Merge remote-tracking branch 'upstream/main' into better-syntax-for-false-positives-and-negatives-inline-expectation

Required fixing up semantic conflicts in tests. Conflicts: python/ql/test/experimental/library-tests/frameworks/stdlib/Decoding.py
2026-05-02 04:05:14 +02:00 · 2020-11-03 09:47:26 +01:00
parent 6d0783a3bd 82f37e97c8
commit 5680b2df13
180 changed files with 3494 additions and 3248 deletions
--- a/python/ql/test/experimental/dataflow/basic/allFlowsConfig.qll
+++ b/python/ql/test/experimental/dataflow/basic/allFlowsConfig.qll
@@ -1,4 +1,4 @@
-import experimental.dataflow.DataFlow
+import semmle.python.dataflow.new.DataFlow

 /**
 * A configuration to find all flows.
--- a/python/ql/test/experimental/dataflow/basic/local.ql
+++ b/python/ql/test/experimental/dataflow/basic/local.ql
@@ -1,4 +1,4 @@
-import experimental.dataflow.DataFlow
+import semmle.python.dataflow.new.DataFlow

 from DataFlow::Node fromNode, DataFlow::Node toNode
 where DataFlow::localFlow(fromNode, toNode)
--- a/python/ql/test/experimental/dataflow/basic/localStep.ql
+++ b/python/ql/test/experimental/dataflow/basic/localStep.ql
@@ -1,4 +1,4 @@
-import experimental.dataflow.DataFlow
+import semmle.python.dataflow.new.DataFlow

 from DataFlow::Node fromNode, DataFlow::Node toNode
 where DataFlow::localFlowStep(fromNode, toNode)
--- a/python/ql/test/experimental/dataflow/basic/maximalFlowsConfig.qll
+++ b/python/ql/test/experimental/dataflow/basic/maximalFlowsConfig.qll
@@ -1,5 +1,5 @@
-import experimental.dataflow.DataFlow
-private import experimental.dataflow.internal.DataFlowPrivate as DataFlowPrivate
+import semmle.python.dataflow.new.DataFlow
+private import semmle.python.dataflow.new.internal.DataFlowPrivate as DataFlowPrivate

 /**
 * A configuration to find all "maximal" flows.
--- a/python/ql/test/experimental/dataflow/callGraphConfig.qll
+++ b/python/ql/test/experimental/dataflow/callGraphConfig.qll
@@ -1,6 +1,6 @@
 private import python
-import experimental.dataflow.DataFlow
-private import experimental.dataflow.internal.DataFlowPrivate as DataFlowPrivate
+import semmle.python.dataflow.new.DataFlow
+private import semmle.python.dataflow.new.internal.DataFlowPrivate as DataFlowPrivate

 /**
 * A configuration to find the call graph edges.
--- a/python/ql/test/experimental/dataflow/consistency/dataflow-consistency.ql
+++ b/python/ql/test/experimental/dataflow/consistency/dataflow-consistency.ql
@@ -1 +1 @@
-import experimental.dataflow.internal.DataFlowImplConsistency::Consistency
+import semmle.python.dataflow.new.internal.DataFlowImplConsistency::Consistency
--- a/python/ql/test/experimental/dataflow/coverage/argumentRouting1.ql
+++ b/python/ql/test/experimental/dataflow/coverage/argumentRouting1.ql
@@ -3,9 +3,9 @@
 */

 import python
-import experimental.dataflow.DataFlow
+import semmle.python.dataflow.new.DataFlow
 import DataFlow::PathGraph
-private import experimental.dataflow.internal.DataFlowPrivate as DataFlowPrivate
+private import semmle.python.dataflow.new.internal.DataFlowPrivate as DataFlowPrivate

 /**
 * A configuration to check routing of arguments through magic methods.
--- a/python/ql/test/experimental/dataflow/coverage/argumentRouting2.ql
+++ b/python/ql/test/experimental/dataflow/coverage/argumentRouting2.ql
@@ -3,7 +3,7 @@
 */

 import python
-import experimental.dataflow.DataFlow
+import semmle.python.dataflow.new.DataFlow
 import DataFlow::PathGraph

 /**
--- a/python/ql/test/experimental/dataflow/coverage/argumentRouting3.ql
+++ b/python/ql/test/experimental/dataflow/coverage/argumentRouting3.ql
@@ -3,7 +3,7 @@
 */

 import python
-import experimental.dataflow.DataFlow
+import semmle.python.dataflow.new.DataFlow
 import DataFlow::PathGraph

 /**
--- a/python/ql/test/experimental/dataflow/coverage/argumentRouting4.ql
+++ b/python/ql/test/experimental/dataflow/coverage/argumentRouting4.ql
@@ -3,7 +3,7 @@
 */

 import python
-import experimental.dataflow.DataFlow
+import semmle.python.dataflow.new.DataFlow
 import DataFlow::PathGraph

 /**
--- a/python/ql/test/experimental/dataflow/coverage/argumentRouting5.ql
+++ b/python/ql/test/experimental/dataflow/coverage/argumentRouting5.ql
@@ -3,7 +3,7 @@
 */

 import python
-import experimental.dataflow.DataFlow
+import semmle.python.dataflow.new.DataFlow
 import DataFlow::PathGraph

 /**
--- a/python/ql/test/experimental/dataflow/coverage/argumentRouting6.ql
+++ b/python/ql/test/experimental/dataflow/coverage/argumentRouting6.ql
@@ -3,7 +3,7 @@
 */

 import python
-import experimental.dataflow.DataFlow
+import semmle.python.dataflow.new.DataFlow
 import DataFlow::PathGraph

 /**
--- a/python/ql/test/experimental/dataflow/coverage/argumentRouting7.ql
+++ b/python/ql/test/experimental/dataflow/coverage/argumentRouting7.ql
@@ -3,7 +3,7 @@
 */

 import python
-import experimental.dataflow.DataFlow
+import semmle.python.dataflow.new.DataFlow
 import DataFlow::PathGraph

 /**
--- a/python/ql/test/experimental/dataflow/coverage/classesCallGraph.ql
+++ b/python/ql/test/experimental/dataflow/coverage/classesCallGraph.ql
@@ -1,5 +1,5 @@
-import experimental.dataflow.DataFlow
-private import experimental.dataflow.internal.DataFlowPrivate as DataFlowPrivate
+import semmle.python.dataflow.new.DataFlow
+private import semmle.python.dataflow.new.internal.DataFlowPrivate as DataFlowPrivate

 /**
 * A configuration to find the call graph edges.
--- a/python/ql/test/experimental/dataflow/coverage/localFlow.ql
+++ b/python/ql/test/experimental/dataflow/coverage/localFlow.ql
@@ -1,5 +1,5 @@
 import python
-import experimental.dataflow.DataFlow
+import semmle.python.dataflow.new.DataFlow

 from DataFlow::Node nodeFrom, DataFlow::Node nodeTo
 where
--- a/python/ql/test/experimental/dataflow/fieldflow/allLocalFlow.ql
+++ b/python/ql/test/experimental/dataflow/fieldflow/allLocalFlow.ql
@@ -1,5 +1,5 @@
 import python
-import experimental.dataflow.DataFlow
+import semmle.python.dataflow.new.DataFlow

 from DataFlow::Node nodeFrom, DataFlow::Node nodeTo
 where
--- a/python/ql/test/experimental/dataflow/fieldflow/localFlow.ql
+++ b/python/ql/test/experimental/dataflow/fieldflow/localFlow.ql
@@ -1,5 +1,5 @@
 import python
-import experimental.dataflow.DataFlow
+import semmle.python.dataflow.new.DataFlow

 from DataFlow::Node nodeFrom, DataFlow::Node nodeTo
 where
--- a/python/ql/test/experimental/dataflow/global-flow/accesses.ql
+++ b/python/ql/test/experimental/dataflow/global-flow/accesses.ql
@@ -1,5 +1,5 @@
 import python
-import experimental.dataflow.DataFlow
+import semmle.python.dataflow.new.DataFlow
 import TestUtilities.InlineExpectationsTest

 class GlobalReadTest extends InlineExpectationsTest {
--- a/python/ql/test/experimental/dataflow/import-helper/ImportHelper.ql
+++ b/python/ql/test/experimental/dataflow/import-helper/ImportHelper.ql
@@ -1,4 +1,4 @@
 import python
-import experimental.dataflow.DataFlow
+import semmle.python.dataflow.new.DataFlow

 query predicate importNode(DataFlow::Node res, string name) { res = DataFlow::importNode(name) }
--- a/python/ql/test/experimental/dataflow/regression/custom_dataflow.ql
+++ b/python/ql/test/experimental/dataflow/regression/custom_dataflow.ql
@@ -8,7 +8,7 @@
 */

 import python
-import experimental.dataflow.DataFlow
+import semmle.python.dataflow.new.DataFlow

 class CustomTestConfiguration extends DataFlow::Configuration {
  CustomTestConfiguration() { this = "CustomTestConfiguration" }
--- a/python/ql/test/experimental/dataflow/strange-essaflow/testFlow.ql
+++ b/python/ql/test/experimental/dataflow/strange-essaflow/testFlow.ql
@@ -1,6 +1,6 @@
 import python
-import experimental.dataflow.DataFlow
-private import experimental.dataflow.internal.DataFlowPrivate as DataFlowPrivate
+import semmle.python.dataflow.new.DataFlow
+private import semmle.python.dataflow.new.internal.DataFlowPrivate as DataFlowPrivate

 /** Gets the EssaNode that holds the module imported by the fully qualified module name `name` */
 DataFlow::EssaNode module_import(string name) {
--- a/python/ql/test/experimental/dataflow/tainttracking/TestTaintLib.qll
+++ b/python/ql/test/experimental/dataflow/tainttracking/TestTaintLib.qll
@@ -1,6 +1,6 @@
 import python
-import experimental.dataflow.TaintTracking
-import experimental.dataflow.DataFlow
+import semmle.python.dataflow.new.TaintTracking
+import semmle.python.dataflow.new.DataFlow

 class TestTaintTrackingConfiguration extends TaintTracking::Configuration {
  TestTaintTrackingConfiguration() { this = "TestTaintTrackingConfiguration" }
--- a/python/ql/test/experimental/dataflow/tainttracking/basic/GlobalTaintTracking.ql
+++ b/python/ql/test/experimental/dataflow/tainttracking/basic/GlobalTaintTracking.ql
@@ -1,6 +1,6 @@
 import python
-import experimental.dataflow.TaintTracking
-import experimental.dataflow.DataFlow
+import semmle.python.dataflow.new.TaintTracking
+import semmle.python.dataflow.new.DataFlow

 class TestTaintTrackingConfiguration extends TaintTracking::Configuration {
  TestTaintTrackingConfiguration() { this = "TestTaintTrackingConfiguration" }
--- a/python/ql/test/experimental/dataflow/tainttracking/basic/LocalTaintStep.ql
+++ b/python/ql/test/experimental/dataflow/tainttracking/basic/LocalTaintStep.ql
@@ -1,6 +1,6 @@
 import python
-import experimental.dataflow.TaintTracking
-import experimental.dataflow.DataFlow
+import semmle.python.dataflow.new.TaintTracking
+import semmle.python.dataflow.new.DataFlow

 from DataFlow::Node nodeFrom, DataFlow::Node nodeTo
 where TaintTracking::localTaintStep(nodeFrom, nodeTo)
--- a/python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep-py3/TestTaint.expected
+++ b/python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep-py3/TestTaint.expected
@@ -16,12 +16,12 @@
 | test_string.py:17 | ok   | str_methods | ts.casefold() |
 | test_string.py:19 | ok   | str_methods | ts.format_map(..) |
 | test_string.py:20 | ok   | str_methods | "{unsafe}".format_map(..) |
-| test_string.py:31 | fail | binary_decode_encode | base64.a85encode(..) |
-| test_string.py:32 | fail | binary_decode_encode | base64.a85decode(..) |
-| test_string.py:35 | fail | binary_decode_encode | base64.b85encode(..) |
-| test_string.py:36 | fail | binary_decode_encode | base64.b85decode(..) |
-| test_string.py:39 | fail | binary_decode_encode | base64.encodebytes(..) |
-| test_string.py:40 | fail | binary_decode_encode | base64.decodebytes(..) |
+| test_string.py:31 | ok   | binary_decode_encode | base64.a85encode(..) |
+| test_string.py:32 | ok   | binary_decode_encode | base64.a85decode(..) |
+| test_string.py:35 | ok   | binary_decode_encode | base64.b85encode(..) |
+| test_string.py:36 | ok   | binary_decode_encode | base64.b85decode(..) |
+| test_string.py:39 | ok   | binary_decode_encode | base64.encodebytes(..) |
+| test_string.py:40 | ok   | binary_decode_encode | base64.decodebytes(..) |
 | test_string.py:48 | ok   | f_strings | Fstring |
 | test_unpacking.py:18 | ok   | extended_unpacking | first |
 | test_unpacking.py:18 | ok   | extended_unpacking | last |
--- a/python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep/TestTaint.expected
+++ b/python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep/TestTaint.expected
@@ -123,18 +123,18 @@
 | test_string.py:114 | ok   | percent_fmt | BinaryExpr |
 | test_string.py:115 | ok   | percent_fmt | BinaryExpr |
 | test_string.py:116 | ok   | percent_fmt | BinaryExpr |
-| test_string.py:126 | fail | binary_decode_encode | base64.b64encode(..) |
-| test_string.py:127 | fail | binary_decode_encode | base64.b64decode(..) |
-| test_string.py:129 | fail | binary_decode_encode | base64.standard_b64encode(..) |
-| test_string.py:130 | fail | binary_decode_encode | base64.standard_b64decode(..) |
-| test_string.py:132 | fail | binary_decode_encode | base64.urlsafe_b64encode(..) |
-| test_string.py:133 | fail | binary_decode_encode | base64.urlsafe_b64decode(..) |
-| test_string.py:135 | fail | binary_decode_encode | base64.b32encode(..) |
-| test_string.py:136 | fail | binary_decode_encode | base64.b32decode(..) |
-| test_string.py:138 | fail | binary_decode_encode | base64.b16encode(..) |
-| test_string.py:139 | fail | binary_decode_encode | base64.b16decode(..) |
-| test_string.py:142 | fail | binary_decode_encode | base64.encodestring(..) |
-| test_string.py:143 | fail | binary_decode_encode | base64.decodestring(..) |
+| test_string.py:126 | ok   | binary_decode_encode | base64.b64encode(..) |
+| test_string.py:127 | ok   | binary_decode_encode | base64.b64decode(..) |
+| test_string.py:129 | ok   | binary_decode_encode | base64.standard_b64encode(..) |
+| test_string.py:130 | ok   | binary_decode_encode | base64.standard_b64decode(..) |
+| test_string.py:132 | ok   | binary_decode_encode | base64.urlsafe_b64encode(..) |
+| test_string.py:133 | ok   | binary_decode_encode | base64.urlsafe_b64decode(..) |
+| test_string.py:135 | ok   | binary_decode_encode | base64.b32encode(..) |
+| test_string.py:136 | ok   | binary_decode_encode | base64.b32decode(..) |
+| test_string.py:138 | ok   | binary_decode_encode | base64.b16encode(..) |
+| test_string.py:139 | ok   | binary_decode_encode | base64.b16decode(..) |
+| test_string.py:142 | ok   | binary_decode_encode | base64.encodestring(..) |
+| test_string.py:143 | ok   | binary_decode_encode | base64.decodestring(..) |
 | test_string.py:148 | fail | binary_decode_encode | quopri.encodestring(..) |
 | test_string.py:149 | fail | binary_decode_encode | quopri.decodestring(..) |
 | test_string.py:159 | ok   | test_os_path_join | os.path.join(..) |
--- a/python/ql/test/experimental/dataflow/testConfig.qll
+++ b/python/ql/test/experimental/dataflow/testConfig.qll
@@ -21,7 +21,7 @@
 */

 private import python
-import experimental.dataflow.DataFlow
+import semmle.python.dataflow.new.DataFlow

 class TestConfiguration extends DataFlow::Configuration {
  TestConfiguration() { this = "TestConfiguration" }
--- a/python/ql/test/experimental/dataflow/typetracking/moduleattr.ql
+++ b/python/ql/test/experimental/dataflow/typetracking/moduleattr.ql
@@ -1,6 +1,6 @@
 import python
-import experimental.dataflow.DataFlow
-import experimental.dataflow.TypeTracker
+import semmle.python.dataflow.new.DataFlow
+import semmle.python.dataflow.new.TypeTracker

 DataFlow::Node module_tracker(TypeTracker t) {
  t.start() and
--- a/python/ql/test/experimental/dataflow/typetracking/tracked.ql
+++ b/python/ql/test/experimental/dataflow/typetracking/tracked.ql
@@ -1,6 +1,6 @@
 import python
-import experimental.dataflow.DataFlow
-import experimental.dataflow.TypeTracker
+import semmle.python.dataflow.new.DataFlow
+import semmle.python.dataflow.new.TypeTracker
 import TestUtilities.InlineExpectationsTest

 DataFlow::Node tracked(TypeTracker t) {
--- a/python/ql/test/experimental/library-tests/frameworks/django-v2-v3/TestTaint.ql
+++ b/python/ql/test/experimental/library-tests/frameworks/django-v2-v3/TestTaint.ql
@@ -1,5 +1,5 @@
 import experimental.dataflow.tainttracking.TestTaintLib
-import experimental.dataflow.RemoteFlowSources
+import semmle.python.dataflow.new.RemoteFlowSources

 class RemoteFlowTestTaintConfiguration extends TestTaintTrackingConfiguration {
  override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
--- a/python/ql/test/experimental/library-tests/frameworks/django-v2-v3/routing_test.py
+++ b/python/ql/test/experimental/library-tests/frameworks/django-v2-v3/routing_test.py
@@ -78,7 +78,7 @@ urlpatterns = [
 def page_number(request, page_number=1):  # $routeHandler routedParameter=page_number
    return HttpResponse('page_number: {}'.format(page_number))  # $HttpResponse

-def foo_bar_baz(request, foo, bar, baz):  # $routeHandler $routedParameter=foo routedParameter=bar routedParameter=baz
+def foo_bar_baz(request, foo, bar, baz):  # $routeHandler routedParameter=foo routedParameter=bar routedParameter=baz
    return HttpResponse('foo_bar_baz: {} {} {}'.format(foo, bar, baz))  # $HttpResponse

 def path_kwargs(request, foo, bar):  # $routeHandler routedParameter=foo routedParameter=bar
--- a/python/ql/test/experimental/library-tests/frameworks/django/SqlExecution.py
+++ b/python/ql/test/experimental/library-tests/frameworks/django/SqlExecution.py
@@ -20,7 +20,7 @@ class User(models.Model):
 def test_model():
    User.objects.raw("some sql")  # $getSql="some sql"
    User.objects.annotate(RawSQL("some sql"))  # $getSql="some sql"
-    User.objects.annotate(RawSQL("foo"), RawSQL("bar"))  # $getSql="foo" $getSql="bar"
+    User.objects.annotate(RawSQL("foo"), RawSQL("bar"))  # $getSql="foo" getSql="bar"
    User.objects.annotate(val=RawSQL("some sql"))  # $getSql="some sql"
    User.objects.extra("some sql")  # $getSql="some sql"
    User.objects.extra(select="select", where="where", tables="tables", order_by="order_by")  # $getSql="select" getSql="where" getSql="tables" getSql="order_by"
--- a/python/ql/test/experimental/library-tests/frameworks/flask/TestTaint.ql
+++ b/python/ql/test/experimental/library-tests/frameworks/flask/TestTaint.ql
@@ -1,5 +1,5 @@
 import experimental.dataflow.tainttracking.TestTaintLib
-import experimental.dataflow.RemoteFlowSources
+import semmle.python.dataflow.new.RemoteFlowSources

 class RemoteFlowTestTaintConfiguration extends TestTaintTrackingConfiguration {
  override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
--- a/python/ql/test/experimental/library-tests/frameworks/modeling-example/NaiveModel.ql
+++ b/python/ql/test/experimental/library-tests/frameworks/modeling-example/NaiveModel.ql
@@ -3,8 +3,8 @@
 */

 private import python
-private import experimental.dataflow.DataFlow
-private import experimental.dataflow.TaintTracking
+private import semmle.python.dataflow.new.DataFlow
+private import semmle.python.dataflow.new.TaintTracking
 import DataFlow::PathGraph
 import SharedCode

--- a/python/ql/test/experimental/library-tests/frameworks/modeling-example/ProperModel.ql
+++ b/python/ql/test/experimental/library-tests/frameworks/modeling-example/ProperModel.ql
@@ -3,8 +3,8 @@
 */

 private import python
-private import experimental.dataflow.DataFlow
-private import experimental.dataflow.TaintTracking
+private import semmle.python.dataflow.new.DataFlow
+private import semmle.python.dataflow.new.TaintTracking
 import DataFlow::PathGraph
 import SharedCode

--- a/python/ql/test/experimental/library-tests/frameworks/modeling-example/SharedCode.qll
+++ b/python/ql/test/experimental/library-tests/frameworks/modeling-example/SharedCode.qll
@@ -1,6 +1,6 @@
 private import python
-private import experimental.dataflow.DataFlow
-private import experimental.dataflow.TaintTracking
+private import semmle.python.dataflow.new.DataFlow
+private import semmle.python.dataflow.new.TaintTracking

 // Helpers modeling MyClass
 /** A data-flow Node representing an instance of MyClass. */
--- a/python/ql/test/experimental/library-tests/frameworks/mysql-connector-python/ConceptsTest.expected
+++ b/python/ql/test/experimental/library-tests/frameworks/mysql-connector-python/ConceptsTest.expected
--- a/python/ql/test/experimental/library-tests/frameworks/mysql-connector-python/ConceptsTest.ql
+++ b/python/ql/test/experimental/library-tests/frameworks/mysql-connector-python/ConceptsTest.ql
@@ -0,0 +1,2 @@
+import python
+import experimental.meta.ConceptsTest
--- a/python/ql/test/experimental/library-tests/frameworks/mysql-connector-python/pep249.py
+++ b/python/ql/test/experimental/library-tests/frameworks/mysql-connector-python/pep249.py
@@ -0,0 +1,37 @@
+# taken from https://dev.mysql.com/doc/connector-python/en/connector-python-example-cursor-transaction.html
+from __future__ import print_function
+from datetime import date, datetime, timedelta
+import mysql.connector
+
+cnx = mysql.connector.connect(user='scott', database='employees')
+cursor = cnx.cursor()
+
+tomorrow = datetime.now().date() + timedelta(days=1)
+
+add_employee = ("INSERT INTO employees "
+               "(first_name, last_name, hire_date, gender, birth_date) "
+               "VALUES (%s, %s, %s, %s, %s)")
+add_salary = ("INSERT INTO salaries "
+              "(emp_no, salary, from_date, to_date) "
+              "VALUES (%(emp_no)s, %(salary)s, %(from_date)s, %(to_date)s)")
+
+data_employee = ('Geert', 'Vanderkelen', tomorrow, 'M', date(1977, 6, 14))
+
+# Insert new employee
+cursor.execute(add_employee, data_employee)  # $getSql=add_employee
+emp_no = cursor.lastrowid
+
+# Insert salary information
+data_salary = {
+  'emp_no': emp_no,
+  'salary': 50000,
+  'from_date': tomorrow,
+  'to_date': date(9999, 1, 1),
+}
+cursor.execute(add_salary, data_salary)  # $getSql=add_salary
+
+# Make sure data is committed to the database
+cnx.commit()
+
+cursor.close()
+cnx.close()
--- a/python/ql/test/experimental/library-tests/frameworks/mysqldb/ConceptsTest.expected
+++ b/python/ql/test/experimental/library-tests/frameworks/mysqldb/ConceptsTest.expected
--- a/python/ql/test/experimental/library-tests/frameworks/mysqldb/ConceptsTest.ql
+++ b/python/ql/test/experimental/library-tests/frameworks/mysqldb/ConceptsTest.ql
@@ -0,0 +1,2 @@
+import python
+import experimental.meta.ConceptsTest
--- a/python/ql/test/experimental/library-tests/frameworks/mysqldb/pep249.py
+++ b/python/ql/test/experimental/library-tests/frameworks/mysqldb/pep249.py
@@ -0,0 +1,7 @@
+# taken from https://mysqlclient.readthedocs.io/user_guide.html#some-examples
+import MySQLdb
+db=MySQLdb.connect(passwd="moonpie",db="thangs")
+
+c=db.cursor()
+max_price=5
+c.execute("some sql", (max_price,))  # $getSql="some sql"
--- a/python/ql/test/experimental/library-tests/frameworks/stdlib-py3/Decoding.py
+++ b/python/ql/test/experimental/library-tests/frameworks/stdlib-py3/Decoding.py
@@ -0,0 +1,6 @@
+import base64
+
+# TODO: These tests should be merged with python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep-py3/test_string.py
+base64.a85decode(payload)  # $ decodeInput=payload decodeOutput=Attribute() decodeFormat=Ascii85
+base64.b85decode(payload)  # $ decodeInput=payload decodeOutput=Attribute() decodeFormat=Base85
+base64.decodebytes(payload)  # $ decodeInput=payload decodeOutput=Attribute() decodeFormat=Base64
--- a/python/ql/test/experimental/library-tests/frameworks/stdlib-py3/Encoding.py
+++ b/python/ql/test/experimental/library-tests/frameworks/stdlib-py3/Encoding.py
@@ -0,0 +1,6 @@
+import base64
+
+# TODO: These tests should be merged with python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep-py3/test_string.py
+base64.a85encode(bs) # $ encodeInput=bs encodeOutput=Attribute() encodeFormat=Ascii85
+base64.b85encode(bs)# $ encodeInput=bs encodeOutput=Attribute() encodeFormat=Base85
+base64.encodebytes(bs)# $ encodeInput=bs encodeOutput=Attribute() encodeFormat=Base64
--- a/python/ql/test/experimental/library-tests/frameworks/stdlib/Decoding.py
+++ b/python/ql/test/experimental/library-tests/frameworks/stdlib/Decoding.py
@@ -1,5 +1,15 @@
 import pickle
 import marshal
+import base64

-pickle.loads(payload)  # $decodeInput=payload decodeOutput=Attribute() decodeFormat=pickle decodeMayExecuteInput
-marshal.loads(payload)  # $decodeInput=payload decodeOutput=Attribute() decodeFormat=marshal decodeMayExecuteInput
+pickle.loads(payload)  # $ decodeInput=payload decodeOutput=Attribute() decodeFormat=pickle decodeMayExecuteInput
+marshal.loads(payload)  # $ decodeInput=payload decodeOutput=Attribute() decodeFormat=marshal decodeMayExecuteInput
+
+# TODO: These tests should be merged with python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep/test_string.py
+base64.b64decode(payload)  # $ decodeInput=payload decodeOutput=Attribute() decodeFormat=Base64
+base64.standard_b64decode(payload)  # $ decodeInput=payload decodeOutput=Attribute() decodeFormat=Base64
+base64.urlsafe_b64decode(payload)  # $ decodeInput=payload decodeOutput=Attribute() decodeFormat=Base64
+base64.b32decode(payload)  # $ decodeInput=payload decodeOutput=Attribute() decodeFormat=Base32
+base64.b16decode(payload)  # $ decodeInput=payload decodeOutput=Attribute() decodeFormat=Base16
+# deprecated since Python 3.1, but still works
+base64.decodestring(payload)  # $ decodeInput=payload decodeOutput=Attribute() decodeFormat=Base64
--- a/python/ql/test/experimental/library-tests/frameworks/stdlib/Encoding.py
+++ b/python/ql/test/experimental/library-tests/frameworks/stdlib/Encoding.py
@@ -0,0 +1,15 @@
+import pickle
+import marshal
+import base64
+
+pickle.dumps(obj)  # $ MISSING: f-:encodeInput=obj f-:encodeOutput=Attribute() f-:encodeFormat=pickle f-:encodeMayExecuteInput
+marshal.dumps(obj)  # $ MISSING: f-:encodeInput=obj f-:encodeOutput=Attribute() f-:encodeFormat=marshal f-:encodeMayExecuteInput
+
+# TODO: These tests should be merged with python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep/test_string.py
+base64.b64encode(bs)  # $ encodeInput=bs encodeOutput=Attribute() encodeFormat=Base64
+base64.standard_b64encode(bs)  # $ encodeInput=bs encodeOutput=Attribute() encodeFormat=Base64
+base64.urlsafe_b64encode(bs)  # $ encodeInput=bs encodeOutput=Attribute() encodeFormat=Base64
+base64.b32encode(bs)  # $ encodeInput=bs encodeOutput=Attribute() encodeFormat=Base32
+base64.b16encode(bs)  # $ encodeInput=bs encodeOutput=Attribute() encodeFormat=Base16
+# deprecated since Python 3.1, but still works
+base64.encodestring(bs)  # $ encodeInput=bs encodeOutput=Attribute() encodeFormat=Base64
--- a/python/ql/test/experimental/library-tests/frameworks/stdlib/TestTaint.ql
+++ b/python/ql/test/experimental/library-tests/frameworks/stdlib/TestTaint.ql
@@ -1,2 +1,2 @@
 import experimental.dataflow.tainttracking.TestTaintLib
-import experimental.dataflow.RemoteFlowSources
+import semmle.python.dataflow.new.RemoteFlowSources
--- a/python/ql/test/experimental/meta/ConceptsTest.qll
+++ b/python/ql/test/experimental/meta/ConceptsTest.qll
@@ -1,6 +1,6 @@
 import python
-import experimental.dataflow.DataFlow
-import experimental.semmle.python.Concepts
+import semmle.python.dataflow.new.DataFlow
+import semmle.python.Concepts
 import TestUtilities.InlineExpectationsTest

 string value_from_expr(Expr e) {
@@ -73,6 +73,38 @@ class DecodingTest extends InlineExpectationsTest {
  }
 }

+class EncodingTest extends InlineExpectationsTest {
+  EncodingTest() { this = "EncodingTest" }
+
+  override string getARelevantTag() { result in ["encodeInput", "encodeOutput", "encodeFormat"] }
+
+  override predicate hasActualResult(Location location, string element, string tag, string value) {
+    exists(location.getFile().getRelativePath()) and
+    exists(Encoding e |
+      exists(DataFlow::Node data |
+        location = data.getLocation() and
+        element = data.toString() and
+        value = value_from_expr(data.asExpr()) and
+        (
+          data = e.getAnInput() and
+          tag = "encodeInput"
+          or
+          data = e.getOutput() and
+          tag = "encodeOutput"
+        )
+      )
+      or
+      exists(string format |
+        location = e.getLocation() and
+        element = format and
+        value = format and
+        format = e.getFormat() and
+        tag = "encodeFormat"
+      )
+    )
+  }
+}
+
 class CodeExecutionTest extends InlineExpectationsTest {
  CodeExecutionTest() { this = "CodeExecutionTest" }

--- a/python/ql/test/experimental/query-tests/Security-new-dataflow/CWE-022/PathInjection.qlref
+++ b/python/ql/test/experimental/query-tests/Security-new-dataflow/CWE-022/PathInjection.qlref
@@ -1 +0,0 @@
-experimental/Security-new-dataflow/CWE-022/PathInjection.ql
--- a/python/ql/test/experimental/query-tests/Security-new-dataflow/CWE-078-py2/CommandInjection.qlref
+++ b/python/ql/test/experimental/query-tests/Security-new-dataflow/CWE-078-py2/CommandInjection.qlref
@@ -1 +0,0 @@
-experimental/Security-new-dataflow/CWE-078/CommandInjection.ql
--- a/python/ql/test/experimental/query-tests/Security-new-dataflow/CWE-078/CommandInjection.expected
+++ b/python/ql/test/experimental/query-tests/Security-new-dataflow/CWE-078/CommandInjection.expected
@@ -1,42 +0,0 @@
-edges
-| command_injection.py:10:13:10:24 | ControlFlowNode for Attribute | command_injection.py:12:15:12:27 | ControlFlowNode for BinaryExpr |
-| command_injection.py:17:13:17:24 | ControlFlowNode for Attribute | command_injection.py:19:22:19:34 | ControlFlowNode for BinaryExpr |
-| command_injection.py:24:11:24:22 | ControlFlowNode for Attribute | command_injection.py:25:23:25:25 | ControlFlowNode for cmd |
-| command_injection.py:30:13:30:24 | ControlFlowNode for Attribute | command_injection.py:32:14:32:26 | ControlFlowNode for BinaryExpr |
-| command_injection.py:36:15:36:26 | ControlFlowNode for Attribute | command_injection.py:39:15:39:21 | ControlFlowNode for command |
-| command_injection.py:36:15:36:26 | ControlFlowNode for Attribute | command_injection.py:40:15:40:21 | ControlFlowNode for command |
-| command_injection.py:52:15:52:26 | ControlFlowNode for Attribute | command_injection.py:53:15:53:21 | ControlFlowNode for command |
-| command_injection.py:52:15:52:26 | ControlFlowNode for Attribute | command_injection.py:54:14:54:20 | ControlFlowNode for command |
-| command_injection.py:52:15:52:26 | ControlFlowNode for Attribute | command_injection.py:55:21:55:27 | ControlFlowNode for command |
-| command_injection.py:52:15:52:26 | ControlFlowNode for Attribute | command_injection.py:56:27:56:33 | ControlFlowNode for command |
-| command_injection.py:52:15:52:26 | ControlFlowNode for Attribute | command_injection.py:57:20:57:26 | ControlFlowNode for command |
-nodes
-| command_injection.py:10:13:10:24 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
-| command_injection.py:12:15:12:27 | ControlFlowNode for BinaryExpr | semmle.label | ControlFlowNode for BinaryExpr |
-| command_injection.py:17:13:17:24 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
-| command_injection.py:19:22:19:34 | ControlFlowNode for BinaryExpr | semmle.label | ControlFlowNode for BinaryExpr |
-| command_injection.py:24:11:24:22 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
-| command_injection.py:25:23:25:25 | ControlFlowNode for cmd | semmle.label | ControlFlowNode for cmd |
-| command_injection.py:30:13:30:24 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
-| command_injection.py:32:14:32:26 | ControlFlowNode for BinaryExpr | semmle.label | ControlFlowNode for BinaryExpr |
-| command_injection.py:36:15:36:26 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
-| command_injection.py:39:15:39:21 | ControlFlowNode for command | semmle.label | ControlFlowNode for command |
-| command_injection.py:40:15:40:21 | ControlFlowNode for command | semmle.label | ControlFlowNode for command |
-| command_injection.py:52:15:52:26 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
-| command_injection.py:53:15:53:21 | ControlFlowNode for command | semmle.label | ControlFlowNode for command |
-| command_injection.py:54:14:54:20 | ControlFlowNode for command | semmle.label | ControlFlowNode for command |
-| command_injection.py:55:21:55:27 | ControlFlowNode for command | semmle.label | ControlFlowNode for command |
-| command_injection.py:56:27:56:33 | ControlFlowNode for command | semmle.label | ControlFlowNode for command |
-| command_injection.py:57:20:57:26 | ControlFlowNode for command | semmle.label | ControlFlowNode for command |
-#select
-| command_injection.py:12:15:12:27 | ControlFlowNode for BinaryExpr | command_injection.py:10:13:10:24 | ControlFlowNode for Attribute | command_injection.py:12:15:12:27 | ControlFlowNode for BinaryExpr | This command depends on $@. | command_injection.py:10:13:10:24 | ControlFlowNode for Attribute | a user-provided value |
-| command_injection.py:19:22:19:34 | ControlFlowNode for BinaryExpr | command_injection.py:17:13:17:24 | ControlFlowNode for Attribute | command_injection.py:19:22:19:34 | ControlFlowNode for BinaryExpr | This command depends on $@. | command_injection.py:17:13:17:24 | ControlFlowNode for Attribute | a user-provided value |
-| command_injection.py:25:23:25:25 | ControlFlowNode for cmd | command_injection.py:24:11:24:22 | ControlFlowNode for Attribute | command_injection.py:25:23:25:25 | ControlFlowNode for cmd | This command depends on $@. | command_injection.py:24:11:24:22 | ControlFlowNode for Attribute | a user-provided value |
-| command_injection.py:32:14:32:26 | ControlFlowNode for BinaryExpr | command_injection.py:30:13:30:24 | ControlFlowNode for Attribute | command_injection.py:32:14:32:26 | ControlFlowNode for BinaryExpr | This command depends on $@. | command_injection.py:30:13:30:24 | ControlFlowNode for Attribute | a user-provided value |
-| command_injection.py:39:15:39:21 | ControlFlowNode for command | command_injection.py:36:15:36:26 | ControlFlowNode for Attribute | command_injection.py:39:15:39:21 | ControlFlowNode for command | This command depends on $@. | command_injection.py:36:15:36:26 | ControlFlowNode for Attribute | a user-provided value |
-| command_injection.py:40:15:40:21 | ControlFlowNode for command | command_injection.py:36:15:36:26 | ControlFlowNode for Attribute | command_injection.py:40:15:40:21 | ControlFlowNode for command | This command depends on $@. | command_injection.py:36:15:36:26 | ControlFlowNode for Attribute | a user-provided value |
-| command_injection.py:53:15:53:21 | ControlFlowNode for command | command_injection.py:52:15:52:26 | ControlFlowNode for Attribute | command_injection.py:53:15:53:21 | ControlFlowNode for command | This command depends on $@. | command_injection.py:52:15:52:26 | ControlFlowNode for Attribute | a user-provided value |
-| command_injection.py:54:14:54:20 | ControlFlowNode for command | command_injection.py:52:15:52:26 | ControlFlowNode for Attribute | command_injection.py:54:14:54:20 | ControlFlowNode for command | This command depends on $@. | command_injection.py:52:15:52:26 | ControlFlowNode for Attribute | a user-provided value |
-| command_injection.py:55:21:55:27 | ControlFlowNode for command | command_injection.py:52:15:52:26 | ControlFlowNode for Attribute | command_injection.py:55:21:55:27 | ControlFlowNode for command | This command depends on $@. | command_injection.py:52:15:52:26 | ControlFlowNode for Attribute | a user-provided value |
-| command_injection.py:56:27:56:33 | ControlFlowNode for command | command_injection.py:52:15:52:26 | ControlFlowNode for Attribute | command_injection.py:56:27:56:33 | ControlFlowNode for command | This command depends on $@. | command_injection.py:52:15:52:26 | ControlFlowNode for Attribute | a user-provided value |
-| command_injection.py:57:20:57:26 | ControlFlowNode for command | command_injection.py:52:15:52:26 | ControlFlowNode for Attribute | command_injection.py:57:20:57:26 | ControlFlowNode for command | This command depends on $@. | command_injection.py:52:15:52:26 | ControlFlowNode for Attribute | a user-provided value |
--- a/python/ql/test/experimental/query-tests/Security-new-dataflow/CWE-078/CommandInjection.qlref
+++ b/python/ql/test/experimental/query-tests/Security-new-dataflow/CWE-078/CommandInjection.qlref
@@ -1 +0,0 @@
-experimental/Security-new-dataflow/CWE-078/CommandInjection.ql
--- a/python/ql/test/experimental/query-tests/Security-new-dataflow/CWE-078/command_injection.py
+++ b/python/ql/test/experimental/query-tests/Security-new-dataflow/CWE-078/command_injection.py
@@ -1,57 +0,0 @@
-
-import os
-import subprocess
-
-from flask import Flask, request
-app = Flask(__name__)
-
-@app.route("/command1")
-def command_injection1():
-    files = request.args.get('files', '')
-    # Don't let files be `; rm -rf /`
-    os.system("ls " + files)
-
-
-@app.route("/command2")
-def command_injection2():
-    files = request.args.get('files', '')
-    # Don't let files be `; rm -rf /`
-    subprocess.Popen("ls " + files, shell=True)
-
-
-@app.route("/command3")
-def first_arg_injection():
-    cmd = request.args.get('cmd', '')
-    subprocess.Popen([cmd, "param1"])
-
-
-@app.route("/other_cases")
-def others():
-    files = request.args.get('files', '')
-    # Don't let files be `; rm -rf /`
-    os.popen("ls " + files)
-
-@app.route("/multiple")
-def multiple():
-    command = request.args.get('command', '')
-    # We should mark flow to both calls here, which conflicts with removing flow out of
-    # a sink due to use-use flow.
-    os.system(command)
-    os.system(command)
-
-
-@app.route("/not-into-sink-impl")
-def not_into_sink_impl():
-    """When there is flow to a sink such as `os.popen(cmd)`, we don't want to highlight that there is also
-    flow through the actual `popen` function to the internal call to `subprocess.Popen` -- we would usually
-    see that flow since we extract the `os.py` file from the standard library.
-
-    os.popen implementation: https://github.com/python/cpython/blob/fa7ce080175f65d678a7d5756c94f82887fc9803/Lib/os.py#L974
-    subprocess.call implementation: https://github.com/python/cpython/blob/fa7ce080175f65d678a7d5756c94f82887fc9803/Lib/subprocess.py#L341
-    """
-    command = request.args.get('command', '')
-    os.system(command)
-    os.popen(command)
-    subprocess.call(command)
-    subprocess.check_call(command)
-    subprocess.run(command)
--- a/python/ql/test/experimental/query-tests/Security-new-dataflow/CWE-079/ReflectedXss.expected
+++ b/python/ql/test/experimental/query-tests/Security-new-dataflow/CWE-079/ReflectedXss.expected
@@ -1,7 +0,0 @@
-edges
-| reflected_xss.py:8:18:8:29 | ControlFlowNode for Attribute | reflected_xss.py:9:26:9:53 | ControlFlowNode for BinaryExpr |
-nodes
-| reflected_xss.py:8:18:8:29 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
-| reflected_xss.py:9:26:9:53 | ControlFlowNode for BinaryExpr | semmle.label | ControlFlowNode for BinaryExpr |
-#select
-| reflected_xss.py:9:26:9:53 | ControlFlowNode for BinaryExpr | reflected_xss.py:8:18:8:29 | ControlFlowNode for Attribute | reflected_xss.py:9:26:9:53 | ControlFlowNode for BinaryExpr | Cross-site scripting vulnerability due to $@. | reflected_xss.py:8:18:8:29 | ControlFlowNode for Attribute | a user-provided value |
--- a/python/ql/test/experimental/query-tests/Security-new-dataflow/CWE-079/ReflectedXss.qlref
+++ b/python/ql/test/experimental/query-tests/Security-new-dataflow/CWE-079/ReflectedXss.qlref
@@ -1 +0,0 @@
-experimental/Security-new-dataflow/CWE-079/ReflectedXss.ql
--- a/python/ql/test/experimental/query-tests/Security-new-dataflow/CWE-079/reflected_xss.py
+++ b/python/ql/test/experimental/query-tests/Security-new-dataflow/CWE-079/reflected_xss.py
@@ -1,15 +0,0 @@
-from flask import Flask, request, make_response, escape
-
-app = Flask(__name__)
-
-
-@app.route("/unsafe")
-def unsafe():
-    first_name = request.args.get("name", "")
-    return make_response("Your name is " + first_name)  # NOT OK
-
-
-@app.route("/safe")
-def safe():
-    first_name = request.args.get("name", "")
-    return make_response("Your name is " + escape(first_name))  # OK
--- a/python/ql/test/experimental/query-tests/Security-new-dataflow/CWE-089/SqlInjection.expected
+++ b/python/ql/test/experimental/query-tests/Security-new-dataflow/CWE-089/SqlInjection.expected
@@ -1,16 +0,0 @@
-edges
-| sql_injection.py:14:15:14:22 | SSA variable username | sql_injection.py:21:24:21:77 | ControlFlowNode for BinaryExpr |
-| sql_injection.py:14:15:14:22 | SSA variable username | sql_injection.py:24:38:24:95 | ControlFlowNode for BinaryExpr |
-| sql_injection.py:14:15:14:22 | SSA variable username | sql_injection.py:25:26:25:83 | ControlFlowNode for BinaryExpr |
-| sql_injection.py:14:15:14:22 | SSA variable username | sql_injection.py:26:28:26:85 | ControlFlowNode for BinaryExpr |
-nodes
-| sql_injection.py:14:15:14:22 | SSA variable username | semmle.label | SSA variable username |
-| sql_injection.py:21:24:21:77 | ControlFlowNode for BinaryExpr | semmle.label | ControlFlowNode for BinaryExpr |
-| sql_injection.py:24:38:24:95 | ControlFlowNode for BinaryExpr | semmle.label | ControlFlowNode for BinaryExpr |
-| sql_injection.py:25:26:25:83 | ControlFlowNode for BinaryExpr | semmle.label | ControlFlowNode for BinaryExpr |
-| sql_injection.py:26:28:26:85 | ControlFlowNode for BinaryExpr | semmle.label | ControlFlowNode for BinaryExpr |
-#select
-| sql_injection.py:21:24:21:77 | ControlFlowNode for BinaryExpr | sql_injection.py:14:15:14:22 | SSA variable username | sql_injection.py:21:24:21:77 | ControlFlowNode for BinaryExpr | This SQL query depends on $@. | sql_injection.py:14:15:14:22 | SSA variable username | a user-provided value |
-| sql_injection.py:24:38:24:95 | ControlFlowNode for BinaryExpr | sql_injection.py:14:15:14:22 | SSA variable username | sql_injection.py:24:38:24:95 | ControlFlowNode for BinaryExpr | This SQL query depends on $@. | sql_injection.py:14:15:14:22 | SSA variable username | a user-provided value |
-| sql_injection.py:25:26:25:83 | ControlFlowNode for BinaryExpr | sql_injection.py:14:15:14:22 | SSA variable username | sql_injection.py:25:26:25:83 | ControlFlowNode for BinaryExpr | This SQL query depends on $@. | sql_injection.py:14:15:14:22 | SSA variable username | a user-provided value |
-| sql_injection.py:26:28:26:85 | ControlFlowNode for BinaryExpr | sql_injection.py:14:15:14:22 | SSA variable username | sql_injection.py:26:28:26:85 | ControlFlowNode for BinaryExpr | This SQL query depends on $@. | sql_injection.py:14:15:14:22 | SSA variable username | a user-provided value |
--- a/python/ql/test/experimental/query-tests/Security-new-dataflow/CWE-089/SqlInjection.qlref
+++ b/python/ql/test/experimental/query-tests/Security-new-dataflow/CWE-089/SqlInjection.qlref
@@ -1 +0,0 @@
-experimental/Security-new-dataflow/CWE-089/SqlInjection.ql
--- a/python/ql/test/experimental/query-tests/Security-new-dataflow/CWE-089/sql_injection.py
+++ b/python/ql/test/experimental/query-tests/Security-new-dataflow/CWE-089/sql_injection.py
@@ -1,40 +0,0 @@
-"""This is adapted from ql/python/ql/test/query-tests\Security\CWE-089
-we now prefer to setup routing by flask
-"""
-
-from django.db import connection, models
-from django.db.models.expressions import RawSQL
-from flask import Flask, request
-app = Flask(__name__)
-
-class User(models.Model):
-    pass
-
-@app.route("/users/<username>")
-def show_user(username):
-    with connection.cursor() as cursor:
-        # GOOD -- Using parameters
-        cursor.execute("SELECT * FROM users WHERE username = %s", username)
-        User.objects.raw("SELECT * FROM users WHERE username = %s", (username,))
-
-        # BAD -- Using string formatting
-        cursor.execute("SELECT * FROM users WHERE username = '%s'" % username)
-
-        # BAD -- other ways of executing raw SQL code with string interpolation
-        User.objects.annotate(RawSQL("insert into names_file ('name') values ('%s')" % username))
-        User.objects.raw("insert into names_file ('name') values ('%s')" % username)
-        User.objects.extra("insert into names_file ('name') values ('%s')" % username)
-
-        # BAD (but currently no custom query to find this)
-        #
-        # It is exposed to SQL injection (https://docs.djangoproject.com/en/2.2/ref/models/querysets/#extra)
-        # For example, using name = "; DROP ALL TABLES -- "
-        # will result in SQL: SELECT * FROM name WHERE name = ''; DROP ALL TABLES -- ''
-        #
-        # This shouldn't be very widespread, since using a normal string will result in invalid SQL
-        # Using name = "example", will result in SQL: SELECT * FROM name WHERE name = ''example''
-        # which in MySQL will give a syntax error
-        #
-        # When testing this out locally, none of the queries worked against SQLite3, but I could use
-        # the SQL injection against MySQL.
-        User.objects.raw("SELECT * FROM users WHERE username = '%s'", (username,))
--- a/python/ql/test/experimental/query-tests/Security-new-dataflow/CWE-094/CodeInjection.expected
+++ b/python/ql/test/experimental/query-tests/Security-new-dataflow/CWE-094/CodeInjection.expected
@@ -1,13 +0,0 @@
-edges
-| code_injection.py:6:12:6:23 | ControlFlowNode for Attribute | code_injection.py:7:10:7:13 | ControlFlowNode for code |
-| code_injection.py:6:12:6:23 | ControlFlowNode for Attribute | code_injection.py:8:10:8:13 | ControlFlowNode for code |
-| code_injection.py:6:12:6:23 | ControlFlowNode for Attribute | code_injection.py:10:10:10:12 | ControlFlowNode for cmd |
-nodes
-| code_injection.py:6:12:6:23 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
-| code_injection.py:7:10:7:13 | ControlFlowNode for code | semmle.label | ControlFlowNode for code |
-| code_injection.py:8:10:8:13 | ControlFlowNode for code | semmle.label | ControlFlowNode for code |
-| code_injection.py:10:10:10:12 | ControlFlowNode for cmd | semmle.label | ControlFlowNode for cmd |
-#select
-| code_injection.py:7:10:7:13 | ControlFlowNode for code | code_injection.py:6:12:6:23 | ControlFlowNode for Attribute | code_injection.py:7:10:7:13 | ControlFlowNode for code | $@ flows to here and is interpreted as code. | code_injection.py:6:12:6:23 | ControlFlowNode for Attribute | A user-provided value |
-| code_injection.py:8:10:8:13 | ControlFlowNode for code | code_injection.py:6:12:6:23 | ControlFlowNode for Attribute | code_injection.py:8:10:8:13 | ControlFlowNode for code | $@ flows to here and is interpreted as code. | code_injection.py:6:12:6:23 | ControlFlowNode for Attribute | A user-provided value |
-| code_injection.py:10:10:10:12 | ControlFlowNode for cmd | code_injection.py:6:12:6:23 | ControlFlowNode for Attribute | code_injection.py:10:10:10:12 | ControlFlowNode for cmd | $@ flows to here and is interpreted as code. | code_injection.py:6:12:6:23 | ControlFlowNode for Attribute | A user-provided value |
--- a/python/ql/test/experimental/query-tests/Security-new-dataflow/CWE-094/CodeInjection.qlref
+++ b/python/ql/test/experimental/query-tests/Security-new-dataflow/CWE-094/CodeInjection.qlref
@@ -1 +0,0 @@
-experimental/Security-new-dataflow/CWE-094/CodeInjection.ql
--- a/python/ql/test/experimental/query-tests/Security-new-dataflow/CWE-094/code_injection.py
+++ b/python/ql/test/experimental/query-tests/Security-new-dataflow/CWE-094/code_injection.py
@@ -1,10 +0,0 @@
-from flask import Flask, request
-app = Flask(__name__)
-
-@app.route("/code-execution")
-def code_execution():
-    code = request.args.get("code")
-    exec(code)
-    eval(code)
-    cmd = compile(code, "<filename>", "exec")
-    exec(cmd)
--- a/python/ql/test/experimental/query-tests/Security-new-dataflow/CWE-502/UnsafeDeserialization.expected
+++ b/python/ql/test/experimental/query-tests/Security-new-dataflow/CWE-502/UnsafeDeserialization.expected
@@ -1,16 +0,0 @@
-edges
-| unsafe_deserialization.py:14:15:14:26 | ControlFlowNode for Attribute | unsafe_deserialization.py:15:18:15:24 | ControlFlowNode for payload |
-| unsafe_deserialization.py:14:15:14:26 | ControlFlowNode for Attribute | unsafe_deserialization.py:16:15:16:21 | ControlFlowNode for payload |
-| unsafe_deserialization.py:14:15:14:26 | ControlFlowNode for Attribute | unsafe_deserialization.py:18:19:18:25 | ControlFlowNode for payload |
-| unsafe_deserialization.py:14:15:14:26 | ControlFlowNode for Attribute | unsafe_deserialization.py:21:16:21:22 | ControlFlowNode for payload |
-nodes
-| unsafe_deserialization.py:14:15:14:26 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
-| unsafe_deserialization.py:15:18:15:24 | ControlFlowNode for payload | semmle.label | ControlFlowNode for payload |
-| unsafe_deserialization.py:16:15:16:21 | ControlFlowNode for payload | semmle.label | ControlFlowNode for payload |
-| unsafe_deserialization.py:18:19:18:25 | ControlFlowNode for payload | semmle.label | ControlFlowNode for payload |
-| unsafe_deserialization.py:21:16:21:22 | ControlFlowNode for payload | semmle.label | ControlFlowNode for payload |
-#select
-| unsafe_deserialization.py:15:18:15:24 | ControlFlowNode for payload | unsafe_deserialization.py:14:15:14:26 | ControlFlowNode for Attribute | unsafe_deserialization.py:15:18:15:24 | ControlFlowNode for payload | Deserializing of $@. | unsafe_deserialization.py:14:15:14:26 | ControlFlowNode for Attribute | untrusted input |
-| unsafe_deserialization.py:16:15:16:21 | ControlFlowNode for payload | unsafe_deserialization.py:14:15:14:26 | ControlFlowNode for Attribute | unsafe_deserialization.py:16:15:16:21 | ControlFlowNode for payload | Deserializing of $@. | unsafe_deserialization.py:14:15:14:26 | ControlFlowNode for Attribute | untrusted input |
-| unsafe_deserialization.py:18:19:18:25 | ControlFlowNode for payload | unsafe_deserialization.py:14:15:14:26 | ControlFlowNode for Attribute | unsafe_deserialization.py:18:19:18:25 | ControlFlowNode for payload | Deserializing of $@. | unsafe_deserialization.py:14:15:14:26 | ControlFlowNode for Attribute | untrusted input |
-| unsafe_deserialization.py:21:16:21:22 | ControlFlowNode for payload | unsafe_deserialization.py:14:15:14:26 | ControlFlowNode for Attribute | unsafe_deserialization.py:21:16:21:22 | ControlFlowNode for payload | Deserializing of $@. | unsafe_deserialization.py:14:15:14:26 | ControlFlowNode for Attribute | untrusted input |
--- a/python/ql/test/experimental/query-tests/Security-new-dataflow/CWE-502/UnsafeDeserialization.qlref
+++ b/python/ql/test/experimental/query-tests/Security-new-dataflow/CWE-502/UnsafeDeserialization.qlref
@@ -1 +0,0 @@
-experimental/Security-new-dataflow/CWE-502/UnsafeDeserialization.ql
--- a/python/ql/test/experimental/query-tests/Security-new-dataflow/CWE-022/PathInjection.expected
+++ b/python/ql/test/experimental/query-tests/Security-new-dataflow/CWE-022/PathInjection.expected
--- a/python/ql/test/query-tests/Security/CWE-022-PathInjection/PathInjection.qlref
+++ b/python/ql/test/query-tests/Security/CWE-022-PathInjection/PathInjection.qlref
--- a/python/ql/test/experimental/query-tests/Security-new-dataflow/CWE-022/path_injection.py
+++ b/python/ql/test/experimental/query-tests/Security-new-dataflow/CWE-022/path_injection.py
--- a/python/ql/test/experimental/query-tests/Security-new-dataflow/CWE-022/test.py
+++ b/python/ql/test/experimental/query-tests/Security-new-dataflow/CWE-022/test.py
--- a/python/ql/test/experimental/query-tests/Security-new-dataflow/CWE-022/test_chaining.py
+++ b/python/ql/test/experimental/query-tests/Security-new-dataflow/CWE-022/test_chaining.py
--- a/python/ql/test/query-tests/Security/CWE-022-TarSlip/TarSlip.expected
+++ b/python/ql/test/query-tests/Security/CWE-022-TarSlip/TarSlip.expected
--- a/python/ql/test/query-tests/Security/CWE-022-TarSlip/TarSlip.qlref
+++ b/python/ql/test/query-tests/Security/CWE-022-TarSlip/TarSlip.qlref
--- a/python/ql/test/query-tests/Security/CWE-022-TarSlip/options
+++ b/python/ql/test/query-tests/Security/CWE-022-TarSlip/options
--- a/python/ql/test/query-tests/Security/CWE-022-TarSlip/tarslip.py
+++ b/python/ql/test/query-tests/Security/CWE-022-TarSlip/tarslip.py
--- a/python/ql/test/query-tests/Security/CWE-022/PathInjection.expected
+++ b/python/ql/test/query-tests/Security/CWE-022/PathInjection.expected
@@ -1,31 +0,0 @@
-edges
-| path_injection.py:9:12:9:23 | dict of externally controlled string | path_injection.py:9:12:9:39 | externally controlled string |
-| path_injection.py:9:12:9:23 | dict of externally controlled string | path_injection.py:9:12:9:39 | externally controlled string |
-| path_injection.py:9:12:9:39 | externally controlled string | path_injection.py:10:40:10:43 | externally controlled string |
-| path_injection.py:9:12:9:39 | externally controlled string | path_injection.py:10:40:10:43 | externally controlled string |
-| path_injection.py:10:40:10:43 | externally controlled string | path_injection.py:10:14:10:44 | externally controlled string |
-| path_injection.py:10:40:10:43 | externally controlled string | path_injection.py:10:14:10:44 | externally controlled string |
-| path_injection.py:15:12:15:23 | dict of externally controlled string | path_injection.py:15:12:15:39 | externally controlled string |
-| path_injection.py:15:12:15:23 | dict of externally controlled string | path_injection.py:15:12:15:39 | externally controlled string |
-| path_injection.py:15:12:15:39 | externally controlled string | path_injection.py:16:56:16:59 | externally controlled string |
-| path_injection.py:15:12:15:39 | externally controlled string | path_injection.py:16:56:16:59 | externally controlled string |
-| path_injection.py:16:13:16:61 | normalized path | path_injection.py:17:14:17:18 | normalized path |
-| path_injection.py:16:13:16:61 | normalized path | path_injection.py:17:14:17:18 | normalized path |
-| path_injection.py:16:30:16:60 | externally controlled string | path_injection.py:16:13:16:61 | normalized path |
-| path_injection.py:16:30:16:60 | externally controlled string | path_injection.py:16:13:16:61 | normalized path |
-| path_injection.py:16:56:16:59 | externally controlled string | path_injection.py:16:30:16:60 | externally controlled string |
-| path_injection.py:16:56:16:59 | externally controlled string | path_injection.py:16:30:16:60 | externally controlled string |
-| path_injection.py:24:12:24:23 | dict of externally controlled string | path_injection.py:24:12:24:39 | externally controlled string |
-| path_injection.py:24:12:24:23 | dict of externally controlled string | path_injection.py:24:12:24:39 | externally controlled string |
-| path_injection.py:24:12:24:39 | externally controlled string | path_injection.py:25:56:25:59 | externally controlled string |
-| path_injection.py:24:12:24:39 | externally controlled string | path_injection.py:25:56:25:59 | externally controlled string |
-| path_injection.py:25:13:25:61 | normalized path | path_injection.py:28:14:28:18 | normalized path |
-| path_injection.py:25:13:25:61 | normalized path | path_injection.py:28:14:28:18 | normalized path |
-| path_injection.py:25:30:25:60 | externally controlled string | path_injection.py:25:13:25:61 | normalized path |
-| path_injection.py:25:30:25:60 | externally controlled string | path_injection.py:25:13:25:61 | normalized path |
-| path_injection.py:25:56:25:59 | externally controlled string | path_injection.py:25:30:25:60 | externally controlled string |
-| path_injection.py:25:56:25:59 | externally controlled string | path_injection.py:25:30:25:60 | externally controlled string |
-#select
-| path_injection.py:10:14:10:44 | Attribute() | path_injection.py:9:12:9:23 | dict of externally controlled string | path_injection.py:10:14:10:44 | externally controlled string | This path depends on $@. | path_injection.py:9:12:9:23 | Attribute | a user-provided value |
-| path_injection.py:17:14:17:18 | npath | path_injection.py:15:12:15:23 | dict of externally controlled string | path_injection.py:17:14:17:18 | normalized path | This path depends on $@. | path_injection.py:15:12:15:23 | Attribute | a user-provided value |
-| path_injection.py:28:14:28:18 | npath | path_injection.py:24:12:24:23 | dict of externally controlled string | path_injection.py:28:14:28:18 | normalized path | This path depends on $@. | path_injection.py:24:12:24:23 | Attribute | a user-provided value |
--- a/python/ql/test/query-tests/Security/CWE-022/path_injection.py
+++ b/python/ql/test/query-tests/Security/CWE-022/path_injection.py
@@ -1,36 +0,0 @@
-
-import os.path
-
-from flask import Flask, request
-app = Flask(__name__)
-
-@app.route("/path1")
-def path_injection():
-    path = request.args.get('path', '')
-    f = open(os.path.join(os.getcwd(), path))
-
-@app.route("/path2")
-def path_injection():
-    # Normalized, but not checked
-    path = request.args.get('path', '')
-    npath = os.path.normpath(os.path.join(os.getcwd(), path))
-    f = open(npath)
-
-SAFE = "/tmp/scratch_area/"
-
-@app.route("/path3")
-def safe_path():
-    # Normalized, but check doesn't reach open().
-    path = request.args.get('path', '')
-    npath = os.path.normpath(os.path.join(os.getcwd(), path))
-    if npath.startswith(SAFE):
-        pass
-    f = open(npath)
-
-@app.route("/path4")
-def safe_path():
-    # Normalized, and checked properly
-    path = request.args.get('path', '')
-    npath = os.path.normpath(os.path.join(os.getcwd(), path))
-    if npath.startswith(SAFE):
-        f = open(npath)
--- a/python/ql/test/experimental/query-tests/Security-new-dataflow/CWE-078-py2/CommandInjection.expected
+++ b/python/ql/test/experimental/query-tests/Security-new-dataflow/CWE-078-py2/CommandInjection.expected
--- a/python/ql/test/query-tests/Security/CWE-078-py2/CommandInjection.qlref
+++ b/python/ql/test/query-tests/Security/CWE-078-py2/CommandInjection.qlref
@@ -0,0 +1 @@
+Security/CWE-078/CommandInjection.ql
--- a/python/ql/test/experimental/query-tests/Security-new-dataflow/CWE-078-py2/command_injection.py
+++ b/python/ql/test/experimental/query-tests/Security-new-dataflow/CWE-078-py2/command_injection.py
--- a/python/ql/test/experimental/query-tests/Security-new-dataflow/CWE-078-py2/options
+++ b/python/ql/test/experimental/query-tests/Security-new-dataflow/CWE-078-py2/options
--- a/python/ql/test/query-tests/Security/CWE-078/CommandInjection.expected
+++ b/python/ql/test/query-tests/Security/CWE-078/CommandInjection.expected
@@ -1,30 +1,42 @@
 edges
-| command_injection.py:10:13:10:24 | dict of externally controlled string | command_injection.py:10:13:10:41 | externally controlled string |
-| command_injection.py:10:13:10:24 | dict of externally controlled string | command_injection.py:10:13:10:41 | externally controlled string |
-| command_injection.py:10:13:10:41 | externally controlled string | command_injection.py:12:23:12:27 | externally controlled string |
-| command_injection.py:10:13:10:41 | externally controlled string | command_injection.py:12:23:12:27 | externally controlled string |
-| command_injection.py:12:23:12:27 | externally controlled string | command_injection.py:12:15:12:27 | externally controlled string |
-| command_injection.py:12:23:12:27 | externally controlled string | command_injection.py:12:15:12:27 | externally controlled string |
-| command_injection.py:17:13:17:24 | dict of externally controlled string | command_injection.py:17:13:17:41 | externally controlled string |
-| command_injection.py:17:13:17:24 | dict of externally controlled string | command_injection.py:17:13:17:41 | externally controlled string |
-| command_injection.py:17:13:17:41 | externally controlled string | command_injection.py:19:30:19:34 | externally controlled string |
-| command_injection.py:17:13:17:41 | externally controlled string | command_injection.py:19:30:19:34 | externally controlled string |
-| command_injection.py:19:30:19:34 | externally controlled string | command_injection.py:19:22:19:34 | externally controlled string |
-| command_injection.py:19:30:19:34 | externally controlled string | command_injection.py:19:22:19:34 | externally controlled string |
-| command_injection.py:24:11:24:22 | dict of externally controlled string | command_injection.py:24:11:24:37 | externally controlled string |
-| command_injection.py:24:11:24:22 | dict of externally controlled string | command_injection.py:24:11:24:37 | externally controlled string |
-| command_injection.py:24:11:24:37 | externally controlled string | command_injection.py:25:23:25:25 | externally controlled string |
-| command_injection.py:24:11:24:37 | externally controlled string | command_injection.py:25:23:25:25 | externally controlled string |
-| command_injection.py:25:23:25:25 | externally controlled string | command_injection.py:25:22:25:36 | first item in sequence of externally controlled string |
-| command_injection.py:25:23:25:25 | externally controlled string | command_injection.py:25:22:25:36 | first item in sequence of externally controlled string |
-| command_injection.py:30:13:30:24 | dict of externally controlled string | command_injection.py:30:13:30:41 | externally controlled string |
-| command_injection.py:30:13:30:24 | dict of externally controlled string | command_injection.py:30:13:30:41 | externally controlled string |
-| command_injection.py:30:13:30:41 | externally controlled string | command_injection.py:32:22:32:26 | externally controlled string |
-| command_injection.py:30:13:30:41 | externally controlled string | command_injection.py:32:22:32:26 | externally controlled string |
-| command_injection.py:32:22:32:26 | externally controlled string | command_injection.py:32:14:32:26 | externally controlled string |
-| command_injection.py:32:22:32:26 | externally controlled string | command_injection.py:32:14:32:26 | externally controlled string |
+| command_injection.py:10:13:10:24 | ControlFlowNode for Attribute | command_injection.py:12:15:12:27 | ControlFlowNode for BinaryExpr |
+| command_injection.py:17:13:17:24 | ControlFlowNode for Attribute | command_injection.py:19:22:19:34 | ControlFlowNode for BinaryExpr |
+| command_injection.py:24:11:24:22 | ControlFlowNode for Attribute | command_injection.py:25:23:25:25 | ControlFlowNode for cmd |
+| command_injection.py:30:13:30:24 | ControlFlowNode for Attribute | command_injection.py:32:14:32:26 | ControlFlowNode for BinaryExpr |
+| command_injection.py:36:15:36:26 | ControlFlowNode for Attribute | command_injection.py:39:15:39:21 | ControlFlowNode for command |
+| command_injection.py:36:15:36:26 | ControlFlowNode for Attribute | command_injection.py:40:15:40:21 | ControlFlowNode for command |
+| command_injection.py:52:15:52:26 | ControlFlowNode for Attribute | command_injection.py:53:15:53:21 | ControlFlowNode for command |
+| command_injection.py:52:15:52:26 | ControlFlowNode for Attribute | command_injection.py:54:14:54:20 | ControlFlowNode for command |
+| command_injection.py:52:15:52:26 | ControlFlowNode for Attribute | command_injection.py:55:21:55:27 | ControlFlowNode for command |
+| command_injection.py:52:15:52:26 | ControlFlowNode for Attribute | command_injection.py:56:27:56:33 | ControlFlowNode for command |
+| command_injection.py:52:15:52:26 | ControlFlowNode for Attribute | command_injection.py:57:20:57:26 | ControlFlowNode for command |
+nodes
+| command_injection.py:10:13:10:24 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
+| command_injection.py:12:15:12:27 | ControlFlowNode for BinaryExpr | semmle.label | ControlFlowNode for BinaryExpr |
+| command_injection.py:17:13:17:24 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
+| command_injection.py:19:22:19:34 | ControlFlowNode for BinaryExpr | semmle.label | ControlFlowNode for BinaryExpr |
+| command_injection.py:24:11:24:22 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
+| command_injection.py:25:23:25:25 | ControlFlowNode for cmd | semmle.label | ControlFlowNode for cmd |
+| command_injection.py:30:13:30:24 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
+| command_injection.py:32:14:32:26 | ControlFlowNode for BinaryExpr | semmle.label | ControlFlowNode for BinaryExpr |
+| command_injection.py:36:15:36:26 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
+| command_injection.py:39:15:39:21 | ControlFlowNode for command | semmle.label | ControlFlowNode for command |
+| command_injection.py:40:15:40:21 | ControlFlowNode for command | semmle.label | ControlFlowNode for command |
+| command_injection.py:52:15:52:26 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
+| command_injection.py:53:15:53:21 | ControlFlowNode for command | semmle.label | ControlFlowNode for command |
+| command_injection.py:54:14:54:20 | ControlFlowNode for command | semmle.label | ControlFlowNode for command |
+| command_injection.py:55:21:55:27 | ControlFlowNode for command | semmle.label | ControlFlowNode for command |
+| command_injection.py:56:27:56:33 | ControlFlowNode for command | semmle.label | ControlFlowNode for command |
+| command_injection.py:57:20:57:26 | ControlFlowNode for command | semmle.label | ControlFlowNode for command |
 #select
-| command_injection.py:12:15:12:27 | BinaryExpr | command_injection.py:10:13:10:24 | dict of externally controlled string | command_injection.py:12:15:12:27 | externally controlled string | This command depends on $@. | command_injection.py:10:13:10:24 | Attribute | a user-provided value |
-| command_injection.py:19:22:19:34 | BinaryExpr | command_injection.py:17:13:17:24 | dict of externally controlled string | command_injection.py:19:22:19:34 | externally controlled string | This command depends on $@. | command_injection.py:17:13:17:24 | Attribute | a user-provided value |
-| command_injection.py:25:22:25:36 | List | command_injection.py:24:11:24:22 | dict of externally controlled string | command_injection.py:25:22:25:36 | first item in sequence of externally controlled string | This command depends on $@. | command_injection.py:24:11:24:22 | Attribute | a user-provided value |
-| command_injection.py:32:14:32:26 | BinaryExpr | command_injection.py:30:13:30:24 | dict of externally controlled string | command_injection.py:32:14:32:26 | externally controlled string | This command depends on $@. | command_injection.py:30:13:30:24 | Attribute | a user-provided value |
+| command_injection.py:12:15:12:27 | ControlFlowNode for BinaryExpr | command_injection.py:10:13:10:24 | ControlFlowNode for Attribute | command_injection.py:12:15:12:27 | ControlFlowNode for BinaryExpr | This command depends on $@. | command_injection.py:10:13:10:24 | ControlFlowNode for Attribute | a user-provided value |
+| command_injection.py:19:22:19:34 | ControlFlowNode for BinaryExpr | command_injection.py:17:13:17:24 | ControlFlowNode for Attribute | command_injection.py:19:22:19:34 | ControlFlowNode for BinaryExpr | This command depends on $@. | command_injection.py:17:13:17:24 | ControlFlowNode for Attribute | a user-provided value |
+| command_injection.py:25:23:25:25 | ControlFlowNode for cmd | command_injection.py:24:11:24:22 | ControlFlowNode for Attribute | command_injection.py:25:23:25:25 | ControlFlowNode for cmd | This command depends on $@. | command_injection.py:24:11:24:22 | ControlFlowNode for Attribute | a user-provided value |
+| command_injection.py:32:14:32:26 | ControlFlowNode for BinaryExpr | command_injection.py:30:13:30:24 | ControlFlowNode for Attribute | command_injection.py:32:14:32:26 | ControlFlowNode for BinaryExpr | This command depends on $@. | command_injection.py:30:13:30:24 | ControlFlowNode for Attribute | a user-provided value |
+| command_injection.py:39:15:39:21 | ControlFlowNode for command | command_injection.py:36:15:36:26 | ControlFlowNode for Attribute | command_injection.py:39:15:39:21 | ControlFlowNode for command | This command depends on $@. | command_injection.py:36:15:36:26 | ControlFlowNode for Attribute | a user-provided value |
+| command_injection.py:40:15:40:21 | ControlFlowNode for command | command_injection.py:36:15:36:26 | ControlFlowNode for Attribute | command_injection.py:40:15:40:21 | ControlFlowNode for command | This command depends on $@. | command_injection.py:36:15:36:26 | ControlFlowNode for Attribute | a user-provided value |
+| command_injection.py:53:15:53:21 | ControlFlowNode for command | command_injection.py:52:15:52:26 | ControlFlowNode for Attribute | command_injection.py:53:15:53:21 | ControlFlowNode for command | This command depends on $@. | command_injection.py:52:15:52:26 | ControlFlowNode for Attribute | a user-provided value |
+| command_injection.py:54:14:54:20 | ControlFlowNode for command | command_injection.py:52:15:52:26 | ControlFlowNode for Attribute | command_injection.py:54:14:54:20 | ControlFlowNode for command | This command depends on $@. | command_injection.py:52:15:52:26 | ControlFlowNode for Attribute | a user-provided value |
+| command_injection.py:55:21:55:27 | ControlFlowNode for command | command_injection.py:52:15:52:26 | ControlFlowNode for Attribute | command_injection.py:55:21:55:27 | ControlFlowNode for command | This command depends on $@. | command_injection.py:52:15:52:26 | ControlFlowNode for Attribute | a user-provided value |
+| command_injection.py:56:27:56:33 | ControlFlowNode for command | command_injection.py:52:15:52:26 | ControlFlowNode for Attribute | command_injection.py:56:27:56:33 | ControlFlowNode for command | This command depends on $@. | command_injection.py:52:15:52:26 | ControlFlowNode for Attribute | a user-provided value |
+| command_injection.py:57:20:57:26 | ControlFlowNode for command | command_injection.py:52:15:52:26 | ControlFlowNode for Attribute | command_injection.py:57:20:57:26 | ControlFlowNode for command | This command depends on $@. | command_injection.py:52:15:52:26 | ControlFlowNode for Attribute | a user-provided value |
--- a/python/ql/test/query-tests/Security/CWE-078/command_injection.py
+++ b/python/ql/test/query-tests/Security/CWE-078/command_injection.py
@@ -30,3 +30,28 @@ def others():
    files = request.args.get('files', '')
    # Don't let files be `; rm -rf /`
    os.popen("ls " + files)
+
+@app.route("/multiple")
+def multiple():
+    command = request.args.get('command', '')
+    # We should mark flow to both calls here, which conflicts with removing flow out of
+    # a sink due to use-use flow.
+    os.system(command)
+    os.system(command)
+
+
+@app.route("/not-into-sink-impl")
+def not_into_sink_impl():
+    """When there is flow to a sink such as `os.popen(cmd)`, we don't want to highlight that there is also
+    flow through the actual `popen` function to the internal call to `subprocess.Popen` -- we would usually
+    see that flow since we extract the `os.py` file from the standard library.
+
+    os.popen implementation: https://github.com/python/cpython/blob/fa7ce080175f65d678a7d5756c94f82887fc9803/Lib/os.py#L974
+    subprocess.call implementation: https://github.com/python/cpython/blob/fa7ce080175f65d678a7d5756c94f82887fc9803/Lib/subprocess.py#L341
+    """
+    command = request.args.get('command', '')
+    os.system(command)
+    os.popen(command)
+    subprocess.call(command)
+    subprocess.check_call(command)
+    subprocess.run(command)
--- a/python/ql/test/query-tests/Security/CWE-079/ReflectedXss.expected
+++ b/python/ql/test/query-tests/Security/CWE-079/ReflectedXss.expected
@@ -1,9 +1,7 @@
 edges
-| reflected_xss.py:7:18:7:29 | dict of externally controlled string | reflected_xss.py:7:18:7:45 | externally controlled string |
-| reflected_xss.py:7:18:7:29 | dict of externally controlled string | reflected_xss.py:7:18:7:45 | externally controlled string |
-| reflected_xss.py:7:18:7:45 | externally controlled string | reflected_xss.py:8:44:8:53 | externally controlled string |
-| reflected_xss.py:7:18:7:45 | externally controlled string | reflected_xss.py:8:44:8:53 | externally controlled string |
-| reflected_xss.py:8:44:8:53 | externally controlled string | reflected_xss.py:8:26:8:53 | externally controlled string |
-| reflected_xss.py:8:44:8:53 | externally controlled string | reflected_xss.py:8:26:8:53 | externally controlled string |
+| reflected_xss.py:8:18:8:29 | ControlFlowNode for Attribute | reflected_xss.py:9:26:9:53 | ControlFlowNode for BinaryExpr |
+nodes
+| reflected_xss.py:8:18:8:29 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
+| reflected_xss.py:9:26:9:53 | ControlFlowNode for BinaryExpr | semmle.label | ControlFlowNode for BinaryExpr |
 #select
-| reflected_xss.py:8:26:8:53 | BinaryExpr | reflected_xss.py:7:18:7:29 | dict of externally controlled string | reflected_xss.py:8:26:8:53 | externally controlled string | Cross-site scripting vulnerability due to $@. | reflected_xss.py:7:18:7:29 | Attribute | a user-provided value |
+| reflected_xss.py:9:26:9:53 | ControlFlowNode for BinaryExpr | reflected_xss.py:8:18:8:29 | ControlFlowNode for Attribute | reflected_xss.py:9:26:9:53 | ControlFlowNode for BinaryExpr | Cross-site scripting vulnerability due to $@. | reflected_xss.py:8:18:8:29 | ControlFlowNode for Attribute | a user-provided value |
--- a/python/ql/test/query-tests/Security/CWE-079/reflected_xss.py
+++ b/python/ql/test/query-tests/Security/CWE-079/reflected_xss.py
@@ -2,12 +2,14 @@ from flask import Flask, request, make_response, escape

 app = Flask(__name__)

-@app.route('/unsafe')
-def unsafe():
-    first_name = request.args.get('name', '')
-    return make_response("Your name is " + first_name)

-@app.route('/safe')
+@app.route("/unsafe")
+def unsafe():
+    first_name = request.args.get("name", "")
+    return make_response("Your name is " + first_name)  # NOT OK
+
+
+@app.route("/safe")
 def safe():
-    first_name = request.args.get('name', '')
-    return make_response("Your name is " + escape(first_name))
+    first_name = request.args.get("name", "")
+    return make_response("Your name is " + escape(first_name))  # OK
--- a/python/ql/test/query-tests/Security/CWE-089/SqlInjection.expected
+++ b/python/ql/test/query-tests/Security/CWE-089/SqlInjection.expected
@@ -1,22 +1,16 @@
 edges
-| sql_injection.py:12:24:12:31 | externally controlled string | sql_injection.py:19:70:19:77 | externally controlled string |
-| sql_injection.py:12:24:12:31 | externally controlled string | sql_injection.py:19:70:19:77 | externally controlled string |
-| sql_injection.py:12:24:12:31 | externally controlled string | sql_injection.py:22:88:22:95 | externally controlled string |
-| sql_injection.py:12:24:12:31 | externally controlled string | sql_injection.py:22:88:22:95 | externally controlled string |
-| sql_injection.py:12:24:12:31 | externally controlled string | sql_injection.py:23:76:23:83 | externally controlled string |
-| sql_injection.py:12:24:12:31 | externally controlled string | sql_injection.py:23:76:23:83 | externally controlled string |
-| sql_injection.py:12:24:12:31 | externally controlled string | sql_injection.py:24:78:24:85 | externally controlled string |
-| sql_injection.py:12:24:12:31 | externally controlled string | sql_injection.py:24:78:24:85 | externally controlled string |
-| sql_injection.py:19:70:19:77 | externally controlled string | sql_injection.py:19:24:19:77 | externally controlled string |
-| sql_injection.py:19:70:19:77 | externally controlled string | sql_injection.py:19:24:19:77 | externally controlled string |
-| sql_injection.py:22:88:22:95 | externally controlled string | sql_injection.py:22:38:22:95 | externally controlled string |
-| sql_injection.py:22:88:22:95 | externally controlled string | sql_injection.py:22:38:22:95 | externally controlled string |
-| sql_injection.py:23:76:23:83 | externally controlled string | sql_injection.py:23:26:23:83 | externally controlled string |
-| sql_injection.py:23:76:23:83 | externally controlled string | sql_injection.py:23:26:23:83 | externally controlled string |
-| sql_injection.py:24:78:24:85 | externally controlled string | sql_injection.py:24:28:24:85 | externally controlled string |
-| sql_injection.py:24:78:24:85 | externally controlled string | sql_injection.py:24:28:24:85 | externally controlled string |
+| sql_injection.py:14:15:14:22 | SSA variable username | sql_injection.py:21:24:21:77 | ControlFlowNode for BinaryExpr |
+| sql_injection.py:14:15:14:22 | SSA variable username | sql_injection.py:24:38:24:95 | ControlFlowNode for BinaryExpr |
+| sql_injection.py:14:15:14:22 | SSA variable username | sql_injection.py:25:26:25:83 | ControlFlowNode for BinaryExpr |
+| sql_injection.py:14:15:14:22 | SSA variable username | sql_injection.py:26:28:26:85 | ControlFlowNode for BinaryExpr |
+nodes
+| sql_injection.py:14:15:14:22 | SSA variable username | semmle.label | SSA variable username |
+| sql_injection.py:21:24:21:77 | ControlFlowNode for BinaryExpr | semmle.label | ControlFlowNode for BinaryExpr |
+| sql_injection.py:24:38:24:95 | ControlFlowNode for BinaryExpr | semmle.label | ControlFlowNode for BinaryExpr |
+| sql_injection.py:25:26:25:83 | ControlFlowNode for BinaryExpr | semmle.label | ControlFlowNode for BinaryExpr |
+| sql_injection.py:26:28:26:85 | ControlFlowNode for BinaryExpr | semmle.label | ControlFlowNode for BinaryExpr |
 #select
-| sql_injection.py:19:24:19:77 | BinaryExpr | sql_injection.py:12:24:12:31 | externally controlled string | sql_injection.py:19:24:19:77 | externally controlled string | This SQL query depends on $@. | sql_injection.py:12:24:12:31 | username | a user-provided value |
-| sql_injection.py:22:38:22:95 | BinaryExpr | sql_injection.py:12:24:12:31 | externally controlled string | sql_injection.py:22:38:22:95 | externally controlled string | This SQL query depends on $@. | sql_injection.py:12:24:12:31 | username | a user-provided value |
-| sql_injection.py:23:26:23:83 | BinaryExpr | sql_injection.py:12:24:12:31 | externally controlled string | sql_injection.py:23:26:23:83 | externally controlled string | This SQL query depends on $@. | sql_injection.py:12:24:12:31 | username | a user-provided value |
-| sql_injection.py:24:28:24:85 | BinaryExpr | sql_injection.py:12:24:12:31 | externally controlled string | sql_injection.py:24:28:24:85 | externally controlled string | This SQL query depends on $@. | sql_injection.py:12:24:12:31 | username | a user-provided value |
+| sql_injection.py:21:24:21:77 | ControlFlowNode for BinaryExpr | sql_injection.py:14:15:14:22 | SSA variable username | sql_injection.py:21:24:21:77 | ControlFlowNode for BinaryExpr | This SQL query depends on $@. | sql_injection.py:14:15:14:22 | SSA variable username | a user-provided value |
+| sql_injection.py:24:38:24:95 | ControlFlowNode for BinaryExpr | sql_injection.py:14:15:14:22 | SSA variable username | sql_injection.py:24:38:24:95 | ControlFlowNode for BinaryExpr | This SQL query depends on $@. | sql_injection.py:14:15:14:22 | SSA variable username | a user-provided value |
+| sql_injection.py:25:26:25:83 | ControlFlowNode for BinaryExpr | sql_injection.py:14:15:14:22 | SSA variable username | sql_injection.py:25:26:25:83 | ControlFlowNode for BinaryExpr | This SQL query depends on $@. | sql_injection.py:14:15:14:22 | SSA variable username | a user-provided value |
+| sql_injection.py:26:28:26:85 | ControlFlowNode for BinaryExpr | sql_injection.py:14:15:14:22 | SSA variable username | sql_injection.py:26:28:26:85 | ControlFlowNode for BinaryExpr | This SQL query depends on $@. | sql_injection.py:14:15:14:22 | SSA variable username | a user-provided value |
--- a/python/ql/test/query-tests/Security/CWE-089/options
+++ b/python/ql/test/query-tests/Security/CWE-089/options
@@ -1 +0,0 @@
-semmle-extractor-options: -p ../lib/ --max-import-depth=3
--- a/python/ql/test/query-tests/Security/CWE-089/sql_injection.py
+++ b/python/ql/test/query-tests/Security/CWE-089/sql_injection.py
@@ -1,15 +1,17 @@
-"""This is copied from ql/python/ql/test/library-tests/web/django/test.py
-and a only a slight extension of ql/python/ql/src/Security/CWE-089/examples/sql_injection.py
+"""This is adapted from ql/python/ql/test/query-tests\Security\CWE-089
+we now prefer to setup routing by flask
 """

-from django.conf.urls import url
 from django.db import connection, models
 from django.db.models.expressions import RawSQL
+from flask import Flask, request
+app = Flask(__name__)

 class User(models.Model):
    pass

-def show_user(request, username):
+@app.route("/users/<username>")
+def show_user(username):
    with connection.cursor() as cursor:
        # GOOD -- Using parameters
        cursor.execute("SELECT * FROM users WHERE username = %s", username)
@@ -36,5 +38,3 @@ def show_user(request, username):
        # When testing this out locally, none of the queries worked against SQLite3, but I could use
        # the SQL injection against MySQL.
        User.objects.raw("SELECT * FROM users WHERE username = '%s'", (username,))
-
-urlpatterns = [url(r'^users/(?P<username>[^/]+)$', show_user)]
--- a/python/ql/test/query-tests/Security/CWE-094/CodeInjection.expected
+++ b/python/ql/test/query-tests/Security/CWE-094/CodeInjection.expected
@@ -1,13 +1,13 @@
 edges
-| code_injection.py:4:20:4:26 | django.request.HttpRequest | code_injection.py:6:22:6:28 | django.request.HttpRequest |
-| code_injection.py:4:20:4:26 | django.request.HttpRequest | code_injection.py:6:22:6:28 | django.request.HttpRequest |
-| code_injection.py:6:22:6:28 | django.request.HttpRequest | code_injection.py:6:22:6:33 | django.http.request.QueryDict |
-| code_injection.py:6:22:6:28 | django.request.HttpRequest | code_injection.py:6:22:6:33 | django.http.request.QueryDict |
-| code_injection.py:6:22:6:33 | django.http.request.QueryDict | code_injection.py:6:22:6:55 | externally controlled string |
-| code_injection.py:6:22:6:33 | django.http.request.QueryDict | code_injection.py:6:22:6:55 | externally controlled string |
-| code_injection.py:6:22:6:55 | externally controlled string | code_injection.py:7:34:7:43 | externally controlled string |
-| code_injection.py:6:22:6:55 | externally controlled string | code_injection.py:7:34:7:43 | externally controlled string |
-| code_injection.py:7:34:7:43 | externally controlled string | code_injection.py:7:14:7:44 | externally controlled string |
-| code_injection.py:7:34:7:43 | externally controlled string | code_injection.py:7:14:7:44 | externally controlled string |
+| code_injection.py:6:12:6:23 | ControlFlowNode for Attribute | code_injection.py:7:10:7:13 | ControlFlowNode for code |
+| code_injection.py:6:12:6:23 | ControlFlowNode for Attribute | code_injection.py:8:10:8:13 | ControlFlowNode for code |
+| code_injection.py:6:12:6:23 | ControlFlowNode for Attribute | code_injection.py:10:10:10:12 | ControlFlowNode for cmd |
+nodes
+| code_injection.py:6:12:6:23 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
+| code_injection.py:7:10:7:13 | ControlFlowNode for code | semmle.label | ControlFlowNode for code |
+| code_injection.py:8:10:8:13 | ControlFlowNode for code | semmle.label | ControlFlowNode for code |
+| code_injection.py:10:10:10:12 | ControlFlowNode for cmd | semmle.label | ControlFlowNode for cmd |
 #select
-| code_injection.py:7:14:7:44 | Attribute() | code_injection.py:4:20:4:26 | django.request.HttpRequest | code_injection.py:7:14:7:44 | externally controlled string | $@ flows to here and is interpreted as code. | code_injection.py:4:20:4:26 | request | A user-provided value |
+| code_injection.py:7:10:7:13 | ControlFlowNode for code | code_injection.py:6:12:6:23 | ControlFlowNode for Attribute | code_injection.py:7:10:7:13 | ControlFlowNode for code | $@ flows to here and is interpreted as code. | code_injection.py:6:12:6:23 | ControlFlowNode for Attribute | A user-provided value |
+| code_injection.py:8:10:8:13 | ControlFlowNode for code | code_injection.py:6:12:6:23 | ControlFlowNode for Attribute | code_injection.py:8:10:8:13 | ControlFlowNode for code | $@ flows to here and is interpreted as code. | code_injection.py:6:12:6:23 | ControlFlowNode for Attribute | A user-provided value |
+| code_injection.py:10:10:10:12 | ControlFlowNode for cmd | code_injection.py:6:12:6:23 | ControlFlowNode for Attribute | code_injection.py:10:10:10:12 | ControlFlowNode for cmd | $@ flows to here and is interpreted as code. | code_injection.py:6:12:6:23 | ControlFlowNode for Attribute | A user-provided value |
--- a/python/ql/test/query-tests/Security/CWE-094/code_injection.py
+++ b/python/ql/test/query-tests/Security/CWE-094/code_injection.py
@@ -1,12 +1,10 @@
-from django.conf.urls import url
-import base64
+from flask import Flask, request
+app = Flask(__name__)

-def code_execution(request):
-    if request.method == 'POST':
-        first_name = request.POST.get('first_name', '')
-        exec(base64.decodestring(first_name))
-
-urlpatterns = [
-    # Route to code_execution
-    url(r'^code-ex$', code_execution, name='code-execution')
-]
+@app.route("/code-execution")
+def code_execution():
+    code = request.args.get("code")
+    exec(code)
+    eval(code)
+    cmd = compile(code, "<filename>", "exec")
+    exec(cmd)
--- a/python/ql/test/query-tests/Security/CWE-094/options
+++ b/python/ql/test/query-tests/Security/CWE-094/options
@@ -1 +0,0 @@
-semmle-extractor-options: -p ../lib/ --max-import-depth=3
--- a/python/ql/test/query-tests/Security/CWE-502/UnsafeDeserialization.expected
+++ b/python/ql/test/query-tests/Security/CWE-502/UnsafeDeserialization.expected
@@ -1,16 +1,16 @@
 edges
-| test.py:11:15:11:26 | dict of externally controlled string | test.py:11:15:11:41 | externally controlled string |
-| test.py:11:15:11:26 | dict of externally controlled string | test.py:11:15:11:41 | externally controlled string |
-| test.py:11:15:11:41 | externally controlled string | test.py:12:18:12:24 | externally controlled string |
-| test.py:11:15:11:41 | externally controlled string | test.py:12:18:12:24 | externally controlled string |
-| test.py:11:15:11:41 | externally controlled string | test.py:13:15:13:21 | externally controlled string |
-| test.py:11:15:11:41 | externally controlled string | test.py:13:15:13:21 | externally controlled string |
-| test.py:11:15:11:41 | externally controlled string | test.py:14:19:14:25 | externally controlled string |
-| test.py:11:15:11:41 | externally controlled string | test.py:14:19:14:25 | externally controlled string |
-| test.py:11:15:11:41 | externally controlled string | test.py:16:16:16:22 | externally controlled string |
-| test.py:11:15:11:41 | externally controlled string | test.py:16:16:16:22 | externally controlled string |
+| unsafe_deserialization.py:14:15:14:26 | ControlFlowNode for Attribute | unsafe_deserialization.py:15:18:15:24 | ControlFlowNode for payload |
+| unsafe_deserialization.py:14:15:14:26 | ControlFlowNode for Attribute | unsafe_deserialization.py:16:15:16:21 | ControlFlowNode for payload |
+| unsafe_deserialization.py:14:15:14:26 | ControlFlowNode for Attribute | unsafe_deserialization.py:18:19:18:25 | ControlFlowNode for payload |
+| unsafe_deserialization.py:14:15:14:26 | ControlFlowNode for Attribute | unsafe_deserialization.py:21:16:21:22 | ControlFlowNode for payload |
+nodes
+| unsafe_deserialization.py:14:15:14:26 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
+| unsafe_deserialization.py:15:18:15:24 | ControlFlowNode for payload | semmle.label | ControlFlowNode for payload |
+| unsafe_deserialization.py:16:15:16:21 | ControlFlowNode for payload | semmle.label | ControlFlowNode for payload |
+| unsafe_deserialization.py:18:19:18:25 | ControlFlowNode for payload | semmle.label | ControlFlowNode for payload |
+| unsafe_deserialization.py:21:16:21:22 | ControlFlowNode for payload | semmle.label | ControlFlowNode for payload |
 #select
-| test.py:12:18:12:24 | payload | test.py:11:15:11:26 | dict of externally controlled string | test.py:12:18:12:24 | externally controlled string | Deserializing of $@. | test.py:11:15:11:26 | Attribute | untrusted input |
-| test.py:13:15:13:21 | payload | test.py:11:15:11:26 | dict of externally controlled string | test.py:13:15:13:21 | externally controlled string | Deserializing of $@. | test.py:11:15:11:26 | Attribute | untrusted input |
-| test.py:14:19:14:25 | payload | test.py:11:15:11:26 | dict of externally controlled string | test.py:14:19:14:25 | externally controlled string | Deserializing of $@. | test.py:11:15:11:26 | Attribute | untrusted input |
-| test.py:16:16:16:22 | payload | test.py:11:15:11:26 | dict of externally controlled string | test.py:16:16:16:22 | externally controlled string | Deserializing of $@. | test.py:11:15:11:26 | Attribute | untrusted input |
+| unsafe_deserialization.py:15:18:15:24 | ControlFlowNode for payload | unsafe_deserialization.py:14:15:14:26 | ControlFlowNode for Attribute | unsafe_deserialization.py:15:18:15:24 | ControlFlowNode for payload | Deserializing of $@. | unsafe_deserialization.py:14:15:14:26 | ControlFlowNode for Attribute | untrusted input |
+| unsafe_deserialization.py:16:15:16:21 | ControlFlowNode for payload | unsafe_deserialization.py:14:15:14:26 | ControlFlowNode for Attribute | unsafe_deserialization.py:16:15:16:21 | ControlFlowNode for payload | Deserializing of $@. | unsafe_deserialization.py:14:15:14:26 | ControlFlowNode for Attribute | untrusted input |
+| unsafe_deserialization.py:18:19:18:25 | ControlFlowNode for payload | unsafe_deserialization.py:14:15:14:26 | ControlFlowNode for Attribute | unsafe_deserialization.py:18:19:18:25 | ControlFlowNode for payload | Deserializing of $@. | unsafe_deserialization.py:14:15:14:26 | ControlFlowNode for Attribute | untrusted input |
+| unsafe_deserialization.py:21:16:21:22 | ControlFlowNode for payload | unsafe_deserialization.py:14:15:14:26 | ControlFlowNode for Attribute | unsafe_deserialization.py:21:16:21:22 | ControlFlowNode for payload | Deserializing of $@. | unsafe_deserialization.py:14:15:14:26 | ControlFlowNode for Attribute | untrusted input |
--- a/python/ql/test/query-tests/Security/CWE-502/options
+++ b/python/ql/test/query-tests/Security/CWE-502/options
@@ -1 +0,0 @@
-semmle-extractor-options: --max-import-depth=2 -p ../lib
--- a/python/ql/test/query-tests/Security/CWE-502/test.py
+++ b/python/ql/test/query-tests/Security/CWE-502/test.py
@@ -1,18 +0,0 @@
-import flask
-import pickle
-import yaml
-import marshal
-
-from flask import Flask, request
-app = Flask(__name__)
-
-@app.route("/")
-def hello():
-    payload = request.args.get('payload')
-    pickle.loads(payload)
-    yaml.load(payload)
-    marshal.loads(payload)
-    import dill
-    dill.loads(payload)
-
-
--- a/python/ql/test/experimental/query-tests/Security-new-dataflow/CWE-502/unsafe_deserialization.py
+++ b/python/ql/test/experimental/query-tests/Security-new-dataflow/CWE-502/unsafe_deserialization.py
				`@@ -1 +0,0 @@`
				`experimental/Security-new-dataflow/CWE-022/PathInjection.ql`
				`@@ -1 +0,0 @@`
				`semmle-extractor-options: -p ../lib/ --max-import-depth=3`
				`@@ -1 +0,0 @@`
				`semmle-extractor-options: --max-import-depth=2 -p ../lib`