From 05737af165f8fca31c7744b26f46743a9298b835 Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen <mathiasvp@github.com>
Date: Tue, 25 Nov 2025 14:54:47 +0000
Subject: [PATCH] C++: Only support non-type template parameters in tail
 position.

---
 .../semmle/code/cpp/dataflow/ExternalFlow.qll | 40 +++++++++++++------
 1 file changed, 27 insertions(+), 13 deletions(-)

diff --git a/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll b/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll
index a269427971e..ebf82a59dfa 100644
--- a/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll
+++ b/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll
@@ -634,14 +634,13 @@ string getParameterTypeWithoutTemplateArguments(Function f, int n, boolean canon
   canonical = true
 }
 
-/** Gets the `i`'th supported template parameter for `templateFunction`. */
-private Locatable getSupportedFunctionTemplateArgument(Function templateFunction, int i) {
+/**
+ * Gets the largest index of a template parameter of `templateFunction` that
+ * is a type template parameter.
+ */
+private int getLastTypeTemplateFunctionParameterIndex(Function templateFunction) {
   result =
-    rank[i + 1](int j, TypeTemplateParameter ttp |
-      ttp = templateFunction.getTemplateArgument(j)
-    |
-      ttp order by j
-    )
+    max(int index | templateFunction.getTemplateArgument(index) instanceof TypeTemplateParameter)
 }
 
 /** Gets the number of supported template parameters for `templateFunction`. */
@@ -649,6 +648,14 @@ private int getNumberOfSupportedFunctionTemplateArguments(Function templateFunct
   result = count(int i | exists(getSupportedFunctionTemplateArgument(templateFunction, i)) | i)
 }
 
+/** Gets the `i`'th supported template parameter for `templateFunction`. */
+private Locatable getSupportedFunctionTemplateArgument(Function templateFunction, int i) {
+  result = templateFunction.getTemplateArgument(i) and
+  // We don't yet support non-type template parameters in the middle of a
+  // template parameter list
+  i <= getLastTypeTemplateFunctionParameterIndex(templateFunction)
+}
+
 /**
  * Normalize the `n`'th parameter of `f` by replacing template names
  * with `func:N` (where `N` is the index of the template).
@@ -669,14 +676,21 @@ private string getTypeNameWithoutFunctionTemplates(Function f, int n, int remain
   )
 }
 
+/**
+ * Gets the largest index of a template parameter of `templateFunction` that
+ * is a type template parameter.
+ */
+private int getLastTypeTemplateClassParameterIndex(Class templateClass) {
+  result =
+    max(int index | templateClass.getTemplateArgument(index) instanceof TypeTemplateParameter)
+}
+
 /** Gets the `i`'th supported template parameter for `templateClass`. */
 private Locatable getSupportedClassTemplateArgument(Class templateClass, int i) {
-  result =
-    rank[i + 1](int j, TypeTemplateParameter ttp |
-      ttp = templateClass.getTemplateArgument(j)
-    |
-      ttp order by j
-    )
+  result = templateClass.getTemplateArgument(i) and
+  // We don't yet support non-type template parameters in the middle of a
+  // template parameter list
+  i <= getLastTypeTemplateClassParameterIndex(templateClass)
 }
 
 /** Gets the number of supported template parameters for `templateClass`. */