Merge pull request #83 from microsoft/powershell-more-ast-classes

PS: Copy existing AST classes from internal repo

powershell/ql/lib/powershell.qll

@@ -0,0 +1,70 @@
+import semmle.code.powershell.File
+import semmle.code.powershell.Location
+import semmle.code.powershell.SourceLocation
+import semmle.code.powershell.Ast
+import semmle.code.powershell.Statement
+import semmle.code.powershell.Expression
+import semmle.code.powershell.CommandBase
+import semmle.code.powershell.AttributeBase
+import semmle.code.powershell.PipelineBase
+import semmle.code.powershell.BaseConstantExpression
+import semmle.code.powershell.ConstantExpression
+import semmle.code.powershell.MemberExpressionBase
+import semmle.code.powershell.Attribute
+import semmle.code.powershell.NamedAttributeArgument
+import semmle.code.powershell.TypeConstraint
+import semmle.code.powershell.VariableExpression
+import semmle.code.powershell.Parameter
+import semmle.code.powershell.ModuleSpecification
+import semmle.code.powershell.ParamBlock
+import semmle.code.powershell.NamedBlock
+import semmle.code.powershell.ScriptBlock
+import semmle.code.powershell.StringLiteral
+import semmle.code.powershell.AssignmentStatement
+import semmle.code.powershell.BinaryExpression
+import semmle.code.powershell.ScriptBlockExpr
+import semmle.code.powershell.TernaryExpression
+import semmle.code.powershell.UsingExpression
+import semmle.code.powershell.TrapStatement
+import semmle.code.powershell.StatementBlock
+import semmle.code.powershell.ArrayExpression
+import semmle.code.powershell.ArrayLiteral
+import semmle.code.powershell.CommandElement
+import semmle.code.powershell.Redirection
+import semmle.code.powershell.FileRedirection
+import semmle.code.powershell.MergingRedirection
+import semmle.code.powershell.LoopStmt
+import semmle.code.powershell.DoWhileStmt
+import semmle.code.powershell.DoUntilStmt
+import semmle.code.powershell.WhileStmt
+import semmle.code.powershell.ForStmt
+import semmle.code.powershell.ForEachStmt
+import semmle.code.powershell.GotoStmt
+import semmle.code.powershell.ContinueStmt
+import semmle.code.powershell.BreakStmt
+import semmle.code.powershell.ReturnStmt
+import semmle.code.powershell.UsingStmt
+import semmle.code.powershell.Type
+import semmle.code.powershell.Member
+import semmle.code.powershell.PropertyMember
+import semmle.code.powershell.FunctionMember
+import semmle.code.powershell.TryStmt
+import semmle.code.powershell.IfStmt
+import semmle.code.powershell.ExitStmt
+import semmle.code.powershell.LabeledStmt
+import semmle.code.powershell.DynamicStmt
+import semmle.code.powershell.DataStmt
+import semmle.code.powershell.Configuration
+import semmle.code.powershell.CatchClause
+import semmle.code.powershell.Command
+import semmle.code.powershell.CommandExpression
+import semmle.code.powershell.CommandParameter
+import semmle.code.powershell.ExpandableStringExpression
+import semmle.code.powershell.TypeExpression
+import semmle.code.powershell.ParenExpression
+import semmle.code.powershell.Chainable
+import semmle.code.powershell.Pipeline
+import semmle.code.powershell.StringConstantExpression
+import semmle.code.powershell.FunctionDefinition
+import semmle.code.powershell.InvokeMemberExpression
+import semmle.code.powershell.CommentEntity

powershell/ql/lib/qlpack.yml

@@ -0,0 +1,9 @@
+name: microsoft-sdl/powershell-all
+version: 0.0.1
+groups: 
+  - powershell
+  - microsoft-all
+dbscheme: semmlecode.powershell.dbscheme
+extractor: powershell
+library: true
+warnOnImplicitThis: true

powershell/ql/lib/semmle/code/powershell/ArrayExpression.qll

@@ -0,0 +1,9 @@
+import powershell
+
+class ArrayExpr extends @array_expression, Expr {
+  override SourceLocation getLocation() { array_expression_location(this, result) }
+
+  StmtBlock getStatementBlock() { array_expression(this, result) }
+
+  override string toString() { result = "ArrayExpression at: " + this.getLocation().toString() }
+}

powershell/ql/lib/semmle/code/powershell/ArrayLiteral.qll

@@ -0,0 +1,11 @@
+import powershell
+
+class ArrayLiteral extends @array_literal, Expr {
+  override SourceLocation getLocation() { array_literal_location(this, result) }
+
+  Expr getElement(int index) { array_literal_element(this, index, result) }
+
+  Expr getAnElement() { array_literal_element(this, _, result) }
+
+  override string toString() { result = "ArrayLiteral at: " + this.getLocation().toString() }
+}

powershell/ql/lib/semmle/code/powershell/AssignmentStatement.qll

@@ -0,0 +1,13 @@
+import powershell
+
+class AssignStmt extends @assignment_statement, Stmt {
+  override SourceLocation getLocation() { assignment_statement_location(this, result) }
+
+  int getKind() { assignment_statement(this, result, _, _) }
+
+  Expr getLeftHandSide() { assignment_statement(this, _, result, _) }
+
+  Stmt getRightHandSide() { assignment_statement(this, _, _, result) }
+
+  override string toString() { result = "AssignmentStatement at: " + this.getLocation().toString() }
+}

powershell/ql/lib/semmle/code/powershell/Ast.qll

@@ -0,0 +1,9 @@
+import powershell
+
+class Ast extends @ast {
+  string toString() { none() }
+
+  Ast getParent() { parent(result, this) }
+
+  Location getLocation() { none() }
+}

powershell/ql/lib/semmle/code/powershell/Attribute.qll

@@ -0,0 +1,21 @@
+import powershell
+
+class Attribute extends @attribute, AttributeBase {
+  override string toString() { result = this.getName() }
+
+  override SourceLocation getLocation() { attribute_location(this, result) }
+
+  string getName() { attribute(this, result, _, _) }
+
+  int getNumNamedArguments() { attribute(this, _, result, _) }
+
+  int getNumPositionalArguments() { attribute(this, _, _, result) }
+
+  NamedAttributeArgument getNamedArgument(int i) { attribute_named_argument(this, i, result) }
+
+  NamedAttributeArgument getANamedArgument() { result = this.getNamedArgument(_) }
+
+  Expr getPositionalArgument(int i) { attribute_positional_argument(this, i, result) }
+
+  Expr getAPositionalArgument() { result = this.getPositionalArgument(_) }
+}

powershell/ql/lib/semmle/code/powershell/AttributeBase.qll

@@ -0,0 +1,3 @@
+import powershell
+
+class AttributeBase extends @attribute_base, Ast { }

powershell/ql/lib/semmle/code/powershell/BaseConstantExpression.qll

@@ -0,0 +1,3 @@
+import powershell
+
+class BaseConstExpr extends @base_constant_expression, Expr { }

powershell/ql/lib/semmle/code/powershell/BinaryExpression.qll

@@ -0,0 +1,15 @@
+import powershell
+
+class BinaryExpr extends @binary_expression, Expr {
+  override string toString() {
+    result = "...+..." // TODO
+  }
+
+  override SourceLocation getLocation() { binary_expression_location(this, result) }
+
+  private int getKind() { binary_expression(this, result, _, _) }
+
+  Expr getLeft() { binary_expression(this, _, result, _) }
+
+  Expr getRight() { binary_expression(this, _, _, result) }
+}

powershell/ql/lib/semmle/code/powershell/BreakStmt.qll

@@ -0,0 +1,7 @@
+import powershell
+
+class BreakStmt extends GotoStmt, Stmt {
+  override SourceLocation getLocation() { break_statement_location(this, result) }
+
+  override string toString() { result = "continue" }
+}

powershell/ql/lib/semmle/code/powershell/CatchClause.qll

@@ -0,0 +1,17 @@
+import powershell
+
+class CatchClause extends @catch_clause, Ast {
+  override SourceLocation getLocation() { catch_clause_location(this, result) }
+
+  override string toString() { result = "catch {...}" }
+
+  StmtBlock getBody() { catch_clause(this, result, _) } // TODO: Change @ast to @stmt_block in dbscheme
+
+  TypeConstraint getCatchType(int i) { catch_clause_catch_type(this, i, result) } // TODO: Change @ast to @type_constraint in dbscheme
+
+  TypeConstraint getACatchType() { result = this.getCatchType(_) }
+
+  predicate isCatchAll() { catch_clause(this, _, true) } // TODO: Should be equivalent to not exists(this.getACatchType())
+
+  TryStmt getTryStmt() { result.getACatchClause() = this }
+}

powershell/ql/lib/semmle/code/powershell/Chainable.qll

@@ -0,0 +1,3 @@
+import powershell
+
+class Chainable extends @chainable, PipelineBase { }

powershell/ql/lib/semmle/code/powershell/Command.qll

@@ -0,0 +1,23 @@
+import powershell
+
+class Cmd extends @command, CmdBase {
+  override string toString() { result = this.getName() }
+
+  override SourceLocation getLocation() { command_location(this, result) }
+
+  string getName() { command(this, result, _, _, _) }
+
+  int getKind() { command(this, _, result, _, _) }
+
+  int getNumElements() { command(this, _, _, result, _) }
+
+  int getNumRedirection() { command(this, _, _, _, result) }
+
+  CmdElement getElement(int i) { command_command_element(this, i, result) }
+
+  Redirection getRedirection(int i) { command_redirection(this, i, result) }
+
+  CmdElement getAnElement() { result = this.getElement(_) }
+
+  Redirection getARedirection() { result = this.getRedirection(_) }
+}

powershell/ql/lib/semmle/code/powershell/CommandBase.qll

@@ -0,0 +1,3 @@
+import powershell
+
+class CmdBase extends @command_base, Stmt { }

powershell/ql/lib/semmle/code/powershell/CommandElement.qll

@@ -0,0 +1,3 @@
+import powershell
+
+class CmdElement extends @command_element, Ast { }

powershell/ql/lib/semmle/code/powershell/CommandExpression.qll

@@ -0,0 +1,15 @@
+import powershell
+
+class CmdExpr extends @command_expression, CmdBase {
+  override SourceLocation getLocation() { command_expression_location(this, result) }
+
+  Expr getExpression() { command_expression(this, result, _) }
+
+  int getNumRedirections() { command_expression(this, _, result) }
+
+  Redirection getRedirection(int i) { command_expression_redirection(this, i, result) }
+
+  Redirection getARedirection() { result = this.getRedirection(_) }
+
+  override string toString() { result = "CommandExpression at: " + this.getLocation().toString() }
+}

powershell/ql/lib/semmle/code/powershell/CommandParameter.qll

@@ -0,0 +1,11 @@
+import powershell
+
+class CmdParameter extends @command_parameter, CmdElement {
+  override SourceLocation getLocation() { command_parameter_location(this, result) }
+
+  string getName() { command_parameter(this, result) }
+
+  Expr getArgument() { command_parameter_argument(this, result) }
+
+  override string toString() { command_parameter(this, result) }
+}

powershell/ql/lib/semmle/code/powershell/CommentEntity.qll

@@ -0,0 +1,9 @@
+import powershell
+
+class Comment extends @comment_entity {
+  SourceLocation getLocation() { comment_entity_location(this, result) }
+
+  StringLiteral getCommentContents() { comment_entity(this, result) }
+
+  string toString() { result = "Comment at: " + this.getLocation().toString() }
+}

powershell/ql/lib/semmle/code/powershell/Configuration.qll

@@ -0,0 +1,15 @@
+import powershell
+
+class Configuration extends @configuration_definition, Stmt {
+  override SourceLocation getLocation() { configuration_definition_location(this, result) }
+
+  override string toString() { result = "Configuration" }
+
+  Expr getName() { configuration_definition(this, _, _, result) } // TODO: Change @ast to @expression in dbscheme
+
+  ScriptBlockExpr getBody() { configuration_definition(this, result, _, _) } // TODO: Change @ast to @script_block in dbscheme
+
+  predicate isMeta() { configuration_definition(this, _, 1, _) }
+
+  predicate isResource() { configuration_definition(this, _, 0, _) }
+}

powershell/ql/lib/semmle/code/powershell/ConstantExpression.qll

@@ -0,0 +1,11 @@
+import powershell
+
+class ConstExpr extends @constant_expression, BaseConstExpr {
+  override SourceLocation getLocation() { constant_expression_location(this, result) }
+
+  string getType() { constant_expression(this, result) }
+
+  StringLiteral getValue() { constant_expression_value(this, result) }
+
+  override string toString() { result = "ConstantExpression at: " + this.getLocation().toString() }
+}

powershell/ql/lib/semmle/code/powershell/ContinueStmt.qll

@@ -0,0 +1,7 @@
+import powershell
+
+class ContinueStmt extends GotoStmt, Stmt {
+  override SourceLocation getLocation() { continue_statement_location(this, result) }
+
+  override string toString() { result = "continue" }
+}

powershell/ql/lib/semmle/code/powershell/DataStmt.qll

@@ -0,0 +1,15 @@
+import powershell
+
+class DataStmt extends @data_statement, Stmt {
+  override SourceLocation getLocation() { data_statement_location(this, result) }
+
+  override string toString() { result = "data {...}" }
+
+  string getVariableName() { data_statement_variable(this, result) }
+
+  Expr getCmdAllowed(int i) { data_statement_commands_allowed(this, i, result) }
+
+  Expr getACmdAllowed() { result = this.getCmdAllowed(_) }
+
+  StmtBlock getBody() { data_statement(this, result) } // TODO: Change @ast to @stmt_block in dbscheme
+}

powershell/ql/lib/semmle/code/powershell/DoUntilStmt.qll

@@ -0,0 +1,11 @@
+import powershell
+
+class DoUntilStmt extends @do_until_statement, LoopStmt {
+  override SourceLocation getLocation() { do_until_statement_location(this, result) }
+
+  override string toString() { result = "DoUntil" }
+
+  PipelineBase getCondition() { do_until_statement_condition(this, result) } // TODO: Change @ast to @pipeline_base in dbscheme
+
+  StmtBlock getBody() { do_until_statement(this, result) } // TODO: Change @ast to @stmt_block in dbscheme
+}

powershell/ql/lib/semmle/code/powershell/DoWhileStmt.qll

@@ -0,0 +1,11 @@
+import powershell
+
+class DoWhileStmt extends @do_while_statement, LoopStmt {
+  override SourceLocation getLocation() { do_while_statement_location(this, result) }
+
+  override string toString() { result = "DoWhile" }
+
+  PipelineBase getCondition() { do_while_statement_condition(this, result) } // TODO: Change @ast to @pipeline_base in dbscheme
+
+  StmtBlock getBody() { do_while_statement(this, result) } // TODO: Change @ast to @stmt_block in dbscheme
+}

powershell/ql/lib/semmle/code/powershell/DynamicStmt.qll

@@ -0,0 +1,11 @@
+import powershell
+
+class DynamicStmt extends @dynamic_keyword_statement, Stmt {
+  override SourceLocation getLocation() { dynamic_keyword_statement_location(this, result) }
+
+  override string toString() { result = "&..." }
+
+  CmdElement getCmd(int i) { dynamic_keyword_statement_command_elements(this, i, result) }
+
+  CmdElement getACmd() { result = this.getCmd(_) }
+}

powershell/ql/lib/semmle/code/powershell/ExitStmt.qll

@@ -0,0 +1,12 @@
+import powershell
+
+class ExitStmt extends @exit_statement, Stmt {
+  override SourceLocation getLocation() { exit_statement_location(this, result) }
+
+  override string toString() { if this.hasPipeline() then result = "exit ..." else result = "exit" }
+
+  /** ..., if any. */
+  PipelineBase getPipeline() { exit_statement_pipeline(this, result) } // TODO: Change @ast to @pipeline_base in dbscheme
+
+  predicate hasPipeline() { exists(this.getPipeline()) }
+}

powershell/ql/lib/semmle/code/powershell/ExpandableStringExpression.qll

@@ -0,0 +1,17 @@
+import powershell
+
+class ExpandableStringExpression extends @expandable_string_expression, Expr {
+  override SourceLocation getLocation() { expandable_string_expression_location(this, result) }
+
+  override string toString() {
+    result = "ExpandableStringExpression at: " + this.getLocation().toString()
+  }
+
+  private int getKind() { expandable_string_expression(this, _, result, _) }
+
+  int getNumExprs() { expandable_string_expression(this, _, _, result) }
+
+  Expr getExpr(int i) { expandable_string_expression_nested_expression(this, i, result) }
+
+  Expr getAnExpr() { result = this.getExpr(_) }
+}

powershell/ql/lib/semmle/code/powershell/Expression.qll

@@ -0,0 +1,3 @@
+import powershell
+
+class Expr extends @expression, CmdElement { }

powershell/ql/lib/semmle/code/powershell/File.qll

@@ -0,0 +1,224 @@
+/**
+ * Provides classes representing filesystem files and folders.
+ * Based on csharp/ql/lib/semmle/code/csharp/File.qll
+ */
+
+/** A file or folder. */
+class Container extends @container {
+  /**
+   * Gets the absolute, canonical path of this container, using forward slashes
+   * as path separator.
+   *
+   * The path starts with a _root prefix_ followed by zero or more _path
+   * segments_ separated by forward slashes.
+   *
+   * The root prefix is of one of the following forms:
+   *
+   *   1. A single forward slash `/` (Unix-style)
+   *   2. An upper-case drive letter followed by a colon and a forward slash,
+   *      such as `C:/` (Windows-style)
+   *   3. Two forward slashes, a computer name, and then another forward slash,
+   *      such as `//FileServer/` (UNC-style)
+   *
+   * Path segments are never empty (that is, absolute paths never contain two
+   * contiguous slashes, except as part of a UNC-style root prefix). Also, path
+   * segments never contain forward slashes, and no path segment is of the
+   * form `.` (one dot) or `..` (two dots).
+   *
+   * Note that an absolute path never ends with a forward slash, except if it is
+   * a bare root prefix, that is, the path has no path segments. A container
+   * whose absolute path has no segments is always a `Folder`, not a `File`.
+   */
+  string getAbsolutePath() { none() }
+
+  /**
+   * Gets a URL representing the location of this container.
+   *
+   * For more information see [Providing URLs](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/#providing-urls).
+   */
+  string getURL() { none() }
+
+  /**
+   * Gets the relative path of this file or folder from the root folder of the
+   * analyzed source location. The relative path of the root folder itself is
+   * the empty string.
+   *
+   * This has no result if the container is outside the source root, that is,
+   * if the root folder is not a reflexive, transitive parent of this container.
+   */
+  string getRelativePath() {
+    exists(string absPath, string pref |
+      absPath = this.getAbsolutePath() and sourceLocationPrefix(pref)
+    |
+      absPath = pref and result = ""
+      or
+      absPath = pref.regexpReplaceAll("/$", "") + "/" + result and
+      not result.matches("/%")
+    )
+  }
+
+  /**
+   * Gets the base name of this container including extension, that is, the last
+   * segment of its absolute path, or the empty string if it has no segments.
+   *
+   * Here are some examples of absolute paths and the corresponding base names
+   * (surrounded with quotes to avoid ambiguity):
+   *
+   * <table border="1">
+   * <tr><th>Absolute path</th><th>Base name</th></tr>
+   * <tr><td>"/tmp/tst.sql"</td><td>"tst.sql"</td></tr>
+   * <tr><td>"C:/Program Files (x86)"</td><td>"Program Files (x86)"</td></tr>
+   * <tr><td>"/"</td><td>""</td></tr>
+   * <tr><td>"C:/"</td><td>""</td></tr>
+   * <tr><td>"D:/"</td><td>""</td></tr>
+   * <tr><td>"//FileServer/"</td><td>""</td></tr>
+   * </table>
+   */
+  string getBaseName() {
+    result = this.getAbsolutePath().regexpCapture(".*/(([^/]*?)(?:\\.([^.]*))?)", 1)
+  }
+
+  /**
+   * Gets the extension of this container, that is, the suffix of its base name
+   * after the last dot character, if any.
+   *
+   * In particular,
+   *
+   *  - if the name does not include a dot, there is no extension, so this
+   *    predicate has no result;
+   *  - if the name ends in a dot, the extension is the empty string;
+   *  - if the name contains multiple dots, the extension follows the last dot.
+   *
+   * Here are some examples of absolute paths and the corresponding extensions
+   * (surrounded with quotes to avoid ambiguity):
+   *
+   * <table border="1">
+   * <tr><th>Absolute path</th><th>Extension</th></tr>
+   * <tr><td>"/tmp/tst.cs"</td><td>"cs"</td></tr>
+   * <tr><td>"/tmp/.classpath"</td><td>"classpath"</td></tr>
+   * <tr><td>"/bin/bash"</td><td>not defined</td></tr>
+   * <tr><td>"/tmp/tst2."</td><td>""</td></tr>
+   * <tr><td>"/tmp/x.tar.gz"</td><td>"gz"</td></tr>
+   * </table>
+   */
+  string getExtension() {
+    result = this.getAbsolutePath().regexpCapture(".*/([^/]*?)(\\.([^.]*))?", 3)
+  }
+
+  /**
+   * Gets the stem of this container, that is, the prefix of its base name up to
+   * (but not including) the last dot character if there is one, or the entire
+   * base name if there is not.
+   *
+   * Here are some examples of absolute paths and the corresponding stems
+   * (surrounded with quotes to avoid ambiguity):
+   *
+   * <table border="1">
+   * <tr><th>Absolute path</th><th>Stem</th></tr>
+   * <tr><td>"/tmp/tst.cs"</td><td>"tst"</td></tr>
+   * <tr><td>"/tmp/.classpath"</td><td>""</td></tr>
+   * <tr><td>"/bin/bash"</td><td>"bash"</td></tr>
+   * <tr><td>"/tmp/tst2."</td><td>"tst2"</td></tr>
+   * <tr><td>"/tmp/x.tar.gz"</td><td>"x.tar"</td></tr>
+   * </table>
+   */
+  string getStem() {
+    result = this.getAbsolutePath().regexpCapture(".*/([^/]*?)(?:\\.([^.]*))?", 1)
+  }
+
+  /** Gets the parent container of this file or folder, if any. */
+  Container getParentContainer() { containerparent(result, this) }
+
+  /** Gets a file or sub-folder in this container. */
+  Container getAChildContainer() { this = result.getParentContainer() }
+
+  /** Gets a file in this container. */
+  File getAFile() { result = this.getAChildContainer() }
+
+  /** Gets the file in this container that has the given `baseName`, if any. */
+  File getFile(string baseName) {
+    result = this.getAFile() and
+    result.getBaseName() = baseName
+  }
+
+  /** Gets a sub-folder in this container. */
+  Folder getAFolder() { result = this.getAChildContainer() }
+
+  /** Gets the sub-folder in this container that has the given `baseName`, if any. */
+  Folder getFolder(string baseName) {
+    result = this.getAFolder() and
+    result.getBaseName() = baseName
+  }
+
+  /** Gets the file or sub-folder in this container that has the given `name`, if any. */
+  Container getChildContainer(string name) {
+    result = this.getAChildContainer() and
+    result.getBaseName() = name
+  }
+
+  /** Gets the file in this container that has the given `stem` and `extension`, if any. */
+  File getFile(string stem, string extension) {
+    result = this.getAChildContainer() and
+    result.getStem() = stem and
+    result.getExtension() = extension
+  }
+
+  /** Gets a sub-folder contained in this container. */
+  Folder getASubFolder() { result = this.getAChildContainer() }
+
+  /**
+   * Gets a textual representation of the path of this container.
+   *
+   * This is the absolute path of the container.
+   */
+  string toString() { result = this.getAbsolutePath() }
+}
+
+/** A folder. */
+class Folder extends Container, @folder {
+  override string getAbsolutePath() { folders(this, result) }
+
+  override string getURL() { result = "folder://" + this.getAbsolutePath() }
+}
+
+/** A file. */
+class File extends Container, @file {
+  override string getAbsolutePath() { files(this, result) }
+
+  /** Gets the number of lines in this file. */
+  int getNumberOfLines() { numlines(this, result, _, _) }
+
+  /** Gets the number of lines containing code in this file. */
+  int getNumberOfLinesOfCode() { numlines(this, _, result, _) }
+
+  /** Gets the number of lines containing comments in this file. */
+  int getNumberOfLinesOfComments() { numlines(this, _, _, result) }
+
+  override string getURL() { result = "file://" + this.getAbsolutePath() + ":0:0:0:0" }
+
+  /** Holds if this file is a QL test stub file. */
+  pragma[noinline]
+  private predicate isStub() {
+    // this.extractedQlTest() and
+    this.getAbsolutePath().matches("%resources/stubs/%")
+  }
+
+  /** Holds if this file contains source code. */
+  predicate fromSource() {
+    this.getExtension() = "cs" and
+    not this.isStub()
+  }
+
+  /** Holds if this file is a library. */
+  predicate fromLibrary() {
+    not this.getBaseName() = "" and
+    not this.fromSource()
+  }
+}
+
+/**
+ * A source file.
+ */
+class SourceFile extends File {
+  SourceFile() { this.fromSource() }
+}

powershell/ql/lib/semmle/code/powershell/FileRedirection.qll

@@ -0,0 +1,7 @@
+import powershell
+
+class FileRedirection extends @file_redirection, Redirection {
+  override string toString() { result = "FileRedirection" }
+
+  override Location getLocation() { file_redirection_location(this, result) }
+}

powershell/ql/lib/semmle/code/powershell/ForEachStmt.qll

@@ -0,0 +1,16 @@
+import powershell
+
+class ForEachStmt extends @foreach_statement, LoopStmt {
+  override SourceLocation getLocation() { foreach_statement_location(this, result) }
+
+  override string toString() { result = "forach(... in ...)" }
+
+  StmtBlock getBody() { foreach_statement(this, _, _, result, _) } // TODO: Change @ast to @stmt_block in dbscheme
+
+  VarAccess getVariable() { foreach_statement(this, result, _, _, _) } // TODO: Change @ast to @variable_expression in dbscheme
+
+  /** ..., if any. */
+  PipelineBase getCondition() { foreach_statement(this, _, result, _, _) } // TODO: Change @ast to @pipeline_base in dbscheme
+
+  predicate isParallel() { foreach_statement(this, _, _, _, 1) }
+}

powershell/ql/lib/semmle/code/powershell/ForStmt.qll

@@ -0,0 +1,15 @@
+import powershell
+
+class ForStmt extends @for_statement, LoopStmt {
+  override SourceLocation getLocation() { for_statement_location(this, result) }
+
+  override string toString() { result = "for(...;...;...)" }
+
+  PipelineBase getInitializer() { for_statement_initializer(this, result) } // TODO: Change @ast to @pipeline_base in dbscheme
+
+  PipelineBase getCondition() { for_statement_condition(this, result) } // TODO: Change @ast to @pipeline_base in dbscheme
+
+  PipelineBase getIterator() { for_statement_iterator(this, result) } // TODO: Change @ast to @pipeline_base in dbscheme
+
+  StmtBlock getBody() { for_statement(this, result) } // TODO: Change @ast to @stmt_block in dbscheme
+}

powershell/ql/lib/semmle/code/powershell/FunctionDefinition.qll

@@ -0,0 +1,19 @@
+import powershell
+
+class Function extends @function_definition, Stmt {
+  override string toString() { result = "FunctionDefinition at: " + this.getLocation().toString() }
+
+  override SourceLocation getLocation() { function_definition_location(this, result) }
+
+  string getName() { function_definition(this, _, result, _, _) }
+
+  ScriptBlock getBody() { function_definition(this, result, _, _, _) }
+
+  predicate isFilter() { function_definition(this, _, _, true, _) }
+
+  predicate isWorkflow() { function_definition(this, _, _, _, true) }
+
+  Parameter getParameter(int i) { function_definition_parameter(this, i, result) }
+
+  Parameter getAParameter() { result = this.getParameter(_) }
+}

powershell/ql/lib/semmle/code/powershell/FunctionMember.qll

@@ -0,0 +1,31 @@
+import powershell
+
+class FunctionMember extends @function_member, Member {
+  override string getName() { function_member(this, _, _, _, _, _, _, result, _) }
+
+  override SourceLocation getLocation() { function_member_location(this, result) }
+
+  override string toString() { result = this.getName() }
+
+  ScriptBlock getBody() { function_member(this, result, _, _, _, _, _, _, _) }
+
+  override predicate isHidden() { function_member(this, _, _, true, _, _, _, _, _) }
+
+  override predicate isPrivate() { function_member(this, _, _, _, true, _, _, _, _) }
+
+  override predicate isPublic() { function_member(this, _, _, _, _, true, _, _, _) }
+
+  override predicate isStatic() { function_member(this, _, _, _, _, _, true, _, _) }
+
+  predicate isConstructor() { function_member(this, _, true, _, _, _, _, _, _) }
+
+  Parameter getParameter(int i) { function_member_parameter(this, i, result) }
+
+  Parameter getAParameter() { result = this.getParameter(_) }
+
+  TypeConstraint getTypeConstraint() { function_member_return_type(this, result) }
+}
+
+class Constructor extends FunctionMember {
+  Constructor() { this.isConstructor() }
+}

powershell/ql/lib/semmle/code/powershell/GotoStmt.qll

@@ -0,0 +1,8 @@
+import powershell
+
+/** A `break` or `continue` statement. */
+class GotoStmt extends @labelled_statement, Stmt { // TODO: Rename @labelled_statement to @goto_statement
+
+  /** ..., if any. */
+  Expr getLabel() { statement_label(this, result) } // TODO: Replace @ast with @expression
+}

powershell/ql/lib/semmle/code/powershell/IfStmt.qll

@@ -0,0 +1,18 @@
+import powershell
+
+class IfStmt extends @if_statement, Stmt {
+  override SourceLocation getLocation() { if_statement_location(this, result) }
+
+  override string toString() {
+    if this.hasElse() then result = "if (...) {...} else {...}" else result = "if (...) {...}"
+  }
+
+  PipelineBase getCondition(int i) { if_statement_clause(this, i, result, _) } // TODO: Change @ast to @pipeline_base in dbscheme
+
+  StmtBlock getThen(int i) { if_statement_clause(this, i, _, result) } // TODO: Change @ast to @statement_block in dbscheme
+
+  /** ..., if any. */
+  StmtBlock getElse() { if_statement_else(this, result) } // TODO: Change @ast to @stmt_block in dbscheme
+
+  predicate hasElse() { exists(this.getElse()) }
+}

powershell/ql/lib/semmle/code/powershell/InvokeMemberExpression.qll

@@ -0,0 +1,15 @@
+import powershell
+
+class InvokeMemberExpression extends @invoke_member_expression, MemberExprBase {
+  override SourceLocation getLocation() { invoke_member_expression_location(this, result) }
+
+  Expr getExpression() { invoke_member_expression(this, result, _) }
+
+  CmdElement getMember() { invoke_member_expression(this, _, result) }
+
+  Expr getArgument(int i) { invoke_member_expression_argument(this, i, result) }
+
+  Expr getAnArgument() { invoke_member_expression_argument(this, _, result) }
+
+  override string toString() { result = "ArrayExpression at: " + this.getLocation().toString() }
+}

powershell/ql/lib/semmle/code/powershell/LabeledStmt.qll

@@ -0,0 +1,5 @@
+import powershell
+
+class LabeledStmt extends @labeled_statement, Stmt {
+  string getLabel() { label(this, result) }
+}

powershell/ql/lib/semmle/code/powershell/Location.qll

@@ -0,0 +1,52 @@
+/**
+ * Provides the `Location` class to give a location for each
+ * program element.
+ *
+ * A `SourceLocation` provides a section of text in a source file
+ * containing the program element.
+ *
+ * Based on csharp/ql/lib/semmle/code/csharp/Location.qll
+ */
+
+import File
+
+/**
+ * A location of a program element.
+ */
+class Location extends @location {
+  /** Gets the file of the location. */
+  File getFile() { none() }
+
+  /**
+   * Holds if this element is at the specified location.
+   * The location spans column `startcolumn` of line `startline` to
+   * column `endcolumn` of line `endline` in file `filepath`.
+   * For more information, see
+   * [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
+   */
+  predicate hasLocationInfo(
+    string filepath, int startline, int startcolumn, int endline, int endcolumn
+  ) {
+    none()
+  }
+
+  /** Gets a textual representation of this location. */
+  string toString() { none() }
+
+  /** Gets the 1-based line number (inclusive) where this location starts. */
+  int getStartLine() { this.hasLocationInfo(_, result, _, _, _) }
+
+  /** Gets the 1-based line number (inclusive) where this location ends. */
+  int getEndLine() { this.hasLocationInfo(_, _, _, result, _) }
+
+  /** Gets the 1-based column number (inclusive) where this location starts. */
+  int getStartColumn() { this.hasLocationInfo(_, _, result, _, _) }
+
+  /** Gets the 1-based column number (inclusive) where this location ends. */
+  int getEndColumn() { this.hasLocationInfo(_, _, _, _, result) }
+}
+
+/** An empty location. */
+class EmptyLocation extends Location {
+  EmptyLocation() { this.hasLocationInfo("", 0, 0, 0, 0) }
+}

powershell/ql/lib/semmle/code/powershell/LoopStmt.qll

@@ -0,0 +1,3 @@
+import powershell
+
+class LoopStmt extends @loop_statement, LabeledStmt { }

powershell/ql/lib/semmle/code/powershell/Member.qll

@@ -0,0 +1,17 @@
+import powershell
+
+class Member extends @member, Ast {
+  Type getDeclaringType() { result.getAMember() = this }
+
+  string getName() { none() }
+
+  override string toString() { result = this.getName() }
+
+  predicate isHidden() { none() }
+
+  predicate isPrivate() { none() }
+
+  predicate isPublic() { none() }
+
+  predicate isStatic() { none() }
+}

powershell/ql/lib/semmle/code/powershell/MemberExpressionBase.qll

@@ -0,0 +1,3 @@
+import powershell
+
+class MemberExprBase extends @member_expression_base, Expr { }

powershell/ql/lib/semmle/code/powershell/MergingRedirection.qll

@@ -0,0 +1,7 @@
+import powershell
+
+class MergingRedirection extends @merging_redirection, Redirection {
+  override string toString() { result = "MergingRedirection" }
+
+  override Location getLocation() { merging_redirection_location(this, result) }
+}

powershell/ql/lib/semmle/code/powershell/ModuleSpecification.qll

@@ -0,0 +1,17 @@
+import powershell
+
+class ModuleSpecification extends @module_specification {
+  string toString() { result = this.getName() }
+
+  string getName() { module_specification(this, result, _, _, _, _) }
+
+  string getGuid() { module_specification(this, _, result, _, _, _) }
+
+  string getMaxVersion() { module_specification(this, _, _, result, _, _) }
+
+  string getRequiredVersion() { module_specification(this, _, _, _, result, _) }
+
+  string getVersion() { module_specification(this, _, _, _, _, result) }
+
+  Location getLocation() { result instanceof EmptyLocation }
+}

powershell/ql/lib/semmle/code/powershell/NamedAttributeArgument.qll

@@ -0,0 +1,11 @@
+import powershell
+
+class NamedAttributeArgument extends @named_attribute_argument {
+  string toString() { result = this.getValue().toString() }
+
+  SourceLocation getLocation() { named_attribute_argument_location(this, result) }
+
+  string getName() { named_attribute_argument(this, result, _) }
+
+  Expr getValue() { named_attribute_argument(this, _, result) }
+}

powershell/ql/lib/semmle/code/powershell/NamedBlock.qll

@@ -0,0 +1,19 @@
+import powershell
+
+class NamedBlock extends @named_block, Ast {
+  override string toString() { result = "{...}" }
+
+  override SourceLocation getLocation() { named_block_location(this, result) }
+
+  int getNumStatements() { named_block(this, result, _) }
+
+  int getNumTraps() { named_block(this, _, result) }
+
+  Stmt getStatement(int i) { named_block_statement(this, i, result) }
+
+  Stmt getAStatement() { result = this.getStatement(_) }
+
+  TrapStmt getTrap(int i) { named_block_trap(this, i, result) }
+
+  TrapStmt getATrap() { result = this.getTrap(_) }
+}

powershell/ql/lib/semmle/code/powershell/ParamBlock.qll

@@ -0,0 +1,19 @@
+import powershell
+
+class ParamBlock extends @param_block, Ast {
+  override string toString() { result = "ParamBlock" }
+
+  override SourceLocation getLocation() { param_block_location(this, result) }
+
+  int getNumAttributes() { param_block(this, result, _) }
+
+  int getNumParameters() { param_block(this, _, result) }
+
+  Attribute getAttribute(int i) { param_block_attribute(this, i, result) }
+
+  Attribute getAnAttribute() { result = this.getAttribute(_) }
+
+  Parameter getParameter(int i) { param_block_parameter(this, i, result) }
+
+  Parameter getAParameter() { result = this.getParameter(_) }
+}

powershell/ql/lib/semmle/code/powershell/Parameter.qll

@@ -0,0 +1,19 @@
+import powershell
+
+class Parameter extends @parameter, Ast {
+  override string toString() { result = this.getName().toString() }
+
+  VarAccess getName() { parameter(this, result, _, _) }
+
+  string getStaticType() { parameter(this, _, result, _) }
+
+  int getNumAttributes() { parameter(this, _, _, result) }
+
+  AttributeBase getAttribute(int i) { parameter_attribute(this, i, result) }
+
+  AttributeBase getAnAttribute() { result = this.getAttribute(_) }
+
+  Expr getDefaultValue() { parameter_default_value(this, result) }
+
+  override SourceLocation getLocation() { parameter_location(this, result) }
+}

powershell/ql/lib/semmle/code/powershell/ParenExpression.qll

@@ -0,0 +1,9 @@
+import powershell
+
+class ParenExpression extends @paren_expression, Expr {
+  PipelineBase getExpression() { paren_expression(this, result) }
+
+  override SourceLocation getLocation() { paren_expression_location(this, result) }
+
+  override string toString() { result = "(...)" }
+}

powershell/ql/lib/semmle/code/powershell/Pipeline.qll

@@ -0,0 +1,13 @@
+import powershell
+
+class Pipeline extends @pipeline, Chainable {
+  override string toString() { result = "...|..." }
+
+  override SourceLocation getLocation() { pipeline_location(this, result) }
+
+  int getNumComponents() { pipeline(this, result) }
+
+  CmdBase getComponent(int i) { pipeline_component(this, i, result) }
+
+  CmdBase getAComponent() { result = this.getComponent(_) }
+}

powershell/ql/lib/semmle/code/powershell/PipelineBase.qll

@@ -0,0 +1,3 @@
+import powershell
+
+class PipelineBase extends @pipeline_base, Stmt { }

powershell/ql/lib/semmle/code/powershell/PropertyMember.qll

@@ -0,0 +1,17 @@
+import powershell
+
+class PropertyMember extends @property_member, Member {
+  override string getName() { property_member(this, _, _, _, _, result, _) }
+
+  override SourceLocation getLocation() { property_member_location(this, result) }
+
+  override string toString() { result = this.getName() }
+
+  override predicate isHidden() { property_member(this, true, _, _, _, _, _) }
+
+  override predicate isPrivate() { property_member(this, _, true, _, _, _, _) }
+
+  override predicate isPublic() { property_member(this, _, _, true, _, _, _) }
+
+  override predicate isStatic() { property_member(this, _, _, _, true, _, _) }
+}

powershell/ql/lib/semmle/code/powershell/Redirection.qll

@@ -0,0 +1,3 @@
+import powershell
+
+class Redirection extends @redirection, Ast { }

powershell/ql/lib/semmle/code/powershell/ReturnStmt.qll

@@ -0,0 +1,13 @@
+import powershell
+
+class ReturnStmt extends @return_statement, Stmt {
+  override SourceLocation getLocation() { return_statement_location(this, result) }
+
+  override string toString() {
+    if this.hasPipeline() then result = "return ..." else result = "return"
+  }
+
+  PipelineBase getPipeline() { return_statement_pipeline(this, result) } // TODO: Change @ast to @pipeline_base in dbscheme
+
+  predicate hasPipeline() { exists(this.getPipeline()) }
+}

powershell/ql/lib/semmle/code/powershell/ScriptBlock.qll

@@ -0,0 +1,45 @@
+import powershell
+
+class ScriptBlock extends @script_block, Ast {
+  override string toString() { result = "ScriptBlock at: " + this.getLocation().toString() }
+
+  override SourceLocation getLocation() { script_block_location(this, result) }
+
+  int getNumUsings() { script_block(this, result, _, _, _, _) }
+
+  int getNumRequiredModules() { script_block(this, _, result, _, _, _) }
+
+  int getNumRequiredAssemblies() { script_block(this, _, _, result, _, _) }
+
+  int getNumRequiredPsEditions() { script_block(this, _, _, _, result, _) }
+
+  int getNumRequiredPsSnapIns() { script_block(this, _, _, _, _, result) }
+
+  Stmt getUsing(int i) { script_block_using(this, i, result) }
+
+  Stmt getAUsing() { result = this.getUsing(_) }
+
+  ParamBlock getParamBlock() { script_block_param_block(this, result) }
+
+  NamedBlock getBeginBlock() { script_block_begin_block(this, result) }
+
+  NamedBlock getCleanBlock() { script_block_clean_block(this, result) }
+
+  NamedBlock getDynamicParamBlock() { script_block_dynamic_param_block(this, result) }
+
+  NamedBlock getEndBlock() { script_block_end_block(this, result) }
+
+  NamedBlock getProcessBlock() { script_block_process_block(this, result) }
+
+  string getRequiredApplicationId() { script_block_required_application_id(this, result) }
+
+  boolean getRequiresElevation() { script_block_requires_elevation(this, result) }
+
+  string getRequiredPsVersion() { script_block_required_ps_version(this, result) }
+
+  ModuleSpecification getModuleSpecification(int i) {
+    script_block_required_module(this, i, result)
+  }
+
+  ModuleSpecification getAModuleSpecification() { result = this.getModuleSpecification(_) }
+}

powershell/ql/lib/semmle/code/powershell/ScriptBlockExpr.qll

@@ -0,0 +1,9 @@
+import powershell
+
+class ScriptBlockExpr extends @script_block_expression, Expr {
+  override SourceLocation getLocation() { script_block_expression_location(this, result) }
+
+  override string toString() { result = "{...}" }
+
+  ScriptBlock getBody() { script_block_expression(this, result) }
+}

powershell/ql/lib/semmle/code/powershell/SourceLocation.qll

@@ -0,0 +1,25 @@
+import powershell
+
+/**
+ * A location in source code, comprising of a source file and a segment of text
+ * within the file.
+ */
+class SourceLocation extends Location, @location_default {
+  override File getFile() { locations_default(this, result, _, _, _, _) }
+
+  override predicate hasLocationInfo(
+    string filepath, int startline, int startcolumn, int endline, int endcolumn
+  ) {
+    exists(File f | locations_default(this, f, startline, startcolumn, endline, endcolumn) |
+      filepath = f.getAbsolutePath()
+    )
+  }
+
+  override string toString() {
+    exists(string filepath, int startline, int startcolumn, int endline, int endcolumn |
+      this.hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
+    |
+      result = filepath + ":" + startline + ":" + startcolumn + ":" + endline + ":" + endcolumn
+    )
+  }
+}

powershell/ql/lib/semmle/code/powershell/Statement.qll

@@ -0,0 +1,3 @@
+import powershell
+
+class Stmt extends @statement, Ast { }

powershell/ql/lib/semmle/code/powershell/StatementBlock.qll

@@ -0,0 +1,19 @@
+import powershell
+
+class StmtBlock extends @statement_block, Ast {
+  override SourceLocation getLocation() { statement_block_location(this, result) }
+
+  int getNumStatements() { statement_block(this, result, _) }
+
+  int getNumTraps() { statement_block(this, _, result) }
+
+  Stmt getStatement(int index) { statement_block_statement(this, index, result) }
+
+  Stmt getAStatement() { result = this.getStatement(_) }
+
+  TrapStmt getTrapStatement(int index) { statement_block_trap(this, index, result) }
+
+  TrapStmt getATrapStatement() { result = this.getTrapStatement(_) }
+
+  override string toString() { result = "StatementBlock at: " + this.getLocation().toString() }
+}

powershell/ql/lib/semmle/code/powershell/StringConstantExpression.qll

@@ -0,0 +1,10 @@
+import powershell
+
+class StringConstExpression extends @string_constant_expression, BaseConstExpr {
+  StringLiteral getValue() { string_constant_expression(this, result) }
+
+  /** Get the full string literal with all its parts concatenated */
+  override string toString() { result = getValue().toString() }
+
+  override SourceLocation getLocation() { string_constant_expression_location(this, result) }
+}

powershell/ql/lib/semmle/code/powershell/StringLiteral.qll

@@ -0,0 +1,14 @@
+import powershell
+
+class StringLiteral extends @string_literal {
+  int getNumContinuations() { string_literal_line(this, result, _) }
+
+  string getContinuation(int index) { string_literal_line(this, index, result) }
+
+  /** Get the full string literal with all its parts concatenated */
+  string toString() {
+    result = concat(int i | i = [0 .. getNumContinuations()] | getContinuation(i), "\n")
+  }
+
+  SourceLocation getLocation() { string_literal_location(this, result) }
+}

powershell/ql/lib/semmle/code/powershell/TernaryExpression.qll

@@ -0,0 +1,13 @@
+import powershell
+
+class ConditionalExpr extends @ternary_expression, Expr {
+  override string toString() { result = "...?...:..." }
+
+  override SourceLocation getLocation() { ternary_expression_location(this, result) }
+
+  Expr getCondition() { ternary_expression(this, result, _, _) }
+
+  Expr getIfFalse() { ternary_expression(this, _, result, _) }
+
+  Expr getIfTrue() { ternary_expression(this, _, _, result) }
+}

powershell/ql/lib/semmle/code/powershell/TrapStatement.qll

@@ -0,0 +1,7 @@
+import powershell
+
+class TrapStmt extends @trap_statement, Stmt {
+  override SourceLocation getLocation() { trap_statement_location(this, result) }
+
+  override string toString() { result = "TrapStatement at: " + this.getLocation().toString() }
+}

powershell/ql/lib/semmle/code/powershell/TryStmt.qll

@@ -0,0 +1,17 @@
+import powershell
+
+class TryStmt extends @try_statement, Stmt {
+  override SourceLocation getLocation() { try_statement_location(this, result) }
+
+  override string toString() { result = "try {...}" }
+
+  CatchClause getCatchClause(int i) { try_statement_catch_clause(this, i, result) }
+
+  CatchClause getACatchClause() { result = this.getCatchClause(_) }
+
+  /** ..., if any. */
+  StmtBlock getFinally() { try_statement_finally(this, result) }
+
+  StmtBlock getBody() { try_statement(this, result) } // TODO: Change @ast to @stmt_block in dbscheme
+
+}

powershell/ql/lib/semmle/code/powershell/Type.qll

@@ -0,0 +1,13 @@
+import powershell
+
+class Type extends @type_definition, Stmt {
+  override SourceLocation getLocation() { type_definition_location(this, result) }
+
+  override string toString() { result = this.getName() }
+
+  string getName() { type_definition(this, result, _, _, _, _) }
+
+  Member getMember(int i) { type_definition_members(this, i, result) }
+
+  Member getAMember() { result = this.getMember(_) }
+}

powershell/ql/lib/semmle/code/powershell/TypeConstraint.qll

@@ -0,0 +1,13 @@
+import powershell
+
+class TypeConstraint extends @type_constraint, AttributeBase {
+  override SourceLocation getLocation() { type_constraint_location(this, result) }
+
+  /** Gets the assembly name. */
+  string getName() { type_constraint(this, result, _) }
+
+  /** Gets the full name of this type constraint including namespaces. */
+  string getFullName() { type_constraint(this, _, result) }
+
+  override string toString() { result = this.getName() }
+}

powershell/ql/lib/semmle/code/powershell/TypeExpression.qll

@@ -0,0 +1,11 @@
+import powershell
+
+class TypeExpression extends @type_expression, Expr {
+  string getName() { type_expression(this, result, _) }
+
+  string getFullyQualifiedName() { type_expression(this, _, result) }
+
+  override string toString() { result = this.getName() }
+
+  override SourceLocation getLocation() { type_expression_location(this, result) }
+}

powershell/ql/lib/semmle/code/powershell/UsingExpression.qll

@@ -0,0 +1,7 @@
+import powershell
+
+class UsingExpr extends @using_expression, Expr {
+  override string toString() { result = "$using..." }
+
+  override SourceLocation getLocation() { using_expression_location(this, result) }
+}

powershell/ql/lib/semmle/code/powershell/UsingStmt.qll

@@ -0,0 +1,7 @@
+import powershell
+
+class UsingStmt extends @using_statement, Stmt {
+  override SourceLocation getLocation() { using_statement_location(this, result) }
+
+  override string toString() { result = "using ..." }
+}

powershell/ql/lib/semmle/code/powershell/VariableExpression.qll

@@ -0,0 +1,29 @@
+import powershell
+
+class VarAccess extends @variable_expression, Expr {
+  override string toString() { result = this.getUserPath() }
+
+  override SourceLocation getLocation() { variable_expression_location(this, result) }
+
+  string getUserPath() { variable_expression(this, result, _, _, _, _, _, _, _, _, _, _) }
+
+  string getDriveName() { variable_expression(this, _, result, _, _, _, _, _, _, _, _, _) }
+
+  boolean isConstant() { variable_expression(this, _, _, result, _, _, _, _, _, _, _, _) }
+
+  boolean isGlobal() { variable_expression(this, _, _, _, result, _, _, _, _, _, _, _) }
+
+  boolean isLocal() { variable_expression(this, _, _, _, _, result, _, _, _, _, _, _) }
+
+  boolean isPrivate() { variable_expression(this, _, _, _, _, _, result, _, _, _, _, _) }
+
+  boolean isScript() { variable_expression(this, _, _, _, _, _, _, result, _, _, _, _) }
+
+  boolean isUnqualified() { variable_expression(this, _, _, _, _, _, _, _, result, _, _, _) }
+
+  boolean isUnscoped() { variable_expression(this, _, _, _, _, _, _, _, _, result, _, _) }
+
+  boolean isVariable() { variable_expression(this, _, _, _, _, _, _, _, _, _, result, _) }
+
+  boolean isDriveQualified() { variable_expression(this, _, _, _, _, _, _, _, _, _, _, result) }
+}

powershell/ql/lib/semmle/code/powershell/WhileStmt.qll

@@ -0,0 +1,11 @@
+import powershell
+
+class WhileStmt extends @while_statement, LoopStmt {
+  override SourceLocation getLocation() { while_statement_location(this, result) }
+
+  override string toString() { result = "while(...) {...}" }
+
+  PipelineBase getCondition() { while_statement_condition(this, result) } // TODO: Change @ast to @pipeline_base in dbscheme
+
+  StmtBlock getBody() { while_statement(this, result) } // TODO: Change @ast to @stmt_block in dbscheme
+}

powershell/ql/test/library-tests/ast/Arrays/Arrays.ps1

@@ -0,0 +1,15 @@
+$array1 = 1,2,"a",$true,$false,$null # 1-D array
+$array1[1] = 3
+$array1[2] = "b"
+
+$array2 = New-Object 'object[,]' 2,2 # 2-D array
+$array2[0,0] = "key1"
+$array2[1,0] = "key1"
+$array2[0,1] = "value1"
+$array2[1,1] = $null
+
+$array3 = @("a","b","c")
+$array3.count
+
+$array4 = [System.Collections.ArrayList]@()
+$array4.Add(1)

powershell/ql/test/library-tests/ast/Arrays/arrays.expected

@@ -0,0 +1,23 @@
+arrayExpr
+| Arrays.ps1:11:11:11:25 | ArrayExpression at: Arrays.ps1:11:11:11:25 | Arrays.ps1:11:13:11:24 | StatementBlock at: Arrays.ps1:11:13:11:24 |
+| Arrays.ps1:14:41:14:44 | ArrayExpression at: Arrays.ps1:14:41:14:44 | Arrays.ps1:0:0:0:0 | StatementBlock at: Arrays.ps1:0:0:0:0 |
+arrayLiteral
+| Arrays.ps1:1:11:1:37 | ArrayLiteral at: Arrays.ps1:1:11:1:37 | 0 | Arrays.ps1:1:11:1:12 | ConstantExpression at: Arrays.ps1:1:11:1:12 |
+| Arrays.ps1:1:11:1:37 | ArrayLiteral at: Arrays.ps1:1:11:1:37 | 1 | Arrays.ps1:1:13:1:14 | ConstantExpression at: Arrays.ps1:1:13:1:14 |
+| Arrays.ps1:1:11:1:37 | ArrayLiteral at: Arrays.ps1:1:11:1:37 | 2 | Arrays.ps1:1:15:1:18 | a |
+| Arrays.ps1:1:11:1:37 | ArrayLiteral at: Arrays.ps1:1:11:1:37 | 3 | Arrays.ps1:1:19:1:24 | true |
+| Arrays.ps1:1:11:1:37 | ArrayLiteral at: Arrays.ps1:1:11:1:37 | 4 | Arrays.ps1:1:25:1:31 | false |
+| Arrays.ps1:1:11:1:37 | ArrayLiteral at: Arrays.ps1:1:11:1:37 | 5 | Arrays.ps1:1:32:1:37 | null |
+| Arrays.ps1:5:34:5:37 | ArrayLiteral at: Arrays.ps1:5:34:5:37 | 0 | Arrays.ps1:5:34:5:35 | ConstantExpression at: Arrays.ps1:5:34:5:35 |
+| Arrays.ps1:5:34:5:37 | ArrayLiteral at: Arrays.ps1:5:34:5:37 | 1 | Arrays.ps1:5:36:5:37 | ConstantExpression at: Arrays.ps1:5:36:5:37 |
+| Arrays.ps1:6:9:6:12 | ArrayLiteral at: Arrays.ps1:6:9:6:12 | 0 | Arrays.ps1:6:9:6:10 | ConstantExpression at: Arrays.ps1:6:9:6:10 |
+| Arrays.ps1:6:9:6:12 | ArrayLiteral at: Arrays.ps1:6:9:6:12 | 1 | Arrays.ps1:6:11:6:12 | ConstantExpression at: Arrays.ps1:6:11:6:12 |
+| Arrays.ps1:7:9:7:12 | ArrayLiteral at: Arrays.ps1:7:9:7:12 | 0 | Arrays.ps1:7:9:7:10 | ConstantExpression at: Arrays.ps1:7:9:7:10 |
+| Arrays.ps1:7:9:7:12 | ArrayLiteral at: Arrays.ps1:7:9:7:12 | 1 | Arrays.ps1:7:11:7:12 | ConstantExpression at: Arrays.ps1:7:11:7:12 |
+| Arrays.ps1:8:9:8:12 | ArrayLiteral at: Arrays.ps1:8:9:8:12 | 0 | Arrays.ps1:8:9:8:10 | ConstantExpression at: Arrays.ps1:8:9:8:10 |
+| Arrays.ps1:8:9:8:12 | ArrayLiteral at: Arrays.ps1:8:9:8:12 | 1 | Arrays.ps1:8:11:8:12 | ConstantExpression at: Arrays.ps1:8:11:8:12 |
+| Arrays.ps1:9:9:9:12 | ArrayLiteral at: Arrays.ps1:9:9:9:12 | 0 | Arrays.ps1:9:9:9:10 | ConstantExpression at: Arrays.ps1:9:9:9:10 |
+| Arrays.ps1:9:9:9:12 | ArrayLiteral at: Arrays.ps1:9:9:9:12 | 1 | Arrays.ps1:9:11:9:12 | ConstantExpression at: Arrays.ps1:9:11:9:12 |
+| Arrays.ps1:11:13:11:24 | ArrayLiteral at: Arrays.ps1:11:13:11:24 | 0 | Arrays.ps1:11:13:11:16 | a |
+| Arrays.ps1:11:13:11:24 | ArrayLiteral at: Arrays.ps1:11:13:11:24 | 1 | Arrays.ps1:11:17:11:20 | b |
+| Arrays.ps1:11:13:11:24 | ArrayLiteral at: Arrays.ps1:11:13:11:24 | 2 | Arrays.ps1:11:21:11:24 | c |

powershell/ql/test/library-tests/ast/Arrays/arrays.ql

@@ -0,0 +1,7 @@
+import powershell
+
+query predicate arrayExpr(ArrayExpr arrayExpr, StmtBlock subExpr) { subExpr = arrayExpr.getStatementBlock() }
+
+query predicate arrayLiteral(ArrayLiteral arrayLiteral, int i, Expr e) {
+    e = arrayLiteral.getElement(i)
+}

powershell/ql/test/library-tests/ast/Blocks/ParamBlock.ps1

@@ -0,0 +1,5 @@
+[CmdletBinding()]
+param(
+    [Parameter()]
+    [string]$Parameter
+)

powershell/ql/test/library-tests/ast/Blocks/blocks.expected

@@ -0,0 +1 @@
+| ParamBlock.ps1:2:1:5:2 | ParamBlock | 0 | ParamBlock.ps1:3:5:4:23 | Parameter |

powershell/ql/test/library-tests/ast/Blocks/blocks.ql

@@ -0,0 +1,5 @@
+import powershell
+
+query predicate paramBlockHasParam(ParamBlock block, int i, Parameter p) {
+    p = block.getParameter(i)
+}

powershell/ql/test/library-tests/ast/Dynamic/DynamicExecution.ps1

@@ -0,0 +1,5 @@
+$foo = 'cmd.exe'
+Invoke-Expression $foo
+[scriptblock]::Create($foo)
+& ([scriptblock]::Create($foo))
+&"$foo"

powershell/ql/test/library-tests/ast/Dynamic/DynamicExecutionWithFunc.ps1

@@ -0,0 +1,11 @@
+function ExecuteAThing {
+    param (
+        $userInput
+    )
+    $foo = 'cmd.exe' + $userInput;
+    Invoke-Expression $foo
+    [scriptblock]::Create($foo)
+    & ([scriptblock]::Create($foo))
+    &"$foo"
+    & 'cmd.exe' @($userInput)
+}

powershell/ql/test/library-tests/ast/Expressions/BinaryExpression.ps1

@@ -0,0 +1,4 @@
+$val1 = 1
+$val2 = 2
+$result = $val1 + $val2
+$result

powershell/ql/test/library-tests/ast/Expressions/ConvertWithSecureString.ps1

@@ -0,0 +1,2 @@
+$UserInput = Read-Host "Please enter your secure code"
+$EncryptedInput = ConvertTo-SecureString -String $UserInput -AsPlainText -Force

powershell/ql/test/library-tests/ast/Expressions/ExpandableString.ps1

@@ -0,0 +1 @@
+"Name: $name`nDate: $([DateTime]::Now)"

powershell/ql/test/library-tests/ast/Expressions/SubExpression.ps1

@@ -0,0 +1,2 @@
+$(Get-Date).AddDays(10)
+$(Get-Date).AddDays()

powershell/ql/test/library-tests/ast/Expressions/TernaryExpression.ps1

@@ -0,0 +1 @@
+$var = (6 -gt 7) ? 1:2

powershell/ql/test/library-tests/ast/Expressions/expressions.expected

@@ -0,0 +1,19 @@
+binaryExpr
+| BinaryExpression.ps1:3:11:3:24 | ...+... | BinaryExpression.ps1:3:11:3:16 | val1 | BinaryExpression.ps1:3:19:3:24 | val2 |
+| TernaryExpression.ps1:1:9:1:16 | ...+... | TernaryExpression.ps1:1:9:1:10 | ConstantExpression at: TernaryExpression.ps1:1:9:1:10 | TernaryExpression.ps1:1:15:1:16 | ConstantExpression at: TernaryExpression.ps1:1:15:1:16 |
+cmdExpr
+| BinaryExpression.ps1:1:9:1:10 | CommandExpression at: BinaryExpression.ps1:1:9:1:10 | BinaryExpression.ps1:1:9:1:10 | ConstantExpression at: BinaryExpression.ps1:1:9:1:10 |
+| BinaryExpression.ps1:2:9:2:10 | CommandExpression at: BinaryExpression.ps1:2:9:2:10 | BinaryExpression.ps1:2:9:2:10 | ConstantExpression at: BinaryExpression.ps1:2:9:2:10 |
+| BinaryExpression.ps1:3:11:3:24 | CommandExpression at: BinaryExpression.ps1:3:11:3:24 | BinaryExpression.ps1:3:11:3:24 | ...+... |
+| BinaryExpression.ps1:4:1:4:8 | CommandExpression at: BinaryExpression.ps1:4:1:4:8 | BinaryExpression.ps1:4:1:4:8 | result |
+| ExpandableString.ps1:1:1:1:40 | CommandExpression at: ExpandableString.ps1:1:1:1:40 | ExpandableString.ps1:1:1:1:40 | ExpandableStringExpression at: ExpandableString.ps1:1:1:1:40 |
+| ExpandableString.ps1:1:23:1:38 | CommandExpression at: ExpandableString.ps1:1:23:1:38 | file://:0:0:0:0 | (no string representation) |
+| SubExpression.ps1:1:1:1:24 | CommandExpression at: SubExpression.ps1:1:1:1:24 | SubExpression.ps1:1:1:1:24 | ArrayExpression at: SubExpression.ps1:1:1:1:24 |
+| SubExpression.ps1:2:1:2:22 | CommandExpression at: SubExpression.ps1:2:1:2:22 | SubExpression.ps1:2:1:2:22 | ArrayExpression at: SubExpression.ps1:2:1:2:22 |
+| TernaryExpression.ps1:1:8:1:23 | CommandExpression at: TernaryExpression.ps1:1:8:1:23 | TernaryExpression.ps1:1:8:1:23 | ...?...:... |
+| TernaryExpression.ps1:1:9:1:16 | CommandExpression at: TernaryExpression.ps1:1:9:1:16 | TernaryExpression.ps1:1:9:1:16 | ...+... |
+invokeMemoryExpression
+| SubExpression.ps1:1:1:1:24 | ArrayExpression at: SubExpression.ps1:1:1:1:24 | file://:0:0:0:0 | (no string representation) | 0 | SubExpression.ps1:1:21:1:23 | ConstantExpression at: SubExpression.ps1:1:21:1:23 |
+expandableString
+| ExpandableString.ps1:1:1:1:40 | ExpandableStringExpression at: ExpandableString.ps1:1:1:1:40 | 0 | ExpandableString.ps1:1:8:1:13 | name |
+| ExpandableString.ps1:1:1:1:40 | ExpandableStringExpression at: ExpandableString.ps1:1:1:1:40 | 1 | file://:0:0:0:0 | (no string representation) |

powershell/ql/test/library-tests/ast/Expressions/expressions.ql

@@ -0,0 +1,19 @@
+import powershell
+
+query predicate binaryExpr(BinaryExpr e, Expr e1, Expr e2) {
+    e1 = e.getLeft() and
+    e2 = e.getRight()
+}
+
+query predicate cmdExpr(CmdExpr cmd, Expr e) {
+    e = cmd.getExpression()
+}
+
+query predicate invokeMemoryExpression(InvokeMemberExpression invoke, Expr e, int i, Expr arg) {
+    e = invoke.getExpression() and
+    arg = invoke.getArgument(i)
+}
+
+query predicate expandableString(ExpandableStringExpression expandable, int i, Expr e) {
+    e = expandable.getExpr(i)
+}

powershell/ql/test/library-tests/ast/Loops/DoUntil.ps1

@@ -0,0 +1,7 @@
+DO
+{
+ “Starting Loop $a”
+ $a
+ $a++
+ “Now `$a is $a”
+} Until ($a -le 5)

powershell/ql/test/library-tests/ast/Loops/DoWhile.ps1

@@ -0,0 +1,7 @@
+DO
+{
+ “Starting Loop $a”
+ $a
+ $a++
+ “Now `$a is $a”
+} While ($a -le 5)

powershell/ql/test/library-tests/ast/Loops/While.ps1

@@ -0,0 +1,13 @@
+$var = 1
+while ($var -le 5)
+{
+    Write-Host The value of Var is: $var
+    $var++
+    if ($var -le 3){
+        continue;
+    }
+    else
+    {
+        break;
+    }
+}

powershell/ql/test/library-tests/ast/Loops/loops.ql

@@ -0,0 +1,16 @@
+import powershell
+
+query predicate doUntil(DoUntilStmt s, PipelineBase e, StmtBlock body) {
+  e = s.getCondition() and
+  body = s.getBody()
+}
+
+query predicate doWhile(DoWhileStmt s, PipelineBase e, StmtBlock body) {
+  e = s.getCondition() and
+  body = s.getBody()
+}
+
+query predicate while(WhileStmt s, PipelineBase e, StmtBlock body) {
+  e = s.getCondition() and
+  body = s.getBody()
+}

powershell/ql/test/library-tests/ast/Redirections/FileRedirection.ps1

@@ -0,0 +1,3 @@
+$(
+    Here is your current script
+) *>&1 > output.txt

powershell/ql/test/library-tests/ast/Redirections/redirections.expected

@@ -0,0 +1,2 @@
+| FileRedirection.ps1:3:3:3:7 | MergingRedirection |
+| FileRedirection.ps1:3:8:3:20 | FileRedirection |

powershell/ql/test/library-tests/ast/Redirections/redirections.ql

@@ -0,0 +1,3 @@
+import powershell
+
+query predicate redirection(Redirection r) { any() }

powershell/ql/test/library-tests/ast/Statements/ExitStatement.ps1

@@ -0,0 +1 @@
+exit -1

powershell/ql/test/library-tests/ast/Statements/IfStatement.ps1

@@ -0,0 +1,8 @@
+$x = 4
+
+if ($x -ge 3) {
+	"$x is greater than or equal to 3"
+}
+else {
+	"$x is less than 3"
+}

powershell/ql/test/library-tests/ast/Statements/TrapStatement.ps1

@@ -0,0 +1,6 @@
+function TrapTest {
+    trap {"Error found."}
+    nonsenseString
+}
+
+TrapTest

powershell/ql/test/library-tests/ast/Statements/Try.ps1

@@ -0,0 +1,13 @@
+try {
+   $Exception = New-Object System.Xaml.XamlException -ArgumentList ("Bad XAML!", $null, 10, 2)
+    throw $Exception
+}
+catch [System.Net.WebException],[System.IO.IOException] {
+    "Unable to download MyDoc.doc from http://www.contoso.com."
+}
+catch {
+    "An error occurred that could not be resolved."
+}
+finally {
+    "The finally block is executed."
+}

powershell/ql/test/library-tests/ast/Statements/UseProcessBlockForPipelineCommand.ps1

@@ -0,0 +1,11 @@
+Function Get-Number
+{
+    [CmdletBinding()]
+    Param(
+        [Parameter(ValueFromPipeline)]
+        [int]
+        $Number
+    )
+
+    $Number
+}