];value",
"java.util;Enumeration;true;asIterator;;;Element of Argument[-1];Element of ReturnValue;value",
"java.util;Enumeration;true;nextElement;;;Element of Argument[-1];ReturnValue;value",
"java.util;Map;true;computeIfAbsent;;;MapValue of Argument[-1];ReturnValue;value",
"java.util;Map;true;computeIfAbsent;;;ReturnValue of Argument[1];ReturnValue;value",
"java.util;Map;true;computeIfAbsent;;;ReturnValue of Argument[1];MapValue of Argument[-1];value",
"java.util;Map;true;entrySet;;;MapValue of Argument[-1];MapValue of Element of ReturnValue;value",
"java.util;Map;true;entrySet;;;MapKey of Argument[-1];MapKey of Element of ReturnValue;value",
"java.util;Map;true;get;;;MapValue of Argument[-1];ReturnValue;value",
"java.util;Map;true;getOrDefault;;;MapValue of Argument[-1];ReturnValue;value",
"java.util;Map;true;getOrDefault;;;Argument[1];ReturnValue;value",
"java.util;Map;true;put;;;MapValue of Argument[-1];ReturnValue;value",
"java.util;Map;true;put;;;Argument[0];MapKey of Argument[-1];value",
"java.util;Map;true;put;;;Argument[1];MapValue of Argument[-1];value",
"java.util;Map;true;putIfAbsent;;;MapValue of Argument[-1];ReturnValue;value",
"java.util;Map;true;putIfAbsent;;;Argument[0];MapKey of Argument[-1];value",
"java.util;Map;true;putIfAbsent;;;Argument[1];MapValue of Argument[-1];value",
"java.util;Map;true;remove;(Object);;MapValue of Argument[-1];ReturnValue;value",
"java.util;Map;true;replace;(Object,Object);;MapValue of Argument[-1];ReturnValue;value",
"java.util;Map;true;replace;(Object,Object);;Argument[0];MapKey of Argument[-1];value",
"java.util;Map;true;replace;(Object,Object);;Argument[1];MapValue of Argument[-1];value",
"java.util;Map;true;replace;(Object,Object,Object);;Argument[0];MapKey of Argument[-1];value",
"java.util;Map;true;replace;(Object,Object,Object);;Argument[2];MapValue of Argument[-1];value",
"java.util;Map;true;keySet;();;MapKey of Argument[-1];Element of ReturnValue;value",
"java.util;Map;true;values;();;MapValue of Argument[-1];Element of ReturnValue;value",
"java.util;Map;true;merge;(Object,Object,BiFunction);;Argument[1];MapValue of Argument[-1];value",
"java.util;Map;true;putAll;(Map);;MapKey of Argument[0];MapKey of Argument[-1];value",
"java.util;Map;true;putAll;(Map);;MapValue of Argument[0];MapValue of Argument[-1];value",
"java.util;Collection;true;parallelStream;();;Element of Argument[-1];Element of ReturnValue;value",
"java.util;Collection;true;stream;();;Element of Argument[-1];Element of ReturnValue;value",
"java.util;Collection;true;toArray;;;Element of Argument[-1];ArrayElement of ReturnValue;value",
"java.util;Collection;true;toArray;;;Element of Argument[-1];ArrayElement of Argument[0];value",
"java.util;Collection;true;add;;;Argument[0];Element of Argument[-1];value",
"java.util;Collection;true;addAll;;;Element of Argument[0];Element of Argument[-1];value",
"java.util;List;true;get;(int);;Element of Argument[-1];ReturnValue;value",
"java.util;List;true;listIterator;;;Element of Argument[-1];Element of ReturnValue;value",
"java.util;List;true;remove;(int);;Element of Argument[-1];ReturnValue;value",
"java.util;List;true;set;(int,Object);;Element of Argument[-1];ReturnValue;value",
"java.util;List;true;set;(int,Object);;Argument[1];Element of Argument[-1];value",
"java.util;List;true;subList;;;Element of Argument[-1];Element of ReturnValue;value",
"java.util;List;true;add;(int,Object);;Argument[1];Element of Argument[-1];value",
"java.util;List;true;addAll;(int,Collection);;Element of Argument[1];Element of Argument[-1];value",
"java.util;Vector;true;elementAt;(int);;Element of Argument[-1];ReturnValue;value",
"java.util;Vector;true;elements;();;Element of Argument[-1];Element of ReturnValue;value",
"java.util;Vector;true;firstElement;();;Element of Argument[-1];ReturnValue;value",
"java.util;Vector;true;lastElement;();;Element of Argument[-1];ReturnValue;value",
"java.util;Vector;true;addElement;(Object);;Argument[0];Element of Argument[-1];value",
"java.util;Vector;true;insertElementAt;(Object,int);;Argument[0];Element of Argument[-1];value",
"java.util;Vector;true;setElementAt;(Object,int);;Argument[0];Element of Argument[-1];value",
"java.util;Vector;true;copyInto;(Object[]);;Element of Argument[-1];ArrayElement of Argument[0];value",
"java.util;Stack;true;peek;();;Element of Argument[-1];ReturnValue;value",
"java.util;Stack;true;pop;();;Element of Argument[-1];ReturnValue;value",
"java.util;Stack;true;push;(Object);;Argument[0];Element of Argument[-1];value",
"java.util;Queue;true;element;();;Element of Argument[-1];ReturnValue;value",
"java.util;Queue;true;peek;();;Element of Argument[-1];ReturnValue;value",
"java.util;Queue;true;poll;();;Element of Argument[-1];ReturnValue;value",
"java.util;Queue;true;remove;();;Element of Argument[-1];ReturnValue;value",
"java.util;Queue;true;offer;(Object);;Argument[0];Element of Argument[-1];value",
"java.util;Deque;true;descendingIterator;();;Element of Argument[-1];Element of ReturnValue;value",
"java.util;Deque;true;getFirst;();;Element of Argument[-1];ReturnValue;value",
"java.util;Deque;true;getLast;();;Element of Argument[-1];ReturnValue;value",
"java.util;Deque;true;peekFirst;();;Element of Argument[-1];ReturnValue;value",
"java.util;Deque;true;peekLast;();;Element of Argument[-1];ReturnValue;value",
"java.util;Deque;true;pollFirst;();;Element of Argument[-1];ReturnValue;value",
"java.util;Deque;true;pollLast;();;Element of Argument[-1];ReturnValue;value",
"java.util;Deque;true;pop;();;Element of Argument[-1];ReturnValue;value",
"java.util;Deque;true;removeFirst;();;Element of Argument[-1];ReturnValue;value",
"java.util;Deque;true;removeLast;();;Element of Argument[-1];ReturnValue;value",
"java.util;Deque;true;push;(Object);;Argument[0];Element of Argument[-1];value",
"java.util;Deque;true;offerLast;(Object);;Argument[0];Element of Argument[-1];value",
"java.util;Deque;true;offerFirst;(Object);;Argument[0];Element of Argument[-1];value",
"java.util;Deque;true;addLast;(Object);;Argument[0];Element of Argument[-1];value",
"java.util;Deque;true;addFirst;(Object);;Argument[0];Element of Argument[-1];value",
"java.util.concurrent;BlockingDeque;true;pollFirst;(long,TimeUnit);;Element of Argument[-1];ReturnValue;value",
"java.util.concurrent;BlockingDeque;true;pollLast;(long,TimeUnit);;Element of Argument[-1];ReturnValue;value",
"java.util.concurrent;BlockingDeque;true;takeFirst;();;Element of Argument[-1];ReturnValue;value",
"java.util.concurrent;BlockingDeque;true;takeLast;();;Element of Argument[-1];ReturnValue;value",
"java.util.concurrent;BlockingQueue;true;poll;(long,TimeUnit);;Element of Argument[-1];ReturnValue;value",
"java.util.concurrent;BlockingQueue;true;take;();;Element of Argument[-1];ReturnValue;value",
"java.util.concurrent;BlockingQueue;true;offer;(Object,long,TimeUnit);;Argument[0];Element of Argument[-1];value",
"java.util.concurrent;BlockingQueue;true;put;(Object);;Argument[0];Element of Argument[-1];value",
"java.util.concurrent;BlockingDeque;true;offerLast;(Object,long,TimeUnit);;Argument[0];Element of Argument[-1];value",
"java.util.concurrent;BlockingDeque;true;offerFirst;(Object,long,TimeUnit);;Argument[0];Element of Argument[-1];value",
"java.util.concurrent;BlockingDeque;true;putLast;(Object);;Argument[0];Element of Argument[-1];value",
"java.util.concurrent;BlockingDeque;true;putFirst;(Object);;Argument[0];Element of Argument[-1];value",
"java.util.concurrent;BlockingQueue;true;drainTo;(Collection,int);;Element of Argument[-1];Element of Argument[0];value",
"java.util.concurrent;BlockingQueue;true;drainTo;(Collection);;Element of Argument[-1];Element of Argument[0];value",
"java.util.concurrent;ConcurrentHashMap;true;elements;();;MapValue of Argument[-1];Element of ReturnValue;value",
"java.util;Dictionary;true;elements;();;MapValue of Argument[-1];Element of ReturnValue;value",
"java.util;Dictionary;true;get;(Object);;MapValue of Argument[-1];ReturnValue;value",
"java.util;Dictionary;true;put;(Object,Object);;MapValue of Argument[-1];ReturnValue;value",
"java.util;Dictionary;true;put;(Object,Object);;Argument[0];MapKey of Argument[-1];value",
"java.util;Dictionary;true;put;(Object,Object);;Argument[1];MapValue of Argument[-1];value",
"java.util;Dictionary;true;remove;(Object);;MapValue of Argument[-1];ReturnValue;value",
"java.util;NavigableMap;true;ceilingEntry;(Object);;MapKey of Argument[-1];MapKey of ReturnValue;value",
"java.util;NavigableMap;true;ceilingEntry;(Object);;MapValue of Argument[-1];MapValue of ReturnValue;value",
"java.util;NavigableMap;true;descendingMap;();;MapKey of Argument[-1];MapKey of ReturnValue;value",
"java.util;NavigableMap;true;descendingMap;();;MapValue of Argument[-1];MapValue of ReturnValue;value",
"java.util;NavigableMap;true;firstEntry;();;MapKey of Argument[-1];MapKey of ReturnValue;value",
"java.util;NavigableMap;true;firstEntry;();;MapValue of Argument[-1];MapValue of ReturnValue;value",
"java.util;NavigableMap;true;floorEntry;(Object);;MapKey of Argument[-1];MapKey of ReturnValue;value",
"java.util;NavigableMap;true;floorEntry;(Object);;MapValue of Argument[-1];MapValue of ReturnValue;value",
"java.util;NavigableMap;true;headMap;(Object,boolean);;MapKey of Argument[-1];MapKey of ReturnValue;value",
"java.util;NavigableMap;true;headMap;(Object,boolean);;MapValue of Argument[-1];MapValue of ReturnValue;value",
"java.util;NavigableMap;true;higherEntry;(Object);;MapKey of Argument[-1];MapKey of ReturnValue;value",
"java.util;NavigableMap;true;higherEntry;(Object);;MapValue of Argument[-1];MapValue of ReturnValue;value",
"java.util;NavigableMap;true;lastEntry;();;MapKey of Argument[-1];MapKey of ReturnValue;value",
"java.util;NavigableMap;true;lastEntry;();;MapValue of Argument[-1];MapValue of ReturnValue;value",
"java.util;NavigableMap;true;lowerEntry;(Object);;MapKey of Argument[-1];MapKey of ReturnValue;value",
"java.util;NavigableMap;true;lowerEntry;(Object);;MapValue of Argument[-1];MapValue of ReturnValue;value",
"java.util;NavigableMap;true;pollFirstEntry;();;MapKey of Argument[-1];MapKey of ReturnValue;value",
"java.util;NavigableMap;true;pollFirstEntry;();;MapValue of Argument[-1];MapValue of ReturnValue;value",
"java.util;NavigableMap;true;pollLastEntry;();;MapKey of Argument[-1];MapKey of ReturnValue;value",
"java.util;NavigableMap;true;pollLastEntry;();;MapValue of Argument[-1];MapValue of ReturnValue;value",
"java.util;NavigableMap;true;subMap;(Object,boolean,Object,boolean);;MapKey of Argument[-1];MapKey of ReturnValue;value",
"java.util;NavigableMap;true;subMap;(Object,boolean,Object,boolean);;MapValue of Argument[-1];MapValue of ReturnValue;value",
"java.util;NavigableMap;true;tailMap;(Object,boolean);;MapKey of Argument[-1];MapKey of ReturnValue;value",
"java.util;NavigableMap;true;tailMap;(Object,boolean);;MapValue of Argument[-1];MapValue of ReturnValue;value",
"java.util;NavigableSet;true;ceiling;(Object);;Element of Argument[-1];ReturnValue;value",
"java.util;NavigableSet;true;descendingIterator;();;Element of Argument[-1];Element of ReturnValue;value",
"java.util;NavigableSet;true;descendingSet;();;Element of Argument[-1];Element of ReturnValue;value",
"java.util;NavigableSet;true;floor;(Object);;Element of Argument[-1];ReturnValue;value",
"java.util;NavigableSet;true;headSet;(Object,boolean);;Element of Argument[-1];Element of ReturnValue;value",
"java.util;NavigableSet;true;higher;(Object);;Element of Argument[-1];ReturnValue;value",
"java.util;NavigableSet;true;lower;(Object);;Element of Argument[-1];ReturnValue;value",
"java.util;NavigableSet;true;pollFirst;();;Element of Argument[-1];ReturnValue;value",
"java.util;NavigableSet;true;pollLast;();;Element of Argument[-1];ReturnValue;value",
"java.util;NavigableSet;true;subSet;(Object,boolean,Object,boolean);;Element of Argument[-1];Element of ReturnValue;value",
"java.util;NavigableSet;true;tailSet;(Object,boolean);;Element of Argument[-1];Element of ReturnValue;value",
"java.util;Scanner;true;next;(Pattern);;Argument[-1];ReturnValue;taint",
"java.util;Scanner;true;next;(String);;Argument[-1];ReturnValue;taint",
"java.util;SortedMap;true;headMap;(Object);;MapKey of Argument[-1];MapKey of ReturnValue;value",
"java.util;SortedMap;true;headMap;(Object);;MapValue of Argument[-1];MapValue of ReturnValue;value",
"java.util;SortedMap;true;subMap;(Object,Object);;MapKey of Argument[-1];MapKey of ReturnValue;value",
"java.util;SortedMap;true;subMap;(Object,Object);;MapValue of Argument[-1];MapValue of ReturnValue;value",
"java.util;SortedMap;true;tailMap;(Object);;MapKey of Argument[-1];MapKey of ReturnValue;value",
"java.util;SortedMap;true;tailMap;(Object);;MapValue of Argument[-1];MapValue of ReturnValue;value",
"java.util;SortedSet;true;first;();;Element of Argument[-1];ReturnValue;value",
"java.util;SortedSet;true;headSet;(Object);;Element of Argument[-1];Element of ReturnValue;value",
"java.util;SortedSet;true;last;();;Element of Argument[-1];ReturnValue;value",
"java.util;SortedSet;true;subSet;(Object,Object);;Element of Argument[-1];Element of ReturnValue;value",
"java.util;SortedSet;true;tailSet;(Object);;Element of Argument[-1];Element of ReturnValue;value",
"java.util.concurrent;TransferQueue;true;tryTransfer;(Object,long,TimeUnit);;Argument[0];Element of Argument[-1];value",
"java.util.concurrent;TransferQueue;true;transfer;(Object);;Argument[0];Element of Argument[-1];value",
"java.util.concurrent;TransferQueue;true;tryTransfer;(Object);;Argument[0];Element of Argument[-1];value",
"java.util;List;false;copyOf;(Collection);;Element of Argument[0];Element of ReturnValue;value",
"java.util;List;false;of;(Object[]);;ArrayElement of Argument[0];Element of ReturnValue;value",
"java.util;List;false;of;(Object);;Argument[0];Element of ReturnValue;value",
"java.util;List;false;of;(Object,Object);;Argument[0..1];Element of ReturnValue;value",
"java.util;List;false;of;(Object,Object,Object);;Argument[0..2];Element of ReturnValue;value",
"java.util;List;false;of;(Object,Object,Object,Object);;Argument[0..3];Element of ReturnValue;value",
"java.util;List;false;of;(Object,Object,Object,Object,Object);;Argument[0..4];Element of ReturnValue;value",
"java.util;List;false;of;(Object,Object,Object,Object,Object,Object);;Argument[0..5];Element of ReturnValue;value",
"java.util;List;false;of;(Object,Object,Object,Object,Object,Object,Object);;Argument[0..6];Element of ReturnValue;value",
"java.util;List;false;of;(Object,Object,Object,Object,Object,Object,Object,Object);;Argument[0..7];Element of ReturnValue;value",
"java.util;List;false;of;(Object,Object,Object,Object,Object,Object,Object,Object,Object);;Argument[0..8];Element of ReturnValue;value",
"java.util;List;false;of;(Object,Object,Object,Object,Object,Object,Object,Object,Object,Object);;Argument[0..9];Element of ReturnValue;value",
"java.util;Map;false;copyOf;(Map);;MapKey of Argument[0];MapKey of ReturnValue;value",
"java.util;Map;false;copyOf;(Map);;MapValue of Argument[0];MapValue of ReturnValue;value",
"java.util;Map;false;entry;(Object,Object);;Argument[0];MapKey of ReturnValue;value",
"java.util;Map;false;entry;(Object,Object);;Argument[1];MapValue of ReturnValue;value",
"java.util;Map;false;of;;;Argument[0];MapKey of ReturnValue;value",
"java.util;Map;false;of;;;Argument[1];MapValue of ReturnValue;value",
"java.util;Map;false;of;;;Argument[2];MapKey of ReturnValue;value",
"java.util;Map;false;of;;;Argument[3];MapValue of ReturnValue;value",
"java.util;Map;false;of;;;Argument[4];MapKey of ReturnValue;value",
"java.util;Map;false;of;;;Argument[5];MapValue of ReturnValue;value",
"java.util;Map;false;of;;;Argument[6];MapKey of ReturnValue;value",
"java.util;Map;false;of;;;Argument[7];MapValue of ReturnValue;value",
"java.util;Map;false;of;;;Argument[8];MapKey of ReturnValue;value",
"java.util;Map;false;of;;;Argument[9];MapValue of ReturnValue;value",
"java.util;Map;false;of;;;Argument[10];MapKey of ReturnValue;value",
"java.util;Map;false;of;;;Argument[11];MapValue of ReturnValue;value",
"java.util;Map;false;of;;;Argument[12];MapKey of ReturnValue;value",
"java.util;Map;false;of;;;Argument[13];MapValue of ReturnValue;value",
"java.util;Map;false;of;;;Argument[14];MapKey of ReturnValue;value",
"java.util;Map;false;of;;;Argument[15];MapValue of ReturnValue;value",
"java.util;Map;false;of;;;Argument[16];MapKey of ReturnValue;value",
"java.util;Map;false;of;;;Argument[17];MapValue of ReturnValue;value",
"java.util;Map;false;of;;;Argument[18];MapKey of ReturnValue;value",
"java.util;Map;false;of;;;Argument[19];MapValue of ReturnValue;value",
"java.util;Map;false;ofEntries;;;MapKey of ArrayElement of Argument[0];MapKey of ReturnValue;value",
"java.util;Map;false;ofEntries;;;MapValue of ArrayElement of Argument[0];MapValue of ReturnValue;value",
"java.util;Set;false;copyOf;(Collection);;Element of Argument[0];Element of ReturnValue;value",
"java.util;Set;false;of;(Object[]);;ArrayElement of Argument[0];Element of ReturnValue;value",
"java.util;Set;false;of;(Object);;Argument[0];Element of ReturnValue;value",
"java.util;Set;false;of;(Object,Object);;Argument[0..1];Element of ReturnValue;value",
"java.util;Set;false;of;(Object,Object,Object);;Argument[0..2];Element of ReturnValue;value",
"java.util;Set;false;of;(Object,Object,Object,Object);;Argument[0..3];Element of ReturnValue;value",
"java.util;Set;false;of;(Object,Object,Object,Object,Object);;Argument[0..4];Element of ReturnValue;value",
"java.util;Set;false;of;(Object,Object,Object,Object,Object,Object);;Argument[0..5];Element of ReturnValue;value",
"java.util;Set;false;of;(Object,Object,Object,Object,Object,Object,Object);;Argument[0..6];Element of ReturnValue;value",
"java.util;Set;false;of;(Object,Object,Object,Object,Object,Object,Object,Object);;Argument[0..7];Element of ReturnValue;value",
"java.util;Set;false;of;(Object,Object,Object,Object,Object,Object,Object,Object,Object);;Argument[0..8];Element of ReturnValue;value",
"java.util;Set;false;of;(Object,Object,Object,Object,Object,Object,Object,Object,Object,Object);;Argument[0..9];Element of ReturnValue;value",
"java.util;Arrays;false;stream;;;ArrayElement of Argument[0];Element of ReturnValue;value",
"java.util;Arrays;false;spliterator;;;ArrayElement of Argument[0];Element of ReturnValue;value",
"java.util;Arrays;false;copyOfRange;;;ArrayElement of Argument[0];ArrayElement of ReturnValue;value",
"java.util;Arrays;false;copyOf;;;ArrayElement of Argument[0];ArrayElement of ReturnValue;value",
"java.util;Collections;false;list;(Enumeration);;Element of Argument[0];Element of ReturnValue;value",
"java.util;Collections;false;enumeration;(Collection);;Element of Argument[0];Element of ReturnValue;value",
"java.util;Collections;false;nCopies;(int,Object);;Argument[1];Element of ReturnValue;value",
"java.util;Collections;false;singletonMap;(Object,Object);;Argument[0];MapKey of ReturnValue;value",
"java.util;Collections;false;singletonMap;(Object,Object);;Argument[1];MapValue of ReturnValue;value",
"java.util;Collections;false;singletonList;(Object);;Argument[0];Element of ReturnValue;value",
"java.util;Collections;false;singleton;(Object);;Argument[0];Element of ReturnValue;value",
"java.util;Collections;false;checkedNavigableMap;(NavigableMap,Class,Class);;MapKey of Argument[0];MapKey of ReturnValue;value",
"java.util;Collections;false;checkedNavigableMap;(NavigableMap,Class,Class);;MapValue of Argument[0];MapValue of ReturnValue;value",
"java.util;Collections;false;checkedSortedMap;(SortedMap,Class,Class);;MapKey of Argument[0];MapKey of ReturnValue;value",
"java.util;Collections;false;checkedSortedMap;(SortedMap,Class,Class);;MapValue of Argument[0];MapValue of ReturnValue;value",
"java.util;Collections;false;checkedMap;(Map,Class,Class);;MapKey of Argument[0];MapKey of ReturnValue;value",
"java.util;Collections;false;checkedMap;(Map,Class,Class);;MapValue of Argument[0];MapValue of ReturnValue;value",
"java.util;Collections;false;checkedList;(List,Class);;Element of Argument[0];Element of ReturnValue;value",
"java.util;Collections;false;checkedNavigableSet;(NavigableSet,Class);;Element of Argument[0];Element of ReturnValue;value",
"java.util;Collections;false;checkedSortedSet;(SortedSet,Class);;Element of Argument[0];Element of ReturnValue;value",
"java.util;Collections;false;checkedSet;(Set,Class);;Element of Argument[0];Element of ReturnValue;value",
"java.util;Collections;false;checkedCollection;(Collection,Class);;Element of Argument[0];Element of ReturnValue;value",
"java.util;Collections;false;synchronizedNavigableMap;(NavigableMap);;MapKey of Argument[0];MapKey of ReturnValue;value",
"java.util;Collections;false;synchronizedNavigableMap;(NavigableMap);;MapValue of Argument[0];MapValue of ReturnValue;value",
"java.util;Collections;false;synchronizedSortedMap;(SortedMap);;MapKey of Argument[0];MapKey of ReturnValue;value",
"java.util;Collections;false;synchronizedSortedMap;(SortedMap);;MapValue of Argument[0];MapValue of ReturnValue;value",
"java.util;Collections;false;synchronizedMap;(Map);;MapKey of Argument[0];MapKey of ReturnValue;value",
"java.util;Collections;false;synchronizedMap;(Map);;MapValue of Argument[0];MapValue of ReturnValue;value",
"java.util;Collections;false;synchronizedList;(List);;Element of Argument[0];Element of ReturnValue;value",
"java.util;Collections;false;synchronizedNavigableSet;(NavigableSet);;Element of Argument[0];Element of ReturnValue;value",
"java.util;Collections;false;synchronizedSortedSet;(SortedSet);;Element of Argument[0];Element of ReturnValue;value",
"java.util;Collections;false;synchronizedSet;(Set);;Element of Argument[0];Element of ReturnValue;value",
"java.util;Collections;false;synchronizedCollection;(Collection);;Element of Argument[0];Element of ReturnValue;value",
"java.util;Collections;false;unmodifiableNavigableMap;(NavigableMap);;MapKey of Argument[0];MapKey of ReturnValue;value",
"java.util;Collections;false;unmodifiableNavigableMap;(NavigableMap);;MapValue of Argument[0];MapValue of ReturnValue;value",
"java.util;Collections;false;unmodifiableSortedMap;(SortedMap);;MapKey of Argument[0];MapKey of ReturnValue;value",
"java.util;Collections;false;unmodifiableSortedMap;(SortedMap);;MapValue of Argument[0];MapValue of ReturnValue;value",
"java.util;Collections;false;unmodifiableMap;(Map);;MapKey of Argument[0];MapKey of ReturnValue;value",
"java.util;Collections;false;unmodifiableMap;(Map);;MapValue of Argument[0];MapValue of ReturnValue;value",
"java.util;Collections;false;unmodifiableList;(List);;Element of Argument[0];Element of ReturnValue;value",
"java.util;Collections;false;unmodifiableNavigableSet;(NavigableSet);;Element of Argument[0];Element of ReturnValue;value",
"java.util;Collections;false;unmodifiableSortedSet;(SortedSet);;Element of Argument[0];Element of ReturnValue;value",
"java.util;Collections;false;unmodifiableSet;(Set);;Element of Argument[0];Element of ReturnValue;value",
"java.util;Collections;false;unmodifiableCollection;(Collection);;Element of Argument[0];Element of ReturnValue;value",
"java.util;Collections;false;max;;;Element of Argument[0];ReturnValue;value",
"java.util;Collections;false;min;;;Element of Argument[0];ReturnValue;value",
"java.util;Arrays;false;fill;(Object[],int,int,Object);;Argument[3];ArrayElement of Argument[0];value",
"java.util;Arrays;false;fill;(Object[],Object);;Argument[1];ArrayElement of Argument[0];value",
"java.util;Arrays;false;fill;(float[],int,int,float);;Argument[3];ArrayElement of Argument[0];value",
"java.util;Arrays;false;fill;(float[],float);;Argument[1];ArrayElement of Argument[0];value",
"java.util;Arrays;false;fill;(double[],int,int,double);;Argument[3];ArrayElement of Argument[0];value",
"java.util;Arrays;false;fill;(double[],double);;Argument[1];ArrayElement of Argument[0];value",
"java.util;Arrays;false;fill;(boolean[],int,int,boolean);;Argument[3];ArrayElement of Argument[0];value",
"java.util;Arrays;false;fill;(boolean[],boolean);;Argument[1];ArrayElement of Argument[0];value",
"java.util;Arrays;false;fill;(byte[],int,int,byte);;Argument[3];ArrayElement of Argument[0];value",
"java.util;Arrays;false;fill;(byte[],byte);;Argument[1];ArrayElement of Argument[0];value",
"java.util;Arrays;false;fill;(char[],int,int,char);;Argument[3];ArrayElement of Argument[0];value",
"java.util;Arrays;false;fill;(char[],char);;Argument[1];ArrayElement of Argument[0];value",
"java.util;Arrays;false;fill;(short[],int,int,short);;Argument[3];ArrayElement of Argument[0];value",
"java.util;Arrays;false;fill;(short[],short);;Argument[1];ArrayElement of Argument[0];value",
"java.util;Arrays;false;fill;(int[],int,int,int);;Argument[3];ArrayElement of Argument[0];value",
"java.util;Arrays;false;fill;(int[],int);;Argument[1];ArrayElement of Argument[0];value",
"java.util;Arrays;false;fill;(long[],int,int,long);;Argument[3];ArrayElement of Argument[0];value",
"java.util;Arrays;false;fill;(long[],long);;Argument[1];ArrayElement of Argument[0];value",
"java.util;Collections;false;replaceAll;(List,Object,Object);;Argument[2];Element of Argument[0];value",
"java.util;Collections;false;copy;(List,List);;Element of Argument[1];Element of Argument[0];value",
"java.util;Collections;false;fill;(List,Object);;Argument[1];Element of Argument[0];value",
"java.util;Arrays;false;asList;;;ArrayElement of Argument[0];Element of ReturnValue;value",
"java.util;Collections;false;addAll;(Collection,Object[]);;ArrayElement of Argument[1];Element of Argument[0];value"
]
}
}
private predicate taintPreservingQualifierToMethod(Method m) {
// java.util.Map.Entry
m.getDeclaringType() instanceof EntryType and
@@ -426,3 +709,58 @@ predicate containerStep(Expr n1, Expr n2) {
containerReturnValueStep(n1, n2) or
containerUpdateStep(n1, n2)
}
/**
* Holds if the step from `node1` to `node2` stores a value in an array.
* This covers array assignments and initializers as well as implicit array
* creations for varargs.
*/
predicate arrayStoreStep(Node node1, Node node2) {
exists(Argument arg |
node1.asExpr() = arg and
arg.isVararg() and
node2.(ImplicitVarargsArray).getCall() = arg.getCall()
)
or
node2.asExpr().(ArrayInit).getAnInit() = node1.asExpr()
or
exists(Assignment assign | assign.getSource() = node1.asExpr() |
node2.(PostUpdateNode).getPreUpdateNode().asExpr() = assign.getDest().(ArrayAccess).getArray()
)
}
private predicate enhancedForStmtStep(Node node1, Node node2, Type containerType) {
exists(EnhancedForStmt for, Expr e, SsaExplicitUpdate v |
for.getExpr() = e and
node1.asExpr() = e and
containerType = e.getType() and
v.getDefiningExpr() = for.getVariable() and
v.getAFirstUse() = node2.asExpr()
)
}
/**
* Holds if the step from `node1` to `node2` reads a value from an array.
* This covers ordinary array reads as well as array iteration through enhanced
* `for` statements.
*/
predicate arrayReadStep(Node node1, Node node2, Type elemType) {
exists(ArrayAccess aa |
aa.getArray() = node1.asExpr() and
aa.getType() = elemType and
node2.asExpr() = aa
)
or
exists(Array arr |
enhancedForStmtStep(node1, node2, arr) and
arr.getComponentType() = elemType
)
}
/**
* Holds if the step from `node1` to `node2` reads a value from a collection.
* This only covers iteration through enhanced `for` statements.
*/
predicate collectionReadStep(Node node1, Node node2) {
enhancedForStmtStep(node1, node2, any(Type t | not t instanceof Array))
}

11
java/ql/src/semmle/code/java/dataflow/internal/DataFlowPrivate.qll
View File

@@ -4,6 +4,7 @@ private import DataFlowImplCommon
private import DataFlowDispatch
private import semmle.code.java.controlflow.Guards
private import semmle.code.java.dataflow.SSA
private import ContainerFlow
private import FlowSummaryImpl as FlowSummaryImpl
import DataFlowNodes::Private
@@ -137,13 +138,15 @@ class MapValueContent extends Content, TMapValueContent {
* Thus, `node2` references an object with a field `f` that contains the
* value of `node1`.
*/
predicate storeStep(Node node1, Content f, PostUpdateNode node2) {
predicate storeStep(Node node1, Content f, Node node2) {
exists(FieldAccess fa |
instanceFieldAssign(node1.asExpr(), fa) and
node2.getPreUpdateNode() = getFieldQualifier(fa) and
node2.(PostUpdateNode).getPreUpdateNode() = getFieldQualifier(fa) and
f.(FieldContent).getField() = fa.getField()
)
or
f instanceof ArrayContent and arrayStoreStep(node1, node2)
or
FlowSummaryImpl::Private::Steps::summaryStoreStep(node1, f, node2)
}
@@ -171,6 +174,10 @@ predicate readStep(Node node1, Content f, Node node2) {
node2.asExpr() = get
)
or
f instanceof ArrayContent and arrayReadStep(node1, node2, _)
or
f instanceof CollectionContent and collectionReadStep(node1, node2)
or
FlowSummaryImpl::Private::Steps::summaryReadStep(node1, f, node2)
}

5
java/ql/src/semmle/code/java/dataflow/internal/DataFlowUtil.qll
View File

@@ -9,10 +9,11 @@ private import semmle.code.java.controlflow.Guards
private import semmle.code.java.dataflow.ExternalFlow
private import semmle.code.java.dataflow.FlowSteps
private import semmle.code.java.dataflow.FlowSummary
import semmle.code.java.dataflow.InstanceAccess
private import semmle.code.java.dataflow.InstanceAccess
private import FlowSummaryImpl as FlowSummaryImpl
private import TaintTrackingUtil as TaintTrackingUtil
import DataFlowNodes::Public
import semmle.code.Unit
/** Holds if `n` is an access to an unqualified `this` at `cfgnode`. */
private predicate thisAccess(Node n, ControlFlowNode cfgnode) {
@@ -144,6 +145,8 @@ predicate simpleLocalFlowStep(Node node1, Node node2) {
or
node2.asExpr().(AssignExpr).getSource() = node1.asExpr()
or
node2.asExpr().(ArrayCreationExpr).getInit() = node1.asExpr()
or
exists(MethodAccess ma, ValuePreservingMethod m, int argNo |
ma.getCallee().getSourceDeclaration() = m and m.returnsValue(argNo)
|

121
java/ql/src/semmle/code/java/dataflow/internal/FlowSummaryImpl.qll
View File

@@ -9,6 +9,7 @@
private import FlowSummaryImplSpecific
private import DataFlowImplSpecific::Private
private import DataFlowImplSpecific::Public
private import DataFlowImplCommon as DataFlowImplCommon
/** Provides classes and predicates for defining flow summaries. */
module Public {
@@ -178,7 +179,6 @@ module Public {
*/
module Private {
private import Public
private import DataFlowImplCommon as DataFlowImplCommon
newtype TSummaryComponent =
TContentSummaryComponent(Content c) or
@@ -580,6 +580,14 @@ module Private {
* summaries into a `SummarizedCallable`s.
*/
module External {
/** Holds if `spec` is a relevant external specification. */
private predicate relevantSpec(string spec) {
summaryElement(_, spec, _, _) or
summaryElement(_, _, spec, _) or
sourceElement(_, spec, _) or
sinkElement(_, spec, _)
}
/** Holds if the `n`th component of specification `s` is `c`. */
predicate specSplit(string s, string c, int n) { relevantSpec(s) and s.splitAt(" of ", n) = c }
@@ -629,6 +637,8 @@ module Private {
or
exists(int pos | parseParam(c, pos) and result = SummaryComponent::parameter(pos))
or
c = "ReturnValue" and result = SummaryComponent::return(getReturnValueKind())
or
result = interpretComponentSpecific(c)
)
}
@@ -664,13 +674,13 @@ module Private {
}
private class SummarizedCallableExternal extends SummarizedCallable {
SummarizedCallableExternal() { externalSummary(this, _, _, _) }
SummarizedCallableExternal() { summaryElement(this, _, _, _) }
override predicate propagatesFlow(
SummaryComponentStack input, SummaryComponentStack output, boolean preservesValue
) {
exists(string inSpec, string outSpec, string kind |
externalSummary(this, inSpec, outSpec, kind) and
summaryElement(this, inSpec, outSpec, kind) and
interpretSpec(inSpec, 0, input) and
interpretSpec(outSpec, 0, output)
|
@@ -686,6 +696,111 @@ module Private {
specSplit(spec, c, _) and
not exists(interpretComponent(c))
}
private predicate inputNeedsReference(string c) {
c = "Argument" or
parseArg(c, _)
}
private predicate outputNeedsReference(string c) {
c = "Argument" or
parseArg(c, _) or
c = "ReturnValue"
}
private predicate sourceElementRef(InterpretNode ref, string output, string kind) {
exists(SourceOrSinkElement e |
sourceElement(e, output, kind) and
if outputNeedsReference(specLast(output))
then e = ref.getCallTarget()
else e = ref.asElement()
)
}
private predicate sinkElementRef(InterpretNode ref, string input, string kind) {
exists(SourceOrSinkElement e |
sinkElement(e, input, kind) and
if inputNeedsReference(specLast(input))
then e = ref.getCallTarget()
else e = ref.asElement()
)
}
private predicate interpretOutput(string output, int idx, InterpretNode ref, InterpretNode node) {
sourceElementRef(ref, output, _) and
specLength(output, idx) and
node = ref
or
exists(InterpretNode mid, string c |
interpretOutput(output, idx + 1, ref, mid) and
specSplit(output, c, idx)
|
exists(int pos |
node.asNode()
.(PostUpdateNode)
.getPreUpdateNode()
.(ArgumentNode)
.argumentOf(mid.asCall(), pos)
|
c = "Argument" or parseArg(c, pos)
)
or
exists(int pos | node.asNode().(ParameterNode).isParameterOf(mid.asCallable(), pos) |
c = "Parameter" or parseParam(c, pos)
)
or
c = "ReturnValue" and
node.asNode() = getAnOutNode(mid.asCall(), getReturnValueKind())
or
interpretOutputSpecific(c, mid, node)
)
}
private predicate interpretInput(string input, int idx, InterpretNode ref, InterpretNode node) {
sinkElementRef(ref, input, _) and
specLength(input, idx) and
node = ref
or
exists(InterpretNode mid, string c |
interpretInput(input, idx + 1, ref, mid) and
specSplit(input, c, idx)
|
exists(int pos | node.asNode().(ArgumentNode).argumentOf(mid.asCall(), pos) |
c = "Argument" or parseArg(c, pos)
)
or
exists(ReturnNode ret |
c = "ReturnValue" and
ret = node.asNode() and
ret.getKind() = getReturnValueKind() and
mid.asCallable() = DataFlowImplCommon::getNodeEnclosingCallable(ret)
)
or
interpretInputSpecific(c, mid, node)
)
}
/**
* Holds if `node` is specified as a source with the given kind in a CSV flow
* model.
*/
predicate isSourceNode(InterpretNode node, string kind) {
exists(InterpretNode ref, string output |
sourceElementRef(ref, output, kind) and
interpretOutput(output, 0, ref, node)
)
}
/**
* Holds if `node` is specified as a sink with the given kind in a CSV flow
* model.
*/
predicate isSinkNode(InterpretNode node, string kind) {
exists(InterpretNode ref, string input |
sinkElementRef(ref, input, kind) and
interpretInput(input, 0, ref, node)
)
}
}
/** Provides a query predicate for outputting a set of relevant flow summaries. */

112
java/ql/src/semmle/code/java/dataflow/internal/FlowSummaryImplSpecific.qll
View File

@@ -31,6 +31,12 @@ DataFlowType getContentType(Content c) {
or
c instanceof ArrayContent and
result instanceof TypeObject
or
c instanceof MapKeyContent and
result instanceof TypeObject
or
c instanceof MapValueContent and
result instanceof TypeObject
}
/** Gets the return type of kind `rk` for callable `c`. */
@@ -51,22 +57,22 @@ DataFlowType getCallbackParameterType(DataFlowType t, int i) { none() }
*/
DataFlowType getCallbackReturnType(DataFlowType t, ReturnKind rk) { none() }
/** Holds if `spec` is a relevant external specification. */
predicate relevantSpec(string spec) { spec = inOutSpec() }
/**
* Holds if an external flow summary exists for `c` with input specification
* `input`, output specification `output`, and kind `kind`.
*/
predicate externalSummary(DataFlowCallable c, string input, string output, string kind) {
summaryElement(c, input, output, kind)
predicate summaryElement(DataFlowCallable c, string input, string output, string kind) {
exists(
string namespace, string type, boolean subtypes, string name, string signature, string ext
|
summaryModel(namespace, type, subtypes, name, signature, ext, input, output, kind) and
c = interpretElement(namespace, type, subtypes, name, signature, ext)
)
}
/** Gets the summary component for specification component `c`, if any. */
bindingset[c]
SummaryComponent interpretComponentSpecific(string c) {
c = "ReturnValue" and result = SummaryComponent::return(_)
or
c = "ArrayElement" and result = SummaryComponent::content(any(ArrayContent c0))
or
c = "Element" and result = SummaryComponent::content(any(CollectionContent c0))
@@ -75,3 +81,95 @@ SummaryComponent interpretComponentSpecific(string c) {
or
c = "MapValue" and result = SummaryComponent::content(any(MapValueContent c0))
}
class SourceOrSinkElement = Top;
/**
* Holds if an external source specification exists for `e` with output specification
* `output` and kind `kind`.
*/
predicate sourceElement(SourceOrSinkElement e, string output, string kind) {
exists(
string namespace, string type, boolean subtypes, string name, string signature, string ext
|
sourceModel(namespace, type, subtypes, name, signature, ext, output, kind) and
e = interpretElement(namespace, type, subtypes, name, signature, ext)
)
}
/**
* Holds if an external sink specification exists for `e` with input specification
* `input` and kind `kind`.
*/
predicate sinkElement(SourceOrSinkElement e, string input, string kind) {
exists(
string namespace, string type, boolean subtypes, string name, string signature, string ext
|
sinkModel(namespace, type, subtypes, name, signature, ext, input, kind) and
e = interpretElement(namespace, type, subtypes, name, signature, ext)
)
}
/** Gets the return kind corresponding to specification `"ReturnValue"`. */
ReturnKind getReturnValueKind() { any() }
private newtype TInterpretNode =
TElement(SourceOrSinkElement n) or
TNode(Node n)
/** An entity used to interpret a source/sink specification. */
class InterpretNode extends TInterpretNode {
/** Gets the element that this node corresponds to, if any. */
SourceOrSinkElement asElement() { this = TElement(result) }
/** Gets the data-flow node that this node corresponds to, if any. */
Node asNode() { this = TNode(result) }
/** Gets the call that this node corresponds to, if any. */
DataFlowCall asCall() { result = this.asElement() }
/** Gets the callable that this node corresponds to, if any. */
DataFlowCallable asCallable() { result = this.asElement() }
/** Gets the target of this call, if any. */
Callable getCallTarget() { result = this.asCall().getCallee().getSourceDeclaration() }
/** Gets a textual representation of this node. */
string toString() {
result = this.asElement().toString()
or
result = this.asNode().toString()
}
/** Gets the location of this node. */
Location getLocation() {
result = this.asElement().getLocation()
or
result = this.asNode().getLocation()
}
}
/** Provides additional sink specification logic required for annotations. */
pragma[inline]
predicate interpretOutputSpecific(string c, InterpretNode mid, InterpretNode node) {
exists(Node n, Top ast |
n = node.asNode() and
ast = mid.asElement()
|
(c = "Parameter" or c = "") and
node.asNode().asParameter() = mid.asElement()
or
c = "" and
n.asExpr().(FieldRead).getField() = ast
)
}
/** Provides additional source specification logic required for annotations. */
pragma[inline]
predicate interpretInputSpecific(string c, InterpretNode mid, InterpretNode n) {
exists(FieldWrite fw |
c = "" and
fw.getField() = mid.asElement() and
n.asNode().asExpr() = fw.getRHS()
)
}

124
java/ql/src/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll
View File

@@ -14,6 +14,7 @@ private import semmle.code.java.dataflow.ExternalFlow
private import semmle.code.java.dataflow.internal.DataFlowPrivate
import semmle.code.java.dataflow.FlowSteps
private import FlowSummaryImpl as FlowSummaryImpl
private import semmle.code.java.frameworks.JaxWS
/**
* Holds if taint can flow from `src` to `sink` in zero or more
@@ -60,10 +61,15 @@ private module Cached {
localAdditionalTaintUpdateStep(src.asExpr(),
sink.(DataFlow::PostUpdateNode).getPreUpdateNode().asExpr())
or
exists(Argument arg |
src.asExpr() = arg and
arg.isVararg() and
sink.(DataFlow::ImplicitVarargsArray).getCall() = arg.getCall()
exists(Content f |
readStep(src, f, sink) and
not sink.getTypeBound() instanceof PrimitiveType and
not sink.getTypeBound() instanceof BoxedType and
not sink.getTypeBound() instanceof NumberType
|
f instanceof ArrayContent or
f instanceof CollectionContent or
f instanceof MapValueContent
)
or
FlowSummaryImpl::Private::Steps::summaryLocalStep(src, sink, false)
@@ -93,6 +99,92 @@ private module Cached {
import Cached
/**
* These configurations add a number of configuration-dependent additional taint
* steps to all taint configurations. For each sink or additional step provided
* by a given configuration the types are inspected to find those implicit
* collection or array read steps that might be required at the sink or step
* input. The corresponding store steps are then added as additional taint steps
* to provide backwards-compatible taint flow to such sinks and steps.
*
* This is a temporary measure until support is added for such sinks that
* require implicit read steps.
*/
private module StoreTaintSteps {
private import semmle.code.java.dataflow.TaintTracking
private import semmle.code.java.dataflow.TaintTracking2
private class StoreTaintConfig extends TaintTracking::Configuration {
StoreTaintConfig() { this instanceof TaintTracking::Configuration or none() }
override predicate isSource(DataFlow::Node n) { none() }
override predicate isSink(DataFlow::Node n) { none() }
private predicate needsTaintStore(RefType container, Type elem, Content f) {
exists(DataFlow::Node arg |
(isSink(arg) or isAdditionalTaintStep(arg, _)) and
(arg.asExpr() instanceof Argument or arg instanceof ArgumentNode) and
arg.getType() = container
or
needsTaintStore(_, container, _)
|
container.(Array).getComponentType() = elem and
f instanceof ArrayContent
or
container.(CollectionType).getElementType() = elem and
f instanceof CollectionContent
or
container.(MapType).getValueType() = elem and
f instanceof MapValueContent
)
}
override predicate isAdditionalTaintStep(DataFlow::Node node1, DataFlow::Node node2) {
exists(Content f, Type elem |
storeStep(node1, f, node2) and
needsTaintStore(_, elem, f) and
not exists(Type srctyp | srctyp = node1.getTypeBound() | not compatibleTypes(srctyp, elem))
)
}
}
private class StoreTaintConfig2 extends TaintTracking2::Configuration {
StoreTaintConfig2() { this instanceof TaintTracking2::Configuration or none() }
override predicate isSource(DataFlow::Node n) { none() }
override predicate isSink(DataFlow::Node n) { none() }
private predicate needsTaintStore(RefType container, Type elem, Content f) {
exists(DataFlow::Node arg |
(isSink(arg) or isAdditionalTaintStep(arg, _)) and
(arg.asExpr() instanceof Argument or arg instanceof ArgumentNode) and
arg.getType() = container
or
needsTaintStore(_, container, _)
|
container.(Array).getComponentType() = elem and
f instanceof ArrayContent
or
container.(CollectionType).getElementType() = elem and
f instanceof CollectionContent
or
container.(MapType).getValueType() = elem and
f instanceof MapValueContent
)
}
override predicate isAdditionalTaintStep(DataFlow::Node node1, DataFlow::Node node2) {
exists(Content f, Type elem |
storeStep(node1, f, node2) and
needsTaintStore(_, elem, f) and
not exists(Type srctyp | srctyp = node1.getTypeBound() | not compatibleTypes(srctyp, elem))
)
}
}
}
/**
* Holds if taint can flow in one local step from `src` to `sink` excluding
* local data flow steps. That is, `src` and `sink` are likely to represent
@@ -103,22 +195,8 @@ private predicate localAdditionalTaintExprStep(Expr src, Expr sink) {
or
sink.(AssignAddExpr).getSource() = src and sink.getType() instanceof TypeString
or
sink.(ArrayCreationExpr).getInit() = src
or
sink.(ArrayInit).getAnInit() = src
or
sink.(ArrayAccess).getArray() = src
or
sink.(LogicExpr).getAnOperand() = src
or
exists(EnhancedForStmt for, SsaExplicitUpdate v |
for.getExpr() = src and
v.getDefiningExpr() = for.getVariable() and
v.getAFirstUse() = sink
)
or
containerReturnValueStep(src, sink)
or
constructorStep(src, sink)
or
qualifierToMethodStep(src, sink)
@@ -141,12 +219,6 @@ private predicate localAdditionalTaintExprStep(Expr src, Expr sink) {
* This is restricted to cases where the step updates the value of `sink`.
*/
private predicate localAdditionalTaintUpdateStep(Expr src, Expr sink) {
exists(Assignment assign | assign.getSource() = src |
sink = assign.getDest().(ArrayAccess).getArray()
)
or
containerUpdateStep(src, sink)
or
qualifierToArgumentStep(src, sink)
or
argToArgStep(src, sink)
@@ -277,6 +349,10 @@ private predicate taintPreservingQualifierToMethod(Method m) {
)
or
m.(TaintPreservingCallable).returnsTaintFrom(-1)
or
exists(JaxRsResourceMethod resourceMethod |
m.(GetterMethod).getDeclaringType() = resourceMethod.getAParameter().getType()
)
}
private class StringReplaceMethod extends TaintPreservingCallable {

1
java/ql/src/semmle/code/java/dispatch/DispatchFlow.qll
View File

@@ -11,6 +11,7 @@ private import VirtualDispatch
private import semmle.code.java.dataflow.internal.BaseSSA
private import semmle.code.java.dataflow.internal.DataFlowUtil
private import semmle.code.java.dataflow.internal.DataFlowPrivate
private import semmle.code.java.dataflow.InstanceAccess
private import semmle.code.java.Collections
private import semmle.code.java.Maps

1
java/ql/src/semmle/code/java/dispatch/ObjFlow.qll
View File

@@ -14,6 +14,7 @@ private import semmle.code.java.dataflow.internal.BaseSSA
private import semmle.code.java.dataflow.internal.DataFlowUtil
private import semmle.code.java.dataflow.internal.DataFlowPrivate
private import semmle.code.java.dataflow.internal.ContainerFlow
private import semmle.code.java.dataflow.InstanceAccess
/**
* Gets a viable dispatch target for `ma`. This is the input dispatch relation.

19
java/ql/src/semmle/code/java/frameworks/ApacheHttp.qll
View File

@@ -165,14 +165,17 @@ private class ApacheHttpFlowStep extends SummaryModelCsv {
"org.apache.http.util;EncodingUtils;true;getAsciiString;;;Argument[0];ReturnValue;taint",
"org.apache.http.util;EncodingUtils;true;getBytes;(String,String);;Argument[0];ReturnValue;taint",
"org.apache.http.util;EncodingUtils;true;getString;;;Argument[0];ReturnValue;taint",
"org.apache.http.util;Args;true;containsNoBlanks;(T,String);;Argument[0];ReturnValue;value",
"org.apache.http.util;Args;true;notNull;(T,String);;Argument[0];ReturnValue;value",
"org.apache.http.util;Args;true;notEmpty;(T,String);;Argument[0];ReturnValue;value",
"org.apache.http.util;Args;true;notBlank;(T,String);;Argument[0];ReturnValue;value",
"org.apache.hc.core5.util;Args;true;containsNoBlanks;(T,String);;Argument[0];ReturnValue;value",
"org.apache.hc.core5.util;Args;true;notNull;(T,String);;Argument[0];ReturnValue;value",
"org.apache.hc.core5.util;Args;true;notEmpty;(T,String);;Argument[0];ReturnValue;value",
"org.apache.hc.core5.util;Args;true;notBlank;(T,String);;Argument[0];ReturnValue;value",
"org.apache.http.util;Args;true;containsNoBlanks;(CharSequence,String);;Argument[0];ReturnValue;value",
"org.apache.http.util;Args;true;notNull;(Object,String);;Argument[0];ReturnValue;value",
"org.apache.http.util;Args;true;notEmpty;(CharSequence,String);;Argument[0];ReturnValue;value",
"org.apache.http.util;Args;true;notEmpty;(Collection,String);;Argument[0];ReturnValue;value",
"org.apache.http.util;Args;true;notBlank;(CharSequence,String);;Argument[0];ReturnValue;value",
"org.apache.hc.core5.util;Args;true;containsNoBlanks;(CharSequence,String);;Argument[0];ReturnValue;value",
"org.apache.hc.core5.util;Args;true;notNull;(Object,String);;Argument[0];ReturnValue;value",
"org.apache.hc.core5.util;Args;true;notEmpty;(Collection,String);;Argument[0];ReturnValue;value",
"org.apache.hc.core5.util;Args;true;notEmpty;(CharSequence,String);;Argument[0];ReturnValue;value",
"org.apache.hc.core5.util;Args;true;notEmpty;(Object,String);;Argument[0];ReturnValue;value",
"org.apache.hc.core5.util;Args;true;notBlank;(CharSequence,String);;Argument[0];ReturnValue;value",
"org.apache.hc.core5.http.io.entity;HttpEntities;true;create;;;Argument[0];ReturnValue;taint",
"org.apache.hc.core5.http.io.entity;HttpEntities;true;createGzipped;;;Argument[0];ReturnValue;taint",
"org.apache.hc.core5.http.io.entity;HttpEntities;true;createUrlEncoded;;;Argument[0];ReturnValue;taint",

228
java/ql/src/semmle/code/java/frameworks/apache/Lang.qll
View File

@@ -94,29 +94,33 @@ private class ApacheStringUtilsModel extends SummaryModelCsv {
"org.apache.commons.lang3;StringUtils;false;defaultString;;;Argument[0..1];ReturnValue;taint",
"org.apache.commons.lang3;StringUtils;false;deleteWhitespace;;;Argument[0];ReturnValue;taint",
"org.apache.commons.lang3;StringUtils;false;difference;;;Argument[0..1];ReturnValue;taint",
"org.apache.commons.lang3;StringUtils;false;firstNonBlank;;;Argument[0];ReturnValue;taint",
"org.apache.commons.lang3;StringUtils;false;firstNonEmpty;;;Argument[0];ReturnValue;taint",
"org.apache.commons.lang3;StringUtils;false;firstNonBlank;;;ArrayElement of Argument[0];ReturnValue;value",
"org.apache.commons.lang3;StringUtils;false;firstNonEmpty;;;ArrayElement of Argument[0];ReturnValue;value",
"org.apache.commons.lang3;StringUtils;false;getBytes;;;Argument[0];ReturnValue;taint",
"org.apache.commons.lang3;StringUtils;false;getCommonPrefix;;;Argument[0];ReturnValue;taint",
"org.apache.commons.lang3;StringUtils;false;getCommonPrefix;;;ArrayElement of Argument[0];ReturnValue;taint",
"org.apache.commons.lang3;StringUtils;false;getDigits;;;Argument[0];ReturnValue;taint",
"org.apache.commons.lang3;StringUtils;false;getIfBlank;;;Argument[0..1];ReturnValue;taint",
"org.apache.commons.lang3;StringUtils;false;getIfEmpty;;;Argument[0..1];ReturnValue;taint",
"org.apache.commons.lang3;StringUtils;false;join;(char[],char);;Argument[0];ReturnValue;taint",
"org.apache.commons.lang3;StringUtils;false;join;(char[],char,int,int);;Argument[0];ReturnValue;taint",
"org.apache.commons.lang3;StringUtils;false;join;(java.lang.Iterable,char);;Argument[0];ReturnValue;taint",
"org.apache.commons.lang3;StringUtils;false;join;(java.lang.Iterable,java.lang.String);;Argument[0..1];ReturnValue;taint",
"org.apache.commons.lang3;StringUtils;false;join;(java.lang.Object[]);;Argument[0];ReturnValue;taint",
"org.apache.commons.lang3;StringUtils;false;join;(java.lang.Object[],char);;Argument[0];ReturnValue;taint",
"org.apache.commons.lang3;StringUtils;false;join;(java.lang.Object[],char,int,int);;Argument[0];ReturnValue;taint",
"org.apache.commons.lang3;StringUtils;false;join;(java.lang.Object[],java.lang.String);;Argument[0..1];ReturnValue;taint",
"org.apache.commons.lang3;StringUtils;false;join;(java.lang.Object[],java.lang.String,int,int);;Argument[0];ReturnValue;taint",
"org.apache.commons.lang3;StringUtils;false;join;(java.lang.Iterable,char);;Element of Argument[0];ReturnValue;taint",
"org.apache.commons.lang3;StringUtils;false;join;(java.lang.Iterable,java.lang.String);;Element of Argument[0];ReturnValue;taint",
"org.apache.commons.lang3;StringUtils;false;join;(java.lang.Iterable,java.lang.String);;Argument[1];ReturnValue;taint",
"org.apache.commons.lang3;StringUtils;false;join;(java.lang.Object[]);;ArrayElement of Argument[0];ReturnValue;taint",
"org.apache.commons.lang3;StringUtils;false;join;(java.lang.Object[],char);;ArrayElement of Argument[0];ReturnValue;taint",
"org.apache.commons.lang3;StringUtils;false;join;(java.lang.Object[],char,int,int);;ArrayElement of Argument[0];ReturnValue;taint",
"org.apache.commons.lang3;StringUtils;false;join;(java.lang.Object[],java.lang.String);;ArrayElement of Argument[0];ReturnValue;taint",
"org.apache.commons.lang3;StringUtils;false;join;(java.lang.Object[],java.lang.String);;Argument[1];ReturnValue;taint",
"org.apache.commons.lang3;StringUtils;false;join;(java.lang.Object[],java.lang.String,int,int);;ArrayElement of Argument[0];ReturnValue;taint",
"org.apache.commons.lang3;StringUtils;false;join;(java.lang.Object[],java.lang.String,int,int);;Argument[1];ReturnValue;taint",
"org.apache.commons.lang3;StringUtils;false;join;(java.util.Iterator,char);;Argument[0];ReturnValue;taint",
"org.apache.commons.lang3;StringUtils;false;join;(java.util.Iterator,java.lang.String);;Argument[0..1];ReturnValue;taint",
"org.apache.commons.lang3;StringUtils;false;join;(java.util.List,char,int,int);;Argument[0];ReturnValue;taint",
"org.apache.commons.lang3;StringUtils;false;join;(java.util.List,java.lang.String,int,int);;Argument[0];ReturnValue;taint",
"org.apache.commons.lang3;StringUtils;false;join;(java.util.Iterator,char);;Element of Argument[0];ReturnValue;taint",
"org.apache.commons.lang3;StringUtils;false;join;(java.util.Iterator,java.lang.String);;Element of Argument[0];ReturnValue;taint",
"org.apache.commons.lang3;StringUtils;false;join;(java.util.Iterator,java.lang.String);;Argument[1];ReturnValue;taint",
"org.apache.commons.lang3;StringUtils;false;join;(java.util.List,char,int,int);;Element of Argument[0];ReturnValue;taint",
"org.apache.commons.lang3;StringUtils;false;join;(java.util.List,java.lang.String,int,int);;Element of Argument[0];ReturnValue;taint",
"org.apache.commons.lang3;StringUtils;false;join;(java.util.List,java.lang.String,int,int);;Argument[1];ReturnValue;taint",
"org.apache.commons.lang3;StringUtils;false;joinWith;;;Argument[0..1];ReturnValue;taint",
"org.apache.commons.lang3;StringUtils;false;joinWith;;;Argument[0];ReturnValue;taint",
"org.apache.commons.lang3;StringUtils;false;joinWith;;;ArrayElement of Argument[1];ReturnValue;taint",
"org.apache.commons.lang3;StringUtils;false;left;;;Argument[0];ReturnValue;taint",
"org.apache.commons.lang3;StringUtils;false;leftPad;(java.lang.String,int,java.lang.String);;Argument[2];ReturnValue;taint",
"org.apache.commons.lang3;StringUtils;false;leftPad;;;Argument[0];ReturnValue;taint",
@@ -148,9 +152,9 @@ private class ApacheStringUtilsModel extends SummaryModelCsv {
"org.apache.commons.lang3;StringUtils;false;replaceChars;(java.lang.String,java.lang.String,java.lang.String);;Argument[2];ReturnValue;taint",
"org.apache.commons.lang3;StringUtils;false;replaceChars;;;Argument[0];ReturnValue;taint",
"org.apache.commons.lang3;StringUtils;false;replaceEach;;;Argument[0];ReturnValue;taint",
"org.apache.commons.lang3;StringUtils;false;replaceEach;;;Argument[2];ReturnValue;taint",
"org.apache.commons.lang3;StringUtils;false;replaceEach;;;ArrayElement of Argument[2];ReturnValue;taint",
"org.apache.commons.lang3;StringUtils;false;replaceEachRepeatedly;;;Argument[0];ReturnValue;taint",
"org.apache.commons.lang3;StringUtils;false;replaceEachRepeatedly;;;Argument[2];ReturnValue;taint",
"org.apache.commons.lang3;StringUtils;false;replaceEachRepeatedly;;;ArrayElement of Argument[2];ReturnValue;taint",
"org.apache.commons.lang3;StringUtils;false;replaceFirst;;;Argument[0];ReturnValue;taint",
"org.apache.commons.lang3;StringUtils;false;replaceFirst;;;Argument[2];ReturnValue;taint",
"org.apache.commons.lang3;StringUtils;false;replaceIgnoreCase;;;Argument[0];ReturnValue;taint",
@@ -182,7 +186,7 @@ private class ApacheStringUtilsModel extends SummaryModelCsv {
"org.apache.commons.lang3;StringUtils;false;strip;(java.lang.String);;Argument[0];ReturnValue;taint",
"org.apache.commons.lang3;StringUtils;false;strip;(java.lang.String,java.lang.String);;Argument[0];ReturnValue;taint",
"org.apache.commons.lang3;StringUtils;false;stripAccents;;;Argument[0];ReturnValue;taint",
"org.apache.commons.lang3;StringUtils;false;stripAll;;;Argument[0];ReturnValue;taint",
"org.apache.commons.lang3;StringUtils;false;stripAll;;;ArrayElement of Argument[0];ArrayElement of ReturnValue;taint",
"org.apache.commons.lang3;StringUtils;false;stripEnd;;;Argument[0];ReturnValue;taint",
"org.apache.commons.lang3;StringUtils;false;stripStart;;;Argument[0];ReturnValue;taint",
"org.apache.commons.lang3;StringUtils;false;stripToEmpty;;;Argument[0];ReturnValue;taint",
@@ -229,7 +233,8 @@ private class ApacheStrBuilderModel extends SummaryModelCsv {
"org.apache.commons.lang3.text;StrBuilder;false;append;(java.lang.Object);;Argument[0];Argument[-1];taint",
"org.apache.commons.lang3.text;StrBuilder;false;append;(java.lang.String);;Argument[0];Argument[-1];taint",
"org.apache.commons.lang3.text;StrBuilder;false;append;(java.lang.String,int,int);;Argument[0];Argument[-1];taint",
"org.apache.commons.lang3.text;StrBuilder;false;append;(java.lang.String,java.lang.Object[]);;Argument[0..1];Argument[-1];taint",
"org.apache.commons.lang3.text;StrBuilder;false;append;(java.lang.String,java.lang.Object[]);;Argument[0];Argument[-1];taint",
"org.apache.commons.lang3.text;StrBuilder;false;append;(java.lang.String,java.lang.Object[]);;ArrayElement of Argument[1];Argument[-1];taint",
"org.apache.commons.lang3.text;StrBuilder;false;append;(java.lang.StringBuffer);;Argument[0];Argument[-1];taint",
"org.apache.commons.lang3.text;StrBuilder;false;append;(java.lang.StringBuffer,int,int);;Argument[0];Argument[-1];taint",
"org.apache.commons.lang3.text;StrBuilder;false;append;(java.lang.StringBuilder);;Argument[0];Argument[-1];taint",
@@ -238,7 +243,9 @@ private class ApacheStrBuilderModel extends SummaryModelCsv {
"org.apache.commons.lang3.text;StrBuilder;false;append;(java.nio.CharBuffer,int,int);;Argument[0];Argument[-1];taint",
"org.apache.commons.lang3.text;StrBuilder;false;append;(org.apache.commons.lang3.text.StrBuilder);;Argument[0];Argument[-1];taint",
"org.apache.commons.lang3.text;StrBuilder;false;append;;;Argument[-1];ReturnValue;taint",
"org.apache.commons.lang3.text;StrBuilder;false;appendAll;;;Argument[0];Argument[-1];taint",
"org.apache.commons.lang3.text;StrBuilder;false;appendAll;(Iterable);;Element of Argument[0];Argument[-1];taint",
"org.apache.commons.lang3.text;StrBuilder;false;appendAll;(Iterator);;Element of Argument[0];Argument[-1];taint",
"org.apache.commons.lang3.text;StrBuilder;false;appendAll;(Object[]);;ArrayElement of Argument[0];Argument[-1];taint",
"org.apache.commons.lang3.text;StrBuilder;false;appendAll;;;Argument[-1];ReturnValue;taint",
"org.apache.commons.lang3.text;StrBuilder;false;appendFixedWidthPadLeft;;;Argument[-1];ReturnValue;taint",
"org.apache.commons.lang3.text;StrBuilder;false;appendFixedWidthPadLeft;;;Argument[0];Argument[-1];taint",
@@ -249,14 +256,18 @@ private class ApacheStrBuilderModel extends SummaryModelCsv {
"org.apache.commons.lang3.text;StrBuilder;false;appendSeparator;(java.lang.String,java.lang.String);;Argument[0..1];Argument[-1];taint",
"org.apache.commons.lang3.text;StrBuilder;false;appendSeparator;;;Argument[-1];ReturnValue;taint",
"org.apache.commons.lang3.text;StrBuilder;false;appendTo;;;Argument[-1];Argument[0];taint",
"org.apache.commons.lang3.text;StrBuilder;false;appendWithSeparators;;;Argument[0..1];Argument[-1];taint",
"org.apache.commons.lang3.text;StrBuilder;false;appendWithSeparators;(Iterable,String);;Element of Argument[0];Argument[-1];taint",
"org.apache.commons.lang3.text;StrBuilder;false;appendWithSeparators;(Iterator,String);;Element of Argument[0];Argument[-1];taint",
"org.apache.commons.lang3.text;StrBuilder;false;appendWithSeparators;(Object[],String);;ArrayElement of Argument[0];Argument[-1];taint",
"org.apache.commons.lang3.text;StrBuilder;false;appendWithSeparators;;;Argument[1];Argument[-1];taint",
"org.apache.commons.lang3.text;StrBuilder;false;appendWithSeparators;;;Argument[-1];ReturnValue;taint",
"org.apache.commons.lang3.text;StrBuilder;false;appendln;(char[]);;Argument[0];Argument[-1];taint",
"org.apache.commons.lang3.text;StrBuilder;false;appendln;(char[],int,int);;Argument[0];Argument[-1];taint",
"org.apache.commons.lang3.text;StrBuilder;false;appendln;(java.lang.Object);;Argument[0];Argument[-1];taint",
"org.apache.commons.lang3.text;StrBuilder;false;appendln;(java.lang.String);;Argument[0];Argument[-1];taint",
"org.apache.commons.lang3.text;StrBuilder;false;appendln;(java.lang.String,int,int);;Argument[0];Argument[-1];taint",
"org.apache.commons.lang3.text;StrBuilder;false;appendln;(java.lang.String,java.lang.Object[]);;Argument[0..1];Argument[-1];taint",
"org.apache.commons.lang3.text;StrBuilder;false;appendln;(java.lang.String,java.lang.Object[]);;Argument[0];Argument[-1];taint",
"org.apache.commons.lang3.text;StrBuilder;false;appendln;(java.lang.String,java.lang.Object[]);;ArrayElement of Argument[1];Argument[-1];taint",
"org.apache.commons.lang3.text;StrBuilder;false;appendln;(java.lang.StringBuffer);;Argument[0];Argument[-1];taint",
"org.apache.commons.lang3.text;StrBuilder;false;appendln;(java.lang.StringBuffer,int,int);;Argument[0];Argument[-1];taint",
"org.apache.commons.lang3.text;StrBuilder;false;appendln;(java.lang.StringBuilder);;Argument[0];Argument[-1];taint",
@@ -296,7 +307,8 @@ private class ApacheStrBuilderModel extends SummaryModelCsv {
"org.apache.commons.text;StrBuilder;false;append;(java.lang.Object);;Argument[0];Argument[-1];taint",
"org.apache.commons.text;StrBuilder;false;append;(java.lang.String);;Argument[0];Argument[-1];taint",
"org.apache.commons.text;StrBuilder;false;append;(java.lang.String,int,int);;Argument[0];Argument[-1];taint",
"org.apache.commons.text;StrBuilder;false;append;(java.lang.String,java.lang.Object[]);;Argument[0..1];Argument[-1];taint",
"org.apache.commons.text;StrBuilder;false;append;(java.lang.String,java.lang.Object[]);;Argument[0];Argument[-1];taint",
"org.apache.commons.text;StrBuilder;false;append;(java.lang.String,java.lang.Object[]);;ArrayElement of Argument[1];Argument[-1];taint",
"org.apache.commons.text;StrBuilder;false;append;(java.lang.StringBuffer);;Argument[0];Argument[-1];taint",
"org.apache.commons.text;StrBuilder;false;append;(java.lang.StringBuffer,int,int);;Argument[0];Argument[-1];taint",
"org.apache.commons.text;StrBuilder;false;append;(java.lang.StringBuilder);;Argument[0];Argument[-1];taint",
@@ -305,7 +317,9 @@ private class ApacheStrBuilderModel extends SummaryModelCsv {
"org.apache.commons.text;StrBuilder;false;append;(java.nio.CharBuffer,int,int);;Argument[0];Argument[-1];taint",
"org.apache.commons.text;StrBuilder;false;append;(org.apache.commons.text.StrBuilder);;Argument[0];Argument[-1];taint",
"org.apache.commons.text;StrBuilder;false;append;;;Argument[-1];ReturnValue;taint",
"org.apache.commons.text;StrBuilder;false;appendAll;;;Argument[0];Argument[-1];taint",
"org.apache.commons.text;StrBuilder;false;appendAll;(Iterable);;Element of Argument[0];Argument[-1];taint",
"org.apache.commons.text;StrBuilder;false;appendAll;(Iterator);;Element of Argument[0];Argument[-1];taint",
"org.apache.commons.text;StrBuilder;false;appendAll;(Object[]);;ArrayElement of Argument[0];Argument[-1];taint",
"org.apache.commons.text;StrBuilder;false;appendAll;;;Argument[-1];ReturnValue;taint",
"org.apache.commons.text;StrBuilder;false;appendFixedWidthPadLeft;;;Argument[-1];ReturnValue;taint",
"org.apache.commons.text;StrBuilder;false;appendFixedWidthPadLeft;;;Argument[0];Argument[-1];taint",
@@ -316,14 +330,18 @@ private class ApacheStrBuilderModel extends SummaryModelCsv {
"org.apache.commons.text;StrBuilder;false;appendSeparator;(java.lang.String,java.lang.String);;Argument[0..1];Argument[-1];taint",
"org.apache.commons.text;StrBuilder;false;appendSeparator;;;Argument[-1];ReturnValue;taint",
"org.apache.commons.text;StrBuilder;false;appendTo;;;Argument[-1];Argument[0];taint",
"org.apache.commons.text;StrBuilder;false;appendWithSeparators;;;Argument[0..1];Argument[-1];taint",
"org.apache.commons.text;StrBuilder;false;appendWithSeparators;(Iterable,String);;Element of Argument[0];Argument[-1];taint",
"org.apache.commons.text;StrBuilder;false;appendWithSeparators;(Iterator,String);;Element of Argument[0];Argument[-1];taint",
"org.apache.commons.text;StrBuilder;false;appendWithSeparators;(Object[],String);;ArrayElement of Argument[0];Argument[-1];taint",
"org.apache.commons.text;StrBuilder;false;appendWithSeparators;;;Argument[1];Argument[-1];taint",
"org.apache.commons.text;StrBuilder;false;appendWithSeparators;;;Argument[-1];ReturnValue;taint",
"org.apache.commons.text;StrBuilder;false;appendln;(char[]);;Argument[0];Argument[-1];taint",
"org.apache.commons.text;StrBuilder;false;appendln;(char[],int,int);;Argument[0];Argument[-1];taint",
"org.apache.commons.text;StrBuilder;false;appendln;(java.lang.Object);;Argument[0];Argument[-1];taint",
"org.apache.commons.text;StrBuilder;false;appendln;(java.lang.String);;Argument[0];Argument[-1];taint",
"org.apache.commons.text;StrBuilder;false;appendln;(java.lang.String,int,int);;Argument[0];Argument[-1];taint",
"org.apache.commons.text;StrBuilder;false;appendln;(java.lang.String,java.lang.Object[]);;Argument[0..1];Argument[-1];taint",
"org.apache.commons.text;StrBuilder;false;appendln;(java.lang.String,java.lang.Object[]);;Argument[0];Argument[-1];taint",
"org.apache.commons.text;StrBuilder;false;appendln;(java.lang.String,java.lang.Object[]);;ArrayElement of Argument[1];Argument[-1];taint",
"org.apache.commons.text;StrBuilder;false;appendln;(java.lang.StringBuffer);;Argument[0];Argument[-1];taint",
"org.apache.commons.text;StrBuilder;false;appendln;(java.lang.StringBuffer,int,int);;Argument[0];Argument[-1];taint",
"org.apache.commons.text;StrBuilder;false;appendln;(java.lang.StringBuilder);;Argument[0];Argument[-1];taint",
@@ -364,7 +382,8 @@ private class ApacheStrBuilderModel extends SummaryModelCsv {
"org.apache.commons.text;TextStringBuilder;false;append;(java.lang.Object);;Argument[0];Argument[-1];taint",
"org.apache.commons.text;TextStringBuilder;false;append;(java.lang.String);;Argument[0];Argument[-1];taint",
"org.apache.commons.text;TextStringBuilder;false;append;(java.lang.String,int,int);;Argument[0];Argument[-1];taint",
"org.apache.commons.text;TextStringBuilder;false;append;(java.lang.String,java.lang.Object[]);;Argument[0..1];Argument[-1];taint",
"org.apache.commons.text;TextStringBuilder;false;append;(java.lang.String,java.lang.Object[]);;Argument[0];Argument[-1];taint",
"org.apache.commons.text;TextStringBuilder;false;append;(java.lang.String,java.lang.Object[]);;ArrayElement of Argument[1];Argument[-1];taint",
"org.apache.commons.text;TextStringBuilder;false;append;(java.lang.StringBuffer);;Argument[0];Argument[-1];taint",
"org.apache.commons.text;TextStringBuilder;false;append;(java.lang.StringBuffer,int,int);;Argument[0];Argument[-1];taint",
"org.apache.commons.text;TextStringBuilder;false;append;(java.lang.StringBuilder);;Argument[0];Argument[-1];taint",
@@ -373,7 +392,9 @@ private class ApacheStrBuilderModel extends SummaryModelCsv {
"org.apache.commons.text;TextStringBuilder;false;append;(java.nio.CharBuffer,int,int);;Argument[0];Argument[-1];taint",
"org.apache.commons.text;TextStringBuilder;false;append;(org.apache.commons.text.TextStringBuilder);;Argument[0];Argument[-1];taint",
"org.apache.commons.text;TextStringBuilder;false;append;;;Argument[-1];ReturnValue;taint",
"org.apache.commons.text;TextStringBuilder;false;appendAll;;;Argument[0];Argument[-1];taint",
"org.apache.commons.text;TextStringBuilder;false;appendAll;(Iterable);;Element of Argument[0];Argument[-1];taint",
"org.apache.commons.text;TextStringBuilder;false;appendAll;(Iterator);;Element of Argument[0];Argument[-1];taint",
"org.apache.commons.text;TextStringBuilder;false;appendAll;(Object[]);;ArrayElement of Argument[0];Argument[-1];taint",
"org.apache.commons.text;TextStringBuilder;false;appendAll;;;Argument[-1];ReturnValue;taint",
"org.apache.commons.text;TextStringBuilder;false;appendFixedWidthPadLeft;;;Argument[-1];ReturnValue;taint",
"org.apache.commons.text;TextStringBuilder;false;appendFixedWidthPadLeft;;;Argument[0];Argument[-1];taint",
@@ -384,14 +405,18 @@ private class ApacheStrBuilderModel extends SummaryModelCsv {
"org.apache.commons.text;TextStringBuilder;false;appendSeparator;(java.lang.String,java.lang.String);;Argument[0..1];Argument[-1];taint",
"org.apache.commons.text;TextStringBuilder;false;appendSeparator;;;Argument[-1];ReturnValue;taint",
"org.apache.commons.text;TextStringBuilder;false;appendTo;;;Argument[-1];Argument[0];taint",
"org.apache.commons.text;TextStringBuilder;false;appendWithSeparators;;;Argument[0..1];Argument[-1];taint",
"org.apache.commons.text;TextStringBuilder;false;appendWithSeparators;(Iterable,String);;Element of Argument[0];Argument[-1];taint",
"org.apache.commons.text;TextStringBuilder;false;appendWithSeparators;(Iterator,String);;Element of Argument[0];Argument[-1];taint",
"org.apache.commons.text;TextStringBuilder;false;appendWithSeparators;(Object[],String);;ArrayElement of Argument[0];Argument[-1];taint",
"org.apache.commons.text;TextStringBuilder;false;appendWithSeparators;;;Argument[1];Argument[-1];taint",
"org.apache.commons.text;TextStringBuilder;false;appendWithSeparators;;;Argument[-1];ReturnValue;taint",
"org.apache.commons.text;TextStringBuilder;false;appendln;(char[]);;Argument[0];Argument[-1];taint",
"org.apache.commons.text;TextStringBuilder;false;appendln;(char[],int,int);;Argument[0];Argument[-1];taint",
"org.apache.commons.text;TextStringBuilder;false;appendln;(java.lang.Object);;Argument[0];Argument[-1];taint",
"org.apache.commons.text;TextStringBuilder;false;appendln;(java.lang.String);;Argument[0];Argument[-1];taint",
"org.apache.commons.text;TextStringBuilder;false;appendln;(java.lang.String,int,int);;Argument[0];Argument[-1];taint",
"org.apache.commons.text;TextStringBuilder;false;appendln;(java.lang.String,java.lang.Object[]);;Argument[0..1];Argument[-1];taint",
"org.apache.commons.text;TextStringBuilder;false;appendln;(java.lang.String,java.lang.Object[]);;Argument[0];Argument[-1];taint",
"org.apache.commons.text;TextStringBuilder;false;appendln;(java.lang.String,java.lang.Object[]);;ArrayElement of Argument[1];Argument[-1];taint",
"org.apache.commons.text;TextStringBuilder;false;appendln;(java.lang.StringBuffer);;Argument[0];Argument[-1];taint",
"org.apache.commons.text;TextStringBuilder;false;appendln;(java.lang.StringBuffer,int,int);;Argument[0];Argument[-1];taint",
"org.apache.commons.text;TextStringBuilder;false;appendln;(java.lang.StringBuilder);;Argument[0];Argument[-1];taint",
@@ -427,6 +452,101 @@ private class ApacheStrBuilderModel extends SummaryModelCsv {
}
}
private class ApacheStrBuilderFluentMethodsModel extends SummaryModelCsv {
override predicate row(string row) {
row =
[
"org.apache.commons.lang3.text;StrBuilder;false;append;;;Argument[-1];ReturnValue;value",
"org.apache.commons.lang3.text;StrBuilder;false;appendAll;;;Argument[-1];ReturnValue;value",
"org.apache.commons.lang3.text;StrBuilder;false;appendFixedWidthPadLeft;;;Argument[-1];ReturnValue;value",
"org.apache.commons.lang3.text;StrBuilder;false;appendFixedWidthPadRight;;;Argument[-1];ReturnValue;value",
"org.apache.commons.lang3.text;StrBuilder;false;appendln;;;Argument[-1];ReturnValue;value",
"org.apache.commons.lang3.text;StrBuilder;false;appendNewLine;;;Argument[-1];ReturnValue;value",
"org.apache.commons.lang3.text;StrBuilder;false;appendNull;;;Argument[-1];ReturnValue;value",
"org.apache.commons.lang3.text;StrBuilder;false;appendPadding;;;Argument[-1];ReturnValue;value",
"org.apache.commons.lang3.text;StrBuilder;false;appendSeparator;;;Argument[-1];ReturnValue;value",
"org.apache.commons.lang3.text;StrBuilder;false;appendWithSeparators;;;Argument[-1];ReturnValue;value",
"org.apache.commons.lang3.text;StrBuilder;false;delete;;;Argument[-1];ReturnValue;value",
"org.apache.commons.lang3.text;StrBuilder;false;deleteAll;;;Argument[-1];ReturnValue;value",
"org.apache.commons.lang3.text;StrBuilder;false;deleteCharAt;;;Argument[-1];ReturnValue;value",
"org.apache.commons.lang3.text;StrBuilder;false;deleteFirst;;;Argument[-1];ReturnValue;value",
"org.apache.commons.lang3.text;StrBuilder;false;ensureCapacity;;;Argument[-1];ReturnValue;value",
"org.apache.commons.lang3.text;StrBuilder;false;insert;;;Argument[-1];ReturnValue;value",
"org.apache.commons.lang3.text;StrBuilder;false;minimizeCapacity;;;Argument[-1];ReturnValue;value",
"org.apache.commons.lang3.text;StrBuilder;false;replace;;;Argument[-1];ReturnValue;value",
"org.apache.commons.lang3.text;StrBuilder;false;replaceAll;;;Argument[-1];ReturnValue;value",
"org.apache.commons.lang3.text;StrBuilder;false;replaceFirst;;;Argument[-1];ReturnValue;value",
"org.apache.commons.lang3.text;StrBuilder;false;reverse;;;Argument[-1];ReturnValue;value",
"org.apache.commons.lang3.text;StrBuilder;false;setCharAt;;;Argument[-1];ReturnValue;value",
"org.apache.commons.lang3.text;StrBuilder;false;setLength;;;Argument[-1];ReturnValue;value",
"org.apache.commons.lang3.text;StrBuilder;false;setNewLineText;;;Argument[-1];ReturnValue;value",
"org.apache.commons.lang3.text;StrBuilder;false;setNullText;;;Argument[-1];ReturnValue;value",
"org.apache.commons.lang3.text;StrBuilder;false;trim;;;Argument[-1];ReturnValue;value",
"org.apache.commons.text;StrBuilder;false;append;;;Argument[-1];ReturnValue;value",
"org.apache.commons.text;StrBuilder;false;appendAll;;;Argument[-1];ReturnValue;value",
"org.apache.commons.text;StrBuilder;false;appendFixedWidthPadLeft;;;Argument[-1];ReturnValue;value",
"org.apache.commons.text;StrBuilder;false;appendFixedWidthPadRight;;;Argument[-1];ReturnValue;value",
"org.apache.commons.text;StrBuilder;false;appendln;;;Argument[-1];ReturnValue;value",
"org.apache.commons.text;StrBuilder;false;appendNewLine;;;Argument[-1];ReturnValue;value",
"org.apache.commons.text;StrBuilder;false;appendNull;;;Argument[-1];ReturnValue;value",
"org.apache.commons.text;StrBuilder;false;appendPadding;;;Argument[-1];ReturnValue;value",
"org.apache.commons.text;StrBuilder;false;appendSeparator;;;Argument[-1];ReturnValue;value",
"org.apache.commons.text;StrBuilder;false;appendWithSeparators;;;Argument[-1];ReturnValue;value",
"org.apache.commons.text;StrBuilder;false;delete;;;Argument[-1];ReturnValue;value",
"org.apache.commons.text;StrBuilder;false;deleteAll;;;Argument[-1];ReturnValue;value",
"org.apache.commons.text;StrBuilder;false;deleteCharAt;;;Argument[-1];ReturnValue;value",
"org.apache.commons.text;StrBuilder;false;deleteFirst;;;Argument[-1];ReturnValue;value",
"org.apache.commons.text;StrBuilder;false;ensureCapacity;;;Argument[-1];ReturnValue;value",
"org.apache.commons.text;StrBuilder;false;insert;;;Argument[-1];ReturnValue;value",
"org.apache.commons.text;StrBuilder;false;minimizeCapacity;;;Argument[-1];ReturnValue;value",
"org.apache.commons.text;StrBuilder;false;replace;;;Argument[-1];ReturnValue;value",
"org.apache.commons.text;StrBuilder;false;replaceAll;;;Argument[-1];ReturnValue;value",
"org.apache.commons.text;StrBuilder;false;replaceFirst;;;Argument[-1];ReturnValue;value",
"org.apache.commons.text;StrBuilder;false;reverse;;;Argument[-1];ReturnValue;value",
"org.apache.commons.text;StrBuilder;false;setCharAt;;;Argument[-1];ReturnValue;value",
"org.apache.commons.text;StrBuilder;false;setLength;;;Argument[-1];ReturnValue;value",
"org.apache.commons.text;StrBuilder;false;setNewLineText;;;Argument[-1];ReturnValue;value",
"org.apache.commons.text;StrBuilder;false;setNullText;;;Argument[-1];ReturnValue;value",
"org.apache.commons.text;StrBuilder;false;trim;;;Argument[-1];ReturnValue;value",
"org.apache.commons.text;TextStringBuilder;false;append;;;Argument[-1];ReturnValue;value",
"org.apache.commons.text;TextStringBuilder;false;appendAll;;;Argument[-1];ReturnValue;value",
"org.apache.commons.text;TextStringBuilder;false;appendFixedWidthPadLeft;;;Argument[-1];ReturnValue;value",
"org.apache.commons.text;TextStringBuilder;false;appendFixedWidthPadRight;;;Argument[-1];ReturnValue;value",
"org.apache.commons.text;TextStringBuilder;false;appendln;;;Argument[-1];ReturnValue;value",
"org.apache.commons.text;TextStringBuilder;false;appendNewLine;;;Argument[-1];ReturnValue;value",
"org.apache.commons.text;TextStringBuilder;false;appendNull;;;Argument[-1];ReturnValue;value",
"org.apache.commons.text;TextStringBuilder;false;appendPadding;;;Argument[-1];ReturnValue;value",
"org.apache.commons.text;TextStringBuilder;false;appendSeparator;;;Argument[-1];ReturnValue;value",
"org.apache.commons.text;TextStringBuilder;false;appendWithSeparators;;;Argument[-1];ReturnValue;value",
"org.apache.commons.text;TextStringBuilder;false;delete;;;Argument[-1];ReturnValue;value",
"org.apache.commons.text;TextStringBuilder;false;deleteAll;;;Argument[-1];ReturnValue;value",
"org.apache.commons.text;TextStringBuilder;false;deleteCharAt;;;Argument[-1];ReturnValue;value",
"org.apache.commons.text;TextStringBuilder;false;deleteFirst;;;Argument[-1];ReturnValue;value",
"org.apache.commons.text;TextStringBuilder;false;ensureCapacity;;;Argument[-1];ReturnValue;value",
"org.apache.commons.text;TextStringBuilder;false;insert;;;Argument[-1];ReturnValue;value",
"org.apache.commons.text;TextStringBuilder;false;minimizeCapacity;;;Argument[-1];ReturnValue;value",
"org.apache.commons.text;TextStringBuilder;false;replace;;;Argument[-1];ReturnValue;value",
"org.apache.commons.text;TextStringBuilder;false;replaceAll;;;Argument[-1];ReturnValue;value",
"org.apache.commons.text;TextStringBuilder;false;replaceFirst;;;Argument[-1];ReturnValue;value",
"org.apache.commons.text;TextStringBuilder;false;reverse;;;Argument[-1];ReturnValue;value",
"org.apache.commons.text;TextStringBuilder;false;setCharAt;;;Argument[-1];ReturnValue;value",
"org.apache.commons.text;TextStringBuilder;false;setLength;;;Argument[-1];ReturnValue;value",
"org.apache.commons.text;TextStringBuilder;false;setNewLineText;;;Argument[-1];ReturnValue;value",
"org.apache.commons.text;TextStringBuilder;false;setNullText;;;Argument[-1];ReturnValue;value",
"org.apache.commons.text;TextStringBuilder;false;trim;;;Argument[-1];ReturnValue;value"
]
}
}
/**
* An Apache Commons-Lang StrBuilder method that returns `this`.
*/
private class ApacheStrBuilderFluentMethod extends FluentMethod {
ApacheStrBuilderFluentMethod() {
this.getReturnType().(RefType).hasQualifiedName("org.apache.commons.lang3.text", "StrBuilder")
}
}
/**
* Taint-propagating models for `WordUtils`.
*/
@@ -525,9 +645,9 @@ private class ApacheStrLookupModel extends SummaryModelCsv {
row =
[
"org.apache.commons.lang3.text;StrLookup;false;lookup;;;Argument[-1];ReturnValue;taint",
"org.apache.commons.lang3.text;StrLookup;false;mapLookup;;;Argument[0];ReturnValue;taint",
"org.apache.commons.lang3.text;StrLookup;false;mapLookup;;;MapValue of Argument[0];ReturnValue;taint",
"org.apache.commons.text.lookup;StringLookup;true;lookup;;;Argument[-1];ReturnValue;taint",
"org.apache.commons.text.lookup;StringLookupFactory;false;mapStringLookup;;;Argument[0];ReturnValue;taint"
"org.apache.commons.text.lookup;StringLookupFactory;false;mapStringLookup;;;MapValue of Argument[0];ReturnValue;taint"
]
}
}
@@ -540,6 +660,7 @@ private class ApacheStrSubstitutorModel extends SummaryModelCsv {
row =
[
"org.apache.commons.lang3.text;StrSubstitutor;false;StrSubstitutor;;;Argument[0];Argument[-1];taint",
"org.apache.commons.lang3.text;StrSubstitutor;false;StrSubstitutor;;;MapValue of Argument[0];Argument[-1];taint",
"org.apache.commons.lang3.text;StrSubstitutor;false;replace;;;Argument[-1];ReturnValue;taint",
"org.apache.commons.lang3.text;StrSubstitutor;false;replace;(java.lang.Object);;Argument[0];ReturnValue;taint",
"org.apache.commons.lang3.text;StrSubstitutor;false;replace;(char[]);;Argument[0];ReturnValue;taint",
@@ -552,10 +673,12 @@ private class ApacheStrSubstitutorModel extends SummaryModelCsv {
"org.apache.commons.lang3.text;StrSubstitutor;false;replace;(java.lang.StringBuffer,int,int);;Argument[0];ReturnValue;taint",
"org.apache.commons.lang3.text;StrSubstitutor;false;replace;(java.lang.String,int,int);;Argument[0];ReturnValue;taint",
"org.apache.commons.lang3.text;StrSubstitutor;false;replace;(org.apache.commons.lang3.text.StrBuilder,int,int);;Argument[0];ReturnValue;taint",
"org.apache.commons.lang3.text;StrSubstitutor;false;replace;(java.lang.Object,java.util.Map);;Argument[0..1];ReturnValue;taint",
"org.apache.commons.lang3.text;StrSubstitutor;false;replace;(java.lang.Object,java.util.Map);;Argument[0];ReturnValue;taint",
"org.apache.commons.lang3.text;StrSubstitutor;false;replace;(java.lang.Object,java.util.Map);;MapValue of Argument[1];ReturnValue;taint",
"org.apache.commons.lang3.text;StrSubstitutor;false;replace;(java.lang.Object,java.util.Map,java.lang.String,java.lang.String);;Argument[0];ReturnValue;taint",
"org.apache.commons.lang3.text;StrSubstitutor;false;replace;(java.lang.Object,java.util.Map,java.lang.String,java.lang.String);;Argument[1];ReturnValue;taint",
"org.apache.commons.lang3.text;StrSubstitutor;false;replace;(java.lang.Object,java.util.Properties);;Argument[0..1];ReturnValue;taint",
"org.apache.commons.lang3.text;StrSubstitutor;false;replace;(java.lang.Object,java.util.Map,java.lang.String,java.lang.String);;MapValue of Argument[1];ReturnValue;taint",
"org.apache.commons.lang3.text;StrSubstitutor;false;replace;(java.lang.Object,java.util.Properties);;Argument[0];ReturnValue;taint",
"org.apache.commons.lang3.text;StrSubstitutor;false;replace;(java.lang.Object,java.util.Properties);;MapValue of Argument[1];ReturnValue;taint",
"org.apache.commons.lang3.text;StrSubstitutor;false;setVariableResolver;;;Argument[0];Argument[-1];taint",
"org.apache.commons.lang3.text;StrSubstitutor;false;replaceIn;(org.apache.commons.lang3.text.StrBuilder);;Argument[-1];Argument[0];taint",
"org.apache.commons.lang3.text;StrSubstitutor;false;replaceIn;(java.lang.StringBuffer);;Argument[-1];Argument[0];taint",
@@ -564,6 +687,7 @@ private class ApacheStrSubstitutorModel extends SummaryModelCsv {
"org.apache.commons.lang3.text;StrSubstitutor;false;replaceIn;(java.lang.StringBuilder,int,int);;Argument[-1];Argument[0];taint",
"org.apache.commons.lang3.text;StrSubstitutor;false;replaceIn;(org.apache.commons.lang3.text.StrBuilder,int,int);;Argument[-1];Argument[0];taint",
"org.apache.commons.text;StringSubstitutor;false;StringSubstitutor;;;Argument[0];Argument[-1];taint",
"org.apache.commons.text;StringSubstitutor;false;StringSubstitutor;;;MapValue of Argument[0];Argument[-1];taint",
"org.apache.commons.text;StringSubstitutor;false;replace;;;Argument[-1];ReturnValue;taint",
"org.apache.commons.text;StringSubstitutor;false;replace;(java.lang.Object);;Argument[0];ReturnValue;taint",
"org.apache.commons.text;StringSubstitutor;false;replace;(char[]);;Argument[0];ReturnValue;taint",
@@ -574,10 +698,12 @@ private class ApacheStrSubstitutorModel extends SummaryModelCsv {
"org.apache.commons.text;StringSubstitutor;false;replace;(java.lang.StringBuffer);;Argument[0];ReturnValue;taint",
"org.apache.commons.text;StringSubstitutor;false;replace;(java.lang.StringBuffer,int,int);;Argument[0];ReturnValue;taint",
"org.apache.commons.text;StringSubstitutor;false;replace;(java.lang.String,int,int);;Argument[0];ReturnValue;taint",
"org.apache.commons.text;StringSubstitutor;false;replace;(java.lang.Object,java.util.Map);;Argument[0..1];ReturnValue;taint",
"org.apache.commons.text;StringSubstitutor;false;replace;(java.lang.Object,java.util.Map);;Argument[0];ReturnValue;taint",
"org.apache.commons.text;StringSubstitutor;false;replace;(java.lang.Object,java.util.Map);;MapValue of Argument[1];ReturnValue;taint",
"org.apache.commons.text;StringSubstitutor;false;replace;(java.lang.Object,java.util.Map,java.lang.String,java.lang.String);;Argument[0];ReturnValue;taint",
"org.apache.commons.text;StringSubstitutor;false;replace;(java.lang.Object,java.util.Map,java.lang.String,java.lang.String);;Argument[1];ReturnValue;taint",
"org.apache.commons.text;StringSubstitutor;false;replace;(java.lang.Object,java.util.Properties);;Argument[0..1];ReturnValue;taint",
"org.apache.commons.text;StringSubstitutor;false;replace;(java.lang.Object,java.util.Map,java.lang.String,java.lang.String);;MapValue of Argument[1];ReturnValue;taint",
"org.apache.commons.text;StringSubstitutor;false;replace;(java.lang.Object,java.util.Properties);;Argument[0];ReturnValue;taint",
"org.apache.commons.text;StringSubstitutor;false;replace;(java.lang.Object,java.util.Properties);;MapValue of Argument[1];ReturnValue;taint",
"org.apache.commons.text;StringSubstitutor;false;replace;(org.apache.commons.text.TextStringBuilder);;Argument[0];ReturnValue;taint",
"org.apache.commons.text;StringSubstitutor;false;replace;(org.apache.commons.text.TextStringBuilder,int,int);;Argument[0];ReturnValue;taint",
"org.apache.commons.text;StringSubstitutor;false;setVariableResolver;;;Argument[0];Argument[-1];taint",
@@ -637,3 +763,29 @@ private class ApacheObjectUtilsModel extends SummaryModelCsv {
]
}
}
private class ApacheToStringBuilderModel extends SummaryModelCsv {
override predicate row(string row) {
row =
[
"org.apache.commons.lang3.builder;ToStringBuilder;false;toString;;;Argument[-1];ReturnValue;taint",
"org.apache.commons.lang3.builder;ToStringBuilder;false;append;(java.lang.Object);;Argument[0];Argument[-1];taint",
"org.apache.commons.lang3.builder;ToStringBuilder;false;append;(java.lang.Object[]);;ArrayElement of Argument[0];Argument[-1];taint",
"org.apache.commons.lang3.builder;ToStringBuilder;false;append;(java.lang.String,java.lang.Object[]);;Argument[0];Argument[-1];taint",
"org.apache.commons.lang3.builder;ToStringBuilder;false;append;(java.lang.String,java.lang.Object[]);;ArrayElement of Argument[1];Argument[-1];taint",
"org.apache.commons.lang3.builder;ToStringBuilder;false;append;(java.lang.String,boolean);;Argument[0];Argument[-1];taint",
"org.apache.commons.lang3.builder;ToStringBuilder;false;append;(java.lang.String,java.lang.Object);;Argument[0..1];Argument[-1];taint",
"org.apache.commons.lang3.builder;ToStringBuilder;false;append;(java.lang.String,java.lang.Object[],boolean);;Argument[0];Argument[-1];taint",
"org.apache.commons.lang3.builder;ToStringBuilder;false;append;(java.lang.String,java.lang.Object[],boolean);;ArrayElement of Argument[1];Argument[-1];taint",
"org.apache.commons.lang3.builder;ToStringBuilder;false;build;;;Argument[-1];ReturnValue;taint",
"org.apache.commons.lang3.builder;ToStringBuilder;false;getStringBuffer;;;Argument[-1];ReturnValue;taint",
"org.apache.commons.lang3.builder;ToStringBuilder;false;appendToString;;;Argument[0];Argument[-1];taint",
"org.apache.commons.lang3.builder;ToStringBuilder;false;appendSuper;;;Argument[0];Argument[-1];taint",
// The following are value-preserving steps for fluent methods:
"org.apache.commons.lang3.builder;ToStringBuilder;false;append;;;Argument[-1];ReturnValue;value",
"org.apache.commons.lang3.builder;ToStringBuilder;false;appendAsObjectToString;;;Argument[-1];ReturnValue;value",
"org.apache.commons.lang3.builder;ToStringBuilder;false;appendSuper;;;Argument[-1];ReturnValue;value",
"org.apache.commons.lang3.builder;ToStringBuilder;false;appendToString;;;Argument[-1];ReturnValue;value"
]
}
}

8
java/ql/src/semmle/code/java/frameworks/guava/Base.qll
View File

@@ -30,7 +30,13 @@ private class GuavaBaseCsv extends SummaryModelCsv {
"com.google.common.base;Joiner$MapJoiner;false;useForNull;(String);;Argument[-1];ReturnValue;taint",
"com.google.common.base;Joiner$MapJoiner;false;appendTo;;;Argument[1];Argument[0];taint",
"com.google.common.base;Joiner$MapJoiner;false;appendTo;;;Argument[0];ReturnValue;value",
"com.google.common.base;Joiner$MapJoiner;false;join;;;Argument[-1..0];ReturnValue;taint",
"com.google.common.base;Joiner$MapJoiner;false;join;;;Argument[-1];ReturnValue;taint",
"com.google.common.base;Joiner$MapJoiner;false;join;(Iterable);;MapKey of Element of Argument[0];ReturnValue;taint",
"com.google.common.base;Joiner$MapJoiner;false;join;(Iterable);;MapValue of Element of Argument[0];ReturnValue;taint",
"com.google.common.base;Joiner$MapJoiner;false;join;(Iterator);;MapKey of Element of Argument[0];ReturnValue;taint",
"com.google.common.base;Joiner$MapJoiner;false;join;(Iterator);;MapValue of Element of Argument[0];ReturnValue;taint",
"com.google.common.base;Joiner$MapJoiner;false;join;(Map);;MapKey of Argument[0];ReturnValue;taint",
"com.google.common.base;Joiner$MapJoiner;false;join;(Map);;MapValue of Argument[0];ReturnValue;taint",
"com.google.common.base;Splitter;false;split;(CharSequence);;Argument[0];ReturnValue;taint",
"com.google.common.base;Splitter;false;splitToList;(CharSequence);;Argument[0];ReturnValue;taint",
"com.google.common.base;Splitter;false;splitToStream;(CharSequence);;Argument[0];ReturnValue;taint",

8
java/ql/src/semmle/code/java/frameworks/guava/IO.qll
View File

@@ -24,7 +24,9 @@ private class GuavaIoCsv extends SummaryModelCsv {
"com.google.common.io;BaseEncoding;true;omitPadding;();;Argument[-1];ReturnValue;taint",
"com.google.common.io;BaseEncoding;true;encode;(byte[],int,int);;Argument[-1];ReturnValue;taint",
"com.google.common.io;ByteSource;true;asCharSource;(Charset);;Argument[-1];ReturnValue;taint",
"com.google.common.io;ByteSource;true;concat;;;Argument[0];ReturnValue;taint",
"com.google.common.io;ByteSource;true;concat;(ByteSource[]);;ArrayElement of Argument[0];ReturnValue;taint",
"com.google.common.io;ByteSource;true;concat;(Iterable);;Element of Argument[0];ReturnValue;taint",
"com.google.common.io;ByteSource;true;concat;(Iterator);;Element of Argument[0];ReturnValue;taint",
"com.google.common.io;ByteSource;true;copyTo;(OutputStream);;Argument[-1];Argument[0];taint",
"com.google.common.io;ByteSource;true;openStream;();;Argument[-1];ReturnValue;taint",
"com.google.common.io;ByteSource;true;openBufferedStream;();;Argument[-1];ReturnValue;taint",
@@ -43,7 +45,9 @@ private class GuavaIoCsv extends SummaryModelCsv {
"com.google.common.io;ByteStreams;false;readFully;(InputStream,byte[],int,int);;Argument[0];Argument[1];taint",
"com.google.common.io;ByteStreams;false;toByteArray;(InputStream);;Argument[0];ReturnValue;taint",
"com.google.common.io;CharSource;true;asByteSource;(Charset);;Argument[-1];ReturnValue;taint",
"com.google.common.io;CharSource;true;concat;;;Argument[0];ReturnValue;taint",
"com.google.common.io;CharSource;true;concat;(CharSource[]);;ArrayElement of Argument[0];ReturnValue;taint",
"com.google.common.io;CharSource;true;concat;(Iterable);;Element of Argument[0];ReturnValue;taint",
"com.google.common.io;CharSource;true;concat;(Iterator);;Element of Argument[0];ReturnValue;taint",
"com.google.common.io;CharSource;true;copyTo;(Appendable);;Argument[-1];Argument[0];taint",
"com.google.common.io;CharSource;true;openStream;();;Argument[-1];ReturnValue;taint",
"com.google.common.io;CharSource;true;openBufferedStream;();;Argument[-1];ReturnValue;taint",

1
java/ql/src/semmle/code/java/frameworks/jackson/JacksonSerializability.qll
View File

@@ -280,6 +280,7 @@ private class JacksonModel extends SummaryModelCsv {
row =
[
"com.fasterxml.jackson.databind;ObjectMapper;true;valueToTree;;;Argument[0];ReturnValue;taint",
"com.fasterxml.jackson.databind;ObjectMapper;true;valueToTree;;;MapValue of Argument[0];ReturnValue;taint",
"com.fasterxml.jackson.databind;ObjectMapper;true;convertValue;;;Argument[0];ReturnValue;taint"
]
}

247
java/ql/src/semmle/code/java/security/JexlInjection.qll Normal file
View File

@@ -0,0 +1,247 @@
/** Provides classes to reason about Expression Langauge (JEXL) injection vulnerabilities. */
import java
import semmle.code.java.dataflow.TaintTracking
private import semmle.code.java.dataflow.ExternalFlow
/**
* A sink for Expresssion Language injection vulnerabilities via Jexl,
* that is, method calls that run evaluation of a JEXL expression.
*/
abstract class JexlEvaluationSink extends DataFlow::ExprNode { }
/** Default sink for JXEL injection vulnerabilities. */
private class DefaultJexlEvaluationSink extends JexlEvaluationSink {
DefaultJexlEvaluationSink() { sinkNode(this, "jexl") }
}
private class DefaultJexlInjectionSinkModel extends SinkModelCsv {
override predicate row(string row) {
row =
[
// JEXL2
"org.apache.commons.jexl2;JexlEngine;false;getProperty;(JexlContext,Object,String);;Argument[2];jexl",
"org.apache.commons.jexl2;JexlEngine;false;getProperty;(Object,String);;Argument[1];jexl",
"org.apache.commons.jexl2;JexlEngine;false;setProperty;(JexlContext,Object,String,Object);;Argument[2];jexl",
"org.apache.commons.jexl2;JexlEngine;false;setProperty;(Object,String,Object);;Argument[1];jexl",
"org.apache.commons.jexl2;Expression;false;evaluate;;;Argument[-1];jexl",
"org.apache.commons.jexl2;Expression;false;callable;;;Argument[-1];jexl",
"org.apache.commons.jexl2;JexlExpression;false;evaluate;;;Argument[-1];jexl",
"org.apache.commons.jexl2;JexlExpression;false;callable;;;Argument[-1];jexl",
"org.apache.commons.jexl2;Script;false;execute;;;Argument[-1];jexl",
"org.apache.commons.jexl2;Script;false;callable;;;Argument[-1];jexl",
"org.apache.commons.jexl2;JexlScript;false;execute;;;Argument[-1];jexl",
"org.apache.commons.jexl2;JexlScript;false;callable;;;Argument[-1];jexl",
"org.apache.commons.jexl2;UnifiedJEXL$Expression;false;evaluate;;;Argument[-1];jexl",
"org.apache.commons.jexl2;UnifiedJEXL$Expression;false;prepare;;;Argument[-1];jexl",
"org.apache.commons.jexl2;UnifiedJEXL$Template;false;evaluate;;;Argument[-1];jexl",
// JEXL3
"org.apache.commons.jexl3;JexlEngine;false;getProperty;(JexlContext,Object,String);;Argument[2];jexl",
"org.apache.commons.jexl3;JexlEngine;false;getProperty;(Object,String);;Argument[1];jexl",
"org.apache.commons.jexl3;JexlEngine;false;setProperty;(JexlContext,Object,String);;Argument[2];jexl",
"org.apache.commons.jexl3;JexlEngine;false;setProperty;(Object,String,Object);;Argument[1];jexl",
"org.apache.commons.jexl3;Expression;false;evaluate;;;Argument[-1];jexl",
"org.apache.commons.jexl3;Expression;false;callable;;;Argument[-1];jexl",
"org.apache.commons.jexl3;JexlExpression;false;evaluate;;;Argument[-1];jexl",
"org.apache.commons.jexl3;JexlExpression;false;callable;;;Argument[-1];jexl",
"org.apache.commons.jexl3;Script;false;execute;;;Argument[-1];jexl",
"org.apache.commons.jexl3;Script;false;callable;;;Argument[-1];jexl",
"org.apache.commons.jexl3;JexlScript;false;execute;;;Argument[-1];jexl",
"org.apache.commons.jexl3;JexlScript;false;callable;;;Argument[-1];jexl",
"org.apache.commons.jexl3;JxltEngine$Expression;false;evaluate;;;Argument[-1];jexl",
"org.apache.commons.jexl3;JxltEngine$Expression;false;prepare;;;Argument[-1];jexl",
"org.apache.commons.jexl3;JxltEngine$Template;false;evaluate;;;Argument[-1];jexl"
]
}
}
/**
* A unit class for adding additional taint steps.
*
* Extend this class to add additional taint steps that should apply to the `JexlInjectionFlowConfig`.
*/
class JexlInjectionAdditionalTaintStep extends Unit {
/**
* Holds if the step from `node1` to `node2` should be considered a taint
* step for the `JexlInjectionConfig` configuration.
*/
abstract predicate step(DataFlow::Node node1, DataFlow::Node node2);
}
/** A set of additional taint steps to consider when taint tracking JXEL related data flows. */
private class DefaultJexlInjectionAdditionalTaintStep extends JexlInjectionAdditionalTaintStep {
override predicate step(DataFlow::Node node1, DataFlow::Node node2) {
createJexlScriptStep(node1, node2) or
createJexlExpressionStep(node1, node2) or
createJexlTemplateStep(node1, node2)
}
}
/**
* Holds if `n1` to `n2` is a dataflow step that creates a JEXL script using an unsafe engine
* by calling `tainted.createScript(jexlExpr)`.
*/
private predicate createJexlScriptStep(DataFlow::Node n1, DataFlow::Node n2) {
exists(MethodAccess ma, Method m | m = ma.getMethod() and n2.asExpr() = ma |
not isSafeEngine(ma.getQualifier()) and
m instanceof CreateJexlScriptMethod and
n1.asExpr() = ma.getArgument(0) and
n1.asExpr().getType() instanceof TypeString
)
}
/**
* Holds if `n1` to `n2` is a dataflow step that creates a JEXL expression using an unsafe engine
* by calling `tainted.createExpression(jexlExpr)`.
*/
private predicate createJexlExpressionStep(DataFlow::Node n1, DataFlow::Node n2) {
exists(MethodAccess ma, Method m | m = ma.getMethod() and n2.asExpr() = ma |
not isSafeEngine(ma.getQualifier()) and
m instanceof CreateJexlExpressionMethod and
n1.asExpr() = ma.getAnArgument() and
n1.asExpr().getType() instanceof TypeString
)
}
/**
* Holds if `n1` to `n2` is a dataflow step that creates a JEXL template using an unsafe engine
* by calling `tainted.createTemplate(jexlExpr)`.
*/
private predicate createJexlTemplateStep(DataFlow::Node n1, DataFlow::Node n2) {
exists(MethodAccess ma, Method m, RefType taintType |
m = ma.getMethod() and n2.asExpr() = ma and taintType = n1.asExpr().getType()
|
not isSafeEngine(ma.getQualifier()) and
m instanceof CreateJexlTemplateMethod and
n1.asExpr() = ma.getArgument([0, 1]) and
(taintType instanceof TypeString or taintType instanceof Reader)
)
}
/**
* Holds if `expr` is a JEXL engine that is configured with a sandbox.
*/
private predicate isSafeEngine(Expr expr) {
exists(SandboxedJexlFlowConfig config | config.hasFlowTo(DataFlow::exprNode(expr)))
}
/**
* A configuration for tracking sandboxed JEXL engines.
*/
private class SandboxedJexlFlowConfig extends DataFlow2::Configuration {
SandboxedJexlFlowConfig() { this = "JexlInjection::SandboxedJexlFlowConfig" }
override predicate isSource(DataFlow::Node node) { node instanceof SandboxedJexlSource }
override predicate isSink(DataFlow::Node node) {
exists(MethodAccess ma, Method m |
m instanceof CreateJexlScriptMethod or
m instanceof CreateJexlExpressionMethod or
m instanceof CreateJexlTemplateMethod
|
ma.getMethod() = m and ma.getQualifier() = node.asExpr()
)
}
override predicate isAdditionalFlowStep(DataFlow::Node fromNode, DataFlow::Node toNode) {
createJexlEngineStep(fromNode, toNode)
}
}
/**
* Defines a data flow source for JEXL engines configured with a sandbox.
*/
private class SandboxedJexlSource extends DataFlow::ExprNode {
SandboxedJexlSource() {
exists(MethodAccess ma, Method m | m = ma.getMethod() |
m.getDeclaringType() instanceof JexlBuilder and
m.hasName(["uberspect", "sandbox"]) and
m.getReturnType() instanceof JexlBuilder and
this.asExpr() = [ma, ma.getQualifier()]
)
or
exists(ConstructorCall cc |
cc.getConstructedType() instanceof JexlEngine and
cc.getArgument(0).getType() instanceof JexlUberspect and
cc = this.asExpr()
)
}
}
/**
* Holds if `fromNode` to `toNode` is a dataflow step that creates one of the JEXL engines.
*/
private predicate createJexlEngineStep(DataFlow::Node fromNode, DataFlow::Node toNode) {
exists(MethodAccess ma, Method m | m = ma.getMethod() |
(m.getDeclaringType() instanceof JexlBuilder or m.getDeclaringType() instanceof JexlEngine) and
m.hasName(["create", "createJxltEngine"]) and
ma.getQualifier() = fromNode.asExpr() and
ma = toNode.asExpr()
)
or
exists(ConstructorCall cc |
cc.getConstructedType() instanceof UnifiedJexl and
cc.getArgument(0) = fromNode.asExpr() and
cc = toNode.asExpr()
)
}
/**
* A method that creates a JEXL script.
*/
private class CreateJexlScriptMethod extends Method {
CreateJexlScriptMethod() { getDeclaringType() instanceof JexlEngine and hasName("createScript") }
}
/**
* A method that creates a JEXL template.
*/
private class CreateJexlTemplateMethod extends Method {
CreateJexlTemplateMethod() {
(getDeclaringType() instanceof JxltEngine or getDeclaringType() instanceof UnifiedJexl) and
hasName("createTemplate")
}
}
/**
* A method that creates a JEXL expression.
*/
private class CreateJexlExpressionMethod extends Method {
CreateJexlExpressionMethod() {
(getDeclaringType() instanceof JexlEngine or getDeclaringType() instanceof JxltEngine) and
hasName("createExpression")
or
getDeclaringType() instanceof UnifiedJexl and hasName("parse")
}
}
private class JexlRefType extends RefType {
JexlRefType() { getPackage().hasName(["org.apache.commons.jexl2", "org.apache.commons.jexl3"]) }
}
private class JexlBuilder extends JexlRefType {
JexlBuilder() { hasName("JexlBuilder") }
}
private class JexlEngine extends JexlRefType {
JexlEngine() { hasName("JexlEngine") }
}
private class JxltEngine extends JexlRefType {
JxltEngine() { hasName("JxltEngine") }
}
private class UnifiedJexl extends JexlRefType {
UnifiedJexl() { hasName("UnifiedJEXL") }
}
private class JexlUberspect extends Interface {
JexlUberspect() {
hasQualifiedName("org.apache.commons.jexl2.introspection", "Uberspect") or
hasQualifiedName("org.apache.commons.jexl3.introspection", "JexlUberspect")
}
}
private class Reader extends RefType {
Reader() { hasQualifiedName("java.io", "Reader") }
}

199
java/ql/test/experimental/query-tests/security/CWE-094/JexlInjection.expected
View File

@@ -1,199 +0,0 @@
edges
| Jexl2Injection.java:10:43:10:57 | jexlExpr : String | Jexl2Injection.java:14:9:14:9 | e |
| Jexl2Injection.java:17:55:17:69 | jexlExpr : String | Jexl2Injection.java:22:9:22:9 | e |
| Jexl2Injection.java:25:39:25:53 | jexlExpr : String | Jexl2Injection.java:29:9:29:14 | script |
| Jexl2Injection.java:32:50:32:64 | jexlExpr : String | Jexl2Injection.java:38:13:38:18 | script |
| Jexl2Injection.java:44:57:44:71 | jexlExpr : String | Jexl2Injection.java:46:40:46:47 | jexlExpr |
| Jexl2Injection.java:49:57:49:71 | jexlExpr : String | Jexl2Injection.java:51:40:51:47 | jexlExpr |
| Jexl2Injection.java:54:73:54:87 | jexlExpr : String | Jexl2Injection.java:57:9:57:35 | parse(...) |
| Jexl2Injection.java:60:72:60:86 | jexlExpr : String | Jexl2Injection.java:63:9:63:35 | parse(...) |
| Jexl2Injection.java:66:73:66:87 | jexlExpr : String | Jexl2Injection.java:69:9:69:44 | createTemplate(...) |
| Jexl2Injection.java:76:25:76:47 | getInputStream(...) : InputStream | Jexl2Injection.java:76:54:76:58 | bytes [post update] : byte[] |
| Jexl2Injection.java:76:54:76:58 | bytes [post update] : byte[] | Jexl2Injection.java:78:31:78:38 | jexlExpr : String |
| Jexl2Injection.java:78:31:78:38 | jexlExpr : String | Jexl2Injection.java:86:24:86:56 | jexlExpr : String |
| Jexl2Injection.java:78:31:78:38 | jexlExpr : String | Jexl2Injection.java:90:24:90:68 | jexlExpr : String |
| Jexl2Injection.java:78:31:78:38 | jexlExpr : String | Jexl2Injection.java:94:24:94:52 | jexlExpr : String |
| Jexl2Injection.java:78:31:78:38 | jexlExpr : String | Jexl2Injection.java:98:24:98:63 | jexlExpr : String |
| Jexl2Injection.java:78:31:78:38 | jexlExpr : String | Jexl2Injection.java:102:24:102:70 | jexlExpr : String |
| Jexl2Injection.java:78:31:78:38 | jexlExpr : String | Jexl2Injection.java:106:24:106:70 | jexlExpr : String |
| Jexl2Injection.java:78:31:78:38 | jexlExpr : String | Jexl2Injection.java:110:24:110:86 | jexlExpr : String |
| Jexl2Injection.java:78:31:78:38 | jexlExpr : String | Jexl2Injection.java:114:24:114:85 | jexlExpr : String |
| Jexl2Injection.java:78:31:78:38 | jexlExpr : String | Jexl2Injection.java:118:24:118:86 | jexlExpr : String |
| Jexl2Injection.java:86:24:86:56 | jexlExpr : String | Jexl2Injection.java:10:43:10:57 | jexlExpr : String |
| Jexl2Injection.java:86:24:86:56 | jexlExpr : String | Jexl2Injection.java:86:24:86:56 | jexlExpr : String |
| Jexl2Injection.java:90:24:90:68 | jexlExpr : String | Jexl2Injection.java:17:55:17:69 | jexlExpr : String |
| Jexl2Injection.java:90:24:90:68 | jexlExpr : String | Jexl2Injection.java:90:24:90:68 | jexlExpr : String |
| Jexl2Injection.java:94:24:94:52 | jexlExpr : String | Jexl2Injection.java:25:39:25:53 | jexlExpr : String |
| Jexl2Injection.java:94:24:94:52 | jexlExpr : String | Jexl2Injection.java:94:24:94:52 | jexlExpr : String |
| Jexl2Injection.java:98:24:98:63 | jexlExpr : String | Jexl2Injection.java:32:50:32:64 | jexlExpr : String |
| Jexl2Injection.java:98:24:98:63 | jexlExpr : String | Jexl2Injection.java:98:24:98:63 | jexlExpr : String |
| Jexl2Injection.java:102:24:102:70 | jexlExpr : String | Jexl2Injection.java:44:57:44:71 | jexlExpr : String |
| Jexl2Injection.java:102:24:102:70 | jexlExpr : String | Jexl2Injection.java:102:24:102:70 | jexlExpr : String |
| Jexl2Injection.java:106:24:106:70 | jexlExpr : String | Jexl2Injection.java:49:57:49:71 | jexlExpr : String |
| Jexl2Injection.java:106:24:106:70 | jexlExpr : String | Jexl2Injection.java:106:24:106:70 | jexlExpr : String |
| Jexl2Injection.java:110:24:110:86 | jexlExpr : String | Jexl2Injection.java:54:73:54:87 | jexlExpr : String |
| Jexl2Injection.java:110:24:110:86 | jexlExpr : String | Jexl2Injection.java:110:24:110:86 | jexlExpr : String |
| Jexl2Injection.java:114:24:114:85 | jexlExpr : String | Jexl2Injection.java:60:72:60:86 | jexlExpr : String |
| Jexl2Injection.java:114:24:114:85 | jexlExpr : String | Jexl2Injection.java:114:24:114:85 | jexlExpr : String |
| Jexl2Injection.java:118:24:118:86 | jexlExpr : String | Jexl2Injection.java:66:73:66:87 | jexlExpr : String |
| Jexl2Injection.java:118:24:118:86 | jexlExpr : String | Jexl2Injection.java:118:24:118:86 | jexlExpr : String |
| Jexl3Injection.java:17:43:17:57 | jexlExpr : String | Jexl3Injection.java:21:9:21:9 | e |
| Jexl3Injection.java:24:55:24:69 | jexlExpr : String | Jexl3Injection.java:28:9:28:9 | e |
| Jexl3Injection.java:31:39:31:53 | jexlExpr : String | Jexl3Injection.java:35:9:35:14 | script |
| Jexl3Injection.java:38:50:38:64 | jexlExpr : String | Jexl3Injection.java:44:13:44:18 | script |
| Jexl3Injection.java:50:57:50:71 | jexlExpr : String | Jexl3Injection.java:52:40:52:47 | jexlExpr |
| Jexl3Injection.java:55:57:55:71 | jexlExpr : String | Jexl3Injection.java:57:40:57:47 | jexlExpr |
| Jexl3Injection.java:60:74:60:88 | jexlExpr : String | Jexl3Injection.java:63:9:63:39 | createExpression(...) |
| Jexl3Injection.java:66:73:66:87 | jexlExpr : String | Jexl3Injection.java:69:9:69:39 | createExpression(...) |
| Jexl3Injection.java:72:72:72:86 | jexlExpr : String | Jexl3Injection.java:75:9:75:37 | createTemplate(...) |
| Jexl3Injection.java:78:54:78:68 | jexlExpr : String | Jexl3Injection.java:84:13:84:13 | e |
| Jexl3Injection.java:94:25:94:47 | getInputStream(...) : InputStream | Jexl3Injection.java:94:54:94:58 | bytes [post update] : byte[] |
| Jexl3Injection.java:94:54:94:58 | bytes [post update] : byte[] | Jexl3Injection.java:96:31:96:38 | jexlExpr : String |
| Jexl3Injection.java:96:31:96:38 | jexlExpr : String | Jexl3Injection.java:104:24:104:56 | jexlExpr : String |
| Jexl3Injection.java:96:31:96:38 | jexlExpr : String | Jexl3Injection.java:108:24:108:68 | jexlExpr : String |
| Jexl3Injection.java:96:31:96:38 | jexlExpr : String | Jexl3Injection.java:112:24:112:52 | jexlExpr : String |
| Jexl3Injection.java:96:31:96:38 | jexlExpr : String | Jexl3Injection.java:116:24:116:63 | jexlExpr : String |
| Jexl3Injection.java:96:31:96:38 | jexlExpr : String | Jexl3Injection.java:120:24:120:70 | jexlExpr : String |
| Jexl3Injection.java:96:31:96:38 | jexlExpr : String | Jexl3Injection.java:124:24:124:70 | jexlExpr : String |
| Jexl3Injection.java:96:31:96:38 | jexlExpr : String | Jexl3Injection.java:128:24:128:87 | jexlExpr : String |
| Jexl3Injection.java:96:31:96:38 | jexlExpr : String | Jexl3Injection.java:132:24:132:86 | jexlExpr : String |
| Jexl3Injection.java:96:31:96:38 | jexlExpr : String | Jexl3Injection.java:136:24:136:85 | jexlExpr : String |
| Jexl3Injection.java:96:31:96:38 | jexlExpr : String | Jexl3Injection.java:140:24:140:67 | jexlExpr : String |
| Jexl3Injection.java:104:24:104:56 | jexlExpr : String | Jexl3Injection.java:17:43:17:57 | jexlExpr : String |
| Jexl3Injection.java:104:24:104:56 | jexlExpr : String | Jexl3Injection.java:104:24:104:56 | jexlExpr : String |
| Jexl3Injection.java:108:24:108:68 | jexlExpr : String | Jexl3Injection.java:24:55:24:69 | jexlExpr : String |
| Jexl3Injection.java:108:24:108:68 | jexlExpr : String | Jexl3Injection.java:108:24:108:68 | jexlExpr : String |
| Jexl3Injection.java:112:24:112:52 | jexlExpr : String | Jexl3Injection.java:31:39:31:53 | jexlExpr : String |
| Jexl3Injection.java:112:24:112:52 | jexlExpr : String | Jexl3Injection.java:112:24:112:52 | jexlExpr : String |
| Jexl3Injection.java:116:24:116:63 | jexlExpr : String | Jexl3Injection.java:38:50:38:64 | jexlExpr : String |
| Jexl3Injection.java:116:24:116:63 | jexlExpr : String | Jexl3Injection.java:116:24:116:63 | jexlExpr : String |
| Jexl3Injection.java:120:24:120:70 | jexlExpr : String | Jexl3Injection.java:50:57:50:71 | jexlExpr : String |
| Jexl3Injection.java:120:24:120:70 | jexlExpr : String | Jexl3Injection.java:120:24:120:70 | jexlExpr : String |
| Jexl3Injection.java:124:24:124:70 | jexlExpr : String | Jexl3Injection.java:55:57:55:71 | jexlExpr : String |
| Jexl3Injection.java:124:24:124:70 | jexlExpr : String | Jexl3Injection.java:124:24:124:70 | jexlExpr : String |
| Jexl3Injection.java:128:24:128:87 | jexlExpr : String | Jexl3Injection.java:60:74:60:88 | jexlExpr : String |
| Jexl3Injection.java:128:24:128:87 | jexlExpr : String | Jexl3Injection.java:128:24:128:87 | jexlExpr : String |
| Jexl3Injection.java:132:24:132:86 | jexlExpr : String | Jexl3Injection.java:66:73:66:87 | jexlExpr : String |
| Jexl3Injection.java:132:24:132:86 | jexlExpr : String | Jexl3Injection.java:132:24:132:86 | jexlExpr : String |
| Jexl3Injection.java:136:24:136:85 | jexlExpr : String | Jexl3Injection.java:72:72:72:86 | jexlExpr : String |
| Jexl3Injection.java:136:24:136:85 | jexlExpr : String | Jexl3Injection.java:136:24:136:85 | jexlExpr : String |
| Jexl3Injection.java:140:24:140:67 | jexlExpr : String | Jexl3Injection.java:78:54:78:68 | jexlExpr : String |
| Jexl3Injection.java:140:24:140:67 | jexlExpr : String | Jexl3Injection.java:140:24:140:67 | jexlExpr : String |
| Jexl3Injection.java:145:13:145:37 | expr : String | Jexl3Injection.java:147:27:147:30 | expr : String |
| Jexl3Injection.java:147:27:147:30 | expr : String | Jexl3Injection.java:17:43:17:57 | jexlExpr : String |
| Jexl3Injection.java:153:13:153:34 | data : Data | Jexl3Injection.java:156:27:156:30 | expr : String |
| Jexl3Injection.java:156:27:156:30 | expr : String | Jexl3Injection.java:17:43:17:57 | jexlExpr : String |
| Jexl3Injection.java:163:13:163:52 | customRequest : CustomRequest | Jexl3Injection.java:166:27:166:30 | expr : String |
| Jexl3Injection.java:166:27:166:30 | expr : String | Jexl3Injection.java:17:43:17:57 | jexlExpr : String |
nodes
| Jexl2Injection.java:10:43:10:57 | jexlExpr : String | semmle.label | jexlExpr : String |
| Jexl2Injection.java:14:9:14:9 | e | semmle.label | e |
| Jexl2Injection.java:17:55:17:69 | jexlExpr : String | semmle.label | jexlExpr : String |
| Jexl2Injection.java:22:9:22:9 | e | semmle.label | e |
| Jexl2Injection.java:25:39:25:53 | jexlExpr : String | semmle.label | jexlExpr : String |
| Jexl2Injection.java:29:9:29:14 | script | semmle.label | script |
| Jexl2Injection.java:32:50:32:64 | jexlExpr : String | semmle.label | jexlExpr : String |
| Jexl2Injection.java:38:13:38:18 | script | semmle.label | script |
| Jexl2Injection.java:44:57:44:71 | jexlExpr : String | semmle.label | jexlExpr : String |
| Jexl2Injection.java:46:40:46:47 | jexlExpr | semmle.label | jexlExpr |
| Jexl2Injection.java:49:57:49:71 | jexlExpr : String | semmle.label | jexlExpr : String |
| Jexl2Injection.java:51:40:51:47 | jexlExpr | semmle.label | jexlExpr |
| Jexl2Injection.java:54:73:54:87 | jexlExpr : String | semmle.label | jexlExpr : String |
| Jexl2Injection.java:57:9:57:35 | parse(...) | semmle.label | parse(...) |
| Jexl2Injection.java:60:72:60:86 | jexlExpr : String | semmle.label | jexlExpr : String |
| Jexl2Injection.java:63:9:63:35 | parse(...) | semmle.label | parse(...) |
| Jexl2Injection.java:66:73:66:87 | jexlExpr : String | semmle.label | jexlExpr : String |
| Jexl2Injection.java:69:9:69:44 | createTemplate(...) | semmle.label | createTemplate(...) |
| Jexl2Injection.java:76:25:76:47 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
| Jexl2Injection.java:76:54:76:58 | bytes [post update] : byte[] | semmle.label | bytes [post update] : byte[] |
| Jexl2Injection.java:78:31:78:38 | jexlExpr : String | semmle.label | jexlExpr : String |
| Jexl2Injection.java:86:24:86:56 | jexlExpr : String | semmle.label | jexlExpr : String |
| Jexl2Injection.java:86:24:86:56 | jexlExpr : String | semmle.label | jexlExpr : String |
| Jexl2Injection.java:90:24:90:68 | jexlExpr : String | semmle.label | jexlExpr : String |
| Jexl2Injection.java:90:24:90:68 | jexlExpr : String | semmle.label | jexlExpr : String |
| Jexl2Injection.java:94:24:94:52 | jexlExpr : String | semmle.label | jexlExpr : String |
| Jexl2Injection.java:94:24:94:52 | jexlExpr : String | semmle.label | jexlExpr : String |
| Jexl2Injection.java:98:24:98:63 | jexlExpr : String | semmle.label | jexlExpr : String |
| Jexl2Injection.java:98:24:98:63 | jexlExpr : String | semmle.label | jexlExpr : String |
| Jexl2Injection.java:102:24:102:70 | jexlExpr : String | semmle.label | jexlExpr : String |
| Jexl2Injection.java:102:24:102:70 | jexlExpr : String | semmle.label | jexlExpr : String |
| Jexl2Injection.java:106:24:106:70 | jexlExpr : String | semmle.label | jexlExpr : String |
| Jexl2Injection.java:106:24:106:70 | jexlExpr : String | semmle.label | jexlExpr : String |
| Jexl2Injection.java:110:24:110:86 | jexlExpr : String | semmle.label | jexlExpr : String |
| Jexl2Injection.java:110:24:110:86 | jexlExpr : String | semmle.label | jexlExpr : String |
| Jexl2Injection.java:114:24:114:85 | jexlExpr : String | semmle.label | jexlExpr : String |
| Jexl2Injection.java:114:24:114:85 | jexlExpr : String | semmle.label | jexlExpr : String |
| Jexl2Injection.java:118:24:118:86 | jexlExpr : String | semmle.label | jexlExpr : String |
| Jexl2Injection.java:118:24:118:86 | jexlExpr : String | semmle.label | jexlExpr : String |
| Jexl3Injection.java:17:43:17:57 | jexlExpr : String | semmle.label | jexlExpr : String |
| Jexl3Injection.java:21:9:21:9 | e | semmle.label | e |
| Jexl3Injection.java:24:55:24:69 | jexlExpr : String | semmle.label | jexlExpr : String |
| Jexl3Injection.java:28:9:28:9 | e | semmle.label | e |
| Jexl3Injection.java:31:39:31:53 | jexlExpr : String | semmle.label | jexlExpr : String |
| Jexl3Injection.java:35:9:35:14 | script | semmle.label | script |
| Jexl3Injection.java:38:50:38:64 | jexlExpr : String | semmle.label | jexlExpr : String |
| Jexl3Injection.java:44:13:44:18 | script | semmle.label | script |
| Jexl3Injection.java:50:57:50:71 | jexlExpr : String | semmle.label | jexlExpr : String |
| Jexl3Injection.java:52:40:52:47 | jexlExpr | semmle.label | jexlExpr |
| Jexl3Injection.java:55:57:55:71 | jexlExpr : String | semmle.label | jexlExpr : String |
| Jexl3Injection.java:57:40:57:47 | jexlExpr | semmle.label | jexlExpr |
| Jexl3Injection.java:60:74:60:88 | jexlExpr : String | semmle.label | jexlExpr : String |
| Jexl3Injection.java:63:9:63:39 | createExpression(...) | semmle.label | createExpression(...) |
| Jexl3Injection.java:66:73:66:87 | jexlExpr : String | semmle.label | jexlExpr : String |
| Jexl3Injection.java:69:9:69:39 | createExpression(...) | semmle.label | createExpression(...) |
| Jexl3Injection.java:72:72:72:86 | jexlExpr : String | semmle.label | jexlExpr : String |
| Jexl3Injection.java:75:9:75:37 | createTemplate(...) | semmle.label | createTemplate(...) |
| Jexl3Injection.java:78:54:78:68 | jexlExpr : String | semmle.label | jexlExpr : String |
| Jexl3Injection.java:84:13:84:13 | e | semmle.label | e |
| Jexl3Injection.java:94:25:94:47 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
| Jexl3Injection.java:94:54:94:58 | bytes [post update] : byte[] | semmle.label | bytes [post update] : byte[] |
| Jexl3Injection.java:96:31:96:38 | jexlExpr : String | semmle.label | jexlExpr : String |
| Jexl3Injection.java:104:24:104:56 | jexlExpr : String | semmle.label | jexlExpr : String |
| Jexl3Injection.java:104:24:104:56 | jexlExpr : String | semmle.label | jexlExpr : String |
| Jexl3Injection.java:108:24:108:68 | jexlExpr : String | semmle.label | jexlExpr : String |
| Jexl3Injection.java:108:24:108:68 | jexlExpr : String | semmle.label | jexlExpr : String |
| Jexl3Injection.java:112:24:112:52 | jexlExpr : String | semmle.label | jexlExpr : String |
| Jexl3Injection.java:112:24:112:52 | jexlExpr : String | semmle.label | jexlExpr : String |
| Jexl3Injection.java:116:24:116:63 | jexlExpr : String | semmle.label | jexlExpr : String |
| Jexl3Injection.java:116:24:116:63 | jexlExpr : String | semmle.label | jexlExpr : String |
| Jexl3Injection.java:120:24:120:70 | jexlExpr : String | semmle.label | jexlExpr : String |
| Jexl3Injection.java:120:24:120:70 | jexlExpr : String | semmle.label | jexlExpr : String |
| Jexl3Injection.java:124:24:124:70 | jexlExpr : String | semmle.label | jexlExpr : String |
| Jexl3Injection.java:124:24:124:70 | jexlExpr : String | semmle.label | jexlExpr : String |
| Jexl3Injection.java:128:24:128:87 | jexlExpr : String | semmle.label | jexlExpr : String |
| Jexl3Injection.java:128:24:128:87 | jexlExpr : String | semmle.label | jexlExpr : String |
| Jexl3Injection.java:132:24:132:86 | jexlExpr : String | semmle.label | jexlExpr : String |
| Jexl3Injection.java:132:24:132:86 | jexlExpr : String | semmle.label | jexlExpr : String |
| Jexl3Injection.java:136:24:136:85 | jexlExpr : String | semmle.label | jexlExpr : String |
| Jexl3Injection.java:136:24:136:85 | jexlExpr : String | semmle.label | jexlExpr : String |
| Jexl3Injection.java:140:24:140:67 | jexlExpr : String | semmle.label | jexlExpr : String |
| Jexl3Injection.java:140:24:140:67 | jexlExpr : String | semmle.label | jexlExpr : String |
| Jexl3Injection.java:145:13:145:37 | expr : String | semmle.label | expr : String |
| Jexl3Injection.java:147:27:147:30 | expr : String | semmle.label | expr : String |
| Jexl3Injection.java:153:13:153:34 | data : Data | semmle.label | data : Data |
| Jexl3Injection.java:156:27:156:30 | expr : String | semmle.label | expr : String |
| Jexl3Injection.java:163:13:163:52 | customRequest : CustomRequest | semmle.label | customRequest : CustomRequest |
| Jexl3Injection.java:166:27:166:30 | expr : String | semmle.label | expr : String |
#select
| Jexl2Injection.java:14:9:14:9 | e | Jexl2Injection.java:76:25:76:47 | getInputStream(...) : InputStream | Jexl2Injection.java:14:9:14:9 | e | JEXL injection from $@. | Jexl2Injection.java:76:25:76:47 | getInputStream(...) | this user input |
| Jexl2Injection.java:22:9:22:9 | e | Jexl2Injection.java:76:25:76:47 | getInputStream(...) : InputStream | Jexl2Injection.java:22:9:22:9 | e | JEXL injection from $@. | Jexl2Injection.java:76:25:76:47 | getInputStream(...) | this user input |
| Jexl2Injection.java:29:9:29:14 | script | Jexl2Injection.java:76:25:76:47 | getInputStream(...) : InputStream | Jexl2Injection.java:29:9:29:14 | script | JEXL injection from $@. | Jexl2Injection.java:76:25:76:47 | getInputStream(...) | this user input |
| Jexl2Injection.java:38:13:38:18 | script | Jexl2Injection.java:76:25:76:47 | getInputStream(...) : InputStream | Jexl2Injection.java:38:13:38:18 | script | JEXL injection from $@. | Jexl2Injection.java:76:25:76:47 | getInputStream(...) | this user input |
| Jexl2Injection.java:46:40:46:47 | jexlExpr | Jexl2Injection.java:76:25:76:47 | getInputStream(...) : InputStream | Jexl2Injection.java:46:40:46:47 | jexlExpr | JEXL injection from $@. | Jexl2Injection.java:76:25:76:47 | getInputStream(...) | this user input |
| Jexl2Injection.java:51:40:51:47 | jexlExpr | Jexl2Injection.java:76:25:76:47 | getInputStream(...) : InputStream | Jexl2Injection.java:51:40:51:47 | jexlExpr | JEXL injection from $@. | Jexl2Injection.java:76:25:76:47 | getInputStream(...) | this user input |
| Jexl2Injection.java:57:9:57:35 | parse(...) | Jexl2Injection.java:76:25:76:47 | getInputStream(...) : InputStream | Jexl2Injection.java:57:9:57:35 | parse(...) | JEXL injection from $@. | Jexl2Injection.java:76:25:76:47 | getInputStream(...) | this user input |
| Jexl2Injection.java:63:9:63:35 | parse(...) | Jexl2Injection.java:76:25:76:47 | getInputStream(...) : InputStream | Jexl2Injection.java:63:9:63:35 | parse(...) | JEXL injection from $@. | Jexl2Injection.java:76:25:76:47 | getInputStream(...) | this user input |
| Jexl2Injection.java:69:9:69:44 | createTemplate(...) | Jexl2Injection.java:76:25:76:47 | getInputStream(...) : InputStream | Jexl2Injection.java:69:9:69:44 | createTemplate(...) | JEXL injection from $@. | Jexl2Injection.java:76:25:76:47 | getInputStream(...) | this user input |
| Jexl3Injection.java:21:9:21:9 | e | Jexl3Injection.java:94:25:94:47 | getInputStream(...) : InputStream | Jexl3Injection.java:21:9:21:9 | e | JEXL injection from $@. | Jexl3Injection.java:94:25:94:47 | getInputStream(...) | this user input |
| Jexl3Injection.java:21:9:21:9 | e | Jexl3Injection.java:145:13:145:37 | expr : String | Jexl3Injection.java:21:9:21:9 | e | JEXL injection from $@. | Jexl3Injection.java:145:13:145:37 | expr | this user input |
| Jexl3Injection.java:21:9:21:9 | e | Jexl3Injection.java:153:13:153:34 | data : Data | Jexl3Injection.java:21:9:21:9 | e | JEXL injection from $@. | Jexl3Injection.java:153:13:153:34 | data | this user input |
| Jexl3Injection.java:21:9:21:9 | e | Jexl3Injection.java:163:13:163:52 | customRequest : CustomRequest | Jexl3Injection.java:21:9:21:9 | e | JEXL injection from $@. | Jexl3Injection.java:163:13:163:52 | customRequest | this user input |
| Jexl3Injection.java:28:9:28:9 | e | Jexl3Injection.java:94:25:94:47 | getInputStream(...) : InputStream | Jexl3Injection.java:28:9:28:9 | e | JEXL injection from $@. | Jexl3Injection.java:94:25:94:47 | getInputStream(...) | this user input |
| Jexl3Injection.java:35:9:35:14 | script | Jexl3Injection.java:94:25:94:47 | getInputStream(...) : InputStream | Jexl3Injection.java:35:9:35:14 | script | JEXL injection from $@. | Jexl3Injection.java:94:25:94:47 | getInputStream(...) | this user input |
| Jexl3Injection.java:44:13:44:18 | script | Jexl3Injection.java:94:25:94:47 | getInputStream(...) : InputStream | Jexl3Injection.java:44:13:44:18 | script | JEXL injection from $@. | Jexl3Injection.java:94:25:94:47 | getInputStream(...) | this user input |
| Jexl3Injection.java:52:40:52:47 | jexlExpr | Jexl3Injection.java:94:25:94:47 | getInputStream(...) : InputStream | Jexl3Injection.java:52:40:52:47 | jexlExpr | JEXL injection from $@. | Jexl3Injection.java:94:25:94:47 | getInputStream(...) | this user input |
| Jexl3Injection.java:57:40:57:47 | jexlExpr | Jexl3Injection.java:94:25:94:47 | getInputStream(...) : InputStream | Jexl3Injection.java:57:40:57:47 | jexlExpr | JEXL injection from $@. | Jexl3Injection.java:94:25:94:47 | getInputStream(...) | this user input |
| Jexl3Injection.java:63:9:63:39 | createExpression(...) | Jexl3Injection.java:94:25:94:47 | getInputStream(...) : InputStream | Jexl3Injection.java:63:9:63:39 | createExpression(...) | JEXL injection from $@. | Jexl3Injection.java:94:25:94:47 | getInputStream(...) | this user input |
| Jexl3Injection.java:69:9:69:39 | createExpression(...) | Jexl3Injection.java:94:25:94:47 | getInputStream(...) : InputStream | Jexl3Injection.java:69:9:69:39 | createExpression(...) | JEXL injection from $@. | Jexl3Injection.java:94:25:94:47 | getInputStream(...) | this user input |
| Jexl3Injection.java:75:9:75:37 | createTemplate(...) | Jexl3Injection.java:94:25:94:47 | getInputStream(...) : InputStream | Jexl3Injection.java:75:9:75:37 | createTemplate(...) | JEXL injection from $@. | Jexl3Injection.java:94:25:94:47 | getInputStream(...) | this user input |
| Jexl3Injection.java:84:13:84:13 | e | Jexl3Injection.java:94:25:94:47 | getInputStream(...) : InputStream | Jexl3Injection.java:84:13:84:13 | e | JEXL injection from $@. | Jexl3Injection.java:94:25:94:47 | getInputStream(...) | this user input |

1
java/ql/test/experimental/query-tests/security/CWE-094/JexlInjection.qlref
View File

@@ -1 +0,0 @@
experimental/Security/CWE/CWE-094/JexlInjection.ql

3
java/ql/test/experimental/query-tests/security/CWE-094/options
View File

@@ -1,2 +1 @@
//semmle-extractor-options: --javac-args -cp ${testdir}/../../../../stubs/springframework-5.2.3:${testdir}/../../../../stubs/mvel2-2.4.7:${testdir}/../../../../stubs/jsr223-api:${testdir}/../../../../stubs/apache-commons-jexl-2.1.1:${testdir}/../../../../stubs/apache-commons-jexl-3.1:${testdir}/../../../../stubs/scriptengine:${testdir}/../../../../stubs/java-ee-el:${testdir}/../../../../stubs/juel-2.2:${testdir}/../../../stubs/groovy-all-3.0.7:${testdir}/../../../../stubs/servlet-api-2.4:${testdir}/../../../../stubs/jython-2.7.2:${testdir}/../../../../experimental/stubs/rhino-1.7.13
//semmle-extractor-options: --javac-args -cp ${testdir}/../../../../stubs/springframework-5.2.3:${testdir}/../../../../stubs/mvel2-2.4.7:${testdir}/../../../../stubs/jsr223-api:${testdir}/../../../../stubs/scriptengine:${testdir}/../../../../stubs/java-ee-el:${testdir}/../../../../stubs/juel-2.2:${testdir}/../../../stubs/groovy-all-3.0.7:${testdir}/../../../../stubs/servlet-api-2.4:${testdir}/../../../../stubs/jython-2.7.2:${testdir}/../../../../experimental/stubs/rhino-1.7.13

3
java/ql/test/experimental/query-tests/security/CWE-348/ClientSuppliedIpUsedInSecurityCheck.expected
View File

@@ -1,7 +1,9 @@
edges
| ClientSuppliedIpUsedInSecurityCheck.java:16:21:16:33 | getClientIP(...) : String | ClientSuppliedIpUsedInSecurityCheck.java:17:37:17:38 | ip |
| ClientSuppliedIpUsedInSecurityCheck.java:24:21:24:33 | getClientIP(...) : String | ClientSuppliedIpUsedInSecurityCheck.java:25:33:25:34 | ip |
| ClientSuppliedIpUsedInSecurityCheck.java:43:27:43:62 | getHeader(...) : String | ClientSuppliedIpUsedInSecurityCheck.java:47:16:47:34 | split(...) : String[] |
| ClientSuppliedIpUsedInSecurityCheck.java:43:27:43:62 | getHeader(...) : String | ClientSuppliedIpUsedInSecurityCheck.java:47:16:47:37 | ...[...] : String |
| ClientSuppliedIpUsedInSecurityCheck.java:47:16:47:34 | split(...) : String[] | ClientSuppliedIpUsedInSecurityCheck.java:47:16:47:37 | ...[...] : String |
| ClientSuppliedIpUsedInSecurityCheck.java:47:16:47:37 | ...[...] : String | ClientSuppliedIpUsedInSecurityCheck.java:16:21:16:33 | getClientIP(...) : String |
| ClientSuppliedIpUsedInSecurityCheck.java:47:16:47:37 | ...[...] : String | ClientSuppliedIpUsedInSecurityCheck.java:24:21:24:33 | getClientIP(...) : String |
nodes
@@ -10,6 +12,7 @@ nodes
| ClientSuppliedIpUsedInSecurityCheck.java:24:21:24:33 | getClientIP(...) : String | semmle.label | getClientIP(...) : String |
| ClientSuppliedIpUsedInSecurityCheck.java:25:33:25:34 | ip | semmle.label | ip |
| ClientSuppliedIpUsedInSecurityCheck.java:43:27:43:62 | getHeader(...) : String | semmle.label | getHeader(...) : String |
| ClientSuppliedIpUsedInSecurityCheck.java:47:16:47:34 | split(...) : String[] | semmle.label | split(...) : String[] |
| ClientSuppliedIpUsedInSecurityCheck.java:47:16:47:37 | ...[...] : String | semmle.label | ...[...] : String |
#select
| ClientSuppliedIpUsedInSecurityCheck.java:17:37:17:38 | ip | ClientSuppliedIpUsedInSecurityCheck.java:43:27:43:62 | getHeader(...) : String | ClientSuppliedIpUsedInSecurityCheck.java:17:37:17:38 | ip | IP address spoofing might include code from $@. | ClientSuppliedIpUsedInSecurityCheck.java:43:27:43:62 | getHeader(...) | this user input |

40
java/ql/test/experimental/query-tests/security/CWE-522/InsecureLdapAuth.expected
View File

@@ -1,52 +1,88 @@
edges
| InsecureLdapAuth.java:11:20:11:50 | "ldap://ad.your-server.com:389" : String | InsecureLdapAuth.java:15:41:15:47 | ldapUrl : String |
| InsecureLdapAuth.java:11:20:11:50 | "ldap://ad.your-server.com:389" : String | InsecureLdapAuth.java:20:49:20:59 | environment |
| InsecureLdapAuth.java:15:3:15:13 | environment [post update] : Hashtable | InsecureLdapAuth.java:20:49:20:59 | environment |
| InsecureLdapAuth.java:15:41:15:47 | ldapUrl : String | InsecureLdapAuth.java:15:3:15:13 | environment [post update] : Hashtable |
| InsecureLdapAuth.java:17:3:17:13 | environment [post update] : Hashtable | InsecureLdapAuth.java:20:49:20:59 | environment |
| InsecureLdapAuth.java:25:20:25:39 | ... + ... : String | InsecureLdapAuth.java:29:41:29:47 | ldapUrl : String |
| InsecureLdapAuth.java:25:20:25:39 | ... + ... : String | InsecureLdapAuth.java:34:49:34:59 | environment |
| InsecureLdapAuth.java:29:3:29:13 | environment [post update] : Hashtable | InsecureLdapAuth.java:34:49:34:59 | environment |
| InsecureLdapAuth.java:29:41:29:47 | ldapUrl : String | InsecureLdapAuth.java:29:3:29:13 | environment [post update] : Hashtable |
| InsecureLdapAuth.java:31:3:31:13 | environment [post update] : Hashtable | InsecureLdapAuth.java:34:49:34:59 | environment |
| InsecureLdapAuth.java:45:3:45:13 | environment [post update] : Hashtable | InsecureLdapAuth.java:48:49:48:59 | environment |
| InsecureLdapAuth.java:53:20:53:50 | "ldap://ad.your-server.com:636" : String | InsecureLdapAuth.java:57:41:57:47 | ldapUrl : String |
| InsecureLdapAuth.java:53:20:53:50 | "ldap://ad.your-server.com:636" : String | InsecureLdapAuth.java:63:49:63:59 | environment |
| InsecureLdapAuth.java:57:3:57:13 | environment [post update] : Hashtable | InsecureLdapAuth.java:63:49:63:59 | environment |
| InsecureLdapAuth.java:57:41:57:47 | ldapUrl : String | InsecureLdapAuth.java:57:3:57:13 | environment [post update] : Hashtable |
| InsecureLdapAuth.java:59:3:59:13 | environment [post update] : Hashtable | InsecureLdapAuth.java:63:49:63:59 | environment |
| InsecureLdapAuth.java:62:3:62:13 | environment [post update] : Hashtable | InsecureLdapAuth.java:63:49:63:59 | environment |
| InsecureLdapAuth.java:68:20:68:50 | "ldap://ad.your-server.com:389" : String | InsecureLdapAuth.java:72:41:72:47 | ldapUrl : String |
| InsecureLdapAuth.java:68:20:68:50 | "ldap://ad.your-server.com:389" : String | InsecureLdapAuth.java:77:49:77:59 | environment |
| InsecureLdapAuth.java:72:3:72:13 | environment [post update] : Hashtable | InsecureLdapAuth.java:77:49:77:59 | environment |
| InsecureLdapAuth.java:72:41:72:47 | ldapUrl : String | InsecureLdapAuth.java:72:3:72:13 | environment [post update] : Hashtable |
| InsecureLdapAuth.java:88:3:88:13 | environment [post update] : Hashtable | InsecureLdapAuth.java:91:49:91:59 | environment |
| InsecureLdapAuth.java:96:20:96:50 | "ldap://ad.your-server.com:389" : String | InsecureLdapAuth.java:100:41:100:47 | ldapUrl : String |
| InsecureLdapAuth.java:96:20:96:50 | "ldap://ad.your-server.com:389" : String | InsecureLdapAuth.java:105:59:105:69 | environment |
| InsecureLdapAuth.java:100:3:100:13 | environment [post update] : Hashtable | InsecureLdapAuth.java:105:59:105:69 | environment |
| InsecureLdapAuth.java:100:41:100:47 | ldapUrl : String | InsecureLdapAuth.java:100:3:100:13 | environment [post update] : Hashtable |
| InsecureLdapAuth.java:102:3:102:13 | environment [post update] : Hashtable | InsecureLdapAuth.java:105:59:105:69 | environment |
| InsecureLdapAuth.java:111:20:111:50 | "ldap://ad.your-server.com:389" : String | InsecureLdapAuth.java:115:47:115:53 | ldapUrl : String |
| InsecureLdapAuth.java:111:20:111:50 | "ldap://ad.your-server.com:389" : String | InsecureLdapAuth.java:120:49:120:59 | environment |
| InsecureLdapAuth.java:115:3:115:13 | environment [post update] : Hashtable | InsecureLdapAuth.java:120:49:120:59 | environment |
| InsecureLdapAuth.java:115:47:115:53 | ldapUrl : String | InsecureLdapAuth.java:115:3:115:13 | environment [post update] : Hashtable |
| InsecureLdapAuth.java:117:3:117:13 | environment [post update] : Hashtable | InsecureLdapAuth.java:120:49:120:59 | environment |
| InsecureLdapAuth.java:124:3:124:5 | env [post update] : Hashtable | InsecureLdapAuth.java:137:10:137:20 | environment [post update] : Hashtable |
| InsecureLdapAuth.java:128:3:128:5 | env [post update] : Hashtable | InsecureLdapAuth.java:141:16:141:26 | environment [post update] : Hashtable |
| InsecureLdapAuth.java:128:3:128:5 | env [post update] : Hashtable | InsecureLdapAuth.java:152:16:152:26 | environment [post update] : Hashtable |
| InsecureLdapAuth.java:135:20:135:39 | ... + ... : String | InsecureLdapAuth.java:140:41:140:47 | ldapUrl : String |
| InsecureLdapAuth.java:135:20:135:39 | ... + ... : String | InsecureLdapAuth.java:142:50:142:60 | environment |
| InsecureLdapAuth.java:137:10:137:20 | environment [post update] : Hashtable | InsecureLdapAuth.java:142:50:142:60 | environment |
| InsecureLdapAuth.java:140:3:140:13 | environment [post update] : Hashtable | InsecureLdapAuth.java:142:50:142:60 | environment |
| InsecureLdapAuth.java:140:41:140:47 | ldapUrl : String | InsecureLdapAuth.java:140:3:140:13 | environment [post update] : Hashtable |
| InsecureLdapAuth.java:141:16:141:26 | environment [post update] : Hashtable | InsecureLdapAuth.java:142:50:142:60 | environment |
| InsecureLdapAuth.java:147:20:147:39 | ... + ... : String | InsecureLdapAuth.java:151:41:151:47 | ldapUrl : String |
| InsecureLdapAuth.java:147:20:147:39 | ... + ... : String | InsecureLdapAuth.java:153:50:153:60 | environment |
| InsecureLdapAuth.java:151:3:151:13 | environment [post update] : Hashtable | InsecureLdapAuth.java:153:50:153:60 | environment |
| InsecureLdapAuth.java:151:41:151:47 | ldapUrl : String | InsecureLdapAuth.java:151:3:151:13 | environment [post update] : Hashtable |
| InsecureLdapAuth.java:152:16:152:26 | environment [post update] : Hashtable | InsecureLdapAuth.java:153:50:153:60 | environment |
nodes
| InsecureLdapAuth.java:11:20:11:50 | "ldap://ad.your-server.com:389" : String | semmle.label | "ldap://ad.your-server.com:389" : String |
| InsecureLdapAuth.java:15:3:15:13 | environment [post update] : Hashtable | semmle.label | environment [post update] : Hashtable |
| InsecureLdapAuth.java:15:41:15:47 | ldapUrl : String | semmle.label | ldapUrl : String |
| InsecureLdapAuth.java:17:3:17:13 | environment [post update] : Hashtable | semmle.label | environment [post update] : Hashtable |
| InsecureLdapAuth.java:20:49:20:59 | environment | semmle.label | environment |
| InsecureLdapAuth.java:20:49:20:59 | environment | semmle.label | environment |
| InsecureLdapAuth.java:25:20:25:39 | ... + ... : String | semmle.label | ... + ... : String |
| InsecureLdapAuth.java:29:3:29:13 | environment [post update] : Hashtable | semmle.label | environment [post update] : Hashtable |
| InsecureLdapAuth.java:29:41:29:47 | ldapUrl : String | semmle.label | ldapUrl : String |
| InsecureLdapAuth.java:31:3:31:13 | environment [post update] : Hashtable | semmle.label | environment [post update] : Hashtable |
| InsecureLdapAuth.java:34:49:34:59 | environment | semmle.label | environment |
| InsecureLdapAuth.java:34:49:34:59 | environment | semmle.label | environment |
| InsecureLdapAuth.java:45:3:45:13 | environment [post update] : Hashtable | semmle.label | environment [post update] : Hashtable |
| InsecureLdapAuth.java:48:49:48:59 | environment | semmle.label | environment |
| InsecureLdapAuth.java:53:20:53:50 | "ldap://ad.your-server.com:636" : String | semmle.label | "ldap://ad.your-server.com:636" : String |
| InsecureLdapAuth.java:57:3:57:13 | environment [post update] : Hashtable | semmle.label | environment [post update] : Hashtable |
| InsecureLdapAuth.java:57:41:57:47 | ldapUrl : String | semmle.label | ldapUrl : String |
| InsecureLdapAuth.java:59:3:59:13 | environment [post update] : Hashtable | semmle.label | environment [post update] : Hashtable |
| InsecureLdapAuth.java:62:3:62:13 | environment [post update] : Hashtable | semmle.label | environment [post update] : Hashtable |
| InsecureLdapAuth.java:63:49:63:59 | environment | semmle.label | environment |
| InsecureLdapAuth.java:63:49:63:59 | environment | semmle.label | environment |
| InsecureLdapAuth.java:63:49:63:59 | environment | semmle.label | environment |
| InsecureLdapAuth.java:68:20:68:50 | "ldap://ad.your-server.com:389" : String | semmle.label | "ldap://ad.your-server.com:389" : String |
| InsecureLdapAuth.java:72:3:72:13 | environment [post update] : Hashtable | semmle.label | environment [post update] : Hashtable |
| InsecureLdapAuth.java:72:41:72:47 | ldapUrl : String | semmle.label | ldapUrl : String |
| InsecureLdapAuth.java:77:49:77:59 | environment | semmle.label | environment |
| InsecureLdapAuth.java:88:3:88:13 | environment [post update] : Hashtable | semmle.label | environment [post update] : Hashtable |
| InsecureLdapAuth.java:91:49:91:59 | environment | semmle.label | environment |
| InsecureLdapAuth.java:96:20:96:50 | "ldap://ad.your-server.com:389" : String | semmle.label | "ldap://ad.your-server.com:389" : String |
| InsecureLdapAuth.java:100:3:100:13 | environment [post update] : Hashtable | semmle.label | environment [post update] : Hashtable |
| InsecureLdapAuth.java:100:41:100:47 | ldapUrl : String | semmle.label | ldapUrl : String |
| InsecureLdapAuth.java:102:3:102:13 | environment [post update] : Hashtable | semmle.label | environment [post update] : Hashtable |
| InsecureLdapAuth.java:105:59:105:69 | environment | semmle.label | environment |
| InsecureLdapAuth.java:105:59:105:69 | environment | semmle.label | environment |
| InsecureLdapAuth.java:111:20:111:50 | "ldap://ad.your-server.com:389" : String | semmle.label | "ldap://ad.your-server.com:389" : String |
| InsecureLdapAuth.java:115:3:115:13 | environment [post update] : Hashtable | semmle.label | environment [post update] : Hashtable |
| InsecureLdapAuth.java:115:47:115:53 | ldapUrl : String | semmle.label | ldapUrl : String |
| InsecureLdapAuth.java:117:3:117:13 | environment [post update] : Hashtable | semmle.label | environment [post update] : Hashtable |
| InsecureLdapAuth.java:120:49:120:59 | environment | semmle.label | environment |
| InsecureLdapAuth.java:120:49:120:59 | environment | semmle.label | environment |
@@ -54,11 +90,15 @@ nodes
| InsecureLdapAuth.java:128:3:128:5 | env [post update] : Hashtable | semmle.label | env [post update] : Hashtable |
| InsecureLdapAuth.java:135:20:135:39 | ... + ... : String | semmle.label | ... + ... : String |
| InsecureLdapAuth.java:137:10:137:20 | environment [post update] : Hashtable | semmle.label | environment [post update] : Hashtable |
| InsecureLdapAuth.java:140:3:140:13 | environment [post update] : Hashtable | semmle.label | environment [post update] : Hashtable |
| InsecureLdapAuth.java:140:41:140:47 | ldapUrl : String | semmle.label | ldapUrl : String |
| InsecureLdapAuth.java:141:16:141:26 | environment [post update] : Hashtable | semmle.label | environment [post update] : Hashtable |
| InsecureLdapAuth.java:142:50:142:60 | environment | semmle.label | environment |
| InsecureLdapAuth.java:142:50:142:60 | environment | semmle.label | environment |
| InsecureLdapAuth.java:142:50:142:60 | environment | semmle.label | environment |
| InsecureLdapAuth.java:147:20:147:39 | ... + ... : String | semmle.label | ... + ... : String |
| InsecureLdapAuth.java:151:3:151:13 | environment [post update] : Hashtable | semmle.label | environment [post update] : Hashtable |
| InsecureLdapAuth.java:151:41:151:47 | ldapUrl : String | semmle.label | ldapUrl : String |
| InsecureLdapAuth.java:152:16:152:26 | environment [post update] : Hashtable | semmle.label | environment [post update] : Hashtable |
| InsecureLdapAuth.java:153:50:153:60 | environment | semmle.label | environment |
| InsecureLdapAuth.java:153:50:153:60 | environment | semmle.label | environment |

6
java/ql/test/experimental/query-tests/security/CWE-598/SensitiveGetQuery.expected
View File

@@ -1,7 +1,9 @@
edges
| SensitiveGetQuery2.java:12:13:12:37 | getParameterMap(...) : Map | SensitiveGetQuery2.java:14:21:14:48 | (...)... : Object |
| SensitiveGetQuery2.java:12:13:12:37 | getParameterMap(...) : Map | SensitiveGetQuery2.java:14:30:14:32 | map : Map |
| SensitiveGetQuery2.java:14:21:14:48 | (...)... : Object | SensitiveGetQuery2.java:15:29:15:36 | password |
| SensitiveGetQuery2.java:14:21:14:48 | (...)... : Object | SensitiveGetQuery2.java:15:29:15:36 | password : Object |
| SensitiveGetQuery2.java:14:30:14:32 | map : Map | SensitiveGetQuery2.java:14:30:14:48 | get(...) : Object |
| SensitiveGetQuery2.java:14:30:14:48 | get(...) : Object | SensitiveGetQuery2.java:14:21:14:48 | (...)... : Object |
| SensitiveGetQuery2.java:15:29:15:36 | password : Object | SensitiveGetQuery2.java:18:40:18:54 | password : Object |
| SensitiveGetQuery2.java:18:40:18:54 | password : Object | SensitiveGetQuery2.java:19:61:19:68 | password |
| SensitiveGetQuery3.java:12:21:12:60 | getRequestParameter(...) : String | SensitiveGetQuery3.java:13:57:13:64 | password |
@@ -15,6 +17,8 @@ edges
nodes
| SensitiveGetQuery2.java:12:13:12:37 | getParameterMap(...) : Map | semmle.label | getParameterMap(...) : Map |
| SensitiveGetQuery2.java:14:21:14:48 | (...)... : Object | semmle.label | (...)... : Object |
| SensitiveGetQuery2.java:14:30:14:32 | map : Map | semmle.label | map : Map |
| SensitiveGetQuery2.java:14:30:14:48 | get(...) : Object | semmle.label | get(...) : Object |
| SensitiveGetQuery2.java:15:29:15:36 | password | semmle.label | password |
| SensitiveGetQuery2.java:15:29:15:36 | password : Object | semmle.label | password : Object |
| SensitiveGetQuery2.java:18:40:18:54 | password : Object | semmle.label | password : Object |

4
java/ql/test/experimental/query-tests/security/CWE-927/SensitiveBroadcast.expected
View File

@@ -3,7 +3,8 @@ edges
| SensitiveBroadcast.java:13:41:13:52 | refreshToken : String | SensitiveBroadcast.java:14:31:14:36 | intent |
| SensitiveBroadcast.java:25:32:25:39 | password : String | SensitiveBroadcast.java:26:31:26:36 | intent |
| SensitiveBroadcast.java:36:35:36:39 | email : String | SensitiveBroadcast.java:38:31:38:36 | intent |
| SensitiveBroadcast.java:50:22:50:29 | password : String | SensitiveBroadcast.java:52:31:52:36 | intent |
| SensitiveBroadcast.java:50:9:50:16 | userinfo [post update] : ArrayList | SensitiveBroadcast.java:52:31:52:36 | intent |
| SensitiveBroadcast.java:50:22:50:29 | password : String | SensitiveBroadcast.java:50:9:50:16 | userinfo [post update] : ArrayList |
| SensitiveBroadcast.java:97:35:97:40 | ticket : String | SensitiveBroadcast.java:98:54:98:59 | intent |
| SensitiveBroadcast.java:109:32:109:39 | passcode : String | SensitiveBroadcast.java:111:54:111:59 | intent |
| SensitiveBroadcast.java:136:33:136:38 | passwd : String | SensitiveBroadcast.java:140:54:140:59 | intent |
@@ -15,6 +16,7 @@ nodes
| SensitiveBroadcast.java:26:31:26:36 | intent | semmle.label | intent |
| SensitiveBroadcast.java:36:35:36:39 | email : String | semmle.label | email : String |
| SensitiveBroadcast.java:38:31:38:36 | intent | semmle.label | intent |
| SensitiveBroadcast.java:50:9:50:16 | userinfo [post update] : ArrayList | semmle.label | userinfo [post update] : ArrayList |
| SensitiveBroadcast.java:50:22:50:29 | password : String | semmle.label | password : String |
| SensitiveBroadcast.java:52:31:52:36 | intent | semmle.label | intent |
| SensitiveBroadcast.java:97:35:97:40 | ticket : String | semmle.label | ticket : String |

32
java/ql/test/library-tests/JDK/PrintAst.expected
View File

@@ -7,7 +7,7 @@ jdk/A.java:
# 4| 0: [Parameter] args
# 4| 0: [ArrayTypeAccess] ...[]
# 4| 0: [TypeAccess] String
# 4| 5: [BlockStmt] stmt
# 4| 5: [BlockStmt] { ... }
# 7| 2: [Class] B
# 8| 2: [Method] main
# 8| 3: [TypeAccess] void
@@ -15,7 +15,7 @@ jdk/A.java:
# 8| 0: [Parameter] args
# 8| 0: [ArrayTypeAccess] ...[]
# 8| 0: [TypeAccess] String
# 8| 5: [BlockStmt] stmt
# 8| 5: [BlockStmt] { ... }
# 11| 3: [Class] C
# 12| 2: [Method] main
# 12| 3: [TypeAccess] void
@@ -23,7 +23,7 @@ jdk/A.java:
# 12| 0: [Parameter] args
# 12| 0: [ArrayTypeAccess] ...[]
# 12| 0: [TypeAccess] String
# 12| 5: [BlockStmt] stmt
# 12| 5: [BlockStmt] { ... }
# 15| 4: [Class] D
# 16| 2: [Method] main
# 16| 3: [TypeAccess] int
@@ -31,8 +31,8 @@ jdk/A.java:
# 16| 0: [Parameter] args
# 16| 0: [ArrayTypeAccess] ...[]
# 16| 0: [TypeAccess] String
# 16| 5: [BlockStmt] stmt
# 16| 0: [ReturnStmt] stmt
# 16| 5: [BlockStmt] { ... }
# 16| 0: [ReturnStmt] return ...
# 16| 0: [IntegerLiteral] 0
# 19| 5: [Class] E
# 20| 2: [Method] main
@@ -43,14 +43,14 @@ jdk/A.java:
# 20| 1: [Parameter] args
# 20| 0: [ArrayTypeAccess] ...[]
# 20| 0: [TypeAccess] String
# 20| 5: [BlockStmt] stmt
# 20| 5: [BlockStmt] { ... }
# 23| 6: [Class] F
# 24| 2: [Method] main
# 24| 3: [TypeAccess] void
#-----| 4: (Parameters)
# 24| 0: [Parameter] arg
# 24| 0: [TypeAccess] String
# 24| 5: [BlockStmt] stmt
# 24| 5: [BlockStmt] { ... }
# 27| 7: [Class] G
# 28| 2: [Method] main
# 28| 3: [TypeAccess] void
@@ -59,7 +59,7 @@ jdk/A.java:
# 28| 0: [ArrayTypeAccess] ...[]
# 28| 0: [ArrayTypeAccess] ...[]
# 28| 0: [TypeAccess] String
# 28| 5: [BlockStmt] stmt
# 28| 5: [BlockStmt] { ... }
jdk/SystemGetPropertyCall.java:
# 0| [CompilationUnit] SystemGetPropertyCall
# 3| 1: [Class] SystemGetPropertyCall
@@ -68,30 +68,30 @@ jdk/SystemGetPropertyCall.java:
# 4| 0: [StringLiteral] "user.dir"
# 6| 4: [Method] a
# 6| 3: [TypeAccess] void
# 6| 5: [BlockStmt] stmt
# 7| 0: [ExprStmt] stmt
# 6| 5: [BlockStmt] { ... }
# 7| 0: [ExprStmt] <Expr>;
# 7| 0: [MethodAccess] getProperty(...)
# 7| -1: [TypeAccess] System
# 7| 0: [StringLiteral] "user.dir"
# 10| 5: [Method] b
# 10| 3: [TypeAccess] void
# 10| 5: [BlockStmt] stmt
# 11| 0: [ExprStmt] stmt
# 10| 5: [BlockStmt] { ... }
# 11| 0: [ExprStmt] <Expr>;
# 11| 0: [MethodAccess] getProperty(...)
# 11| -1: [TypeAccess] System
# 11| 0: [StringLiteral] "user.dir"
# 11| 1: [StringLiteral] "HOME"
# 14| 6: [Method] c
# 14| 3: [TypeAccess] void
# 14| 5: [BlockStmt] stmt
# 15| 0: [ExprStmt] stmt
# 14| 5: [BlockStmt] { ... }
# 15| 0: [ExprStmt] <Expr>;
# 15| 0: [MethodAccess] getProperty(...)
# 15| -1: [TypeAccess] System
# 15| 0: [VarAccess] USER_DIR_PROPERTY
# 18| 7: [Method] d
# 18| 3: [TypeAccess] void
# 18| 5: [BlockStmt] stmt
# 19| 0: [ExprStmt] stmt
# 18| 5: [BlockStmt] { ... }
# 19| 0: [ExprStmt] <Expr>;
# 19| 0: [MethodAccess] getProperty(...)
# 19| -1: [TypeAccess] System
# 19| 0: [StringLiteral] "random.property"

Some files were not shown because too many files have changed in this diff Show More