Merge branch 'main' into post-release-prep/codeql-cli-2.20.1

2024-11-25-ts57.md

@@ -1,4 +0,0 @@
----
-category: majorAnalysis
----
-* Added support for TypeScript 5.7.

Cargo.lock

@@ -92,9 +92,9 @@ dependencies = [
 
 [[package]]
 name = "anyhow"
-version = "1.0.94"
+version = "1.0.95"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c1fd03a028ef38ba2276dce7e33fcd6369c158a1bca17946c4b1b701891c1ff7"
+checksum = "34ac096ce696dc2fcabef30516bb13c0a68a11d30131d3df6f04711467681b04"
 
 [[package]]
 name = "argfile"
@@ -117,7 +117,7 @@ name = "ast-generator"
 version = "0.1.0"
 dependencies = [
  "either",
- "itertools 0.12.1",
+ "itertools 0.14.0",
  "proc-macro2",
  "quote",
  "ra_ap_stdx",
@@ -228,9 +228,9 @@ dependencies = [
 
 [[package]]
 name = "cc"
-version = "1.2.5"
+version = "1.2.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c31a0499c1dc64f458ad13872de75c0eb7e3fdb0e67964610c914b034fc5956e"
+checksum = "a012a0df96dd6d06ba9a1b29d6402d1a5d77c6befd2566afdc26e10603dc93d7"
 dependencies = [
  "shlex",
 ]
@@ -315,9 +315,9 @@ dependencies = [
 
 [[package]]
 name = "clap"
-version = "4.5.23"
+version = "4.5.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3135e7ec2ef7b10c6ed8950f0f792ed96ee093fa088608f1c76e569722700c84"
+checksum = "9560b07a799281c7e0958b9296854d6fafd4c5f31444a7e5bb1ad6dde5ccf1bd"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -325,9 +325,9 @@ dependencies = [
 
 [[package]]
 name = "clap_builder"
-version = "4.5.23"
+version = "4.5.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "30582fc632330df2bd26877bde0c1f4470d57c582bbc070376afcd04d8cb4838"
+checksum = "874e0dd3eb68bf99058751ac9712f622e61e6f393a94f7128fa26e3f02f5c7cd"
 dependencies = [
  "anstream",
  "anstyle",
@@ -337,9 +337,9 @@ dependencies = [
 
 [[package]]
 name = "clap_derive"
-version = "4.5.18"
+version = "4.5.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4ac6a0c7b1a9e9a5186361f67dfa1b88213572f427fb9ab038efb2bd8c582dab"
+checksum = "54b755194d6389280185988721fffba69495eed5ee9feeee9a599b53db80318c"
 dependencies = [
  "heck 0.5.0",
  "proc-macro2",
@@ -411,7 +411,7 @@ dependencies = [
  "dunce",
  "figment",
  "glob",
- "itertools 0.13.0",
+ "itertools 0.14.0",
  "log",
  "num-traits",
  "ra_ap_base_db",
@@ -743,9 +743,9 @@ dependencies = [
 
 [[package]]
 name = "glob"
-version = "0.3.1"
+version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d2fabcfbdc87f4758337ca535fb41a6d701b65693ce38287d856d1674551ec9b"
+checksum = "a8d1add55171497b4705a648c6b583acafb01d58050a51727785f0b2c8e0a2b2"
 
 [[package]]
 name = "globset"
@@ -922,9 +922,9 @@ dependencies = [
 
 [[package]]
 name = "itertools"
-version = "0.13.0"
+version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "413ee7dfc52ee1a4949ceeb7dbc8a33f2d6c088194d9f922fb8318faf1f01186"
+checksum = "2b192c782037fadd9cfa75548310488aabdbf3d2da73885b31bd0abd03351285"
 dependencies = [
  "either",
 ]
@@ -1250,9 +1250,9 @@ dependencies = [
 
 [[package]]
 name = "pin-project-lite"
-version = "0.2.15"
+version = "0.2.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "915a1e146535de9163f3987b8944ed8cf49a18bb0056bcebcdcece385cece4ff"
+checksum = "3b3cff922bd51709b605d9ead9aa71031d81447142d828eb4a6eba76fe619f9b"
 
 [[package]]
 name = "powerfmt"
@@ -1293,9 +1293,9 @@ dependencies = [
 
 [[package]]
 name = "quote"
-version = "1.0.37"
+version = "1.0.38"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5b9d34b8991d19d98081b46eacdd8eb58c6f2b201139f7c5f643cc155a633af"
+checksum = "0e4dccaaaf89514f546c693ddc140f729f958c247918a13380cccc6078391acc"
 dependencies = [
  "proc-macro2",
 ]
@@ -2036,18 +2036,18 @@ dependencies = [
 
 [[package]]
 name = "serde"
-version = "1.0.216"
+version = "1.0.217"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b9781016e935a97e8beecf0c933758c97a5520d32930e460142b4cd80c6338e"
+checksum = "02fc4265df13d6fa1d00ecff087228cc0a2b5f3c0e87e258d8b94a156e984c70"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.216"
+version = "1.0.217"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "46f859dbbf73865c6627ed570e78961cd3ac92407a2d117204c49232485da55e"
+checksum = "5a9bf7cf98d04a2b28aead066b7496853d4779c9cc183c440dbac457641e19a0"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2056,9 +2056,9 @@ dependencies = [
 
 [[package]]
 name = "serde_json"
-version = "1.0.133"
+version = "1.0.135"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c7fceb2473b9166b2294ef05efcb65a3db80803f0b03ef86a5fc88a2b85ee377"
+checksum = "2b0d7ba2887406110130a978386c4e1befb98c674b4fba677954e4db976630d9"
 dependencies = [
  "itoa",
  "memchr",
@@ -2068,9 +2068,9 @@ dependencies = [
 
 [[package]]
 name = "serde_with"
-version = "3.11.0"
+version = "3.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e28bdad6db2b8340e449f7108f020b3b092e8583a9e3fb82713e1d4e71fe817"
+checksum = "d6b6f7f2fcb69f747921f79f3926bd1e203fce4fef62c268dd3abfb6d86029aa"
 dependencies = [
  "base64",
  "chrono",
@@ -2086,9 +2086,9 @@ dependencies = [
 
 [[package]]
 name = "serde_with_macros"
-version = "3.11.0"
+version = "3.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9d846214a9854ef724f3da161b426242d8de7c1fc7de2f89bb1efcb154dca79d"
+checksum = "8d00caa5193a3c8362ac2b73be6b9e768aa5a4b2f721d8f4b339600c3cb51f8e"
 dependencies = [
  "darling",
  "proc-macro2",
@@ -2179,9 +2179,9 @@ checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
 
 [[package]]
 name = "syn"
-version = "2.0.90"
+version = "2.0.95"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "919d3b74a5dd0ccd15aeb8f93e7006bd9e14c295087c9896a110f490752bcf31"
+checksum = "46f71c0377baf4ef1cc3e3402ded576dccc315800fbc62dfc7fe04b009773b4a"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2560,7 +2560,7 @@ version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cf221c93e13a30d793f7645a0e7762c55d169dbb0a49671918a2319d289b10bb"
 dependencies = [
- "windows-sys 0.59.0",
+ "windows-sys 0.48.0",
 ]
 
 [[package]]

MODULE.bazel

@@ -70,7 +70,7 @@ use_repo(py_deps, "vendor__anyhow-1.0.44", "vendor__cc-1.0.70", "vendor__clap-2.
 # deps for ruby+rust
 # keep in sync by running `misc/bazel/3rdparty/update_cargo_deps.sh`
 tree_sitter_extractors_deps = use_extension("//misc/bazel/3rdparty:tree_sitter_extractors_extension.bzl", "r")
-use_repo(tree_sitter_extractors_deps, "vendor__anyhow-1.0.94", "vendor__argfile-0.2.1", "vendor__chrono-0.4.39", "vendor__clap-4.5.23", "vendor__dunce-1.0.5", "vendor__either-1.13.0", "vendor__encoding-0.2.33", "vendor__figment-0.10.19", "vendor__flate2-1.0.35", "vendor__glob-0.3.1", "vendor__globset-0.4.15", "vendor__itertools-0.12.1", "vendor__itertools-0.13.0", "vendor__lazy_static-1.5.0", "vendor__log-0.4.22", "vendor__num-traits-0.2.19", "vendor__num_cpus-1.16.0", "vendor__proc-macro2-1.0.92", "vendor__quote-1.0.37", "vendor__ra_ap_base_db-0.0.248", "vendor__ra_ap_cfg-0.0.248", "vendor__ra_ap_hir-0.0.248", "vendor__ra_ap_hir_def-0.0.248", "vendor__ra_ap_hir_expand-0.0.248", "vendor__ra_ap_ide_db-0.0.248", "vendor__ra_ap_intern-0.0.248", "vendor__ra_ap_load-cargo-0.0.248", "vendor__ra_ap_parser-0.0.248", "vendor__ra_ap_paths-0.0.248", "vendor__ra_ap_project_model-0.0.248", "vendor__ra_ap_span-0.0.248", "vendor__ra_ap_stdx-0.0.248", "vendor__ra_ap_syntax-0.0.248", "vendor__ra_ap_vfs-0.0.248", "vendor__rand-0.8.5", "vendor__rayon-1.10.0", "vendor__regex-1.11.1", "vendor__serde-1.0.216", "vendor__serde_json-1.0.133", "vendor__serde_with-3.11.0", "vendor__stderrlog-0.6.0", "vendor__syn-2.0.90", "vendor__tracing-0.1.41", "vendor__tracing-subscriber-0.3.19", "vendor__tree-sitter-0.24.5", "vendor__tree-sitter-embedded-template-0.23.2", "vendor__tree-sitter-json-0.24.8", "vendor__tree-sitter-ql-0.23.1", "vendor__tree-sitter-ruby-0.23.1", "vendor__triomphe-0.1.14", "vendor__ungrammar-1.16.1")
+use_repo(tree_sitter_extractors_deps, "vendor__anyhow-1.0.95", "vendor__argfile-0.2.1", "vendor__chrono-0.4.39", "vendor__clap-4.5.24", "vendor__dunce-1.0.5", "vendor__either-1.13.0", "vendor__encoding-0.2.33", "vendor__figment-0.10.19", "vendor__flate2-1.0.35", "vendor__glob-0.3.2", "vendor__globset-0.4.15", "vendor__itertools-0.14.0", "vendor__lazy_static-1.5.0", "vendor__log-0.4.22", "vendor__num-traits-0.2.19", "vendor__num_cpus-1.16.0", "vendor__proc-macro2-1.0.92", "vendor__quote-1.0.38", "vendor__ra_ap_base_db-0.0.248", "vendor__ra_ap_cfg-0.0.248", "vendor__ra_ap_hir-0.0.248", "vendor__ra_ap_hir_def-0.0.248", "vendor__ra_ap_hir_expand-0.0.248", "vendor__ra_ap_ide_db-0.0.248", "vendor__ra_ap_intern-0.0.248", "vendor__ra_ap_load-cargo-0.0.248", "vendor__ra_ap_parser-0.0.248", "vendor__ra_ap_paths-0.0.248", "vendor__ra_ap_project_model-0.0.248", "vendor__ra_ap_span-0.0.248", "vendor__ra_ap_stdx-0.0.248", "vendor__ra_ap_syntax-0.0.248", "vendor__ra_ap_vfs-0.0.248", "vendor__rand-0.8.5", "vendor__rayon-1.10.0", "vendor__regex-1.11.1", "vendor__serde-1.0.217", "vendor__serde_json-1.0.135", "vendor__serde_with-3.12.0", "vendor__stderrlog-0.6.0", "vendor__syn-2.0.95", "vendor__tracing-0.1.41", "vendor__tracing-subscriber-0.3.19", "vendor__tree-sitter-0.24.5", "vendor__tree-sitter-embedded-template-0.23.2", "vendor__tree-sitter-json-0.24.8", "vendor__tree-sitter-ql-0.23.1", "vendor__tree-sitter-ruby-0.23.1", "vendor__triomphe-0.1.14", "vendor__ungrammar-1.16.1")
 
 http_archive = use_repo_rule("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 

cpp/downgrades/f786eb3f5dfddb0ac914ab09551bf1c5c64b47c0/upgrade.properties

@@ -0,0 +1,5 @@
+description: Support concept templates
+compatibility: full
+concept_templates.rel: delete
+concept_template_argument.rel: delete
+concept_template_argument_value.rel: delete

cpp/ql/lib/change-notes/2024-12-23-concept-template.md

@@ -0,0 +1,5 @@
+---
+category: feature
+---
+* A new class `Concept` was introduced, which represents C++20 concepts.
+* The `getTemplateArgumentType` and `getTemplateArgumentValue` predicates of the `Declaration` class now also yield template arguments of concepts.

cpp/ql/lib/semmle/code/cpp/Concept.qll

@@ -159,3 +159,32 @@ class ConceptIdExpr extends RequirementExpr, @concept_id {
 
   override string getAPrimaryQlClass() { result = "ConceptIdExpr" }
 }
+
+/**
+ * A C++ concept.
+ *
+ * For example:
+ * ```cpp
+ * template<class T>
+ * concept C = std::is_same<T, int>::value;
+ * ```
+ */
+class Concept extends Declaration, @concept_template {
+  override string getAPrimaryQlClass() { result = "Concept" }
+
+  override Location getLocation() { concept_templates(underlyingElement(this), _, result) }
+
+  override string getName() { concept_templates(underlyingElement(this), result, _) }
+
+  /**
+   * Gets the constraint expression of the concept.
+   *
+   * For example, in
+   * ```cpp
+   * template<class T>
+   * concept C = std::is_same<T, int>::value;
+   * ```
+   * the constraint expression is `std::is_same<T, int>::value`.
+   */
+  Expr getExpr() { result.getParent() = this }
+}

cpp/ql/lib/semmle/code/cpp/Declaration.qll

@@ -279,6 +279,8 @@ class Declaration extends Locatable, @declaration {
     variable_template_argument(underlyingElement(this), index, unresolveElement(result))
     or
     template_template_argument(underlyingElement(this), index, unresolveElement(result))
+    or
+    concept_template_argument(underlyingElement(this), index, unresolveElement(result))
   }
 
   private Expr getTemplateArgumentValue(int index) {
@@ -289,6 +291,8 @@ class Declaration extends Locatable, @declaration {
     variable_template_argument_value(underlyingElement(this), index, unresolveElement(result))
     or
     template_template_argument_value(underlyingElement(this), index, unresolveElement(result))
+    or
+    concept_template_argument_value(underlyingElement(this), index, unresolveElement(result))
   }
 }
 

cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll

@@ -529,8 +529,21 @@ private string getTypeName(Type t, boolean needsSpace) {
       needsSpace = false and
       (if needsSpace0 = true then result = s + " *" else result = s + "*")
       or
+      // We don't need to check for `needsSpace0` here because the type of
+      // `x` in `int x[1024]` is formatted without a space between the bracket
+      // and the `int` by `Type.getName`. That is, calling `Type.getName` on
+      // the type of `x` gives `int[1024]` and not `int [1024]`.
+      needsSpace = false and
+      exists(ArrayType array | array = dt |
+        result = s + "[" + array.getArraySize() + "]"
+        or
+        not array.hasArraySize() and
+        result = s + "[]"
+      )
+      or
       not dt instanceof ReferenceType and
       not dt instanceof PointerType and
+      not dt instanceof ArrayType and
       result = s and
       needsSpace = needsSpace0
     )

cpp/ql/lib/semmlecode.cpp.dbscheme

@@ -876,6 +876,24 @@ template_template_argument_value(
     int arg_value: @expr ref
 );
 
+@concept = @concept_template | @concept_id;
+
+concept_templates(
+    unique int concept_id: @concept_template,
+    string name: string ref,
+    int location: @location_default ref
+);
+concept_template_argument(
+    int concept_id: @concept ref,
+    int index: int ref,
+    int arg_type: @type ref
+);
+concept_template_argument_value(
+    int concept_id: @concept ref,
+    int index: int ref,
+    int arg_value: @expr ref
+);
+
 routinetypes(
     unique int id: @routinetype,
     int return_type: @type ref
@@ -1106,7 +1124,8 @@ frienddecls(
              | @declaredtype
              | @variable
              | @enumconstant
-             | @frienddecl;
+             | @frienddecl
+             | @concept_template;
 
 @member = @membervariable
         | @function

cpp/ql/lib/upgrades/4813509d85b45ae17421c036905199f7324cf228/upgrade.properties

@@ -0,0 +1,2 @@
+description: Support concept templates
+compatibility: partial

cpp/ql/test/library-tests/dataflow/models-as-data/FlowSummaryNode.expected

@@ -76,3 +76,5 @@
 | tests.cpp:437:5:437:36 | [summary] to write: ReturnValue in madCallReturnValueIgnoreFunction | ReturnNode | madCallReturnValueIgnoreFunction | madCallReturnValueIgnoreFunction |
 | tests.cpp:459:5:459:31 | [summary param] *0 in parameter_ref_to_return_ref | ParameterNode | parameter_ref_to_return_ref | parameter_ref_to_return_ref |
 | tests.cpp:459:5:459:31 | [summary] to write: ReturnValue[*] in parameter_ref_to_return_ref | ReturnNode | parameter_ref_to_return_ref | parameter_ref_to_return_ref |
+| tests.cpp:471:5:471:17 | [summary param] *0 in receive_array | ParameterNode | receive_array | receive_array |
+| tests.cpp:471:5:471:17 | [summary] to write: ReturnValue in receive_array | ReturnNode | receive_array | receive_array |

cpp/ql/test/library-tests/dataflow/models-as-data/SummaryCall.expected

@@ -30,6 +30,7 @@ summarizedCallables
 | tests.cpp:436:6:436:25 | madCallArg0WithValue |
 | tests.cpp:437:5:437:36 | madCallReturnValueIgnoreFunction |
 | tests.cpp:459:5:459:31 | parameter_ref_to_return_ref |
+| tests.cpp:471:5:471:17 | receive_array |
 sourceCallables
 | tests.cpp:3:5:3:10 | source |
 | tests.cpp:4:6:4:14 | sourcePtr |
@@ -230,3 +231,9 @@ sourceCallables
 | tests.cpp:463:6:463:6 | x |
 | tests.cpp:464:36:464:36 | s |
 | tests.cpp:465:6:465:6 | y |
+| tests.cpp:469:7:469:9 | INT |
+| tests.cpp:471:23:471:23 | a |
+| tests.cpp:473:6:473:23 | test_receive_array |
+| tests.cpp:474:6:474:6 | x |
+| tests.cpp:475:6:475:10 | array |
+| tests.cpp:476:6:476:6 | y |

cpp/ql/test/library-tests/dataflow/models-as-data/testModels.qll

@@ -98,7 +98,8 @@ private class TestSummaries extends SummaryModelCsv {
         ";;false;madCallArg0ReturnToReturnFirst;;;Argument[0].ReturnValue;ReturnValue.Field[first];value",
         ";;false;madCallArg0WithValue;;;Argument[1];Argument[0].Parameter[0];value",
         ";;false;madCallReturnValueIgnoreFunction;;;Argument[1];ReturnValue;value",
-        ";StructWithTypedefInParameter<T>;true;parameter_ref_to_return_ref;(const T &);;Argument[*0];ReturnValue[*];value"
+        ";StructWithTypedefInParameter<T>;true;parameter_ref_to_return_ref;(const T &);;Argument[*0];ReturnValue[*];value",
+        ";;false;receive_array;(int[20]);;Argument[*0];ReturnValue;taint"
       ]
   }
 }

cpp/ql/test/library-tests/dataflow/models-as-data/tests.cpp

@@ -464,4 +464,15 @@ void test_parameter_ref_to_return_ref() {
 	StructWithTypedefInParameter<int> s;
 	int y = s.parameter_ref_to_return_ref(x);
 	sink(y); // $ ir
+}
+
+using INT = int;
+
+int receive_array(INT a[20]); // $ interpretElement
+
+void test_receive_array() {
+	int x = source();
+	int array[10] = {x};
+	int y = receive_array(array);
+	sink(y); // $ ir
 }

csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/SourceGenerators/DotnetSourceGeneratorWrapper/Razor.cs

@@ -34,10 +34,25 @@ namespace Semmle.Extraction.CSharp.DependencyFetching
             using var sw = new StreamWriter(analyzerConfigPath);
             sw.WriteLine("is_global = true");
 
-            foreach (var f in cshtmls.Select(f => f.Replace('\\', '/')))
+            foreach (var cshtml in cshtmls)
             {
-                sw.WriteLine($"\n[{f}]");
+                var adjustedPath = cshtml.Replace('\\', '/');
-                var base64 = Convert.ToBase64String(Encoding.UTF8.GetBytes(f)); // TODO: this should be the relative path of the file.
+                string? relativePath;
+
+                try
+                {
+                    var csprojFolder = Path.GetDirectoryName(csprojFile);
+                    relativePath = csprojFolder is not null ? Path.GetRelativePath(csprojFolder, cshtml) : cshtml;
+                    relativePath = relativePath.Replace('\\', '/');
+                }
+                catch (Exception e)
+                {
+                    logger.LogWarning($"Failed to get relative path for {cshtml}: {e.Message}");
+                    relativePath = adjustedPath;
+                }
+
+                sw.WriteLine($"\n[{adjustedPath}]");
+                var base64 = Convert.ToBase64String(Encoding.UTF8.GetBytes(relativePath));
                 sw.WriteLine($"build_metadata.AdditionalFiles.TargetPath = {base64}");
             }
         }

csharp/ql/integration-tests/all-platforms/blazor/BlazorTest/BlazorTest.csproj

@@ -0,0 +1,9 @@
+<Project Sdk="Microsoft.NET.Sdk.Web">
+
+  <PropertyGroup>
+    <TargetFramework>net9.0</TargetFramework>
+    <Nullable>enable</Nullable>
+    <ImplicitUsings>enable</ImplicitUsings>
+  </PropertyGroup>
+
+</Project>

csharp/ql/integration-tests/all-platforms/blazor/BlazorTest/Components/App.razor

@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html lang="en">
+
+<head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <base href="/" />
+    <link rel="stylesheet" href="bootstrap/bootstrap.min.css" />
+    <link rel="stylesheet" href="app.css" />
+    <link rel="stylesheet" href="BlazorTest.styles.css" />
+    <link rel="icon" type="image/png" href="favicon.png" />
+    <HeadOutlet />
+</head>
+
+<body>
+    <Routes />
+    <script src="_framework/blazor.web.js"></script>
+</body>
+
+</html>

csharp/ql/integration-tests/all-platforms/blazor/BlazorTest/Components/Layout/MainLayout.razor

@@ -0,0 +1,23 @@
+@inherits LayoutComponentBase
+
+<div class="page">
+    <div class="sidebar">
+        <NavMenu />
+    </div>
+
+    <main>
+        <div class="top-row px-4">
+            <a href="https://learn.microsoft.com/aspnet/core/" target="_blank">About</a>
+        </div>
+
+        <article class="content px-4">
+            @Body
+        </article>
+    </main>
+</div>
+
+<div id="blazor-error-ui">
+    An unhandled error has occurred.
+    <a href="" class="reload">Reload</a>
+    <a class="dismiss">🗙</a>
+</div>

csharp/ql/integration-tests/all-platforms/blazor/BlazorTest/Components/Layout/MainLayout.razor.css

@@ -0,0 +1,96 @@
+.page {
+    position: relative;
+    display: flex;
+    flex-direction: column;
+}
+
+main {
+    flex: 1;
+}
+
+.sidebar {
+    background-image: linear-gradient(180deg, rgb(5, 39, 103) 0%, #3a0647 70%);
+}
+
+.top-row {
+    background-color: #f7f7f7;
+    border-bottom: 1px solid #d6d5d5;
+    justify-content: flex-end;
+    height: 3.5rem;
+    display: flex;
+    align-items: center;
+}
+
+    .top-row ::deep a, .top-row ::deep .btn-link {
+        white-space: nowrap;
+        margin-left: 1.5rem;
+        text-decoration: none;
+    }
+
+    .top-row ::deep a:hover, .top-row ::deep .btn-link:hover {
+        text-decoration: underline;
+    }
+
+    .top-row ::deep a:first-child {
+        overflow: hidden;
+        text-overflow: ellipsis;
+    }
+
+@media (max-width: 640.98px) {
+    .top-row {
+        justify-content: space-between;
+    }
+
+    .top-row ::deep a, .top-row ::deep .btn-link {
+        margin-left: 0;
+    }
+}
+
+@media (min-width: 641px) {
+    .page {
+        flex-direction: row;
+    }
+
+    .sidebar {
+        width: 250px;
+        height: 100vh;
+        position: sticky;
+        top: 0;
+    }
+
+    .top-row {
+        position: sticky;
+        top: 0;
+        z-index: 1;
+    }
+
+    .top-row.auth ::deep a:first-child {
+        flex: 1;
+        text-align: right;
+        width: 0;
+    }
+
+    .top-row, article {
+        padding-left: 2rem !important;
+        padding-right: 1.5rem !important;
+    }
+}
+
+#blazor-error-ui {
+    background: lightyellow;
+    bottom: 0;
+    box-shadow: 0 -1px 2px rgba(0, 0, 0, 0.2);
+    display: none;
+    left: 0;
+    padding: 0.6rem 1.25rem 0.7rem 1.25rem;
+    position: fixed;
+    width: 100%;
+    z-index: 1000;
+}
+
+    #blazor-error-ui .dismiss {
+        cursor: pointer;
+        position: absolute;
+        right: 0.75rem;
+        top: 0.5rem;
+    }

csharp/ql/integration-tests/all-platforms/blazor/BlazorTest/Components/Layout/NavMenu.razor

@@ -0,0 +1,19 @@
+<div class="top-row ps-3 navbar navbar-dark">
+    <div class="container-fluid">
+        <a class="navbar-brand" href="">BlazorTest</a>
+    </div>
+</div>
+
+<input type="checkbox" title="Navigation menu" class="navbar-toggler" />
+
+<div class="nav-scrollable" onclick="document.querySelector('.navbar-toggler').click()">
+    <nav class="flex-column">
+
+        <div class="nav-item px-3">
+            <NavLink class="nav-link" href="test">
+                <span class="bi bi-plus-square-fill-nav-menu" aria-hidden="true"></span> Test
+            </NavLink>
+        </div>
+
+    </nav>
+</div>

csharp/ql/integration-tests/all-platforms/blazor/BlazorTest/Components/Layout/NavMenu.razor.css

@@ -0,0 +1,105 @@
+.navbar-toggler {
+    appearance: none;
+    cursor: pointer;
+    width: 3.5rem;
+    height: 2.5rem;
+    color: white;
+    position: absolute;
+    top: 0.5rem;
+    right: 1rem;
+    border: 1px solid rgba(255, 255, 255, 0.1);
+    background: url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 30 30'%3e%3cpath stroke='rgba%28255, 255, 255, 0.55%29' stroke-linecap='round' stroke-miterlimit='10' stroke-width='2' d='M4 7h22M4 15h22M4 23h22'/%3e%3c/svg%3e") no-repeat center/1.75rem rgba(255, 255, 255, 0.1);
+}
+
+.navbar-toggler:checked {
+    background-color: rgba(255, 255, 255, 0.5);
+}
+
+.top-row {
+    height: 3.5rem;
+    background-color: rgba(0,0,0,0.4);
+}
+
+.navbar-brand {
+    font-size: 1.1rem;
+}
+
+.bi {
+    display: inline-block;
+    position: relative;
+    width: 1.25rem;
+    height: 1.25rem;
+    margin-right: 0.75rem;
+    top: -1px;
+    background-size: cover;
+}
+
+.bi-house-door-fill-nav-menu {
+    background-image: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='16' height='16' fill='white' class='bi bi-house-door-fill' viewBox='0 0 16 16'%3E%3Cpath d='M6.5 14.5v-3.505c0-.245.25-.495.5-.495h2c.25 0 .5.25.5.5v3.5a.5.5 0 0 0 .5.5h4a.5.5 0 0 0 .5-.5v-7a.5.5 0 0 0-.146-.354L13 5.793V2.5a.5.5 0 0 0-.5-.5h-1a.5.5 0 0 0-.5.5v1.293L8.354 1.146a.5.5 0 0 0-.708 0l-6 6A.5.5 0 0 0 1.5 7.5v7a.5.5 0 0 0 .5.5h4a.5.5 0 0 0 .5-.5Z'/%3E%3C/svg%3E");
+}
+
+.bi-plus-square-fill-nav-menu {
+    background-image: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='16' height='16' fill='white' class='bi bi-plus-square-fill' viewBox='0 0 16 16'%3E%3Cpath d='M2 0a2 2 0 0 0-2 2v12a2 2 0 0 0 2 2h12a2 2 0 0 0 2-2V2a2 2 0 0 0-2-2H2zm6.5 4.5v3h3a.5.5 0 0 1 0 1h-3v3a.5.5 0 0 1-1 0v-3h-3a.5.5 0 0 1 0-1h3v-3a.5.5 0 0 1 1 0z'/%3E%3C/svg%3E");
+}
+
+.bi-list-nested-nav-menu {
+    background-image: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='16' height='16' fill='white' class='bi bi-list-nested' viewBox='0 0 16 16'%3E%3Cpath fill-rule='evenodd' d='M4.5 11.5A.5.5 0 0 1 5 11h10a.5.5 0 0 1 0 1H5a.5.5 0 0 1-.5-.5zm-2-4A.5.5 0 0 1 3 7h10a.5.5 0 0 1 0 1H3a.5.5 0 0 1-.5-.5zm-2-4A.5.5 0 0 1 1 3h10a.5.5 0 0 1 0 1H1a.5.5 0 0 1-.5-.5z'/%3E%3C/svg%3E");
+}
+
+.nav-item {
+    font-size: 0.9rem;
+    padding-bottom: 0.5rem;
+}
+
+    .nav-item:first-of-type {
+        padding-top: 1rem;
+    }
+
+    .nav-item:last-of-type {
+        padding-bottom: 1rem;
+    }
+
+    .nav-item ::deep .nav-link {
+        color: #d7d7d7;
+        background: none;
+        border: none;
+        border-radius: 4px;
+        height: 3rem;
+        display: flex;
+        align-items: center;
+        line-height: 3rem;
+        width: 100%;
+    }
+
+.nav-item ::deep a.active {
+    background-color: rgba(255,255,255,0.37);
+    color: white;
+}
+
+.nav-item ::deep .nav-link:hover {
+    background-color: rgba(255,255,255,0.1);
+    color: white;
+}
+
+.nav-scrollable {
+    display: none;
+}
+
+.navbar-toggler:checked ~ .nav-scrollable {
+    display: block;
+}
+
+@media (min-width: 641px) {
+    .navbar-toggler {
+        display: none;
+    }
+
+    .nav-scrollable {
+        /* Never collapse the sidebar for wide screens */
+        display: block;
+
+        /* Allow sidebar to scroll for tall menus */
+        height: calc(100vh - 3.5rem);
+        overflow-y: auto;
+    }
+}

csharp/ql/integration-tests/all-platforms/blazor/BlazorTest/Components/MyInput.razor

@@ -0,0 +1,20 @@
+@rendermode InteractiveServer
+
+<input @bind="Param1" @bind:event="onchange" @bind:after="Fire">
+
+@code {
+    [Parameter]
+    public string? Param1 { get; set; } = "";
+
+    [Parameter]
+    public EventCallback<string?> ValueChanged { get; set; }
+
+    [Parameter]
+    public EventCallback<string?> Param1Changed { get; set; }
+
+    private void Fire()
+    {
+        ValueChanged.InvokeAsync(Param1);
+        Param1Changed.InvokeAsync(Param1);
+    }
+}

csharp/ql/integration-tests/all-platforms/blazor/BlazorTest/Components/MyOutput.razor

@@ -0,0 +1,11 @@
+@rendermode InteractiveServer
+
+<div>
+    <p>Value from InputText: @Value</p>
+    <p>Raw value from InputText: @(new MarkupString(Value))</p>
+</div>
+
+@code {
+    [Parameter]
+    public string Value { get; set; } = "";
+}

csharp/ql/integration-tests/all-platforms/blazor/BlazorTest/Components/Pages/Error.razor

@@ -0,0 +1,36 @@
+@page "/Error"
+@using System.Diagnostics
+
+<PageTitle>Error</PageTitle>
+
+<h1 class="text-danger">Error.</h1>
+<h2 class="text-danger">An error occurred while processing your request.</h2>
+
+@if (ShowRequestId)
+{
+    <p>
+        <strong>Request ID:</strong> <code>@RequestId</code>
+    </p>
+}
+
+<h3>Development Mode</h3>
+<p>
+    Swapping to <strong>Development</strong> environment will display more detailed information about the error that occurred.
+</p>
+<p>
+    <strong>The Development environment shouldn't be enabled for deployed applications.</strong>
+    It can result in displaying sensitive information from exceptions to end users.
+    For local debugging, enable the <strong>Development</strong> environment by setting the <strong>ASPNETCORE_ENVIRONMENT</strong> environment variable to <strong>Development</strong>
+    and restarting the app.
+</p>
+
+@code{
+    [CascadingParameter]
+    private HttpContext? HttpContext { get; set; }
+
+    private string? RequestId { get; set; }
+    private bool ShowRequestId => !string.IsNullOrEmpty(RequestId);
+
+    protected override void OnInitialized() =>
+        RequestId = Activity.Current?.Id ?? HttpContext?.TraceIdentifier;
+}

csharp/ql/integration-tests/all-platforms/blazor/BlazorTest/Components/Pages/TestPage.razor

@@ -0,0 +1,125 @@
+@page "/"
+@page "/test/{urlParam?}"
+@rendermode InteractiveServer
+
+<PageTitle>TestPage</PageTitle>
+
+<div>
+    <h3>Route parameter</h3>
+    <p>Go to: <a href="/test/@XssUrl">/test/@XssUrl</a></p>
+    <p>Parameter from URL: @UrlParam</p>
+    <p>Raw parameter from URL: @((MarkupString)UrlParam)</p>
+</div>
+
+<hr />
+
+<div>
+    <h3>Query parameter</h3>
+    <p>Go to: <a href="/test/?qs=@XssUrl">/test/?qs=@XssUrl</a></p>
+    <p>Parameter from query string: @QueryParam</p>
+    <p>Raw parameter from query string: @(new MarkupString(QueryParam))</p>
+</div>
+
+<hr />
+
+<div>
+    <h3>Bind InputText component</h3>
+    <InputText @bind-Value="InputValue1" />
+    <p>Value from InputText: @InputValue1</p>
+    <p>Raw value from InputText: @(new MarkupString(InputValue1))</p>
+</div>
+
+<hr />
+
+<div>
+    <h3>Bind input element</h3>
+    <input @bind="InputValue2">
+    <p>Value from InputText: @InputValue2</p>
+    <p>Raw value from InputText: @(new MarkupString(InputValue2))</p>
+</div>
+
+<hr />
+
+<div>
+    <h3>Bind through object property</h3>
+    <input @bind="Container1.Value">
+    <p>Value from InputText: @Container1.Value</p>
+    <p>Raw value from InputText: @(new MarkupString(Container1.Value))</p>
+</div>
+
+<hr />
+
+<div>
+    <h3>Input component with custom event</h3>
+    <MyInput Param1="@InputValue3" ValueChanged="MyInputChanged" />
+    <p>Value from InputText: @InputValue3</p>
+    <p>Raw value from InputText: @(new MarkupString(InputValue3))</p>
+</div>
+
+<hr />
+
+<div>
+    <h3>Input component with binding</h3>
+    <MyInput @bind-Param1="InputValue4" />
+    <p>Value from InputText: @InputValue4</p>
+    <p>Raw value from InputText: @(new MarkupString(InputValue4))</p>
+</div>
+
+<hr />
+
+<div>
+    <h3>Input, Output components</h3>
+    <MyInput @bind-Param1="InputValue5" />
+    <MyOutput Value="@InputValue5" />
+</div>
+
+<hr />
+
+<div>
+    <h3>Bind InputText, Output component</h3>
+    <InputText @bind-Value="InputValue6" />
+    <MyOutput Value="@InputValue6" />
+</div>
+
+@code {
+
+    public class Container
+    {
+        public string? Value { get; set; } = "";
+    }
+
+    private const string XssUrl = "<b>aaaa<%2Fb>";
+    private const string XssUrl2 = "<b>aaaa</b>";
+
+    [Parameter]
+    public string UrlParam { get; set; } = "";
+
+    [SupplyParameterFromQuery(Name = "qs")]
+    public string QueryParam { get; set; } = "";
+
+    public string InputValue1 { get; set; } = "";
+    public string InputValue2 { get; set; } = "";
+    public string InputValue3 { get; set; } = "";
+    public string InputValue4 { get; set; } = "";
+    public string InputValue5 { get; set; } = "";
+    public string InputValue6 { get; set; } = "";
+
+    public Container Container1 { get; set; } = new Container();
+
+    protected override void OnInitialized()
+    {
+        InputValue1 = XssUrl2;
+        InputValue2 = XssUrl2;
+        Container1.Value = XssUrl2;
+        InputValue3 = XssUrl2;
+        InputValue4 = XssUrl2;
+        InputValue5 = XssUrl2;
+        InputValue6 = XssUrl2;
+
+    }
+
+    private void MyInputChanged(string value)
+    {
+        InputValue3 = value;
+    }
+}

csharp/ql/integration-tests/all-platforms/blazor/BlazorTest/Components/Routes.razor

@@ -0,0 +1,6 @@
+<Router AppAssembly="typeof(Program).Assembly">
+    <Found Context="routeData">
+        <RouteView RouteData="routeData" DefaultLayout="typeof(Layout.MainLayout)" />
+        <FocusOnNavigate RouteData="routeData" Selector="h1" />
+    </Found>
+</Router>

csharp/ql/integration-tests/all-platforms/blazor/BlazorTest/Components/_Imports.razor

@@ -0,0 +1,10 @@
+@using System.Net.Http
+@using System.Net.Http.Json
+@using Microsoft.AspNetCore.Components.Forms
+@using Microsoft.AspNetCore.Components.Routing
+@using Microsoft.AspNetCore.Components.Web
+@using static Microsoft.AspNetCore.Components.Web.RenderMode
+@using Microsoft.AspNetCore.Components.Web.Virtualization
+@using Microsoft.JSInterop
+@using BlazorTest
+@using BlazorTest.Components

csharp/ql/integration-tests/all-platforms/blazor/BlazorTest/Program.cs

@@ -0,0 +1,27 @@
+using BlazorTest.Components;
+
+var builder = WebApplication.CreateBuilder(args);
+
+// Add services to the container.
+builder.Services.AddRazorComponents()
+    .AddInteractiveServerComponents();
+
+var app = builder.Build();
+
+// Configure the HTTP request pipeline.
+if (!app.Environment.IsDevelopment())
+{
+    app.UseExceptionHandler("/Error", createScopeForErrors: true);
+    // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
+    app.UseHsts();
+}
+
+app.UseHttpsRedirection();
+
+app.UseStaticFiles();
+app.UseAntiforgery();
+
+app.MapRazorComponents<App>()
+    .AddInteractiveServerRenderMode();
+
+app.Run();

csharp/ql/integration-tests/all-platforms/blazor/BlazorTest/Properties/launchSettings.json

@@ -0,0 +1,14 @@
+{
+  "$schema": "http://json.schemastore.org/launchsettings.json",
+  "profiles": {
+    "http": {
+      "commandName": "Project",
+      "dotnetRunMessages": true,
+      "launchBrowser": true,
+      "applicationUrl": "http://localhost:5047",
+      "environmentVariables": {
+        "ASPNETCORE_ENVIRONMENT": "Development"
+      }
+    }
+  }
+}

csharp/ql/integration-tests/all-platforms/blazor/BlazorTest/appsettings.json

@@ -0,0 +1,9 @@
+{
+  "Logging": {
+    "LogLevel": {
+      "Default": "Information",
+      "Microsoft.AspNetCore": "Warning"
+    }
+  },
+  "AllowedHosts": "*"
+}

csharp/ql/integration-tests/all-platforms/blazor/BlazorTest/global.json

@@ -0,0 +1,5 @@
+{
+    "sdk": {
+        "version": "9.0.100"
+    }
+}

csharp/ql/integration-tests/all-platforms/blazor/BlazorTest/wwwroot/app.css

@@ -0,0 +1,51 @@
+html, body {
+    font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif;
+}
+
+a, .btn-link {
+    color: #006bb7;
+}
+
+.btn-primary {
+    color: #fff;
+    background-color: #1b6ec2;
+    border-color: #1861ac;
+}
+
+.btn:focus, .btn:active:focus, .btn-link.nav-link:focus, .form-control:focus, .form-check-input:focus {
+  box-shadow: 0 0 0 0.1rem white, 0 0 0 0.25rem #258cfb;
+}
+
+.content {
+    padding-top: 1.1rem;
+}
+
+h1:focus {
+    outline: none;
+}
+
+.valid.modified:not([type=checkbox]) {
+    outline: 1px solid #26b050;
+}
+
+.invalid {
+    outline: 1px solid #e50000;
+}
+
+.validation-message {
+    color: #e50000;
+}
+
+.blazor-error-boundary {
+    background: url(data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iNTYiIGhlaWdodD0iNDkiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgeG1sbnM6eGxpbms9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkveGxpbmsiIG92ZXJmbG93PSJoaWRkZW4iPjxkZWZzPjxjbGlwUGF0aCBpZD0iY2xpcDAiPjxyZWN0IHg9IjIzNSIgeT0iNTEiIHdpZHRoPSI1NiIgaGVpZ2h0PSI0OSIvPjwvY2xpcFBhdGg+PC9kZWZzPjxnIGNsaXAtcGF0aD0idXJsKCNjbGlwMCkiIHRyYW5zZm9ybT0idHJhbnNsYXRlKC0yMzUgLTUxKSI+PHBhdGggZD0iTTI2My41MDYgNTFDMjY0LjcxNyA1MSAyNjUuODEzIDUxLjQ4MzcgMjY2LjYwNiA1Mi4yNjU4TDI2Ny4wNTIgNTIuNzk4NyAyNjcuNTM5IDUzLjYyODMgMjkwLjE4NSA5Mi4xODMxIDI5MC41NDUgOTIuNzk1IDI5MC42NTYgOTIuOTk2QzI5MC44NzcgOTMuNTEzIDI5MSA5NC4wODE1IDI5MSA5NC42NzgyIDI5MSA5Ny4wNjUxIDI4OS4wMzggOTkgMjg2LjYxNyA5OUwyNDAuMzgzIDk5QzIzNy45NjMgOTkgMjM2IDk3LjA2NTEgMjM2IDk0LjY3ODIgMjM2IDk0LjM3OTkgMjM2LjAzMSA5NC4wODg2IDIzNi4wODkgOTMuODA3MkwyMzYuMzM4IDkzLjAxNjIgMjM2Ljg1OCA5Mi4xMzE0IDI1OS40NzMgNTMuNjI5NCAyNTkuOTYxIDUyLjc5ODUgMjYwLjQwNyA1Mi4yNjU4QzI2MS4yIDUxLjQ4MzcgMjYyLjI5NiA1MSAyNjMuNTA2IDUxWk0yNjMuNTg2IDY2LjAxODNDMjYwLjczNyA2Ni4wMTgzIDI1OS4zMTMgNjcuMTI0NSAyNTkuMzEzIDY5LjMzNyAyNTkuMzEzIDY5LjYxMDIgMjU5LjMzMiA2OS44NjA4IDI1OS4zNzEgNzAuMDg4N0wyNjEuNzk1IDg0LjAxNjEgMjY1LjM4IDg0LjAxNjEgMjY3LjgyMSA2OS43NDc1QzI2Ny44NiA2OS43MzA5IDI2Ny44NzkgNjkuNTg3NyAyNjcuODc5IDY5LjMxNzkgMjY3Ljg3OSA2Ny4xMTgyIDI2Ni40NDggNjYuMDE4MyAyNjMuNTg2IDY2LjAxODNaTTI2My41NzYgODYuMDU0N0MyNjEuMDQ5IDg2LjA1NDcgMjU5Ljc4NiA4Ny4zMDA1IDI1OS43ODYgODkuNzkyMSAyNTkuNzg2IDkyLjI4MzcgMjYxLjA0OSA5My41Mjk1IDI2My41NzYgOTMuNTI5NSAyNjYuMTE2IDkzLjUyOTUgMjY3LjM4NyA5Mi4yODM3IDI2Ny4zODcgODkuNzkyMSAyNjcuMzg3IDg3LjMwMDUgMjY2LjExNiA4Ni4wNTQ3IDI2My41NzYgODYuMDU0N1oiIGZpbGw9IiNGRkU1MDAiIGZpbGwtcnVsZT0iZXZlbm9kZCIvPjwvZz48L3N2Zz4=) no-repeat 1rem/1.8rem, #b32121;
+    padding: 1rem 1rem 1rem 3.7rem;
+    color: white;
+}
+
+    .blazor-error-boundary::after {
+        content: "An error has occurred."
+    }
+
+.darker-border-checkbox.form-check-input {
+    border-color: #929292;
+}

csharp/ql/integration-tests/all-platforms/blazor/Files.expected

@@ -0,0 +1,22 @@
+| BlazorTest/Components/App.razor:0:0:0:0 | BlazorTest/Components/App.razor |
+| BlazorTest/Components/Layout/MainLayout.razor:0:0:0:0 | BlazorTest/Components/Layout/MainLayout.razor |
+| BlazorTest/Components/Layout/NavMenu.razor:0:0:0:0 | BlazorTest/Components/Layout/NavMenu.razor |
+| BlazorTest/Components/MyInput.razor:0:0:0:0 | BlazorTest/Components/MyInput.razor |
+| BlazorTest/Components/MyOutput.razor:0:0:0:0 | BlazorTest/Components/MyOutput.razor |
+| BlazorTest/Components/Pages/Error.razor:0:0:0:0 | BlazorTest/Components/Pages/Error.razor |
+| BlazorTest/Components/Pages/TestPage.razor:0:0:0:0 | BlazorTest/Components/Pages/TestPage.razor |
+| BlazorTest/Components/Routes.razor:0:0:0:0 | BlazorTest/Components/Routes.razor |
+| BlazorTest/Components/_Imports.razor:0:0:0:0 | BlazorTest/Components/_Imports.razor |
+| BlazorTest/Program.cs:0:0:0:0 | BlazorTest/Program.cs |
+| BlazorTest/obj/Debug/net9.0/.NETCoreApp,Version=v9.0.AssemblyAttributes.cs:0:0:0:0 | BlazorTest/obj/Debug/net9.0/.NETCoreApp,Version=v9.0.AssemblyAttributes.cs |
+| BlazorTest/obj/Debug/net9.0/BlazorTest.AssemblyInfo.cs:0:0:0:0 | BlazorTest/obj/Debug/net9.0/BlazorTest.AssemblyInfo.cs |
+| BlazorTest/obj/Debug/net9.0/BlazorTest.GlobalUsings.g.cs:0:0:0:0 | BlazorTest/obj/Debug/net9.0/BlazorTest.GlobalUsings.g.cs |
+| BlazorTest/obj/Debug/net9.0/generated/Microsoft.CodeAnalysis.Razor.Compiler/Microsoft.NET.Sdk.Razor.SourceGenerators.RazorSourceGenerator/Components_App_razor.g.cs:0:0:0:0 | BlazorTest/obj/Debug/net9.0/generated/Microsoft.CodeAnalysis.Razor.Compiler/Microsoft.NET.Sdk.Razor.SourceGenerators.RazorSourceGenerator/Components_App_razor.g.cs |
+| BlazorTest/obj/Debug/net9.0/generated/Microsoft.CodeAnalysis.Razor.Compiler/Microsoft.NET.Sdk.Razor.SourceGenerators.RazorSourceGenerator/Components_Layout_MainLayout_razor.g.cs:0:0:0:0 | BlazorTest/obj/Debug/net9.0/generated/Microsoft.CodeAnalysis.Razor.Compiler/Microsoft.NET.Sdk.Razor.SourceGenerators.RazorSourceGenerator/Components_Layout_MainLayout_razor.g.cs |
+| BlazorTest/obj/Debug/net9.0/generated/Microsoft.CodeAnalysis.Razor.Compiler/Microsoft.NET.Sdk.Razor.SourceGenerators.RazorSourceGenerator/Components_Layout_NavMenu_razor.g.cs:0:0:0:0 | BlazorTest/obj/Debug/net9.0/generated/Microsoft.CodeAnalysis.Razor.Compiler/Microsoft.NET.Sdk.Razor.SourceGenerators.RazorSourceGenerator/Components_Layout_NavMenu_razor.g.cs |
+| BlazorTest/obj/Debug/net9.0/generated/Microsoft.CodeAnalysis.Razor.Compiler/Microsoft.NET.Sdk.Razor.SourceGenerators.RazorSourceGenerator/Components_MyInput_razor.g.cs:0:0:0:0 | BlazorTest/obj/Debug/net9.0/generated/Microsoft.CodeAnalysis.Razor.Compiler/Microsoft.NET.Sdk.Razor.SourceGenerators.RazorSourceGenerator/Components_MyInput_razor.g.cs |
+| BlazorTest/obj/Debug/net9.0/generated/Microsoft.CodeAnalysis.Razor.Compiler/Microsoft.NET.Sdk.Razor.SourceGenerators.RazorSourceGenerator/Components_MyOutput_razor.g.cs:0:0:0:0 | BlazorTest/obj/Debug/net9.0/generated/Microsoft.CodeAnalysis.Razor.Compiler/Microsoft.NET.Sdk.Razor.SourceGenerators.RazorSourceGenerator/Components_MyOutput_razor.g.cs |
+| BlazorTest/obj/Debug/net9.0/generated/Microsoft.CodeAnalysis.Razor.Compiler/Microsoft.NET.Sdk.Razor.SourceGenerators.RazorSourceGenerator/Components_Pages_Error_razor.g.cs:0:0:0:0 | BlazorTest/obj/Debug/net9.0/generated/Microsoft.CodeAnalysis.Razor.Compiler/Microsoft.NET.Sdk.Razor.SourceGenerators.RazorSourceGenerator/Components_Pages_Error_razor.g.cs |
+| BlazorTest/obj/Debug/net9.0/generated/Microsoft.CodeAnalysis.Razor.Compiler/Microsoft.NET.Sdk.Razor.SourceGenerators.RazorSourceGenerator/Components_Pages_TestPage_razor.g.cs:0:0:0:0 | BlazorTest/obj/Debug/net9.0/generated/Microsoft.CodeAnalysis.Razor.Compiler/Microsoft.NET.Sdk.Razor.SourceGenerators.RazorSourceGenerator/Components_Pages_TestPage_razor.g.cs |
+| BlazorTest/obj/Debug/net9.0/generated/Microsoft.CodeAnalysis.Razor.Compiler/Microsoft.NET.Sdk.Razor.SourceGenerators.RazorSourceGenerator/Components_Routes_razor.g.cs:0:0:0:0 | BlazorTest/obj/Debug/net9.0/generated/Microsoft.CodeAnalysis.Razor.Compiler/Microsoft.NET.Sdk.Razor.SourceGenerators.RazorSourceGenerator/Components_Routes_razor.g.cs |
+| BlazorTest/obj/Debug/net9.0/generated/Microsoft.CodeAnalysis.Razor.Compiler/Microsoft.NET.Sdk.Razor.SourceGenerators.RazorSourceGenerator/Components__Imports_razor.g.cs:0:0:0:0 | BlazorTest/obj/Debug/net9.0/generated/Microsoft.CodeAnalysis.Razor.Compiler/Microsoft.NET.Sdk.Razor.SourceGenerators.RazorSourceGenerator/Components__Imports_razor.g.cs |

csharp/ql/integration-tests/all-platforms/blazor/Files.ql

@@ -0,0 +1,5 @@
+import csharp
+
+from File f
+where f.fromSource() or f.getExtension() = "razor"
+select f

csharp/ql/integration-tests/all-platforms/blazor/htmlSinks.expected

@@ -0,0 +1,8 @@
+| BlazorTest/Components/MyOutput.razor:5:53:5:57 | access to property Value |
+| BlazorTest/Components/Pages/TestPage.razor:11:48:11:55 | access to property UrlParam |
+| BlazorTest/Components/Pages/TestPage.razor:20:60:20:69 | access to property QueryParam |
+| BlazorTest/Components/Pages/TestPage.razor:29:53:29:63 | access to property InputValue1 |
+| BlazorTest/Components/Pages/TestPage.razor:38:53:38:63 | access to property InputValue2 |
+| BlazorTest/Components/Pages/TestPage.razor:47:53:47:68 | access to property Value |
+| BlazorTest/Components/Pages/TestPage.razor:56:53:56:63 | access to property InputValue3 |
+| BlazorTest/Components/Pages/TestPage.razor:65:53:65:63 | access to property InputValue4 |

csharp/ql/integration-tests/all-platforms/blazor/htmlSinks.ql

@@ -0,0 +1,7 @@
+import semmle.code.csharp.security.dataflow.flowsinks.Html
+
+from HtmlSink sink, File f
+where
+  sink.getLocation().getFile() = f and
+  (f.fromSource() or f.getExtension() = "razor")
+select sink

csharp/ql/integration-tests/all-platforms/blazor/test.py

@@ -0,0 +1,2 @@
+def test(codeql, csharp):
+    codeql.database.create(source_root="BlazorTest")

csharp/ql/integration-tests/all-platforms/blazor_net_8/BlazorTest/BlazorTest.csproj

@@ -0,0 +1,9 @@
+<Project Sdk="Microsoft.NET.Sdk.Web">
+
+  <PropertyGroup>
+    <TargetFramework>net8.0</TargetFramework>
+    <Nullable>enable</Nullable>
+    <ImplicitUsings>enable</ImplicitUsings>
+  </PropertyGroup>
+
+</Project>

csharp/ql/integration-tests/all-platforms/blazor_net_8/BlazorTest/Components/App.razor

@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html lang="en">
+
+<head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <base href="/" />
+    <link rel="stylesheet" href="bootstrap/bootstrap.min.css" />
+    <link rel="stylesheet" href="app.css" />
+    <link rel="stylesheet" href="BlazorTest.styles.css" />
+    <link rel="icon" type="image/png" href="favicon.png" />
+    <HeadOutlet />
+</head>
+
+<body>
+    <Routes />
+    <script src="_framework/blazor.web.js"></script>
+</body>
+
+</html>

csharp/ql/integration-tests/all-platforms/blazor_net_8/BlazorTest/Components/Layout/MainLayout.razor

@@ -0,0 +1,23 @@
+@inherits LayoutComponentBase
+
+<div class="page">
+    <div class="sidebar">
+        <NavMenu />
+    </div>
+
+    <main>
+        <div class="top-row px-4">
+            <a href="https://learn.microsoft.com/aspnet/core/" target="_blank">About</a>
+        </div>
+
+        <article class="content px-4">
+            @Body
+        </article>
+    </main>
+</div>
+
+<div id="blazor-error-ui">
+    An unhandled error has occurred.
+    <a href="" class="reload">Reload</a>
+    <a class="dismiss">🗙</a>
+</div>

csharp/ql/integration-tests/all-platforms/blazor_net_8/BlazorTest/Components/Layout/MainLayout.razor.css

@@ -0,0 +1,96 @@
+.page {
+    position: relative;
+    display: flex;
+    flex-direction: column;
+}
+
+main {
+    flex: 1;
+}
+
+.sidebar {
+    background-image: linear-gradient(180deg, rgb(5, 39, 103) 0%, #3a0647 70%);
+}
+
+.top-row {
+    background-color: #f7f7f7;
+    border-bottom: 1px solid #d6d5d5;
+    justify-content: flex-end;
+    height: 3.5rem;
+    display: flex;
+    align-items: center;
+}
+
+    .top-row ::deep a, .top-row ::deep .btn-link {
+        white-space: nowrap;
+        margin-left: 1.5rem;
+        text-decoration: none;
+    }
+
+    .top-row ::deep a:hover, .top-row ::deep .btn-link:hover {
+        text-decoration: underline;
+    }
+
+    .top-row ::deep a:first-child {
+        overflow: hidden;
+        text-overflow: ellipsis;
+    }
+
+@media (max-width: 640.98px) {
+    .top-row {
+        justify-content: space-between;
+    }
+
+    .top-row ::deep a, .top-row ::deep .btn-link {
+        margin-left: 0;
+    }
+}
+
+@media (min-width: 641px) {
+    .page {
+        flex-direction: row;
+    }
+
+    .sidebar {
+        width: 250px;
+        height: 100vh;
+        position: sticky;
+        top: 0;
+    }
+
+    .top-row {
+        position: sticky;
+        top: 0;
+        z-index: 1;
+    }
+
+    .top-row.auth ::deep a:first-child {
+        flex: 1;
+        text-align: right;
+        width: 0;
+    }
+
+    .top-row, article {
+        padding-left: 2rem !important;
+        padding-right: 1.5rem !important;
+    }
+}
+
+#blazor-error-ui {
+    background: lightyellow;
+    bottom: 0;
+    box-shadow: 0 -1px 2px rgba(0, 0, 0, 0.2);
+    display: none;
+    left: 0;
+    padding: 0.6rem 1.25rem 0.7rem 1.25rem;
+    position: fixed;
+    width: 100%;
+    z-index: 1000;
+}
+
+    #blazor-error-ui .dismiss {
+        cursor: pointer;
+        position: absolute;
+        right: 0.75rem;
+        top: 0.5rem;
+    }

csharp/ql/integration-tests/all-platforms/blazor_net_8/BlazorTest/Components/Layout/NavMenu.razor

@@ -0,0 +1,19 @@
+<div class="top-row ps-3 navbar navbar-dark">
+    <div class="container-fluid">
+        <a class="navbar-brand" href="">BlazorTest</a>
+    </div>
+</div>
+
+<input type="checkbox" title="Navigation menu" class="navbar-toggler" />
+
+<div class="nav-scrollable" onclick="document.querySelector('.navbar-toggler').click()">
+    <nav class="flex-column">
+
+        <div class="nav-item px-3">
+            <NavLink class="nav-link" href="test">
+                <span class="bi bi-plus-square-fill-nav-menu" aria-hidden="true"></span> Test
+            </NavLink>
+        </div>
+
+    </nav>
+</div>

csharp/ql/integration-tests/all-platforms/blazor_net_8/BlazorTest/Components/Layout/NavMenu.razor.css

@@ -0,0 +1,105 @@
+.navbar-toggler {
+    appearance: none;
+    cursor: pointer;
+    width: 3.5rem;
+    height: 2.5rem;
+    color: white;
+    position: absolute;
+    top: 0.5rem;
+    right: 1rem;
+    border: 1px solid rgba(255, 255, 255, 0.1);
+    background: url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 30 30'%3e%3cpath stroke='rgba%28255, 255, 255, 0.55%29' stroke-linecap='round' stroke-miterlimit='10' stroke-width='2' d='M4 7h22M4 15h22M4 23h22'/%3e%3c/svg%3e") no-repeat center/1.75rem rgba(255, 255, 255, 0.1);
+}
+
+.navbar-toggler:checked {
+    background-color: rgba(255, 255, 255, 0.5);
+}
+
+.top-row {
+    height: 3.5rem;
+    background-color: rgba(0,0,0,0.4);
+}
+
+.navbar-brand {
+    font-size: 1.1rem;
+}
+
+.bi {
+    display: inline-block;
+    position: relative;
+    width: 1.25rem;
+    height: 1.25rem;
+    margin-right: 0.75rem;
+    top: -1px;
+    background-size: cover;
+}
+
+.bi-house-door-fill-nav-menu {
+    background-image: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='16' height='16' fill='white' class='bi bi-house-door-fill' viewBox='0 0 16 16'%3E%3Cpath d='M6.5 14.5v-3.505c0-.245.25-.495.5-.495h2c.25 0 .5.25.5.5v3.5a.5.5 0 0 0 .5.5h4a.5.5 0 0 0 .5-.5v-7a.5.5 0 0 0-.146-.354L13 5.793V2.5a.5.5 0 0 0-.5-.5h-1a.5.5 0 0 0-.5.5v1.293L8.354 1.146a.5.5 0 0 0-.708 0l-6 6A.5.5 0 0 0 1.5 7.5v7a.5.5 0 0 0 .5.5h4a.5.5 0 0 0 .5-.5Z'/%3E%3C/svg%3E");
+}
+
+.bi-plus-square-fill-nav-menu {
+    background-image: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='16' height='16' fill='white' class='bi bi-plus-square-fill' viewBox='0 0 16 16'%3E%3Cpath d='M2 0a2 2 0 0 0-2 2v12a2 2 0 0 0 2 2h12a2 2 0 0 0 2-2V2a2 2 0 0 0-2-2H2zm6.5 4.5v3h3a.5.5 0 0 1 0 1h-3v3a.5.5 0 0 1-1 0v-3h-3a.5.5 0 0 1 0-1h3v-3a.5.5 0 0 1 1 0z'/%3E%3C/svg%3E");
+}
+
+.bi-list-nested-nav-menu {
+    background-image: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='16' height='16' fill='white' class='bi bi-list-nested' viewBox='0 0 16 16'%3E%3Cpath fill-rule='evenodd' d='M4.5 11.5A.5.5 0 0 1 5 11h10a.5.5 0 0 1 0 1H5a.5.5 0 0 1-.5-.5zm-2-4A.5.5 0 0 1 3 7h10a.5.5 0 0 1 0 1H3a.5.5 0 0 1-.5-.5zm-2-4A.5.5 0 0 1 1 3h10a.5.5 0 0 1 0 1H1a.5.5 0 0 1-.5-.5z'/%3E%3C/svg%3E");
+}
+
+.nav-item {
+    font-size: 0.9rem;
+    padding-bottom: 0.5rem;
+}
+
+    .nav-item:first-of-type {
+        padding-top: 1rem;
+    }
+
+    .nav-item:last-of-type {
+        padding-bottom: 1rem;
+    }
+
+    .nav-item ::deep .nav-link {
+        color: #d7d7d7;
+        background: none;
+        border: none;
+        border-radius: 4px;
+        height: 3rem;
+        display: flex;
+        align-items: center;
+        line-height: 3rem;
+        width: 100%;
+    }
+
+.nav-item ::deep a.active {
+    background-color: rgba(255,255,255,0.37);
+    color: white;
+}
+
+.nav-item ::deep .nav-link:hover {
+    background-color: rgba(255,255,255,0.1);
+    color: white;
+}
+
+.nav-scrollable {
+    display: none;
+}
+
+.navbar-toggler:checked ~ .nav-scrollable {
+    display: block;
+}
+
+@media (min-width: 641px) {
+    .navbar-toggler {
+        display: none;
+    }
+
+    .nav-scrollable {
+        /* Never collapse the sidebar for wide screens */
+        display: block;
+
+        /* Allow sidebar to scroll for tall menus */
+        height: calc(100vh - 3.5rem);
+        overflow-y: auto;
+    }
+}

csharp/ql/integration-tests/all-platforms/blazor_net_8/BlazorTest/Components/MyInput.razor

@@ -0,0 +1,20 @@
+@rendermode InteractiveServer
+
+<input @bind="Param1" @bind:event="onchange" @bind:after="Fire">
+
+@code {
+    [Parameter]
+    public string? Param1 { get; set; } = "";
+
+    [Parameter]
+    public EventCallback<string?> ValueChanged { get; set; }
+
+    [Parameter]
+    public EventCallback<string?> Param1Changed { get; set; }
+
+    private void Fire()
+    {
+        ValueChanged.InvokeAsync(Param1);
+        Param1Changed.InvokeAsync(Param1);
+    }
+}

csharp/ql/integration-tests/all-platforms/blazor_net_8/BlazorTest/Components/MyOutput.razor

@@ -0,0 +1,11 @@
+@rendermode InteractiveServer
+
+<div>
+    <p>Value from InputText: @Value</p>
+    <p>Raw value from InputText: @(new MarkupString(Value))</p>
+</div>
+
+@code {
+    [Parameter]
+    public string Value { get; set; } = "";
+}

csharp/ql/integration-tests/all-platforms/blazor_net_8/BlazorTest/Components/Pages/Error.razor

@@ -0,0 +1,36 @@
+@page "/Error"
+@using System.Diagnostics
+
+<PageTitle>Error</PageTitle>
+
+<h1 class="text-danger">Error.</h1>
+<h2 class="text-danger">An error occurred while processing your request.</h2>
+
+@if (ShowRequestId)
+{
+    <p>
+        <strong>Request ID:</strong> <code>@RequestId</code>
+    </p>
+}
+
+<h3>Development Mode</h3>
+<p>
+    Swapping to <strong>Development</strong> environment will display more detailed information about the error that occurred.
+</p>
+<p>
+    <strong>The Development environment shouldn't be enabled for deployed applications.</strong>
+    It can result in displaying sensitive information from exceptions to end users.
+    For local debugging, enable the <strong>Development</strong> environment by setting the <strong>ASPNETCORE_ENVIRONMENT</strong> environment variable to <strong>Development</strong>
+    and restarting the app.
+</p>
+
+@code{
+    [CascadingParameter]
+    private HttpContext? HttpContext { get; set; }
+
+    private string? RequestId { get; set; }
+    private bool ShowRequestId => !string.IsNullOrEmpty(RequestId);
+
+    protected override void OnInitialized() =>
+        RequestId = Activity.Current?.Id ?? HttpContext?.TraceIdentifier;
+}

csharp/ql/integration-tests/all-platforms/blazor_net_8/BlazorTest/Components/Pages/TestPage.razor

@@ -0,0 +1,125 @@
+@page "/"
+@page "/test/{urlParam?}"
+@rendermode InteractiveServer
+
+<PageTitle>TestPage</PageTitle>
+
+<div>
+    <h3>Route parameter</h3>
+    <p>Go to: <a href="/test/@XssUrl">/test/@XssUrl</a></p>
+    <p>Parameter from URL: @UrlParam</p>
+    <p>Raw parameter from URL: @((MarkupString)UrlParam)</p>
+</div>
+
+<hr />
+
+<div>
+    <h3>Query parameter</h3>
+    <p>Go to: <a href="/test/?qs=@XssUrl">/test/?qs=@XssUrl</a></p>
+    <p>Parameter from query string: @QueryParam</p>
+    <p>Raw parameter from query string: @(new MarkupString(QueryParam))</p>
+</div>
+
+<hr />
+
+<div>
+    <h3>Bind InputText component</h3>
+    <InputText @bind-Value="InputValue1" />
+    <p>Value from InputText: @InputValue1</p>
+    <p>Raw value from InputText: @(new MarkupString(InputValue1))</p>
+</div>
+
+<hr />
+
+<div>
+    <h3>Bind input element</h3>
+    <input @bind="InputValue2">
+    <p>Value from InputText: @InputValue2</p>
+    <p>Raw value from InputText: @(new MarkupString(InputValue2))</p>
+</div>
+
+<hr />
+
+<div>
+    <h3>Bind through object property</h3>
+    <input @bind="Container1.Value">
+    <p>Value from InputText: @Container1.Value</p>
+    <p>Raw value from InputText: @(new MarkupString(Container1.Value))</p>
+</div>
+
+<hr />
+
+<div>
+    <h3>Input component with custom event</h3>
+    <MyInput Param1="@InputValue3" ValueChanged="MyInputChanged" />
+    <p>Value from InputText: @InputValue3</p>
+    <p>Raw value from InputText: @(new MarkupString(InputValue3))</p>
+</div>
+
+<hr />
+
+<div>
+    <h3>Input component with binding</h3>
+    <MyInput @bind-Param1="InputValue4" />
+    <p>Value from InputText: @InputValue4</p>
+    <p>Raw value from InputText: @(new MarkupString(InputValue4))</p>
+</div>
+
+<hr />
+
+<div>
+    <h3>Input, Output components</h3>
+    <MyInput @bind-Param1="InputValue5" />
+    <MyOutput Value="@InputValue5" />
+</div>
+
+<hr />
+
+<div>
+    <h3>Bind InputText, Output component</h3>
+    <InputText @bind-Value="InputValue6" />
+    <MyOutput Value="@InputValue6" />
+</div>
+
+@code {
+
+    public class Container
+    {
+        public string? Value { get; set; } = "";
+    }
+
+    private const string XssUrl = "<b>aaaa<%2Fb>";
+    private const string XssUrl2 = "<b>aaaa</b>";
+
+    [Parameter]
+    public string UrlParam { get; set; } = "";
+
+    [SupplyParameterFromQuery(Name = "qs")]
+    public string QueryParam { get; set; } = "";
+
+    public string InputValue1 { get; set; } = "";
+    public string InputValue2 { get; set; } = "";
+    public string InputValue3 { get; set; } = "";
+    public string InputValue4 { get; set; } = "";
+    public string InputValue5 { get; set; } = "";
+    public string InputValue6 { get; set; } = "";
+
+    public Container Container1 { get; set; } = new Container();
+
+    protected override void OnInitialized()
+    {
+        InputValue1 = XssUrl2;
+        InputValue2 = XssUrl2;
+        Container1.Value = XssUrl2;
+        InputValue3 = XssUrl2;
+        InputValue4 = XssUrl2;
+        InputValue5 = XssUrl2;
+        InputValue6 = XssUrl2;
+
+    }
+
+    private void MyInputChanged(string value)
+    {
+        InputValue3 = value;
+    }
+}

csharp/ql/integration-tests/all-platforms/blazor_net_8/BlazorTest/Components/Routes.razor

@@ -0,0 +1,6 @@
+<Router AppAssembly="typeof(Program).Assembly">
+    <Found Context="routeData">
+        <RouteView RouteData="routeData" DefaultLayout="typeof(Layout.MainLayout)" />
+        <FocusOnNavigate RouteData="routeData" Selector="h1" />
+    </Found>
+</Router>

csharp/ql/integration-tests/all-platforms/blazor_net_8/BlazorTest/Components/_Imports.razor

@@ -0,0 +1,10 @@
+@using System.Net.Http
+@using System.Net.Http.Json
+@using Microsoft.AspNetCore.Components.Forms
+@using Microsoft.AspNetCore.Components.Routing
+@using Microsoft.AspNetCore.Components.Web
+@using static Microsoft.AspNetCore.Components.Web.RenderMode
+@using Microsoft.AspNetCore.Components.Web.Virtualization
+@using Microsoft.JSInterop
+@using BlazorTest
+@using BlazorTest.Components

csharp/ql/integration-tests/all-platforms/blazor_net_8/BlazorTest/Program.cs

@@ -0,0 +1,27 @@
+using BlazorTest.Components;
+
+var builder = WebApplication.CreateBuilder(args);
+
+// Add services to the container.
+builder.Services.AddRazorComponents()
+    .AddInteractiveServerComponents();
+
+var app = builder.Build();
+
+// Configure the HTTP request pipeline.
+if (!app.Environment.IsDevelopment())
+{
+    app.UseExceptionHandler("/Error", createScopeForErrors: true);
+    // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
+    app.UseHsts();
+}
+
+app.UseHttpsRedirection();
+
+app.UseStaticFiles();
+app.UseAntiforgery();
+
+app.MapRazorComponents<App>()
+    .AddInteractiveServerRenderMode();
+
+app.Run();

csharp/ql/integration-tests/all-platforms/blazor_net_8/BlazorTest/Properties/launchSettings.json

@@ -0,0 +1,14 @@
+{
+  "$schema": "http://json.schemastore.org/launchsettings.json",
+  "profiles": {
+    "http": {
+      "commandName": "Project",
+      "dotnetRunMessages": true,
+      "launchBrowser": true,
+      "applicationUrl": "http://localhost:5047",
+      "environmentVariables": {
+        "ASPNETCORE_ENVIRONMENT": "Development"
+      }
+    }
+  }
+}

csharp/ql/integration-tests/all-platforms/blazor_net_8/BlazorTest/appsettings.json

@@ -0,0 +1,9 @@
+{
+  "Logging": {
+    "LogLevel": {
+      "Default": "Information",
+      "Microsoft.AspNetCore": "Warning"
+    }
+  },
+  "AllowedHosts": "*"
+}

csharp/ql/integration-tests/all-platforms/blazor_net_8/BlazorTest/global.json

@@ -0,0 +1,5 @@
+{
+    "sdk": {
+        "version": "8.0.401"
+    }
+}

csharp/ql/integration-tests/all-platforms/blazor_net_8/BlazorTest/wwwroot/app.css

@@ -0,0 +1,51 @@
+html, body {
+    font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif;
+}
+
+a, .btn-link {
+    color: #006bb7;
+}
+
+.btn-primary {
+    color: #fff;
+    background-color: #1b6ec2;
+    border-color: #1861ac;
+}
+
+.btn:focus, .btn:active:focus, .btn-link.nav-link:focus, .form-control:focus, .form-check-input:focus {
+  box-shadow: 0 0 0 0.1rem white, 0 0 0 0.25rem #258cfb;
+}
+
+.content {
+    padding-top: 1.1rem;
+}
+
+h1:focus {
+    outline: none;
+}
+
+.valid.modified:not([type=checkbox]) {
+    outline: 1px solid #26b050;
+}
+
+.invalid {
+    outline: 1px solid #e50000;
+}
+
+.validation-message {
+    color: #e50000;
+}
+
+.blazor-error-boundary {
+    background: url(data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iNTYiIGhlaWdodD0iNDkiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgeG1sbnM6eGxpbms9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkveGxpbmsiIG92ZXJmbG93PSJoaWRkZW4iPjxkZWZzPjxjbGlwUGF0aCBpZD0iY2xpcDAiPjxyZWN0IHg9IjIzNSIgeT0iNTEiIHdpZHRoPSI1NiIgaGVpZ2h0PSI0OSIvPjwvY2xpcFBhdGg+PC9kZWZzPjxnIGNsaXAtcGF0aD0idXJsKCNjbGlwMCkiIHRyYW5zZm9ybT0idHJhbnNsYXRlKC0yMzUgLTUxKSI+PHBhdGggZD0iTTI2My41MDYgNTFDMjY0LjcxNyA1MSAyNjUuODEzIDUxLjQ4MzcgMjY2LjYwNiA1Mi4yNjU4TDI2Ny4wNTIgNTIuNzk4NyAyNjcuNTM5IDUzLjYyODMgMjkwLjE4NSA5Mi4xODMxIDI5MC41NDUgOTIuNzk1IDI5MC42NTYgOTIuOTk2QzI5MC44NzcgOTMuNTEzIDI5MSA5NC4wODE1IDI5MSA5NC42NzgyIDI5MSA5Ny4wNjUxIDI4OS4wMzggOTkgMjg2LjYxNyA5OUwyNDAuMzgzIDk5QzIzNy45NjMgOTkgMjM2IDk3LjA2NTEgMjM2IDk0LjY3ODIgMjM2IDk0LjM3OTkgMjM2LjAzMSA5NC4wODg2IDIzNi4wODkgOTMuODA3MkwyMzYuMzM4IDkzLjAxNjIgMjM2Ljg1OCA5Mi4xMzE0IDI1OS40NzMgNTMuNjI5NCAyNTkuOTYxIDUyLjc5ODUgMjYwLjQwNyA1Mi4yNjU4QzI2MS4yIDUxLjQ4MzcgMjYyLjI5NiA1MSAyNjMuNTA2IDUxWk0yNjMuNTg2IDY2LjAxODNDMjYwLjczNyA2Ni4wMTgzIDI1OS4zMTMgNjcuMTI0NSAyNTkuMzEzIDY5LjMzNyAyNTkuMzEzIDY5LjYxMDIgMjU5LjMzMiA2OS44NjA4IDI1OS4zNzEgNzAuMDg4N0wyNjEuNzk1IDg0LjAxNjEgMjY1LjM4IDg0LjAxNjEgMjY3LjgyMSA2OS43NDc1QzI2Ny44NiA2OS43MzA5IDI2Ny44NzkgNjkuNTg3NyAyNjcuODc5IDY5LjMxNzkgMjY3Ljg3OSA2Ny4xMTgyIDI2Ni40NDggNjYuMDE4MyAyNjMuNTg2IDY2LjAxODNaTTI2My41NzYgODYuMDU0N0MyNjEuMDQ5IDg2LjA1NDcgMjU5Ljc4NiA4Ny4zMDA1IDI1OS43ODYgODkuNzkyMSAyNTkuNzg2IDkyLjI4MzcgMjYxLjA0OSA5My41Mjk1IDI2My41NzYgOTMuNTI5NSAyNjYuMTE2IDkzLjUyOTUgMjY3LjM4NyA5Mi4yODM3IDI2Ny4zODcgODkuNzkyMSAyNjcuMzg3IDg3LjMwMDUgMjY2LjExNiA4Ni4wNTQ3IDI2My41NzYgODYuMDU0N1oiIGZpbGw9IiNGRkU1MDAiIGZpbGwtcnVsZT0iZXZlbm9kZCIvPjwvZz48L3N2Zz4=) no-repeat 1rem/1.8rem, #b32121;
+    padding: 1rem 1rem 1rem 3.7rem;
+    color: white;
+}
+
+    .blazor-error-boundary::after {
+        content: "An error has occurred."
+    }
+
+.darker-border-checkbox.form-check-input {
+    border-color: #929292;
+}

csharp/ql/integration-tests/all-platforms/blazor_net_8/Files.expected

@@ -0,0 +1,22 @@
+| BlazorTest/Components/App.razor:0:0:0:0 | BlazorTest/Components/App.razor |
+| BlazorTest/Components/Layout/MainLayout.razor:0:0:0:0 | BlazorTest/Components/Layout/MainLayout.razor |
+| BlazorTest/Components/Layout/NavMenu.razor:0:0:0:0 | BlazorTest/Components/Layout/NavMenu.razor |
+| BlazorTest/Components/MyInput.razor:0:0:0:0 | BlazorTest/Components/MyInput.razor |
+| BlazorTest/Components/MyOutput.razor:0:0:0:0 | BlazorTest/Components/MyOutput.razor |
+| BlazorTest/Components/Pages/Error.razor:0:0:0:0 | BlazorTest/Components/Pages/Error.razor |
+| BlazorTest/Components/Pages/TestPage.razor:0:0:0:0 | BlazorTest/Components/Pages/TestPage.razor |
+| BlazorTest/Components/Routes.razor:0:0:0:0 | BlazorTest/Components/Routes.razor |
+| BlazorTest/Components/_Imports.razor:0:0:0:0 | BlazorTest/Components/_Imports.razor |
+| BlazorTest/Program.cs:0:0:0:0 | BlazorTest/Program.cs |
+| BlazorTest/obj/Debug/net8.0/.NETCoreApp,Version=v8.0.AssemblyAttributes.cs:0:0:0:0 | BlazorTest/obj/Debug/net8.0/.NETCoreApp,Version=v8.0.AssemblyAttributes.cs |
+| BlazorTest/obj/Debug/net8.0/BlazorTest.AssemblyInfo.cs:0:0:0:0 | BlazorTest/obj/Debug/net8.0/BlazorTest.AssemblyInfo.cs |
+| BlazorTest/obj/Debug/net8.0/BlazorTest.GlobalUsings.g.cs:0:0:0:0 | BlazorTest/obj/Debug/net8.0/BlazorTest.GlobalUsings.g.cs |
+| BlazorTest/obj/Debug/net8.0/generated/Microsoft.CodeAnalysis.Razor.Compiler/Microsoft.NET.Sdk.Razor.SourceGenerators.RazorSourceGenerator/Components_App_razor.g.cs:0:0:0:0 | BlazorTest/obj/Debug/net8.0/generated/Microsoft.CodeAnalysis.Razor.Compiler/Microsoft.NET.Sdk.Razor.SourceGenerators.RazorSourceGenerator/Components_App_razor.g.cs |
+| BlazorTest/obj/Debug/net8.0/generated/Microsoft.CodeAnalysis.Razor.Compiler/Microsoft.NET.Sdk.Razor.SourceGenerators.RazorSourceGenerator/Components_Layout_MainLayout_razor.g.cs:0:0:0:0 | BlazorTest/obj/Debug/net8.0/generated/Microsoft.CodeAnalysis.Razor.Compiler/Microsoft.NET.Sdk.Razor.SourceGenerators.RazorSourceGenerator/Components_Layout_MainLayout_razor.g.cs |
+| BlazorTest/obj/Debug/net8.0/generated/Microsoft.CodeAnalysis.Razor.Compiler/Microsoft.NET.Sdk.Razor.SourceGenerators.RazorSourceGenerator/Components_Layout_NavMenu_razor.g.cs:0:0:0:0 | BlazorTest/obj/Debug/net8.0/generated/Microsoft.CodeAnalysis.Razor.Compiler/Microsoft.NET.Sdk.Razor.SourceGenerators.RazorSourceGenerator/Components_Layout_NavMenu_razor.g.cs |
+| BlazorTest/obj/Debug/net8.0/generated/Microsoft.CodeAnalysis.Razor.Compiler/Microsoft.NET.Sdk.Razor.SourceGenerators.RazorSourceGenerator/Components_MyInput_razor.g.cs:0:0:0:0 | BlazorTest/obj/Debug/net8.0/generated/Microsoft.CodeAnalysis.Razor.Compiler/Microsoft.NET.Sdk.Razor.SourceGenerators.RazorSourceGenerator/Components_MyInput_razor.g.cs |
+| BlazorTest/obj/Debug/net8.0/generated/Microsoft.CodeAnalysis.Razor.Compiler/Microsoft.NET.Sdk.Razor.SourceGenerators.RazorSourceGenerator/Components_MyOutput_razor.g.cs:0:0:0:0 | BlazorTest/obj/Debug/net8.0/generated/Microsoft.CodeAnalysis.Razor.Compiler/Microsoft.NET.Sdk.Razor.SourceGenerators.RazorSourceGenerator/Components_MyOutput_razor.g.cs |
+| BlazorTest/obj/Debug/net8.0/generated/Microsoft.CodeAnalysis.Razor.Compiler/Microsoft.NET.Sdk.Razor.SourceGenerators.RazorSourceGenerator/Components_Pages_Error_razor.g.cs:0:0:0:0 | BlazorTest/obj/Debug/net8.0/generated/Microsoft.CodeAnalysis.Razor.Compiler/Microsoft.NET.Sdk.Razor.SourceGenerators.RazorSourceGenerator/Components_Pages_Error_razor.g.cs |
+| BlazorTest/obj/Debug/net8.0/generated/Microsoft.CodeAnalysis.Razor.Compiler/Microsoft.NET.Sdk.Razor.SourceGenerators.RazorSourceGenerator/Components_Pages_TestPage_razor.g.cs:0:0:0:0 | BlazorTest/obj/Debug/net8.0/generated/Microsoft.CodeAnalysis.Razor.Compiler/Microsoft.NET.Sdk.Razor.SourceGenerators.RazorSourceGenerator/Components_Pages_TestPage_razor.g.cs |
+| BlazorTest/obj/Debug/net8.0/generated/Microsoft.CodeAnalysis.Razor.Compiler/Microsoft.NET.Sdk.Razor.SourceGenerators.RazorSourceGenerator/Components_Routes_razor.g.cs:0:0:0:0 | BlazorTest/obj/Debug/net8.0/generated/Microsoft.CodeAnalysis.Razor.Compiler/Microsoft.NET.Sdk.Razor.SourceGenerators.RazorSourceGenerator/Components_Routes_razor.g.cs |
+| BlazorTest/obj/Debug/net8.0/generated/Microsoft.CodeAnalysis.Razor.Compiler/Microsoft.NET.Sdk.Razor.SourceGenerators.RazorSourceGenerator/Components__Imports_razor.g.cs:0:0:0:0 | BlazorTest/obj/Debug/net8.0/generated/Microsoft.CodeAnalysis.Razor.Compiler/Microsoft.NET.Sdk.Razor.SourceGenerators.RazorSourceGenerator/Components__Imports_razor.g.cs |

csharp/ql/integration-tests/all-platforms/blazor_net_8/Files.ql

@@ -0,0 +1,5 @@
+import csharp
+
+from File f
+where f.fromSource() or f.getExtension() = "razor"
+select f

csharp/ql/integration-tests/all-platforms/blazor_net_8/htmlSinks.expected

@@ -0,0 +1,8 @@
+| BlazorTest/Components/MyOutput.razor:5:53:5:57 | access to property Value |
+| BlazorTest/Components/Pages/TestPage.razor:11:48:11:55 | access to property UrlParam |
+| BlazorTest/Components/Pages/TestPage.razor:20:60:20:69 | access to property QueryParam |
+| BlazorTest/Components/Pages/TestPage.razor:29:53:29:63 | access to property InputValue1 |
+| BlazorTest/Components/Pages/TestPage.razor:38:53:38:63 | access to property InputValue2 |
+| BlazorTest/Components/Pages/TestPage.razor:47:53:47:68 | access to property Value |
+| BlazorTest/Components/Pages/TestPage.razor:56:53:56:63 | access to property InputValue3 |
+| BlazorTest/Components/Pages/TestPage.razor:65:53:65:63 | access to property InputValue4 |

csharp/ql/integration-tests/all-platforms/blazor_net_8/htmlSinks.ql

@@ -0,0 +1,7 @@
+import semmle.code.csharp.security.dataflow.flowsinks.Html
+
+from HtmlSink sink, File f
+where
+  sink.getLocation().getFile() = f and
+  (f.fromSource() or f.getExtension() = "razor")
+select sink

csharp/ql/integration-tests/all-platforms/blazor_net_8/test.py

@@ -0,0 +1,2 @@
+def test(codeql, csharp):
+    codeql.database.create(source_root="BlazorTest")

csharp/ql/integration-tests/all-platforms/cshtml_standalone/Files.expected

@@ -1,4 +1,4 @@
 | Program.cs |
 | Views/Home/Index.cshtml |
 | test-db/working/implicitUsings/GlobalUsings.g.cs |
-| test-db/working/razor/EC52D77FE9BF67AD10C5C3F248392316/Microsoft.CodeAnalysis.Razor.Compiler/Microsoft.NET.Sdk.Razor.SourceGenerators.RazorSourceGenerator/[...]_ql_csharp_ql_integration_tests_all_platforms_cshtml_standalone_test_test_Views_Home_Index_cshtml.g.cs |
+| test-db/working/razor/EC52D77FE9BF67AD10C5C3F248392316/Microsoft.CodeAnalysis.Razor.Compiler/Microsoft.NET.Sdk.Razor.SourceGenerators.RazorSourceGenerator/Views_Home_Index_cshtml.g.cs |

csharp/ql/integration-tests/all-platforms/cshtml_standalone/Files.ql

@@ -1,21 +1,5 @@
 import csharp
 
-private string getPath(File f) {
-  result = f.getRelativePath() and
-  not exists(result.indexOf("_ql_csharp_ql_integration_tests_all_platforms_cshtml_standalone_"))
-  or
-  exists(int index1, int index2, string pattern |
-    pattern = "Microsoft.NET.Sdk.Razor.SourceGenerators.RazorSourceGenerator" and
-    index1 = f.getRelativePath().indexOf(pattern) and
-    index2 =
-      f.getRelativePath()
-          .indexOf("_ql_csharp_ql_integration_tests_all_platforms_cshtml_standalone_") and
-    result =
-      f.getRelativePath().substring(0, index1 + pattern.length()) + "/[...]" +
-        f.getRelativePath().substring(index2, f.getRelativePath().length())
-  )
-}
-
 from File f
 where f.fromSource() or f.getExtension() = "cshtml"
-select getPath(f)
+select f.getRelativePath()

csharp/ql/integration-tests/all-platforms/cshtml_standalone_net6/Files.expected

@@ -1,4 +1,4 @@
 | Program.cs |
 | Views/Home/Index.cshtml |
 | test-db/working/implicitUsings/GlobalUsings.g.cs |
-| test-db/working/razor/EC52D77FE9BF67AD10C5C3F248392316/[...]/Microsoft.NET.Sdk.Razor.SourceGenerators.RazorSourceGenerator/[...]_ql_csharp_ql_integration_tests_all_platforms_cshtml_standalone_net6_test_test_Views_Home_Index_cshtml.g.cs |
+| test-db/working/razor/EC52D77FE9BF67AD10C5C3F248392316/[...]/Microsoft.NET.Sdk.Razor.SourceGenerators.RazorSourceGenerator/Views_Home_Index_cshtml.g.cs |

csharp/ql/integration-tests/all-platforms/cshtml_standalone_net6/Files.ql

@@ -2,21 +2,17 @@ import csharp
 
 private string getPath(File f) {
   result = f.getRelativePath() and
-  not exists(result.indexOf("_ql_csharp_ql_integration_tests_all_platforms_cshtml_standalone_"))
+  not exists(result.indexOf("EC52D77FE9BF67AD10C5C3F248392316"))
   or
-  exists(int index0, int index1, int index2, string pattern0, string pattern1 |
+  exists(int index0, int index1, string pattern0, string pattern1 |
     // TODO: Remove index0 and pattern0. Currently there's some instability in the path depending on which dotnet SDK is being used. (See issue #448)
     pattern0 = "EC52D77FE9BF67AD10C5C3F248392316" and
     index0 = f.getRelativePath().indexOf(pattern0) and
     pattern1 = "Microsoft.NET.Sdk.Razor.SourceGenerators.RazorSourceGenerator" and
     index1 = f.getRelativePath().indexOf(pattern1) and
-    index2 =
-      f.getRelativePath()
-          .indexOf("_ql_csharp_ql_integration_tests_all_platforms_cshtml_standalone_") and
     result =
       f.getRelativePath().substring(0, index0 + pattern0.length()) + "/[...]/" +
-        f.getRelativePath().substring(index1, index1 + pattern1.length()) + "/[...]" +
+        f.getRelativePath().substring(index1, f.getRelativePath().length())
-        f.getRelativePath().substring(index2, f.getRelativePath().length())
   )
 }
 

csharp/ql/lib/change-notes/2025-01-06-razor-relative-path.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The Razor source generator invocation in `build-mode:none` extraction has been changed to use relative file paths instead of absolute ones.

docs/codeql/reusables/supported-versions-compilers.rst

@@ -33,7 +33,7 @@
     .. [2] Objective-C, Objective-C++, C++/CLI, and C++/CX are not supported.
     .. [3] Support for the clang-cl compiler is preliminary.
     .. [4] Support for the Arm Compiler (armcc) is preliminary.
-    .. [5] Builds that execute on Java 7 to 22 can be analyzed. The analysis understands Java 22 standard language features.
+    .. [5] Builds that execute on Java 7 to 22 can be analyzed. The analysis understands standard language features in Java 8 to 22; "preview" and "incubator" features are not supported. Source code using Java language versions older than Java 8 are analyzed as Java 8 code.
     .. [6] ECJ is supported when the build invokes it via the Maven Compiler plugin or the Takari Lifecycle plugin.
     .. [7] JSX and Flow code, YAML, JSON, HTML, and XML files may also be analyzed with JavaScript files.
     .. [8] The extractor requires Python 3 to run. To analyze Python 2.7 you should install both versions of Python.

go/extractor/go.mod

@@ -10,7 +10,7 @@ toolchain go1.23.1
 //    bazel mod tidy
 require (
 	golang.org/x/mod v0.22.0
-	golang.org/x/tools v0.28.0
+	golang.org/x/tools v0.29.0
 )
 
 require golang.org/x/sync v0.10.0 // indirect

go/extractor/go.sum

@@ -4,5 +4,5 @@ golang.org/x/mod v0.22.0 h1:D4nJWe9zXqHOmWqj4VMOJhvzj7bEZg4wEYa759z1pH4=
 golang.org/x/mod v0.22.0/go.mod h1:6SkKJ3Xj0I0BrPOZoBy3bdMptDDU9oJrpohJ3eWZ1fY=
 golang.org/x/sync v0.10.0 h1:3NQrjDixjgGwUOCaF8w2+VYHv0Ve/vGYSbdkTa98gmQ=
 golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/tools v0.28.0 h1:WuB6qZ4RPCQo5aP3WdKZS7i595EdWqWR8vqJTlwTVK8=
+golang.org/x/tools v0.29.0 h1:Xx0h3TtM9rzQpQuR4dKLrdglAmCEN5Oi+P74JdhdzXE=
-golang.org/x/tools v0.28.0/go.mod h1:dcIOrVd3mfQKTgrDVQHqCPMWy6lnhfhtX3hLXYVLfRw=
+golang.org/x/tools v0.29.0/go.mod h1:KMQVMRsVxU6nHCFXrBPhDB8XncLNLM0lIy/F14RP588=

go/ql/lib/change-notes/2025-01-03-database-sql-and-database-sql-driver-source-models.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* `database` local source models have been added for the `database/sql` and `database/sql/driver` packages.

go/ql/lib/change-notes/2025-01-05-gorm-database-sources.md

@@ -0,0 +1,5 @@
+---
+category: minorAnalysis
+---
+* Added `database` source models for database methods from the `gorm.io/gorm` package.
+`

go/ql/lib/ext/database.sql.driver.model.yml

@@ -1,4 +1,12 @@
 extensions:
+  - addsTo:
+      pack: codeql/go-all
+      extensible: sourceModel
+    data:
+      - ["database/sql/driver", "Queryer", True, "Query", "", "", "ReturnValue[0]", "database", "manual"]
+      - ["database/sql/driver", "QueryerContext", True, "QueryContext", "", "", "ReturnValue[0]", "database", "manual"]
+      - ["database/sql/driver", "Stmt", True, "Query", "", "", "ReturnValue[0]", "database", "manual"]
+      - ["database/sql/driver", "StmtQueryContext", True, "QueryContext", "", "", "ReturnValue[0]", "database", "manual"]
   - addsTo:
       pack: codeql/go-all
       extensible: sinkModel
@@ -15,5 +23,6 @@ extensions:
     data:
       - ["database/sql/driver", "Conn", True, "Prepare", "", "", "Argument[0]", "ReturnValue[0]", "taint", "manual"]
       - ["database/sql/driver", "ConnPrepareContext", True, "PrepareContext", "", "", "Argument[1]", "ReturnValue[0]", "taint", "manual"]
+      - ["database/sql/driver", "Rows", True, "Next", "", "", "Argument[receiver]", "Argument[0]", "taint", "manual"]
       - ["database/sql/driver", "ValueConverter", True, "ConvertValue", "", "", "Argument[0]", "ReturnValue[0]", "taint", "manual"]
       - ["database/sql/driver", "Valuer", True, "Value", "", "", "Argument[receiver]", "ReturnValue[0]", "taint", "manual"]

go/ql/lib/ext/database.sql.model.yml

@@ -1,4 +1,22 @@
 extensions:
+  - addsTo:
+      pack: codeql/go-all
+      extensible: sourceModel
+    data:
+      - ["database/sql", "Conn", True, "QueryContext", "", "", "ReturnValue[0]", "database", "manual"]
+      - ["database/sql", "Conn", True, "QueryRowContext", "", "", "ReturnValue", "database", "manual"]
+      - ["database/sql", "DB", True, "Query", "", "", "ReturnValue[0]", "database", "manual"]
+      - ["database/sql", "DB", True, "QueryContext", "", "", "ReturnValue[0]", "database", "manual"]
+      - ["database/sql", "DB", True, "QueryRow", "", "", "ReturnValue", "database", "manual"]
+      - ["database/sql", "DB", True, "QueryRowContext", "", "", "ReturnValue", "database", "manual"]
+      - ["database/sql", "Stmt", True, "Query", "", "", "ReturnValue[0]", "database", "manual"]
+      - ["database/sql", "Stmt", True, "QueryContext", "", "", "ReturnValue[0]", "database", "manual"]
+      - ["database/sql", "Stmt", True, "QueryRow", "", "", "ReturnValue", "database", "manual"]
+      - ["database/sql", "Stmt", True, "QueryRowContext", "", "", "ReturnValue", "database", "manual"]
+      - ["database/sql", "Tx", True, "Query", "", "", "ReturnValue[0]", "database", "manual"]
+      - ["database/sql", "Tx", True, "QueryContext", "", "", "ReturnValue[0]", "database", "manual"]
+      - ["database/sql", "Tx", True, "QueryRow", "", "", "ReturnValue", "database", "manual"]
+      - ["database/sql", "Tx", True, "QueryRowContext", "", "", "ReturnValue", "database", "manual"]
   - addsTo:
       pack: codeql/go-all
       extensible: sinkModel

go/ql/lib/ext/gorm.io.gorm.model.yml

@@ -6,6 +6,25 @@ extensions:
       - ["gorm", "gorm.io/gorm"]
       - ["gorm", "github.com/jinzhu/gorm"]
       - ["gorm", "github.com/go-gorm/gorm"]
+  - addsTo:
+      pack: codeql/go-all
+      extensible: sourceModel
+    data:
+      - ["group:gorm", "Association", True, "Find", "", "", "Argument[0]", "database", "manual"]
+      - ["group:gorm", "ConnPool", True, "QueryContext", "", "", "ReturnValue[0]", "database", "manual"]
+      - ["group:gorm", "ConnPool", True, "QueryRowContext", "", "", "ReturnValue", "database", "manual"]
+      - ["group:gorm", "DB", True, "Find", "", "", "Argument[0]", "database", "manual"]
+      - ["group:gorm", "DB", True, "FindInBatches", "", "", "Argument[0]", "database", "manual"]
+      - ["group:gorm", "DB", True, "First", "", "", "Argument[0]", "database", "manual"]
+      - ["group:gorm", "DB", True, "FirstOrCreate", "", "", "Argument[0]", "database", "manual"]
+      - ["group:gorm", "DB", True, "FirstOrInit", "", "", "Argument[0]", "database", "manual"]
+      - ["group:gorm", "DB", True, "Last", "", "", "Argument[0]", "database", "manual"]
+      - ["group:gorm", "DB", True, "Model", "", "", "Argument[0]", "database", "manual"]
+      - ["group:gorm", "DB", True, "Pluck", "", "", "Argument[1]", "database", "manual"]
+      - ["group:gorm", "DB", True, "Row", "", "", "ReturnValue", "database", "manual"]
+      - ["group:gorm", "DB", True, "Rows", "", "", "ReturnValue[0]", "database", "manual"]
+      - ["group:gorm", "DB", True, "Scan", "", "", "Argument[0]", "database", "manual"]
+      - ["group:gorm", "DB", True, "Take", "", "", "Argument[0]", "database", "manual"]
   - addsTo:
       pack: codeql/go-all
       extensible: sinkModel
@@ -23,3 +42,8 @@ extensions:
       - ["group:gorm", "DB", True, "Exec", "", "", "Argument[0]", "sql-injection", "manual"]
       - ["group:gorm", "DB", True, "Distinct", "", "", "Argument[0]", "sql-injection", "manual"]
       - ["group:gorm", "DB", True, "Pluck", "", "", "Argument[0]", "sql-injection", "manual"]
+  - addsTo:
+      pack: codeql/go-all
+      extensible: summaryModel
+    data:
+      - ["group:gorm", "DB", True, "ScanRows", "", "", "Argument[0]", "Argument[1]", "taint", "manual"]

go/ql/test/library-tests/semmle/go/dataflow/flowsources/local/database/go.mod

@@ -0,0 +1,7 @@
+module test
+
+go 1.22.5
+
+require (
+	gorm.io/gorm v1.23.0
+)

go/ql/test/library-tests/semmle/go/dataflow/flowsources/local/database/sink.go

@@ -0,0 +1,5 @@
+package test
+
+func sink(x ...any) {}
+
+func ignore(...any) {}

go/ql/test/library-tests/semmle/go/dataflow/flowsources/local/database/source.expected

@@ -0,0 +1,2 @@
+testFailures
+invalidModelRow

go/ql/test/library-tests/semmle/go/dataflow/flowsources/local/database/source.ext.yml

@@ -0,0 +1,6 @@
+extensions:
+  - addsTo:
+      pack: codeql/threat-models
+      extensible: threatModelConfiguration
+    data:
+      - ["database", true, 0]

go/ql/test/library-tests/semmle/go/dataflow/flowsources/local/database/source.ql

@@ -0,0 +1,19 @@
+import go
+import ModelValidation
+import utils.test.InlineExpectationsTest
+
+module SourceTest implements TestSig {
+  string getARelevantTag() { result = "source" }
+
+  predicate hasActualResult(Location location, string element, string tag, string value) {
+    exists(ActiveThreatModelSource s |
+      s.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
+        location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and
+      element = s.toString() and
+      value = "" and
+      tag = "source"
+    )
+  }
+}
+
+import MakeTest<SourceTest>

go/ql/test/library-tests/semmle/go/dataflow/flowsources/local/database/test.expected

@@ -0,0 +1,2 @@
+testFailures
+invalidModelRow

go/ql/test/library-tests/semmle/go/dataflow/flowsources/local/database/test.ext.yml

@@ -0,0 +1,7 @@
+extensions:
+
+  - addsTo:
+      pack: codeql/threat-models
+      extensible: threatModelConfiguration
+    data:
+      - ["database", true, 0]

go/ql/test/library-tests/semmle/go/dataflow/flowsources/local/database/test.ql

@@ -0,0 +1,15 @@
+import go
+import semmle.go.dataflow.ExternalFlow
+import ModelValidation
+import experimental.frameworks.CleverGo
+import utils.test.InlineFlowTest
+
+module Config implements DataFlow::ConfigSig {
+  predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }
+
+  predicate isSink(DataFlow::Node sink) {
+    sink.asExpr() = any(CallExpr c | c.getTarget().getName() = "sink").getAnArgument()
+  }
+}
+
+import TaintFlowTest<Config>

go/ql/test/library-tests/semmle/go/dataflow/flowsources/local/database/test_database_sql.go

@@ -0,0 +1,157 @@
+package test
+
+import (
+	"database/sql"
+)
+
+// test querying a Conn
+func testConnQuery(conn *sql.Conn) {
+	rows, err := conn.QueryContext(nil, "SELECT * FROM users") // $ source
+
+	if err != nil {
+		return
+	}
+
+	defer rows.Close()
+
+	for rows.Next() {
+		var id int
+		var name string
+		err = rows.Scan(&id, &name)
+		if err != nil {
+			return
+		}
+
+		sink(id, name) // $ hasTaintFlow="id" hasTaintFlow="name"
+	}
+
+	row := conn.QueryRowContext(nil, "SELECT * FROM users WHERE id = 1") // $ source
+
+	var id int
+	var name string
+
+	err = row.Scan(&id, &name)
+
+	sink(id, name) // $ hasTaintFlow="id" hasTaintFlow="name"
+}
+
+// test querying a DB
+func testDBQuery(db *sql.DB) {
+	example, err := db.Query("SELECT * FROM users") // $ source
+	ignore(example)
+
+	rows, err := db.QueryContext(nil, "SELECT * FROM users") // $ source
+
+	if err != nil {
+		return
+	}
+
+	defer rows.Close()
+
+	for rows.Next() {
+		var id int
+		var name string
+		err = rows.Scan(&id, &name)
+
+		if err != nil {
+			return
+		}
+
+		sink(id, name) // $ hasTaintFlow="id" hasTaintFlow="name"
+	}
+
+	row := db.QueryRowContext(nil, "SELECT * FROM users WHERE id = 1") // $ source
+
+	var id int
+	var name string
+
+	err = row.Scan(&id, &name)
+
+	sink(id, name) // $ hasTaintFlow="id" hasTaintFlow="name"
+
+	dog := db.QueryRow("SELECT * FROM dogs WHERE id = 1") // $ source
+	ignore(dog)
+}
+
+// test querying a Stmt
+func testStmtQuery(stmt *sql.Stmt) {
+	example, err := stmt.Query("SELECT * FROM users") // $ source
+	ignore(example)
+
+	rows, err := stmt.QueryContext(nil, "SELECT * FROM users") // $ source
+
+	if err != nil {
+		return
+	}
+
+	defer rows.Close()
+
+	for rows.Next() {
+		var id int
+		var name string
+		err = rows.Scan(&id, &name)
+
+		if err != nil {
+			return
+		}
+
+		sink(id, name) // $ hasTaintFlow="id" hasTaintFlow="name"
+	}
+
+	row := stmt.QueryRowContext(nil, "SELECT * FROM users WHERE id = 1") // $ source
+
+	var id int
+	var name string
+
+	err = row.Scan(&id, &name)
+
+	if err != nil {
+		return
+	}
+
+	sink(id, name) // $ hasTaintFlow="id" hasTaintFlow="name"
+
+	dog := stmt.QueryRow("SELECT * FROM dogs WHERE id = 1") // $ source
+	ignore(dog)
+}
+
+// test querying a Tx
+func testTxQuery(tx *sql.Tx) {
+	example, err := tx.Query("SELECT * FROM users") // $ source
+	ignore(example)
+
+	rows, err := tx.QueryContext(nil, "SELECT * FROM users") // $ source
+	if err != nil {
+		return
+	}
+
+	defer rows.Close()
+
+	for rows.Next() {
+		var id int
+		var name string
+		err = rows.Scan(&id, &name)
+
+		if err != nil {
+			return
+		}
+
+		sink(id, name) // $ hasTaintFlow="id" hasTaintFlow="name"
+	}
+
+	row := tx.QueryRowContext(nil, "SELECT * FROM users WHERE id = 1") // $ source
+
+	var id int
+	var name string
+
+	err = row.Scan(&id, &name)
+
+	if err != nil {
+		return
+	}
+
+	sink(id, name) // $ hasTaintFlow="id" hasTaintFlow="name"
+
+	dog := tx.QueryRow("SELECT * FROM dogs WHERE id = 1") // $ source
+	ignore(dog)
+}

go/ql/test/library-tests/semmle/go/dataflow/flowsources/local/database/test_database_sql_driver.go

@@ -0,0 +1,23 @@
+package test
+
+import "database/sql/driver"
+
+func testQueryer(q driver.Queryer) {
+	rows, err := q.Query("SELECT * FROM users", make([]driver.Value, 0)) // $ source
+	ignore(rows, err)
+}
+
+func testQueryerContext(q driver.QueryerContext) {
+	rows, err := q.QueryContext(nil, "SELECT * FROM users", make([]driver.NamedValue, 0)) // $ source
+	ignore(rows, err)
+}
+
+func testStmt(stmt driver.Stmt) {
+	rows, err := stmt.Query(make([]driver.Value, 0)) // $ source
+	ignore(rows, err)
+}
+
+func testStmtContext(stmt driver.StmtQueryContext) {
+	rows, err := stmt.QueryContext(nil, make([]driver.NamedValue, 0)) // $ source
+	ignore(rows, err)
+}

go/ql/test/library-tests/semmle/go/dataflow/flowsources/local/database/test_gorm.go

@@ -0,0 +1,59 @@
+package test
+
+import "gorm.io/gorm"
+
+// test querying an Association
+func test_gorm_AssociationQuery(association *gorm.Association) {
+	association.Find(&User{}) // $ source
+}
+
+// test querying a ConnPool
+func test_gorm_ConnPoolQuery(connPool gorm.ConnPool) {
+	rows, err := connPool.QueryContext(nil, "SELECT * FROM users") // $ source
+
+	if err != nil {
+		return
+	}
+
+	defer rows.Close()
+
+	userRow := connPool.QueryRowContext(nil, "SELECT * FROM users WHERE id = 1") // $ source
+
+	ignore(userRow)
+}
+
+// test querying a DB
+func test_gorm_db(db *gorm.DB) {
+	db.Find(&User{}) // $ source
+
+	db.FindInBatches(&User{}, 10, nil) // $ source
+
+	db.FirstOrCreate(&User{}) // $ source
+
+	db.FirstOrInit(&User{}) // $ source
+
+	db.First(&User{}) // $ source
+
+	db.Last(&User{}) // $ source
+
+	db.Take(&User{}) // $ source
+
+	db.Scan(&User{}) // $ source
+
+	var user User
+	db.Model(&user) // $ source
+
+	row := db.Row() // $ source
+	ignore(row)
+
+	rows, err := db.Rows() // $ source
+	ignore(err)
+
+	var user2 User
+	db.ScanRows(rows, &user2)
+
+	sink(user2) // $ hasTaintFlow="user2"
+
+	var names []string
+	db.Pluck("name", &names) // $ source
+}

go/ql/test/library-tests/semmle/go/dataflow/flowsources/local/database/user.go

@@ -0,0 +1,3 @@
+package test
+
+type User struct{}

go/ql/test/library-tests/semmle/go/dataflow/flowsources/local/database/vendor/gorm.io/gorm/stub.go

@@ -0,0 +1,77 @@
+package gorm
+
+import (
+	"context"
+	"database/sql"
+)
+
+type DB struct{}
+
+func (db *DB) Find(dest interface{}, conds ...interface{}) *DB {
+	return db
+}
+
+func (db *DB) FindInBatches(dest interface{}, batchSize int, fc func(tx *DB, batch int) error) *DB {
+	return db
+}
+
+func (db *DB) FirstOrCreate(dest interface{}, conds ...interface{}) *DB {
+	return db
+}
+
+func (db *DB) FirstOrInit(dest interface{}, conds ...interface{}) *DB {
+	return db
+}
+
+func (db *DB) First(dest interface{}, conds ...interface{}) *DB {
+	return db
+}
+
+func (db *DB) Model(value interface{}) *DB {
+	return db
+}
+
+func (db *DB) Last(dest interface{}, conds ...interface{}) *DB {
+	return db
+}
+
+func (db *DB) Pluck(column string, dest interface{}) *DB {
+	return db
+}
+
+func (db *DB) Take(dest interface{}, conds ...interface{}) *DB {
+	return db
+}
+
+func (db *DB) Scan(dest interface{}) *DB {
+	return db
+}
+
+func (db *DB) ScanRows(rows *sql.Rows, result interface{}) error {
+	return nil
+}
+
+func (db *DB) Row() *sql.Row {
+	return nil
+}
+
+func (db *DB) Rows() (*sql.Rows, error) {
+	return nil, nil
+}
+
+type Association struct {
+	DB *DB
+}
+
+func (a *Association) Find(dest interface{}) *Association {
+	return a
+}
+
+type ConnPool interface {
+	PrepareContext(ctx context.Context, query string) (*sql.Stmt, error)
+	ExecContext(ctx context.Context, query string, args ...interface{}) (sql.Result, error)
+	QueryContext(ctx context.Context, query string, args ...interface{}) (*sql.Rows, error)
+	QueryRowContext(ctx context.Context, query string, args ...interface{}) *sql.Row
+}
+
+type Model interface{}

go/ql/test/library-tests/semmle/go/dataflow/flowsources/local/database/vendor/modules.txt

@@ -0,0 +1,3 @@
+# gorm.io/gorm v1.23.0
+## explicit
+gorm.io/gorm

go/ql/test/query-tests/Security/CWE-078/StoredCommand.expected

@@ -1,11 +1,12 @@
 #select
 | StoredCommand.go:14:22:14:28 | cmdName | StoredCommand.go:11:2:11:27 | ... := ...[0] | StoredCommand.go:14:22:14:28 | cmdName | This command depends on a $@. | StoredCommand.go:11:2:11:27 | ... := ...[0] | stored value |
 edges
-| StoredCommand.go:11:2:11:27 | ... := ...[0] | StoredCommand.go:13:2:13:5 | rows | provenance |  |
+| StoredCommand.go:11:2:11:27 | ... := ...[0] | StoredCommand.go:13:2:13:5 | rows | provenance | Src:MaD:2  |
 | StoredCommand.go:13:2:13:5 | rows | StoredCommand.go:13:12:13:19 | &... | provenance | FunctionModel |
 | StoredCommand.go:13:12:13:19 | &... | StoredCommand.go:14:22:14:28 | cmdName | provenance | Sink:MaD:1 |
 models
 | 1 | Sink: os/exec; ; false; Command; ; ; Argument[0]; command-injection; manual |
+| 2 | Source: database/sql; DB; true; Query; ; ; ReturnValue[0]; database; manual |
 nodes
 | StoredCommand.go:11:2:11:27 | ... := ...[0] | semmle.label | ... := ...[0] |
 | StoredCommand.go:13:2:13:5 | rows | semmle.label | rows |

go/ql/test/query-tests/Security/CWE-079/StoredXss.expected

@@ -1,9 +1,15 @@
+#select
+| StoredXss.go:13:21:13:36 | ...+... | StoredXss.go:13:21:13:31 | call to Name | StoredXss.go:13:21:13:36 | ...+... | Stored cross-site scripting vulnerability due to $@. | StoredXss.go:13:21:13:31 | call to Name | stored value |
+| stored.go:30:22:30:25 | name | stored.go:18:3:18:28 | ... := ...[0] | stored.go:30:22:30:25 | name | Stored cross-site scripting vulnerability due to $@. | stored.go:18:3:18:28 | ... := ...[0] | stored value |
+| stored.go:61:22:61:25 | path | stored.go:59:30:59:33 | definition of path | stored.go:61:22:61:25 | path | Stored cross-site scripting vulnerability due to $@. | stored.go:59:30:59:33 | definition of path | stored value |
 edges
 | StoredXss.go:13:21:13:31 | call to Name | StoredXss.go:13:21:13:36 | ...+... | provenance |  |
-| stored.go:18:3:18:28 | ... := ...[0] | stored.go:25:14:25:17 | rows | provenance |  |
+| stored.go:18:3:18:28 | ... := ...[0] | stored.go:25:14:25:17 | rows | provenance | Src:MaD:1  |
 | stored.go:25:14:25:17 | rows | stored.go:25:29:25:33 | &... | provenance | FunctionModel |
 | stored.go:25:29:25:33 | &... | stored.go:30:22:30:25 | name | provenance |  |
 | stored.go:59:30:59:33 | definition of path | stored.go:61:22:61:25 | path | provenance |  |
+models
+| 1 | Source: database/sql; DB; true; Query; ; ; ReturnValue[0]; database; manual |
 nodes
 | StoredXss.go:13:21:13:31 | call to Name | semmle.label | call to Name |
 | StoredXss.go:13:21:13:36 | ...+... | semmle.label | ...+... |
@@ -14,7 +20,3 @@ nodes
 | stored.go:59:30:59:33 | definition of path | semmle.label | definition of path |
 | stored.go:61:22:61:25 | path | semmle.label | path |
 subpaths
-#select
-| StoredXss.go:13:21:13:36 | ...+... | StoredXss.go:13:21:13:31 | call to Name | StoredXss.go:13:21:13:36 | ...+... | Stored cross-site scripting vulnerability due to $@. | StoredXss.go:13:21:13:31 | call to Name | stored value |
-| stored.go:30:22:30:25 | name | stored.go:18:3:18:28 | ... := ...[0] | stored.go:30:22:30:25 | name | Stored cross-site scripting vulnerability due to $@. | stored.go:18:3:18:28 | ... := ...[0] | stored value |
-| stored.go:61:22:61:25 | path | stored.go:59:30:59:33 | definition of path | stored.go:61:22:61:25 | path | Stored cross-site scripting vulnerability due to $@. | stored.go:59:30:59:33 | definition of path | stored value |

go/ql/test/query-tests/Security/CWE-079/StoredXss.qlref

@@ -1 +1,2 @@
-Security/CWE-079/StoredXss.ql
+query: Security/CWE-079/StoredXss.ql
+postprocess: utils/test/PrettyPrintModels.ql