Merge branch 'main' into redsun82/cargo-upgrade

Cargo.lock

@@ -116,11 +116,14 @@ checksum = "7c02d123df017efcdfbd739ef81735b36c5ba83ec3c59c80a9d7ecc718f92e50"
 name = "ast-generator"
 version = "0.1.0"
 dependencies = [
+ "anyhow",
  "either",
  "itertools 0.14.0",
+ "mustache",
  "proc-macro2",
  "quote",
  "ra_ap_stdx",
+ "serde",
  "ungrammar",
 ]
 
@@ -168,9 +171,9 @@ dependencies = [
 
 [[package]]
 name = "bstr"
-version = "1.11.1"
+version = "1.11.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "786a307d683a5bf92e6fd5fd69a7eb613751668d1d8d67d802846dfe367c62c8"
+checksum = "531a9155a481e2ee699d4f98f43c0ca4ff8ee1bfd55c31e9e98fb29d2b176fe0"
 dependencies = [
  "memchr",
  "serde",
@@ -184,9 +187,9 @@ checksum = "79296716171880943b8470b5f8d03aa55eb2e645a4874bdbb28adb49162e012c"
 
 [[package]]
 name = "bytemuck"
-version = "1.20.0"
+version = "1.21.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b37c88a63ffd85d15b406896cc343916d7cf57838a847b3a6f2ca5d39a5695a"
+checksum = "ef657dfab802224e671f5818e9a4935f9b1957ed18e58292690cc39e7a4092a3"
 
 [[package]]
 name = "byteorder"
@@ -412,7 +415,7 @@ dependencies = [
  "figment",
  "glob",
  "itertools 0.14.0",
- "log",
+ "log 0.4.22",
  "num-traits",
  "ra_ap_base_db",
  "ra_ap_cfg",
@@ -585,7 +588,7 @@ version = "0.14.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3d248bdd43ce613d87415282f69b9bb99d947d290b10962dd6c56233312c2ad5"
 dependencies = [
- "log",
+ "log 0.4.22",
 ]
 
 [[package]]
@@ -755,7 +758,7 @@ checksum = "15f1ce686646e7f1e19bf7d5533fe443a45dbfb990e00629110797578b42fb19"
 dependencies = [
  "aho-corasick",
  "bstr",
- "log",
+ "log 0.4.22",
  "regex-automata 0.4.9",
  "regex-syntax 0.8.5",
 ]
@@ -1020,6 +1023,15 @@ dependencies = [
  "scopeguard",
 ]
 
+[[package]]
+name = "log"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e19e8d5c34a3e0e2223db8e060f9e8264aeeb5c5fc64a4ee9965c062211c024b"
+dependencies = [
+ "log 0.4.22",
+]
+
 [[package]]
 name = "log"
 version = "0.4.22"
@@ -1072,7 +1084,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a4a650543ca06a924e8b371db273b2756685faae30f8487da1b56505a8f78b0c"
 dependencies = [
  "libc",
- "log",
+ "log 0.4.22",
  "wasi",
  "windows-sys 0.48.0",
 ]
@@ -1086,6 +1098,16 @@ dependencies = [
  "windows-sys 0.48.0",
 ]
 
+[[package]]
+name = "mustache"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "51956ef1c5d20a1384524d91e616fb44dfc7d8f249bf696d49c97dd3289ecab5"
+dependencies = [
+ "log 0.3.9",
+ "serde",
+]
+
 [[package]]
 name = "nohash-hasher"
 version = "0.2.0"
@@ -1105,7 +1127,7 @@ dependencies = [
  "inotify",
  "kqueue",
  "libc",
- "log",
+ "log 0.4.22",
  "mio",
  "walkdir",
  "windows-sys 0.48.0",
@@ -2166,7 +2188,7 @@ checksum = "61c910772f992ab17d32d6760e167d2353f4130ed50e796752689556af07dc6b"
 dependencies = [
  "chrono",
  "is-terminal",
- "log",
+ "log 0.4.22",
  "termcolor",
  "thread_local",
 ]
@@ -2319,7 +2341,7 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ee855f1f400bd0e5c02d150ae5de3840039a3f54b025156404e34c23c03f47c3"
 dependencies = [
- "log",
+ "log 0.4.22",
  "once_cell",
  "tracing-core",
 ]
@@ -2344,9 +2366,9 @@ dependencies = [
 
 [[package]]
 name = "tree-sitter"
-version = "0.24.5"
+version = "0.24.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ac95b18f0f727aaaa012bd5179a1916706ee3ed071920fdbda738750b0c0bf5"
+checksum = "5f2434c86ba59ed15af56039cc5bf1acf8ba76ce301e32ef08827388ef285ec5"
 dependencies = [
  "cc",
  "regex",
@@ -2508,7 +2530,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5f89bb38646b4f81674e8f5c3fb81b562be1fd936d84320f3264486418519c79"
 dependencies = [
  "bumpalo",
- "log",
+ "log 0.4.22",
  "proc-macro2",
  "quote",
  "syn",

MODULE.bazel

@@ -97,6 +97,7 @@ use_repo(
     "vendor__itertools-0.14.0",
     "vendor__lazy_static-1.5.0",
     "vendor__log-0.4.22",
+    "vendor__mustache-0.9.0",
     "vendor__num-traits-0.2.19",
     "vendor__num_cpus-1.16.0",
     "vendor__proc-macro2-1.0.92",
@@ -126,7 +127,7 @@ use_repo(
     "vendor__syn-2.0.95",
     "vendor__tracing-0.1.41",
     "vendor__tracing-subscriber-0.3.19",
-    "vendor__tree-sitter-0.24.5",
+    "vendor__tree-sitter-0.24.6",
     "vendor__tree-sitter-embedded-template-0.23.2",
     "vendor__tree-sitter-json-0.24.8",
     "vendor__tree-sitter-ql-0.23.1",

actions/ql/lib/CHANGELOG.md

@@ -0,0 +1,5 @@
+## 0.4.0
+
+### New Features
+
+* Initial public preview release

actions/ql/lib/change-notes/released/0.4.0.md

@@ -0,0 +1,5 @@
+## 0.4.0
+
+### New Features
+
+* Initial public preview release

actions/ql/lib/codeql-pack.release.yml

@@ -0,0 +1,2 @@
+---
+lastReleaseVersion: 0.4.0

actions/ql/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/actions-all
-version: 0.4.0-dev
+version: 0.4.1-dev
 library: true
 warnOnImplicitThis: true
 dependencies:

actions/ql/src/CHANGELOG.md

@@ -1,4 +1,5 @@
----
-category: feature
----
+## 0.4.0
+
+### New Queries
+
 * Initial public preview release

actions/ql/src/change-notes/released/0.4.0.md

@@ -1,4 +1,5 @@
----
-category: newQuery
----
+## 0.4.0
+
+### New Queries
+
 * Initial public preview release

actions/ql/src/codeql-pack.release.yml

@@ -0,0 +1,2 @@
+---
+lastReleaseVersion: 0.4.0

actions/ql/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/actions-queries
-version: 0.4.0-dev
+version: 0.4.1-dev
 library: false
 warnOnImplicitThis: true
 groups: [actions, queries]

config/identical-files.json

@@ -247,7 +247,8 @@
     "javascript/ql/lib/semmle/javascript/security/internal/SensitiveDataHeuristics.qll",
     "python/ql/lib/semmle/python/security/internal/SensitiveDataHeuristics.qll",
     "ruby/ql/lib/codeql/ruby/security/internal/SensitiveDataHeuristics.qll",
-    "swift/ql/lib/codeql/swift/security/internal/SensitiveDataHeuristics.qll"
+    "swift/ql/lib/codeql/swift/security/internal/SensitiveDataHeuristics.qll",
+    "rust/ql/lib/codeql/rust/security/internal/SensitiveDataHeuristics.qll"
   ],
   "IncompleteUrlSubstringSanitization": [
     "javascript/ql/src/Security/CWE-020/IncompleteUrlSubstringSanitization.qll",

cpp/downgrades/7eeff19bf7c89a350d3e43516a33c98a270cb057/upgrade.properties

@@ -0,0 +1,4 @@
+description: Support concept id expressions
+compatibility: full
+concept_instantiation.rel: delete
+is_type_constraint.rel: delete

cpp/ql/lib/CHANGELOG.md

@@ -1,3 +1,22 @@
+## 3.1.0
+
+### Deprecated APIs
+
+* The `TemplateParameter` class, representing C++ type template parameters has been deprecated. Use `TypeTemplateParameter` instead.
+
+### New Features
+
+* New classes `SizeofPackExprOperator` and `SizeofPackTypeOperator` were introduced, which represent the C++ `sizeof...` operator taking expressions and type arguments, respectively.
+* A new class `TemplateTemplateParameterInstantiation` was introduced, which represents instantiations of template template parameters.
+* A new predicate `getAnInstantiation` was added to the `TemplateTemplateParameter` class, which yields instantiations of template template parameters.
+* The `getTemplateArgumentType` and `getTemplateArgumentValue` predicates of the `Declaration` class now also yield template arguments of template template parameters.
+* A new class `NonTypeTemplateParameter` was introduced, which represents C++ non-type template parameters.
+* A new class `TemplateParameterBase` was introduced, which represents C++ non-type template parameters, type template parameters, and template template parameters.
+
+### Minor Analysis Improvements
+
+* The `Guards` library (`semmle.code.cpp.controlflow.Guards`) has been improved to recognize more guard conditions.
+
 ## 3.0.0
 
 ### Breaking Changes

cpp/ql/lib/change-notes/2024-12-04-guard-conditions.md

@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* The `Guards` library (`semmle.code.cpp.controlflow.Guards`) has been improved to recognize more guard conditions.

cpp/ql/lib/change-notes/2024-12-17-template-parameter-base.md

@@ -1,4 +0,0 @@
----
-category: feature
----
-* A new class `TemplateParameterBase` was introduced, which represents C++ non-type template parameters, type template parameters, and template template parameters.

cpp/ql/lib/change-notes/2024-12-17-template-parameter.md

@@ -1,4 +0,0 @@
----
-category: deprecated
----
-* The `TemplateParameter` class, representing C++ type template parameters has been deprecated. Use `TypeTemplateParameter` instead.

cpp/ql/lib/change-notes/2024-12-18-non-type-template-parameter.md

@@ -1,4 +0,0 @@
----
-category: feature
----
-* A new class `NonTypeTemplateParameter` was introduced, which represents C++ non-type template parameters.

cpp/ql/lib/change-notes/2024-12-20-sizeof-pack.md

@@ -1,4 +0,0 @@
----
-category: feature
----
-* New classes `SizeofPackExprOperator` and `SizeofPackTypeOperator` were introduced, which represent the C++ `sizeof...` operator taking expressions and type arguments, respectively.

cpp/ql/lib/change-notes/2024-12-20-template-template-instantiation.md

@@ -1,6 +0,0 @@
----
-category: feature
----
-* A new class `TemplateTemplateParameterInstantiation` was introduced, which represents instantiations of template template parameters.
-* A new predicate `getAnInstantiation` was added to the `TemplateTemplateParameter` class, which yields instantiations of template template parameters.
-* The `getTemplateArgumentType` and `getTemplateArgumentValue` predicates of the `Declaration` class now also yield template arguments of template template parameters.

cpp/ql/lib/change-notes/2024-12-24-concept-id.md

@@ -0,0 +1,5 @@
+---
+category: feature
+---
+* A new class `ConceptIdExpr` was introduced, which represents C++20 concept id expressions.
+

cpp/ql/lib/change-notes/released/3.1.0.md

@@ -0,0 +1,18 @@
+## 3.1.0
+
+### Deprecated APIs
+
+* The `TemplateParameter` class, representing C++ type template parameters has been deprecated. Use `TypeTemplateParameter` instead.
+
+### New Features
+
+* New classes `SizeofPackExprOperator` and `SizeofPackTypeOperator` were introduced, which represent the C++ `sizeof...` operator taking expressions and type arguments, respectively.
+* A new class `TemplateTemplateParameterInstantiation` was introduced, which represents instantiations of template template parameters.
+* A new predicate `getAnInstantiation` was added to the `TemplateTemplateParameter` class, which yields instantiations of template template parameters.
+* The `getTemplateArgumentType` and `getTemplateArgumentValue` predicates of the `Declaration` class now also yield template arguments of template template parameters.
+* A new class `NonTypeTemplateParameter` was introduced, which represents C++ non-type template parameters.
+* A new class `TemplateParameterBase` was introduced, which represents C++ non-type template parameters, type template parameters, and template template parameters.
+
+### Minor Analysis Improvements
+
+* The `Guards` library (`semmle.code.cpp.controlflow.Guards`) has been improved to recognize more guard conditions.

cpp/ql/lib/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 3.0.0
+lastReleaseVersion: 3.1.0

cpp/ql/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/cpp-all
-version: 3.0.1-dev
+version: 3.1.1-dev
 groups: cpp
 dbscheme: semmlecode.cpp.dbscheme
 extractor: cpp

cpp/ql/lib/semmle/code/cpp/Concept.qll

@@ -153,11 +153,107 @@ class NestedRequirementExpr extends Expr, @nested_requirement {
 
 /**
  * A C++ concept id expression.
+ *
+ * For example, if:
+ * ```cpp
+ * template<typename T, T X> concept C = ...;
+ * ...
+ * requires { C<int, 1>; };
+ * ```
+ * then `C<int, 1>` is a concept id expression that refers to
+ * the concept `C`.
  */
 class ConceptIdExpr extends RequirementExpr, @concept_id {
-  override string toString() { result = "concept<...>" }
+  override string toString() {
+    result = this.getConcept().getName() + "<...>"
+    or
+    // The following is for backward compatibility with databases created with
+    // CodeQL 2.19.3, 2.19.4, and 2.20.0. Those databases include concept id
+    // expressions, but do not include concept template information.
+    not exists(this.getConcept()) and
+    result = "concept<...>"
+  }
 
   override string getAPrimaryQlClass() { result = "ConceptIdExpr" }
+
+  /**
+   * Holds if the concept id is used as a type constraint.
+   *
+   * In this case, the first template argument is implicit.
+   */
+  predicate isTypeConstraint() { is_type_constraint(underlyingElement(this)) }
+
+  /**
+   * Gets the concept this concept id refers to.
+   */
+  Concept getConcept() { concept_instantiation(underlyingElement(this), unresolveElement(result)) }
+
+  /**
+   * Gets a template argument passed to the concept.
+   */
+  final Locatable getATemplateArgument() { result = this.getTemplateArgument(_) }
+
+  /**
+   * Gets the kind of a non-type template argument passed to the concept.
+   */
+  final Locatable getATemplateArgumentKind() { result = this.getTemplateArgumentKind(_) }
+
+  /**
+   * Gets the `i`th template argument passed to the concept.
+   *
+   * For example, if:
+   * ```cpp
+   * template<typename T, T X> concept C = ...;
+   * ...
+   * requires { C<int, 1>; };
+   * ```
+   * then `getTemplateArgument(0)` yields `int`, and `getTemplateArgument(1)`
+   * yields `1`.
+   *
+   * If the concept id is a type constraint, then `getTemplateArgument(0)`
+   * will not yield a result.
+   */
+  final Locatable getTemplateArgument(int index) {
+    if exists(this.getTemplateArgumentValue(index))
+    then result = this.getTemplateArgumentValue(index)
+    else result = this.getTemplateArgumentType(index)
+  }
+
+  /**
+   * Gets the kind of the `i`th template argument value passed to the concept.
+   *
+   * For example, if:
+   * ```cpp
+   * template<typename T, T X> concept C = ...;
+   * ...
+   * requires { C<int, 1>; };
+   * ```
+   * then `getTemplateArgumentKind(1)` yields `int`, and there is no result for
+   * `getTemplateArgumentKind(0)`.
+   */
+  final Locatable getTemplateArgumentKind(int index) {
+    exists(this.getTemplateArgumentValue(index)) and
+    result = this.getTemplateArgumentType(index)
+  }
+
+  /**
+   *  Gets the number of template arguments passed to the concept.
+   */
+  final int getNumberOfTemplateArguments() {
+    result = count(int i | exists(this.getTemplateArgument(i)))
+  }
+
+  private Type getTemplateArgumentType(int index) {
+    exists(int i | if this.isTypeConstraint() then i = index - 1 else i = index |
+      concept_template_argument(underlyingElement(this), i, unresolveElement(result))
+    )
+  }
+
+  private Expr getTemplateArgumentValue(int index) {
+    exists(int i | if this.isTypeConstraint() then i = index - 1 else i = index |
+      concept_template_argument_value(underlyingElement(this), i, unresolveElement(result))
+    )
+  }
 }
 
 /**
@@ -187,4 +283,9 @@ class Concept extends Declaration, @concept_template {
    * the constraint expression is `std::is_same<T, int>::value`.
    */
   Expr getExpr() { result.getParent() = this }
+
+  /**
+   * Gets a concept id expression that refers to this concept
+   */
+  ConceptIdExpr getAReferringConceptIdExpr() { this = result.getConcept() }
 }

cpp/ql/lib/semmle/code/cpp/Declaration.qll

@@ -235,7 +235,7 @@ class Declaration extends Locatable, @declaration {
    *
    * `Foo<int, 1> bar;`
    *
-   * Will have `getTemplateArgument())` return `int`, and
+   * Will have `getTemplateArgument(0)` return `int`, and
    * `getTemplateArgument(1)` return `1`.
    */
   final Locatable getTemplateArgument(int index) {

cpp/ql/lib/semmle/code/cpp/PrintAST.qll

@@ -88,6 +88,10 @@ private Declaration getAnEnclosingDeclaration(Locatable ast) {
   or
   result = ast.(Initializer).getDeclaration()
   or
+  exists(ConceptIdExpr concept | ast = concept.getATemplateArgument() |
+    result = concept.getEnclosingFunction()
+  )
+  or
   result = ast
 }
 
@@ -107,6 +111,12 @@ private newtype TPrintAstNode =
   TRequiresExprParametersNode(RequiresExpr req) {
     shouldPrintDeclaration(getAnEnclosingDeclaration(req))
   } or
+  TConceptIdExprArgumentsNode(ConceptIdExpr concept) {
+    shouldPrintDeclaration(getAnEnclosingDeclaration(concept))
+  } or
+  TConceptIdExprTypeArgumentNode(Type type, ConceptIdExpr concept, int childIndex) {
+    type = concept.getTemplateArgument(childIndex)
+  } or
   TConstructorInitializersNode(Constructor ctor) {
     ctor.hasEntryPoint() and
     shouldPrintDeclaration(ctor)
@@ -357,6 +367,26 @@ class StringLiteralNode extends ExprNode {
   override string getValue() { result = "\"" + escapeString(expr.getValue()) + "\"" }
 }
 
+/**
+ * A node representing a `ConceptIdExpr`.
+ */
+class ConceptIdExprNode extends ExprNode {
+  override ConceptIdExpr expr;
+
+  override PrintAstNode getChildInternal(int childIndex) {
+    result = super.getChildInternal(childIndex)
+    or
+    childIndex = -1 and
+    result.(ConceptIdExprArgumentsNode).getConceptIdExpr() = expr
+  }
+
+  override string getChildAccessorPredicateInternal(int childIndex) {
+    result = super.getChildAccessorPredicateInternal(childIndex)
+    or
+    childIndex = -1 and result = "<args>"
+  }
+}
+
 /**
  * A node representing a `Conversion`.
  */
@@ -593,6 +623,63 @@ class InitializerNode extends AstNode {
   }
 }
 
+/**
+ * A node representing the arguments of a `ConceptIdExpr`.
+ */
+class ConceptIdExprArgumentsNode extends PrintAstNode, TConceptIdExprArgumentsNode {
+  ConceptIdExpr concept;
+
+  ConceptIdExprArgumentsNode() { this = TConceptIdExprArgumentsNode(concept) }
+
+  final override string toString() { result = "" }
+
+  final override Location getLocation() { result = getRepresentativeLocation(concept) }
+
+  override PrintAstNode getChildInternal(int childIndex) {
+    exists(Locatable arg | arg = concept.getTemplateArgument(childIndex) |
+      result.(ConceptIdExprTypeArgumentNode).isArgumentNode(arg, concept, childIndex)
+      or
+      result.(ExprNode).getAst() = arg
+    )
+  }
+
+  override string getChildAccessorPredicateInternal(int childIndex) {
+    exists(this.getChildInternal(childIndex)) and
+    result = "getTemplateArgument(" + childIndex + ")"
+  }
+
+  /**
+   * Gets the `ConceptIdExpr` for which this node represents the parameters.
+   */
+  final ConceptIdExpr getConceptIdExpr() { result = concept }
+}
+
+/**
+ * A node representing a type argument of a `ConceptIdExpr`.
+ */
+class ConceptIdExprTypeArgumentNode extends PrintAstNode, TConceptIdExprTypeArgumentNode {
+  Type type;
+  ConceptIdExpr concept;
+  int index;
+
+  ConceptIdExprTypeArgumentNode() { this = TConceptIdExprTypeArgumentNode(type, concept, index) }
+
+  final override string toString() { result = qlClass(type) + type.toString() }
+
+  final override Location getLocation() { result = getRepresentativeLocation(type) }
+
+  override AstNode getChildInternal(int childIndex) { none() }
+
+  override string getChildAccessorPredicateInternal(int childIndex) { none() }
+
+  /**
+   * Holds if `t` is the `i`th template argument of `c`.
+   */
+  predicate isArgumentNode(Type t, ConceptIdExpr c, int i) {
+    type = t and concept = c and index = i
+  }
+}
+
 /**
  * A node representing the parameters of a `Function`.
  */
@@ -611,7 +698,7 @@ class FunctionParametersNode extends PrintAstNode, TFunctionParametersNode {
 
   override string getChildAccessorPredicateInternal(int childIndex) {
     exists(this.getChildInternal(childIndex)) and
-    result = "getParameter(" + childIndex.toString() + ")"
+    result = "getParameter(" + childIndex + ")"
   }
 
   /**
@@ -638,7 +725,7 @@ class RequiresExprParametersNode extends PrintAstNode, TRequiresExprParametersNo
 
   override string getChildAccessorPredicateInternal(int childIndex) {
     exists(this.getChildInternal(childIndex)) and
-    result = "getParameter(" + childIndex.toString() + ")"
+    result = "getParameter(" + childIndex + ")"
   }
 
   /**
@@ -665,7 +752,7 @@ class ConstructorInitializersNode extends PrintAstNode, TConstructorInitializers
 
   final override string getChildAccessorPredicateInternal(int childIndex) {
     exists(this.getChildInternal(childIndex)) and
-    result = "getInitializer(" + childIndex.toString() + ")"
+    result = "getInitializer(" + childIndex + ")"
   }
 
   /**
@@ -692,7 +779,7 @@ class DestructorDestructionsNode extends PrintAstNode, TDestructorDestructionsNo
 
   final override string getChildAccessorPredicateInternal(int childIndex) {
     exists(this.getChildInternal(childIndex)) and
-    result = "getDestruction(" + childIndex.toString() + ")"
+    result = "getDestruction(" + childIndex + ")"
   }
 
   /**

cpp/ql/lib/semmle/code/cpp/rangeanalysis/new/internal/semantic/SemanticExpr.qll

@@ -3,6 +3,7 @@
  */
 
 private import Semantic
+private import SemanticLocation
 private import SemanticExprSpecific::SemanticExprConfig as Specific
 private import SemanticType
 
@@ -15,7 +16,7 @@ private import SemanticType
 class SemExpr instanceof Specific::Expr {
   final string toString() { result = super.toString() }
 
-  final Specific::Location getLocation() { result = super.getLocation() }
+  SemLocation getLocation() { result = super.getLocation() }
 
   Opcode getOpcode() { result instanceof Opcode::Unknown }
 

cpp/ql/lib/semmle/code/cpp/rangeanalysis/new/internal/semantic/analysis/FloatDelta.qll

@@ -2,6 +2,7 @@ private import RangeAnalysisImpl
 private import codeql.rangeanalysis.RangeAnalysis
 private import semmle.code.cpp.rangeanalysis.new.internal.semantic.SemanticExpr
 private import semmle.code.cpp.rangeanalysis.new.internal.semantic.SemanticType
+private import semmle.code.cpp.rangeanalysis.new.internal.semantic.SemanticLocation
 
 module FloatDelta implements DeltaSig {
   class Delta = float;
@@ -22,7 +23,7 @@ module FloatDelta implements DeltaSig {
   Delta fromFloat(float f) { result = f }
 }
 
-module FloatOverflow implements OverflowSig<Sem, FloatDelta> {
+module FloatOverflow implements OverflowSig<SemLocation, Sem, FloatDelta> {
   predicate semExprDoesNotOverflow(boolean positively, SemExpr expr) {
     exists(float lb, float ub, float delta |
       typeBounds(expr.getSemType(), lb, ub) and

cpp/ql/lib/semmle/code/cpp/rangeanalysis/new/internal/semantic/analysis/RangeAnalysisConstantSpecific.qll

@@ -3,11 +3,12 @@
  */
 
 private import semmle.code.cpp.rangeanalysis.new.internal.semantic.Semantic
+private import semmle.code.cpp.rangeanalysis.new.internal.semantic.SemanticLocation
 private import semmle.code.cpp.rangeanalysis.new.internal.semantic.analysis.FloatDelta
 private import RangeAnalysisImpl
 private import codeql.rangeanalysis.RangeAnalysis
 
-module CppLangImplConstant implements LangSig<Sem, FloatDelta> {
+module CppLangImplConstant implements LangSig<SemLocation, Sem, FloatDelta> {
   /**
    * Ignore the bound on this expression.
    *

cpp/ql/lib/semmle/code/cpp/rangeanalysis/new/internal/semantic/analysis/RangeAnalysisImpl.qll

@@ -12,7 +12,7 @@ private import SemanticType
 private import codeql.rangeanalysis.RangeAnalysis
 private import ConstantAnalysis as ConstantAnalysis
 
-module Sem implements Semantic {
+module Sem implements Semantic<SemLocation> {
   class Expr = SemExpr;
 
   class ConstantIntegerExpr = ConstantAnalysis::SemConstantIntegerExpr;
@@ -104,7 +104,7 @@ module Sem implements Semantic {
   }
 }
 
-module SignAnalysis implements SignAnalysisSig<Sem> {
+module SignAnalysis implements SignAnalysisSig<SemLocation, Sem> {
   private import SignAnalysisCommon as SA
   import SA::SignAnalysis<FloatDelta>
 }
@@ -165,7 +165,7 @@ module AllBounds implements BoundSig<SemLocation, Sem, FloatDelta> {
   }
 }
 
-private module ModulusAnalysisInstantiated implements ModulusAnalysisSig<Sem> {
+private module ModulusAnalysisInstantiated implements ModulusAnalysisSig<SemLocation, Sem> {
   class ModBound = AllBounds::SemBound;
 
   private import codeql.rangeanalysis.ModulusAnalysis as MA

cpp/ql/lib/semmle/code/cpp/rangeanalysis/new/internal/semantic/analysis/RangeAnalysisRelativeSpecific.qll

@@ -3,12 +3,13 @@
  */
 
 private import semmle.code.cpp.rangeanalysis.new.internal.semantic.Semantic
+private import semmle.code.cpp.rangeanalysis.new.internal.semantic.SemanticLocation
 private import semmle.code.cpp.rangeanalysis.new.internal.semantic.analysis.FloatDelta
 private import RangeAnalysisImpl
 private import semmle.code.cpp.rangeanalysis.RangeAnalysisUtils
 private import codeql.rangeanalysis.RangeAnalysis
 
-module CppLangImplRelative implements LangSig<Sem, FloatDelta> {
+module CppLangImplRelative implements LangSig<SemLocation, Sem, FloatDelta> {
   /**
    * Ignore the bound on this expression.
    *

cpp/ql/lib/semmle/code/cpp/rangeanalysis/new/internal/semantic/analysis/SignAnalysisCommon.qll

@@ -10,11 +10,12 @@ private import codeql.rangeanalysis.RangeAnalysis
 private import RangeAnalysisImpl
 private import SignAnalysisSpecific as Specific
 private import semmle.code.cpp.rangeanalysis.new.internal.semantic.Semantic
+private import semmle.code.cpp.rangeanalysis.new.internal.semantic.SemanticLocation
 private import ConstantAnalysis
 private import Sign
 
 module SignAnalysis<DeltaSig D> {
-  private import codeql.rangeanalysis.internal.RangeUtils::MakeUtils<Sem, D>
+  private import codeql.rangeanalysis.internal.RangeUtils::MakeUtils<SemLocation, Sem, D>
 
   /**
    * An SSA definition for which the analysis can compute the sign.

cpp/ql/lib/semmlecode.cpp.dbscheme

@@ -883,6 +883,11 @@ concept_templates(
     string name: string ref,
     int location: @location_default ref
 );
+concept_instantiation(
+    unique int to: @concept_id ref,
+    int from: @concept_template ref
+);
+is_type_constraint(int concept_id: @concept_id ref);
 concept_template_argument(
     int concept_id: @concept ref,
     int index: int ref,

cpp/ql/lib/upgrades/f786eb3f5dfddb0ac914ab09551bf1c5c64b47c0/upgrade.properties

@@ -0,0 +1,2 @@
+description: Support concept id expressions
+compatibility: partial

cpp/ql/src/CHANGELOG.md

@@ -1,3 +1,13 @@
+## 1.3.1
+
+### Minor Analysis Improvements
+
+* The "Returning stack-allocated memory" query (`cpp/return-stack-allocated-memory`) no longer produces results if there is an extraction error in the returned expression.
+* The "Badly bounded write" query (`cpp/badly-bounded-write`) no longer produces results if there is an extraction error in the type of the output buffer.
+* The "Too few arguments to formatting function" query (`cpp/wrong-number-format-arguments`) no longer produces results if an argument has an extraction error.
+* The "Wrong type of arguments to formatting function" query (`cpp/wrong-type-format-argument`) no longer produces results when an argument type has an extraction error.
+* Added dataflow models and flow sources for Microsoft's Active Template Library (ATL).
+
 ## 1.3.0
 
 ### New Queries

cpp/ql/src/change-notes/2024-11-27-active-template-library.md

@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Added dataflow models and flow sources for Microsoft's Active Template Library (ATL).

cpp/ql/src/change-notes/2024-12-05-badly-bounded-write.md

@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* The "Badly bounded write" query (`cpp/badly-bounded-write`) no longer produces results if there is an extraction error in the type of the output buffer.

cpp/ql/src/change-notes/2024-12-05-wrong-number-format-arguments.md

@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* The "Too few arguments to formatting function" query (`cpp/wrong-number-format-arguments`) no longer produces results if an argument has an extraction error.

cpp/ql/src/change-notes/2024-12-05-wrong-type-format-args.md

@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* The "Wrong type of arguments to formatting function" query (`cpp/wrong-type-format-argument`) no longer produces results when an argument type has an extraction error.

cpp/ql/src/change-notes/2024-12-18-return-stack-allocated-memory.md

@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* The "Returning stack-allocated memory" query (`cpp/return-stack-allocated-memory`) no longer produces results if there is an extraction error in the returned expression.

cpp/ql/src/change-notes/released/1.3.1.md

@@ -0,0 +1,9 @@
+## 1.3.1
+
+### Minor Analysis Improvements
+
+* The "Returning stack-allocated memory" query (`cpp/return-stack-allocated-memory`) no longer produces results if there is an extraction error in the returned expression.
+* The "Badly bounded write" query (`cpp/badly-bounded-write`) no longer produces results if there is an extraction error in the type of the output buffer.
+* The "Too few arguments to formatting function" query (`cpp/wrong-number-format-arguments`) no longer produces results if an argument has an extraction error.
+* The "Wrong type of arguments to formatting function" query (`cpp/wrong-type-format-argument`) no longer produces results when an argument type has an extraction error.
+* Added dataflow models and flow sources for Microsoft's Active Template Library (ATL).

cpp/ql/src/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.3.0
+lastReleaseVersion: 1.3.1

cpp/ql/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/cpp-queries
-version: 1.3.1-dev
+version: 1.3.2-dev
 groups:
   - cpp
   - queries

csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md

@@ -1,3 +1,7 @@
+## 1.7.31
+
+No user-facing changes.
+
 ## 1.7.30
 
 No user-facing changes.

csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.31.md

@@ -0,0 +1,3 @@
+## 1.7.31
+
+No user-facing changes.

csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.7.30
+lastReleaseVersion: 1.7.31

csharp/ql/campaigns/Solorigate/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/csharp-solorigate-all
-version: 1.7.31-dev
+version: 1.7.32-dev
 groups:
   - csharp
   - solorigate

csharp/ql/campaigns/Solorigate/src/CHANGELOG.md

@@ -1,3 +1,7 @@
+## 1.7.31
+
+No user-facing changes.
+
 ## 1.7.30
 
 No user-facing changes.

csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.31.md

@@ -0,0 +1,3 @@
+## 1.7.31
+
+No user-facing changes.

csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.7.30
+lastReleaseVersion: 1.7.31

csharp/ql/campaigns/Solorigate/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/csharp-solorigate-queries
-version: 1.7.31-dev
+version: 1.7.32-dev
 groups:
   - csharp
   - solorigate

csharp/ql/integration-tests/all-platforms/blazor/BlazorTest/BlazorTest.csproj

@@ -0,0 +1,9 @@
+<Project Sdk="Microsoft.NET.Sdk.Web">
+
+  <PropertyGroup>
+    <TargetFramework>net9.0</TargetFramework>
+    <Nullable>enable</Nullable>
+    <ImplicitUsings>enable</ImplicitUsings>
+  </PropertyGroup>
+
+</Project>

csharp/ql/integration-tests/all-platforms/blazor/BlazorTest/Components/App.razor

@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html lang="en">
+
+<head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <base href="/" />
+    <link rel="stylesheet" href="bootstrap/bootstrap.min.css" />
+    <link rel="stylesheet" href="app.css" />
+    <link rel="stylesheet" href="BlazorTest.styles.css" />
+    <link rel="icon" type="image/png" href="favicon.png" />
+    <HeadOutlet />
+</head>
+
+<body>
+    <Routes />
+    <script src="_framework/blazor.web.js"></script>
+</body>
+
+</html>

csharp/ql/integration-tests/all-platforms/blazor/BlazorTest/Components/Layout/MainLayout.razor

@@ -0,0 +1,23 @@
+@inherits LayoutComponentBase
+
+<div class="page">
+    <div class="sidebar">
+        <NavMenu />
+    </div>
+
+    <main>
+        <div class="top-row px-4">
+            <a href="https://learn.microsoft.com/aspnet/core/" target="_blank">About</a>
+        </div>
+
+        <article class="content px-4">
+            @Body
+        </article>
+    </main>
+</div>
+
+<div id="blazor-error-ui">
+    An unhandled error has occurred.
+    <a href="" class="reload">Reload</a>
+    <a class="dismiss">🗙</a>
+</div>

csharp/ql/integration-tests/all-platforms/blazor/BlazorTest/Components/Layout/MainLayout.razor.css

@@ -0,0 +1,96 @@
+.page {
+    position: relative;
+    display: flex;
+    flex-direction: column;
+}
+
+main {
+    flex: 1;
+}
+
+.sidebar {
+    background-image: linear-gradient(180deg, rgb(5, 39, 103) 0%, #3a0647 70%);
+}
+
+.top-row {
+    background-color: #f7f7f7;
+    border-bottom: 1px solid #d6d5d5;
+    justify-content: flex-end;
+    height: 3.5rem;
+    display: flex;
+    align-items: center;
+}
+
+    .top-row ::deep a, .top-row ::deep .btn-link {
+        white-space: nowrap;
+        margin-left: 1.5rem;
+        text-decoration: none;
+    }
+
+    .top-row ::deep a:hover, .top-row ::deep .btn-link:hover {
+        text-decoration: underline;
+    }
+
+    .top-row ::deep a:first-child {
+        overflow: hidden;
+        text-overflow: ellipsis;
+    }
+
+@media (max-width: 640.98px) {
+    .top-row {
+        justify-content: space-between;
+    }
+
+    .top-row ::deep a, .top-row ::deep .btn-link {
+        margin-left: 0;
+    }
+}
+
+@media (min-width: 641px) {
+    .page {
+        flex-direction: row;
+    }
+
+    .sidebar {
+        width: 250px;
+        height: 100vh;
+        position: sticky;
+        top: 0;
+    }
+
+    .top-row {
+        position: sticky;
+        top: 0;
+        z-index: 1;
+    }
+
+    .top-row.auth ::deep a:first-child {
+        flex: 1;
+        text-align: right;
+        width: 0;
+    }
+
+    .top-row, article {
+        padding-left: 2rem !important;
+        padding-right: 1.5rem !important;
+    }
+}
+
+#blazor-error-ui {
+    background: lightyellow;
+    bottom: 0;
+    box-shadow: 0 -1px 2px rgba(0, 0, 0, 0.2);
+    display: none;
+    left: 0;
+    padding: 0.6rem 1.25rem 0.7rem 1.25rem;
+    position: fixed;
+    width: 100%;
+    z-index: 1000;
+}
+
+    #blazor-error-ui .dismiss {
+        cursor: pointer;
+        position: absolute;
+        right: 0.75rem;
+        top: 0.5rem;
+    }

csharp/ql/integration-tests/all-platforms/blazor/BlazorTest/Components/Layout/NavMenu.razor

@@ -0,0 +1,19 @@
+<div class="top-row ps-3 navbar navbar-dark">
+    <div class="container-fluid">
+        <a class="navbar-brand" href="">BlazorTest</a>
+    </div>
+</div>
+
+<input type="checkbox" title="Navigation menu" class="navbar-toggler" />
+
+<div class="nav-scrollable" onclick="document.querySelector('.navbar-toggler').click()">
+    <nav class="flex-column">
+
+        <div class="nav-item px-3">
+            <NavLink class="nav-link" href="test">
+                <span class="bi bi-plus-square-fill-nav-menu" aria-hidden="true"></span> Test
+            </NavLink>
+        </div>
+
+    </nav>
+</div>

csharp/ql/integration-tests/all-platforms/blazor/BlazorTest/Components/Layout/NavMenu.razor.css

@@ -0,0 +1,105 @@
+.navbar-toggler {
+    appearance: none;
+    cursor: pointer;
+    width: 3.5rem;
+    height: 2.5rem;
+    color: white;
+    position: absolute;
+    top: 0.5rem;
+    right: 1rem;
+    border: 1px solid rgba(255, 255, 255, 0.1);
+    background: url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 30 30'%3e%3cpath stroke='rgba%28255, 255, 255, 0.55%29' stroke-linecap='round' stroke-miterlimit='10' stroke-width='2' d='M4 7h22M4 15h22M4 23h22'/%3e%3c/svg%3e") no-repeat center/1.75rem rgba(255, 255, 255, 0.1);
+}
+
+.navbar-toggler:checked {
+    background-color: rgba(255, 255, 255, 0.5);
+}
+
+.top-row {
+    height: 3.5rem;
+    background-color: rgba(0,0,0,0.4);
+}
+
+.navbar-brand {
+    font-size: 1.1rem;
+}
+
+.bi {
+    display: inline-block;
+    position: relative;
+    width: 1.25rem;
+    height: 1.25rem;
+    margin-right: 0.75rem;
+    top: -1px;
+    background-size: cover;
+}
+
+.bi-house-door-fill-nav-menu {
+    background-image: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='16' height='16' fill='white' class='bi bi-house-door-fill' viewBox='0 0 16 16'%3E%3Cpath d='M6.5 14.5v-3.505c0-.245.25-.495.5-.495h2c.25 0 .5.25.5.5v3.5a.5.5 0 0 0 .5.5h4a.5.5 0 0 0 .5-.5v-7a.5.5 0 0 0-.146-.354L13 5.793V2.5a.5.5 0 0 0-.5-.5h-1a.5.5 0 0 0-.5.5v1.293L8.354 1.146a.5.5 0 0 0-.708 0l-6 6A.5.5 0 0 0 1.5 7.5v7a.5.5 0 0 0 .5.5h4a.5.5 0 0 0 .5-.5Z'/%3E%3C/svg%3E");
+}
+
+.bi-plus-square-fill-nav-menu {
+    background-image: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='16' height='16' fill='white' class='bi bi-plus-square-fill' viewBox='0 0 16 16'%3E%3Cpath d='M2 0a2 2 0 0 0-2 2v12a2 2 0 0 0 2 2h12a2 2 0 0 0 2-2V2a2 2 0 0 0-2-2H2zm6.5 4.5v3h3a.5.5 0 0 1 0 1h-3v3a.5.5 0 0 1-1 0v-3h-3a.5.5 0 0 1 0-1h3v-3a.5.5 0 0 1 1 0z'/%3E%3C/svg%3E");
+}
+
+.bi-list-nested-nav-menu {
+    background-image: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='16' height='16' fill='white' class='bi bi-list-nested' viewBox='0 0 16 16'%3E%3Cpath fill-rule='evenodd' d='M4.5 11.5A.5.5 0 0 1 5 11h10a.5.5 0 0 1 0 1H5a.5.5 0 0 1-.5-.5zm-2-4A.5.5 0 0 1 3 7h10a.5.5 0 0 1 0 1H3a.5.5 0 0 1-.5-.5zm-2-4A.5.5 0 0 1 1 3h10a.5.5 0 0 1 0 1H1a.5.5 0 0 1-.5-.5z'/%3E%3C/svg%3E");
+}
+
+.nav-item {
+    font-size: 0.9rem;
+    padding-bottom: 0.5rem;
+}
+
+    .nav-item:first-of-type {
+        padding-top: 1rem;
+    }
+
+    .nav-item:last-of-type {
+        padding-bottom: 1rem;
+    }
+
+    .nav-item ::deep .nav-link {
+        color: #d7d7d7;
+        background: none;
+        border: none;
+        border-radius: 4px;
+        height: 3rem;
+        display: flex;
+        align-items: center;
+        line-height: 3rem;
+        width: 100%;
+    }
+
+.nav-item ::deep a.active {
+    background-color: rgba(255,255,255,0.37);
+    color: white;
+}
+
+.nav-item ::deep .nav-link:hover {
+    background-color: rgba(255,255,255,0.1);
+    color: white;
+}
+
+.nav-scrollable {
+    display: none;
+}
+
+.navbar-toggler:checked ~ .nav-scrollable {
+    display: block;
+}
+
+@media (min-width: 641px) {
+    .navbar-toggler {
+        display: none;
+    }
+
+    .nav-scrollable {
+        /* Never collapse the sidebar for wide screens */
+        display: block;
+
+        /* Allow sidebar to scroll for tall menus */
+        height: calc(100vh - 3.5rem);
+        overflow-y: auto;
+    }
+}

csharp/ql/integration-tests/all-platforms/blazor/BlazorTest/Components/MyInput.razor

@@ -0,0 +1,20 @@
+@rendermode InteractiveServer
+
+<input @bind="Param1" @bind:event="onchange" @bind:after="Fire">
+
+@code {
+    [Parameter]
+    public string? Param1 { get; set; } = "";
+
+    [Parameter]
+    public EventCallback<string?> ValueChanged { get; set; }
+
+    [Parameter]
+    public EventCallback<string?> Param1Changed { get; set; }
+
+    private void Fire()
+    {
+        ValueChanged.InvokeAsync(Param1);
+        Param1Changed.InvokeAsync(Param1);
+    }
+}

csharp/ql/integration-tests/all-platforms/blazor/BlazorTest/Components/MyOutput.razor

@@ -0,0 +1,11 @@
+@rendermode InteractiveServer
+
+<div>
+    <p>Value from InputText: @Value</p>
+    <p>Raw value from InputText: @(new MarkupString(Value))</p>
+</div>
+
+@code {
+    [Parameter]
+    public string Value { get; set; } = "";
+}

csharp/ql/integration-tests/all-platforms/blazor/BlazorTest/Components/Pages/Error.razor

@@ -0,0 +1,36 @@
+@page "/Error"
+@using System.Diagnostics
+
+<PageTitle>Error</PageTitle>
+
+<h1 class="text-danger">Error.</h1>
+<h2 class="text-danger">An error occurred while processing your request.</h2>
+
+@if (ShowRequestId)
+{
+    <p>
+        <strong>Request ID:</strong> <code>@RequestId</code>
+    </p>
+}
+
+<h3>Development Mode</h3>
+<p>
+    Swapping to <strong>Development</strong> environment will display more detailed information about the error that occurred.
+</p>
+<p>
+    <strong>The Development environment shouldn't be enabled for deployed applications.</strong>
+    It can result in displaying sensitive information from exceptions to end users.
+    For local debugging, enable the <strong>Development</strong> environment by setting the <strong>ASPNETCORE_ENVIRONMENT</strong> environment variable to <strong>Development</strong>
+    and restarting the app.
+</p>
+
+@code{
+    [CascadingParameter]
+    private HttpContext? HttpContext { get; set; }
+
+    private string? RequestId { get; set; }
+    private bool ShowRequestId => !string.IsNullOrEmpty(RequestId);
+
+    protected override void OnInitialized() =>
+        RequestId = Activity.Current?.Id ?? HttpContext?.TraceIdentifier;
+}

csharp/ql/integration-tests/all-platforms/blazor/BlazorTest/Components/Pages/TestPage.razor

@@ -0,0 +1,125 @@
+@page "/"
+@page "/test/{urlParam?}"
+@rendermode InteractiveServer
+
+<PageTitle>TestPage</PageTitle>
+
+<div>
+    <h3>Route parameter</h3>
+    <p>Go to: <a href="/test/@XssUrl">/test/@XssUrl</a></p>
+    <p>Parameter from URL: @UrlParam</p>
+    <p>Raw parameter from URL: @((MarkupString)UrlParam)</p>
+</div>
+
+<hr />
+
+<div>
+    <h3>Query parameter</h3>
+    <p>Go to: <a href="/test/?qs=@XssUrl">/test/?qs=@XssUrl</a></p>
+    <p>Parameter from query string: @QueryParam</p>
+    <p>Raw parameter from query string: @(new MarkupString(QueryParam))</p>
+</div>
+
+<hr />
+
+<div>
+    <h3>Bind InputText component</h3>
+    <InputText @bind-Value="InputValue1" />
+    <p>Value from InputText: @InputValue1</p>
+    <p>Raw value from InputText: @(new MarkupString(InputValue1))</p>
+</div>
+
+<hr />
+
+<div>
+    <h3>Bind input element</h3>
+    <input @bind="InputValue2">
+    <p>Value from InputText: @InputValue2</p>
+    <p>Raw value from InputText: @(new MarkupString(InputValue2))</p>
+</div>
+
+<hr />
+
+<div>
+    <h3>Bind through object property</h3>
+    <input @bind="Container1.Value">
+    <p>Value from InputText: @Container1.Value</p>
+    <p>Raw value from InputText: @(new MarkupString(Container1.Value))</p>
+</div>
+
+<hr />
+
+<div>
+    <h3>Input component with custom event</h3>
+    <MyInput Param1="@InputValue3" ValueChanged="MyInputChanged" />
+    <p>Value from InputText: @InputValue3</p>
+    <p>Raw value from InputText: @(new MarkupString(InputValue3))</p>
+</div>
+
+<hr />
+
+<div>
+    <h3>Input component with binding</h3>
+    <MyInput @bind-Param1="InputValue4" />
+    <p>Value from InputText: @InputValue4</p>
+    <p>Raw value from InputText: @(new MarkupString(InputValue4))</p>
+</div>
+
+<hr />
+
+<div>
+    <h3>Input, Output components</h3>
+    <MyInput @bind-Param1="InputValue5" />
+    <MyOutput Value="@InputValue5" />
+</div>
+
+<hr />
+
+<div>
+    <h3>Bind InputText, Output component</h3>
+    <InputText @bind-Value="InputValue6" />
+    <MyOutput Value="@InputValue6" />
+</div>
+
+@code {
+
+    public class Container
+    {
+        public string? Value { get; set; } = "";
+    }
+
+    private const string XssUrl = "<b>aaaa<%2Fb>";
+    private const string XssUrl2 = "<b>aaaa</b>";
+
+    [Parameter]
+    public string UrlParam { get; set; } = "";
+
+    [SupplyParameterFromQuery(Name = "qs")]
+    public string QueryParam { get; set; } = "";
+
+    public string InputValue1 { get; set; } = "";
+    public string InputValue2 { get; set; } = "";
+    public string InputValue3 { get; set; } = "";
+    public string InputValue4 { get; set; } = "";
+    public string InputValue5 { get; set; } = "";
+    public string InputValue6 { get; set; } = "";
+
+    public Container Container1 { get; set; } = new Container();
+
+    protected override void OnInitialized()
+    {
+        InputValue1 = XssUrl2;
+        InputValue2 = XssUrl2;
+        Container1.Value = XssUrl2;
+        InputValue3 = XssUrl2;
+        InputValue4 = XssUrl2;
+        InputValue5 = XssUrl2;
+        InputValue6 = XssUrl2;
+
+    }
+
+    private void MyInputChanged(string value)
+    {
+        InputValue3 = value;
+    }
+}

csharp/ql/integration-tests/all-platforms/blazor/BlazorTest/Components/Routes.razor

@@ -0,0 +1,6 @@
+<Router AppAssembly="typeof(Program).Assembly">
+    <Found Context="routeData">
+        <RouteView RouteData="routeData" DefaultLayout="typeof(Layout.MainLayout)" />
+        <FocusOnNavigate RouteData="routeData" Selector="h1" />
+    </Found>
+</Router>

csharp/ql/integration-tests/all-platforms/blazor/BlazorTest/Components/_Imports.razor

@@ -0,0 +1,10 @@
+@using System.Net.Http
+@using System.Net.Http.Json
+@using Microsoft.AspNetCore.Components.Forms
+@using Microsoft.AspNetCore.Components.Routing
+@using Microsoft.AspNetCore.Components.Web
+@using static Microsoft.AspNetCore.Components.Web.RenderMode
+@using Microsoft.AspNetCore.Components.Web.Virtualization
+@using Microsoft.JSInterop
+@using BlazorTest
+@using BlazorTest.Components

csharp/ql/integration-tests/all-platforms/blazor/BlazorTest/Program.cs

@@ -0,0 +1,27 @@
+using BlazorTest.Components;
+
+var builder = WebApplication.CreateBuilder(args);
+
+// Add services to the container.
+builder.Services.AddRazorComponents()
+    .AddInteractiveServerComponents();
+
+var app = builder.Build();
+
+// Configure the HTTP request pipeline.
+if (!app.Environment.IsDevelopment())
+{
+    app.UseExceptionHandler("/Error", createScopeForErrors: true);
+    // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
+    app.UseHsts();
+}
+
+app.UseHttpsRedirection();
+
+app.UseStaticFiles();
+app.UseAntiforgery();
+
+app.MapRazorComponents<App>()
+    .AddInteractiveServerRenderMode();
+
+app.Run();

csharp/ql/integration-tests/all-platforms/blazor/BlazorTest/Properties/launchSettings.json

@@ -0,0 +1,14 @@
+{
+  "$schema": "http://json.schemastore.org/launchsettings.json",
+  "profiles": {
+    "http": {
+      "commandName": "Project",
+      "dotnetRunMessages": true,
+      "launchBrowser": true,
+      "applicationUrl": "http://localhost:5047",
+      "environmentVariables": {
+        "ASPNETCORE_ENVIRONMENT": "Development"
+      }
+    }
+  }
+}

csharp/ql/integration-tests/all-platforms/blazor/BlazorTest/appsettings.json

@@ -0,0 +1,9 @@
+{
+  "Logging": {
+    "LogLevel": {
+      "Default": "Information",
+      "Microsoft.AspNetCore": "Warning"
+    }
+  },
+  "AllowedHosts": "*"
+}

csharp/ql/integration-tests/all-platforms/blazor/BlazorTest/global.json

@@ -0,0 +1,5 @@
+{
+    "sdk": {
+        "version": "9.0.100"
+    }
+}

csharp/ql/integration-tests/all-platforms/blazor/BlazorTest/wwwroot/app.css

@@ -0,0 +1,51 @@
+html, body {
+    font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif;
+}
+
+a, .btn-link {
+    color: #006bb7;
+}
+
+.btn-primary {
+    color: #fff;
+    background-color: #1b6ec2;
+    border-color: #1861ac;
+}
+
+.btn:focus, .btn:active:focus, .btn-link.nav-link:focus, .form-control:focus, .form-check-input:focus {
+  box-shadow: 0 0 0 0.1rem white, 0 0 0 0.25rem #258cfb;
+}
+
+.content {
+    padding-top: 1.1rem;
+}
+
+h1:focus {
+    outline: none;
+}
+
+.valid.modified:not([type=checkbox]) {
+    outline: 1px solid #26b050;
+}
+
+.invalid {
+    outline: 1px solid #e50000;
+}
+
+.validation-message {
+    color: #e50000;
+}
+
+.blazor-error-boundary {
+    background: url(data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iNTYiIGhlaWdodD0iNDkiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgeG1sbnM6eGxpbms9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkveGxpbmsiIG92ZXJmbG93PSJoaWRkZW4iPjxkZWZzPjxjbGlwUGF0aCBpZD0iY2xpcDAiPjxyZWN0IHg9IjIzNSIgeT0iNTEiIHdpZHRoPSI1NiIgaGVpZ2h0PSI0OSIvPjwvY2xpcFBhdGg+PC9kZWZzPjxnIGNsaXAtcGF0aD0idXJsKCNjbGlwMCkiIHRyYW5zZm9ybT0idHJhbnNsYXRlKC0yMzUgLTUxKSI+PHBhdGggZD0iTTI2My41MDYgNTFDMjY0LjcxNyA1MSAyNjUuODEzIDUxLjQ4MzcgMjY2LjYwNiA1Mi4yNjU4TDI2Ny4wNTIgNTIuNzk4NyAyNjcuNTM5IDUzLjYyODMgMjkwLjE4NSA5Mi4xODMxIDI5MC41NDUgOTIuNzk1IDI5MC42NTYgOTIuOTk2QzI5MC44NzcgOTMuNTEzIDI5MSA5NC4wODE1IDI5MSA5NC42NzgyIDI5MSA5Ny4wNjUxIDI4OS4wMzggOTkgMjg2LjYxNyA5OUwyNDAuMzgzIDk5QzIzNy45NjMgOTkgMjM2IDk3LjA2NTEgMjM2IDk0LjY3ODIgMjM2IDk0LjM3OTkgMjM2LjAzMSA5NC4wODg2IDIzNi4wODkgOTMuODA3MkwyMzYuMzM4IDkzLjAxNjIgMjM2Ljg1OCA5Mi4xMzE0IDI1OS40NzMgNTMuNjI5NCAyNTkuOTYxIDUyLjc5ODUgMjYwLjQwNyA1Mi4yNjU4QzI2MS4yIDUxLjQ4MzcgMjYyLjI5NiA1MSAyNjMuNTA2IDUxWk0yNjMuNTg2IDY2LjAxODNDMjYwLjczNyA2Ni4wMTgzIDI1OS4zMTMgNjcuMTI0NSAyNTkuMzEzIDY5LjMzNyAyNTkuMzEzIDY5LjYxMDIgMjU5LjMzMiA2OS44NjA4IDI1OS4zNzEgNzAuMDg4N0wyNjEuNzk1IDg0LjAxNjEgMjY1LjM4IDg0LjAxNjEgMjY3LjgyMSA2OS43NDc1QzI2Ny44NiA2OS43MzA5IDI2Ny44NzkgNjkuNTg3NyAyNjcuODc5IDY5LjMxNzkgMjY3Ljg3OSA2Ny4xMTgyIDI2Ni40NDggNjYuMDE4MyAyNjMuNTg2IDY2LjAxODNaTTI2My41NzYgODYuMDU0N0MyNjEuMDQ5IDg2LjA1NDcgMjU5Ljc4NiA4Ny4zMDA1IDI1OS43ODYgODkuNzkyMSAyNTkuNzg2IDkyLjI4MzcgMjYxLjA0OSA5My41Mjk1IDI2My41NzYgOTMuNTI5NSAyNjYuMTE2IDkzLjUyOTUgMjY3LjM4NyA5Mi4yODM3IDI2Ny4zODcgODkuNzkyMSAyNjcuMzg3IDg3LjMwMDUgMjY2LjExNiA4Ni4wNTQ3IDI2My41NzYgODYuMDU0N1oiIGZpbGw9IiNGRkU1MDAiIGZpbGwtcnVsZT0iZXZlbm9kZCIvPjwvZz48L3N2Zz4=) no-repeat 1rem/1.8rem, #b32121;
+    padding: 1rem 1rem 1rem 3.7rem;
+    color: white;
+}
+
+    .blazor-error-boundary::after {
+        content: "An error has occurred."
+    }
+
+.darker-border-checkbox.form-check-input {
+    border-color: #929292;
+}

csharp/ql/integration-tests/all-platforms/blazor/Files.expected

@@ -0,0 +1,22 @@
+| BlazorTest/Components/App.razor:0:0:0:0 | BlazorTest/Components/App.razor |
+| BlazorTest/Components/Layout/MainLayout.razor:0:0:0:0 | BlazorTest/Components/Layout/MainLayout.razor |
+| BlazorTest/Components/Layout/NavMenu.razor:0:0:0:0 | BlazorTest/Components/Layout/NavMenu.razor |
+| BlazorTest/Components/MyInput.razor:0:0:0:0 | BlazorTest/Components/MyInput.razor |
+| BlazorTest/Components/MyOutput.razor:0:0:0:0 | BlazorTest/Components/MyOutput.razor |
+| BlazorTest/Components/Pages/Error.razor:0:0:0:0 | BlazorTest/Components/Pages/Error.razor |
+| BlazorTest/Components/Pages/TestPage.razor:0:0:0:0 | BlazorTest/Components/Pages/TestPage.razor |
+| BlazorTest/Components/Routes.razor:0:0:0:0 | BlazorTest/Components/Routes.razor |
+| BlazorTest/Components/_Imports.razor:0:0:0:0 | BlazorTest/Components/_Imports.razor |
+| BlazorTest/Program.cs:0:0:0:0 | BlazorTest/Program.cs |
+| BlazorTest/obj/Debug/net9.0/.NETCoreApp,Version=v9.0.AssemblyAttributes.cs:0:0:0:0 | BlazorTest/obj/Debug/net9.0/.NETCoreApp,Version=v9.0.AssemblyAttributes.cs |
+| BlazorTest/obj/Debug/net9.0/BlazorTest.AssemblyInfo.cs:0:0:0:0 | BlazorTest/obj/Debug/net9.0/BlazorTest.AssemblyInfo.cs |
+| BlazorTest/obj/Debug/net9.0/BlazorTest.GlobalUsings.g.cs:0:0:0:0 | BlazorTest/obj/Debug/net9.0/BlazorTest.GlobalUsings.g.cs |
+| BlazorTest/obj/Debug/net9.0/generated/Microsoft.CodeAnalysis.Razor.Compiler/Microsoft.NET.Sdk.Razor.SourceGenerators.RazorSourceGenerator/Components_App_razor.g.cs:0:0:0:0 | BlazorTest/obj/Debug/net9.0/generated/Microsoft.CodeAnalysis.Razor.Compiler/Microsoft.NET.Sdk.Razor.SourceGenerators.RazorSourceGenerator/Components_App_razor.g.cs |
+| BlazorTest/obj/Debug/net9.0/generated/Microsoft.CodeAnalysis.Razor.Compiler/Microsoft.NET.Sdk.Razor.SourceGenerators.RazorSourceGenerator/Components_Layout_MainLayout_razor.g.cs:0:0:0:0 | BlazorTest/obj/Debug/net9.0/generated/Microsoft.CodeAnalysis.Razor.Compiler/Microsoft.NET.Sdk.Razor.SourceGenerators.RazorSourceGenerator/Components_Layout_MainLayout_razor.g.cs |
+| BlazorTest/obj/Debug/net9.0/generated/Microsoft.CodeAnalysis.Razor.Compiler/Microsoft.NET.Sdk.Razor.SourceGenerators.RazorSourceGenerator/Components_Layout_NavMenu_razor.g.cs:0:0:0:0 | BlazorTest/obj/Debug/net9.0/generated/Microsoft.CodeAnalysis.Razor.Compiler/Microsoft.NET.Sdk.Razor.SourceGenerators.RazorSourceGenerator/Components_Layout_NavMenu_razor.g.cs |
+| BlazorTest/obj/Debug/net9.0/generated/Microsoft.CodeAnalysis.Razor.Compiler/Microsoft.NET.Sdk.Razor.SourceGenerators.RazorSourceGenerator/Components_MyInput_razor.g.cs:0:0:0:0 | BlazorTest/obj/Debug/net9.0/generated/Microsoft.CodeAnalysis.Razor.Compiler/Microsoft.NET.Sdk.Razor.SourceGenerators.RazorSourceGenerator/Components_MyInput_razor.g.cs |
+| BlazorTest/obj/Debug/net9.0/generated/Microsoft.CodeAnalysis.Razor.Compiler/Microsoft.NET.Sdk.Razor.SourceGenerators.RazorSourceGenerator/Components_MyOutput_razor.g.cs:0:0:0:0 | BlazorTest/obj/Debug/net9.0/generated/Microsoft.CodeAnalysis.Razor.Compiler/Microsoft.NET.Sdk.Razor.SourceGenerators.RazorSourceGenerator/Components_MyOutput_razor.g.cs |
+| BlazorTest/obj/Debug/net9.0/generated/Microsoft.CodeAnalysis.Razor.Compiler/Microsoft.NET.Sdk.Razor.SourceGenerators.RazorSourceGenerator/Components_Pages_Error_razor.g.cs:0:0:0:0 | BlazorTest/obj/Debug/net9.0/generated/Microsoft.CodeAnalysis.Razor.Compiler/Microsoft.NET.Sdk.Razor.SourceGenerators.RazorSourceGenerator/Components_Pages_Error_razor.g.cs |
+| BlazorTest/obj/Debug/net9.0/generated/Microsoft.CodeAnalysis.Razor.Compiler/Microsoft.NET.Sdk.Razor.SourceGenerators.RazorSourceGenerator/Components_Pages_TestPage_razor.g.cs:0:0:0:0 | BlazorTest/obj/Debug/net9.0/generated/Microsoft.CodeAnalysis.Razor.Compiler/Microsoft.NET.Sdk.Razor.SourceGenerators.RazorSourceGenerator/Components_Pages_TestPage_razor.g.cs |
+| BlazorTest/obj/Debug/net9.0/generated/Microsoft.CodeAnalysis.Razor.Compiler/Microsoft.NET.Sdk.Razor.SourceGenerators.RazorSourceGenerator/Components_Routes_razor.g.cs:0:0:0:0 | BlazorTest/obj/Debug/net9.0/generated/Microsoft.CodeAnalysis.Razor.Compiler/Microsoft.NET.Sdk.Razor.SourceGenerators.RazorSourceGenerator/Components_Routes_razor.g.cs |
+| BlazorTest/obj/Debug/net9.0/generated/Microsoft.CodeAnalysis.Razor.Compiler/Microsoft.NET.Sdk.Razor.SourceGenerators.RazorSourceGenerator/Components__Imports_razor.g.cs:0:0:0:0 | BlazorTest/obj/Debug/net9.0/generated/Microsoft.CodeAnalysis.Razor.Compiler/Microsoft.NET.Sdk.Razor.SourceGenerators.RazorSourceGenerator/Components__Imports_razor.g.cs |

csharp/ql/integration-tests/all-platforms/blazor/Files.ql

@@ -0,0 +1,5 @@
+import csharp
+
+from File f
+where f.fromSource() or f.getExtension() = "razor"
+select f

csharp/ql/integration-tests/all-platforms/blazor/htmlSinks.expected

@@ -0,0 +1,8 @@
+| BlazorTest/Components/MyOutput.razor:5:53:5:57 | access to property Value |
+| BlazorTest/Components/Pages/TestPage.razor:11:48:11:55 | access to property UrlParam |
+| BlazorTest/Components/Pages/TestPage.razor:20:60:20:69 | access to property QueryParam |
+| BlazorTest/Components/Pages/TestPage.razor:29:53:29:63 | access to property InputValue1 |
+| BlazorTest/Components/Pages/TestPage.razor:38:53:38:63 | access to property InputValue2 |
+| BlazorTest/Components/Pages/TestPage.razor:47:53:47:68 | access to property Value |
+| BlazorTest/Components/Pages/TestPage.razor:56:53:56:63 | access to property InputValue3 |
+| BlazorTest/Components/Pages/TestPage.razor:65:53:65:63 | access to property InputValue4 |

csharp/ql/integration-tests/all-platforms/blazor/htmlSinks.ql

@@ -0,0 +1,7 @@
+import semmle.code.csharp.security.dataflow.flowsinks.Html
+
+from HtmlSink sink, File f
+where
+  sink.getLocation().getFile() = f and
+  (f.fromSource() or f.getExtension() = "razor")
+select sink

csharp/ql/integration-tests/all-platforms/blazor/test.py

@@ -0,0 +1,2 @@
+def test(codeql, csharp):
+    codeql.database.create(source_root="BlazorTest")

csharp/ql/integration-tests/all-platforms/blazor_net_8/BlazorTest/BlazorTest.csproj

@@ -0,0 +1,9 @@
+<Project Sdk="Microsoft.NET.Sdk.Web">
+
+  <PropertyGroup>
+    <TargetFramework>net8.0</TargetFramework>
+    <Nullable>enable</Nullable>
+    <ImplicitUsings>enable</ImplicitUsings>
+  </PropertyGroup>
+
+</Project>

csharp/ql/integration-tests/all-platforms/blazor_net_8/BlazorTest/Components/App.razor

@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html lang="en">
+
+<head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <base href="/" />
+    <link rel="stylesheet" href="bootstrap/bootstrap.min.css" />
+    <link rel="stylesheet" href="app.css" />
+    <link rel="stylesheet" href="BlazorTest.styles.css" />
+    <link rel="icon" type="image/png" href="favicon.png" />
+    <HeadOutlet />
+</head>
+
+<body>
+    <Routes />
+    <script src="_framework/blazor.web.js"></script>
+</body>
+
+</html>

csharp/ql/integration-tests/all-platforms/blazor_net_8/BlazorTest/Components/Layout/MainLayout.razor

@@ -0,0 +1,23 @@
+@inherits LayoutComponentBase
+
+<div class="page">
+    <div class="sidebar">
+        <NavMenu />
+    </div>
+
+    <main>
+        <div class="top-row px-4">
+            <a href="https://learn.microsoft.com/aspnet/core/" target="_blank">About</a>
+        </div>
+
+        <article class="content px-4">
+            @Body
+        </article>
+    </main>
+</div>
+
+<div id="blazor-error-ui">
+    An unhandled error has occurred.
+    <a href="" class="reload">Reload</a>
+    <a class="dismiss">🗙</a>
+</div>

csharp/ql/integration-tests/all-platforms/blazor_net_8/BlazorTest/Components/Layout/MainLayout.razor.css

@@ -0,0 +1,96 @@
+.page {
+    position: relative;
+    display: flex;
+    flex-direction: column;
+}
+
+main {
+    flex: 1;
+}
+
+.sidebar {
+    background-image: linear-gradient(180deg, rgb(5, 39, 103) 0%, #3a0647 70%);
+}
+
+.top-row {
+    background-color: #f7f7f7;
+    border-bottom: 1px solid #d6d5d5;
+    justify-content: flex-end;
+    height: 3.5rem;
+    display: flex;
+    align-items: center;
+}
+
+    .top-row ::deep a, .top-row ::deep .btn-link {
+        white-space: nowrap;
+        margin-left: 1.5rem;
+        text-decoration: none;
+    }
+
+    .top-row ::deep a:hover, .top-row ::deep .btn-link:hover {
+        text-decoration: underline;
+    }
+
+    .top-row ::deep a:first-child {
+        overflow: hidden;
+        text-overflow: ellipsis;
+    }
+
+@media (max-width: 640.98px) {
+    .top-row {
+        justify-content: space-between;
+    }
+
+    .top-row ::deep a, .top-row ::deep .btn-link {
+        margin-left: 0;
+    }
+}
+
+@media (min-width: 641px) {
+    .page {
+        flex-direction: row;
+    }
+
+    .sidebar {
+        width: 250px;
+        height: 100vh;
+        position: sticky;
+        top: 0;
+    }
+
+    .top-row {
+        position: sticky;
+        top: 0;
+        z-index: 1;
+    }
+
+    .top-row.auth ::deep a:first-child {
+        flex: 1;
+        text-align: right;
+        width: 0;
+    }
+
+    .top-row, article {
+        padding-left: 2rem !important;
+        padding-right: 1.5rem !important;
+    }
+}
+
+#blazor-error-ui {
+    background: lightyellow;
+    bottom: 0;
+    box-shadow: 0 -1px 2px rgba(0, 0, 0, 0.2);
+    display: none;
+    left: 0;
+    padding: 0.6rem 1.25rem 0.7rem 1.25rem;
+    position: fixed;
+    width: 100%;
+    z-index: 1000;
+}
+
+    #blazor-error-ui .dismiss {
+        cursor: pointer;
+        position: absolute;
+        right: 0.75rem;
+        top: 0.5rem;
+    }

csharp/ql/integration-tests/all-platforms/blazor_net_8/BlazorTest/Components/Layout/NavMenu.razor

@@ -0,0 +1,19 @@
+<div class="top-row ps-3 navbar navbar-dark">
+    <div class="container-fluid">
+        <a class="navbar-brand" href="">BlazorTest</a>
+    </div>
+</div>
+
+<input type="checkbox" title="Navigation menu" class="navbar-toggler" />
+
+<div class="nav-scrollable" onclick="document.querySelector('.navbar-toggler').click()">
+    <nav class="flex-column">
+
+        <div class="nav-item px-3">
+            <NavLink class="nav-link" href="test">
+                <span class="bi bi-plus-square-fill-nav-menu" aria-hidden="true"></span> Test
+            </NavLink>
+        </div>
+
+    </nav>
+</div>

csharp/ql/integration-tests/all-platforms/blazor_net_8/BlazorTest/Components/Layout/NavMenu.razor.css

@@ -0,0 +1,105 @@
+.navbar-toggler {
+    appearance: none;
+    cursor: pointer;
+    width: 3.5rem;
+    height: 2.5rem;
+    color: white;
+    position: absolute;
+    top: 0.5rem;
+    right: 1rem;
+    border: 1px solid rgba(255, 255, 255, 0.1);
+    background: url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 30 30'%3e%3cpath stroke='rgba%28255, 255, 255, 0.55%29' stroke-linecap='round' stroke-miterlimit='10' stroke-width='2' d='M4 7h22M4 15h22M4 23h22'/%3e%3c/svg%3e") no-repeat center/1.75rem rgba(255, 255, 255, 0.1);
+}
+
+.navbar-toggler:checked {
+    background-color: rgba(255, 255, 255, 0.5);
+}
+
+.top-row {
+    height: 3.5rem;
+    background-color: rgba(0,0,0,0.4);
+}
+
+.navbar-brand {
+    font-size: 1.1rem;
+}
+
+.bi {
+    display: inline-block;
+    position: relative;
+    width: 1.25rem;
+    height: 1.25rem;
+    margin-right: 0.75rem;
+    top: -1px;
+    background-size: cover;
+}
+
+.bi-house-door-fill-nav-menu {
+    background-image: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='16' height='16' fill='white' class='bi bi-house-door-fill' viewBox='0 0 16 16'%3E%3Cpath d='M6.5 14.5v-3.505c0-.245.25-.495.5-.495h2c.25 0 .5.25.5.5v3.5a.5.5 0 0 0 .5.5h4a.5.5 0 0 0 .5-.5v-7a.5.5 0 0 0-.146-.354L13 5.793V2.5a.5.5 0 0 0-.5-.5h-1a.5.5 0 0 0-.5.5v1.293L8.354 1.146a.5.5 0 0 0-.708 0l-6 6A.5.5 0 0 0 1.5 7.5v7a.5.5 0 0 0 .5.5h4a.5.5 0 0 0 .5-.5Z'/%3E%3C/svg%3E");
+}
+
+.bi-plus-square-fill-nav-menu {
+    background-image: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='16' height='16' fill='white' class='bi bi-plus-square-fill' viewBox='0 0 16 16'%3E%3Cpath d='M2 0a2 2 0 0 0-2 2v12a2 2 0 0 0 2 2h12a2 2 0 0 0 2-2V2a2 2 0 0 0-2-2H2zm6.5 4.5v3h3a.5.5 0 0 1 0 1h-3v3a.5.5 0 0 1-1 0v-3h-3a.5.5 0 0 1 0-1h3v-3a.5.5 0 0 1 1 0z'/%3E%3C/svg%3E");
+}
+
+.bi-list-nested-nav-menu {
+    background-image: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='16' height='16' fill='white' class='bi bi-list-nested' viewBox='0 0 16 16'%3E%3Cpath fill-rule='evenodd' d='M4.5 11.5A.5.5 0 0 1 5 11h10a.5.5 0 0 1 0 1H5a.5.5 0 0 1-.5-.5zm-2-4A.5.5 0 0 1 3 7h10a.5.5 0 0 1 0 1H3a.5.5 0 0 1-.5-.5zm-2-4A.5.5 0 0 1 1 3h10a.5.5 0 0 1 0 1H1a.5.5 0 0 1-.5-.5z'/%3E%3C/svg%3E");
+}
+
+.nav-item {
+    font-size: 0.9rem;
+    padding-bottom: 0.5rem;
+}
+
+    .nav-item:first-of-type {
+        padding-top: 1rem;
+    }
+
+    .nav-item:last-of-type {
+        padding-bottom: 1rem;
+    }
+
+    .nav-item ::deep .nav-link {
+        color: #d7d7d7;
+        background: none;
+        border: none;
+        border-radius: 4px;
+        height: 3rem;
+        display: flex;
+        align-items: center;
+        line-height: 3rem;
+        width: 100%;
+    }
+
+.nav-item ::deep a.active {
+    background-color: rgba(255,255,255,0.37);
+    color: white;
+}
+
+.nav-item ::deep .nav-link:hover {
+    background-color: rgba(255,255,255,0.1);
+    color: white;
+}
+
+.nav-scrollable {
+    display: none;
+}
+
+.navbar-toggler:checked ~ .nav-scrollable {
+    display: block;
+}
+
+@media (min-width: 641px) {
+    .navbar-toggler {
+        display: none;
+    }
+
+    .nav-scrollable {
+        /* Never collapse the sidebar for wide screens */
+        display: block;
+
+        /* Allow sidebar to scroll for tall menus */
+        height: calc(100vh - 3.5rem);
+        overflow-y: auto;
+    }
+}

csharp/ql/integration-tests/all-platforms/blazor_net_8/BlazorTest/Components/MyInput.razor

@@ -0,0 +1,20 @@
+@rendermode InteractiveServer
+
+<input @bind="Param1" @bind:event="onchange" @bind:after="Fire">
+
+@code {
+    [Parameter]
+    public string? Param1 { get; set; } = "";
+
+    [Parameter]
+    public EventCallback<string?> ValueChanged { get; set; }
+
+    [Parameter]
+    public EventCallback<string?> Param1Changed { get; set; }
+
+    private void Fire()
+    {
+        ValueChanged.InvokeAsync(Param1);
+        Param1Changed.InvokeAsync(Param1);
+    }
+}

csharp/ql/integration-tests/all-platforms/blazor_net_8/BlazorTest/Components/MyOutput.razor

@@ -0,0 +1,11 @@
+@rendermode InteractiveServer
+
+<div>
+    <p>Value from InputText: @Value</p>
+    <p>Raw value from InputText: @(new MarkupString(Value))</p>
+</div>
+
+@code {
+    [Parameter]
+    public string Value { get; set; } = "";
+}

csharp/ql/integration-tests/all-platforms/blazor_net_8/BlazorTest/Components/Pages/Error.razor

@@ -0,0 +1,36 @@
+@page "/Error"
+@using System.Diagnostics
+
+<PageTitle>Error</PageTitle>
+
+<h1 class="text-danger">Error.</h1>
+<h2 class="text-danger">An error occurred while processing your request.</h2>
+
+@if (ShowRequestId)
+{
+    <p>
+        <strong>Request ID:</strong> <code>@RequestId</code>
+    </p>
+}
+
+<h3>Development Mode</h3>
+<p>
+    Swapping to <strong>Development</strong> environment will display more detailed information about the error that occurred.
+</p>
+<p>
+    <strong>The Development environment shouldn't be enabled for deployed applications.</strong>
+    It can result in displaying sensitive information from exceptions to end users.
+    For local debugging, enable the <strong>Development</strong> environment by setting the <strong>ASPNETCORE_ENVIRONMENT</strong> environment variable to <strong>Development</strong>
+    and restarting the app.
+</p>
+
+@code{
+    [CascadingParameter]
+    private HttpContext? HttpContext { get; set; }
+
+    private string? RequestId { get; set; }
+    private bool ShowRequestId => !string.IsNullOrEmpty(RequestId);
+
+    protected override void OnInitialized() =>
+        RequestId = Activity.Current?.Id ?? HttpContext?.TraceIdentifier;
+}

csharp/ql/integration-tests/all-platforms/blazor_net_8/BlazorTest/Components/Pages/TestPage.razor

@@ -0,0 +1,125 @@
+@page "/"
+@page "/test/{urlParam?}"
+@rendermode InteractiveServer
+
+<PageTitle>TestPage</PageTitle>
+
+<div>
+    <h3>Route parameter</h3>
+    <p>Go to: <a href="/test/@XssUrl">/test/@XssUrl</a></p>
+    <p>Parameter from URL: @UrlParam</p>
+    <p>Raw parameter from URL: @((MarkupString)UrlParam)</p>
+</div>
+
+<hr />
+
+<div>
+    <h3>Query parameter</h3>
+    <p>Go to: <a href="/test/?qs=@XssUrl">/test/?qs=@XssUrl</a></p>
+    <p>Parameter from query string: @QueryParam</p>
+    <p>Raw parameter from query string: @(new MarkupString(QueryParam))</p>
+</div>
+
+<hr />
+
+<div>
+    <h3>Bind InputText component</h3>
+    <InputText @bind-Value="InputValue1" />
+    <p>Value from InputText: @InputValue1</p>
+    <p>Raw value from InputText: @(new MarkupString(InputValue1))</p>
+</div>
+
+<hr />
+
+<div>
+    <h3>Bind input element</h3>
+    <input @bind="InputValue2">
+    <p>Value from InputText: @InputValue2</p>
+    <p>Raw value from InputText: @(new MarkupString(InputValue2))</p>
+</div>
+
+<hr />
+
+<div>
+    <h3>Bind through object property</h3>
+    <input @bind="Container1.Value">
+    <p>Value from InputText: @Container1.Value</p>
+    <p>Raw value from InputText: @(new MarkupString(Container1.Value))</p>
+</div>
+
+<hr />
+
+<div>
+    <h3>Input component with custom event</h3>
+    <MyInput Param1="@InputValue3" ValueChanged="MyInputChanged" />
+    <p>Value from InputText: @InputValue3</p>
+    <p>Raw value from InputText: @(new MarkupString(InputValue3))</p>
+</div>
+
+<hr />
+
+<div>
+    <h3>Input component with binding</h3>
+    <MyInput @bind-Param1="InputValue4" />
+    <p>Value from InputText: @InputValue4</p>
+    <p>Raw value from InputText: @(new MarkupString(InputValue4))</p>
+</div>
+
+<hr />
+
+<div>
+    <h3>Input, Output components</h3>
+    <MyInput @bind-Param1="InputValue5" />
+    <MyOutput Value="@InputValue5" />
+</div>
+
+<hr />
+
+<div>
+    <h3>Bind InputText, Output component</h3>
+    <InputText @bind-Value="InputValue6" />
+    <MyOutput Value="@InputValue6" />
+</div>
+
+@code {
+
+    public class Container
+    {
+        public string? Value { get; set; } = "";
+    }
+
+    private const string XssUrl = "<b>aaaa<%2Fb>";
+    private const string XssUrl2 = "<b>aaaa</b>";
+
+    [Parameter]
+    public string UrlParam { get; set; } = "";
+
+    [SupplyParameterFromQuery(Name = "qs")]
+    public string QueryParam { get; set; } = "";
+
+    public string InputValue1 { get; set; } = "";
+    public string InputValue2 { get; set; } = "";
+    public string InputValue3 { get; set; } = "";
+    public string InputValue4 { get; set; } = "";
+    public string InputValue5 { get; set; } = "";
+    public string InputValue6 { get; set; } = "";
+
+    public Container Container1 { get; set; } = new Container();
+
+    protected override void OnInitialized()
+    {
+        InputValue1 = XssUrl2;
+        InputValue2 = XssUrl2;
+        Container1.Value = XssUrl2;
+        InputValue3 = XssUrl2;
+        InputValue4 = XssUrl2;
+        InputValue5 = XssUrl2;
+        InputValue6 = XssUrl2;
+
+    }
+
+    private void MyInputChanged(string value)
+    {
+        InputValue3 = value;
+    }
+}

csharp/ql/integration-tests/all-platforms/blazor_net_8/BlazorTest/Components/Routes.razor

@@ -0,0 +1,6 @@
+<Router AppAssembly="typeof(Program).Assembly">
+    <Found Context="routeData">
+        <RouteView RouteData="routeData" DefaultLayout="typeof(Layout.MainLayout)" />
+        <FocusOnNavigate RouteData="routeData" Selector="h1" />
+    </Found>
+</Router>

csharp/ql/integration-tests/all-platforms/blazor_net_8/BlazorTest/Components/_Imports.razor

@@ -0,0 +1,10 @@
+@using System.Net.Http
+@using System.Net.Http.Json
+@using Microsoft.AspNetCore.Components.Forms
+@using Microsoft.AspNetCore.Components.Routing
+@using Microsoft.AspNetCore.Components.Web
+@using static Microsoft.AspNetCore.Components.Web.RenderMode
+@using Microsoft.AspNetCore.Components.Web.Virtualization
+@using Microsoft.JSInterop
+@using BlazorTest
+@using BlazorTest.Components

csharp/ql/integration-tests/all-platforms/blazor_net_8/BlazorTest/Program.cs

@@ -0,0 +1,27 @@
+using BlazorTest.Components;
+
+var builder = WebApplication.CreateBuilder(args);
+
+// Add services to the container.
+builder.Services.AddRazorComponents()
+    .AddInteractiveServerComponents();
+
+var app = builder.Build();
+
+// Configure the HTTP request pipeline.
+if (!app.Environment.IsDevelopment())
+{
+    app.UseExceptionHandler("/Error", createScopeForErrors: true);
+    // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
+    app.UseHsts();
+}
+
+app.UseHttpsRedirection();
+
+app.UseStaticFiles();
+app.UseAntiforgery();
+
+app.MapRazorComponents<App>()
+    .AddInteractiveServerRenderMode();
+
+app.Run();

csharp/ql/integration-tests/all-platforms/blazor_net_8/BlazorTest/Properties/launchSettings.json

@@ -0,0 +1,14 @@
+{
+  "$schema": "http://json.schemastore.org/launchsettings.json",
+  "profiles": {
+    "http": {
+      "commandName": "Project",
+      "dotnetRunMessages": true,
+      "launchBrowser": true,
+      "applicationUrl": "http://localhost:5047",
+      "environmentVariables": {
+        "ASPNETCORE_ENVIRONMENT": "Development"
+      }
+    }
+  }
+}

csharp/ql/integration-tests/all-platforms/blazor_net_8/BlazorTest/appsettings.json

@@ -0,0 +1,9 @@
+{
+  "Logging": {
+    "LogLevel": {
+      "Default": "Information",
+      "Microsoft.AspNetCore": "Warning"
+    }
+  },
+  "AllowedHosts": "*"
+}

csharp/ql/integration-tests/all-platforms/blazor_net_8/BlazorTest/global.json

@@ -0,0 +1,5 @@
+{
+    "sdk": {
+        "version": "8.0.401"
+    }
+}

csharp/ql/integration-tests/all-platforms/blazor_net_8/BlazorTest/wwwroot/app.css

@@ -0,0 +1,51 @@
+html, body {
+    font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif;
+}
+
+a, .btn-link {
+    color: #006bb7;
+}
+
+.btn-primary {
+    color: #fff;
+    background-color: #1b6ec2;
+    border-color: #1861ac;
+}
+
+.btn:focus, .btn:active:focus, .btn-link.nav-link:focus, .form-control:focus, .form-check-input:focus {
+  box-shadow: 0 0 0 0.1rem white, 0 0 0 0.25rem #258cfb;
+}
+
+.content {
+    padding-top: 1.1rem;
+}
+
+h1:focus {
+    outline: none;
+}
+
+.valid.modified:not([type=checkbox]) {
+    outline: 1px solid #26b050;
+}
+
+.invalid {
+    outline: 1px solid #e50000;
+}
+
+.validation-message {
+    color: #e50000;
+}
+
+.blazor-error-boundary {
+    background: url(data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iNTYiIGhlaWdodD0iNDkiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgeG1sbnM6eGxpbms9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkveGxpbmsiIG92ZXJmbG93PSJoaWRkZW4iPjxkZWZzPjxjbGlwUGF0aCBpZD0iY2xpcDAiPjxyZWN0IHg9IjIzNSIgeT0iNTEiIHdpZHRoPSI1NiIgaGVpZ2h0PSI0OSIvPjwvY2xpcFBhdGg+PC9kZWZzPjxnIGNsaXAtcGF0aD0idXJsKCNjbGlwMCkiIHRyYW5zZm9ybT0idHJhbnNsYXRlKC0yMzUgLTUxKSI+PHBhdGggZD0iTTI2My41MDYgNTFDMjY0LjcxNyA1MSAyNjUuODEzIDUxLjQ4MzcgMjY2LjYwNiA1Mi4yNjU4TDI2Ny4wNTIgNTIuNzk4NyAyNjcuNTM5IDUzLjYyODMgMjkwLjE4NSA5Mi4xODMxIDI5MC41NDUgOTIuNzk1IDI5MC42NTYgOTIuOTk2QzI5MC44NzcgOTMuNTEzIDI5MSA5NC4wODE1IDI5MSA5NC42NzgyIDI5MSA5Ny4wNjUxIDI4OS4wMzggOTkgMjg2LjYxNyA5OUwyNDAuMzgzIDk5QzIzNy45NjMgOTkgMjM2IDk3LjA2NTEgMjM2IDk0LjY3ODIgMjM2IDk0LjM3OTkgMjM2LjAzMSA5NC4wODg2IDIzNi4wODkgOTMuODA3MkwyMzYuMzM4IDkzLjAxNjIgMjM2Ljg1OCA5Mi4xMzE0IDI1OS40NzMgNTMuNjI5NCAyNTkuOTYxIDUyLjc5ODUgMjYwLjQwNyA1Mi4yNjU4QzI2MS4yIDUxLjQ4MzcgMjYyLjI5NiA1MSAyNjMuNTA2IDUxWk0yNjMuNTg2IDY2LjAxODNDMjYwLjczNyA2Ni4wMTgzIDI1OS4zMTMgNjcuMTI0NSAyNTkuMzEzIDY5LjMzNyAyNTkuMzEzIDY5LjYxMDIgMjU5LjMzMiA2OS44NjA4IDI1OS4zNzEgNzAuMDg4N0wyNjEuNzk1IDg0LjAxNjEgMjY1LjM4IDg0LjAxNjEgMjY3LjgyMSA2OS43NDc1QzI2Ny44NiA2OS43MzA5IDI2Ny44NzkgNjkuNTg3NyAyNjcuODc5IDY5LjMxNzkgMjY3Ljg3OSA2Ny4xMTgyIDI2Ni40NDggNjYuMDE4MyAyNjMuNTg2IDY2LjAxODNaTTI2My41NzYgODYuMDU0N0MyNjEuMDQ5IDg2LjA1NDcgMjU5Ljc4NiA4Ny4zMDA1IDI1OS43ODYgODkuNzkyMSAyNTkuNzg2IDkyLjI4MzcgMjYxLjA0OSA5My41Mjk1IDI2My41NzYgOTMuNTI5NSAyNjYuMTE2IDkzLjUyOTUgMjY3LjM4NyA5Mi4yODM3IDI2Ny4zODcgODkuNzkyMSAyNjcuMzg3IDg3LjMwMDUgMjY2LjExNiA4Ni4wNTQ3IDI2My41NzYgODYuMDU0N1oiIGZpbGw9IiNGRkU1MDAiIGZpbGwtcnVsZT0iZXZlbm9kZCIvPjwvZz48L3N2Zz4=) no-repeat 1rem/1.8rem, #b32121;
+    padding: 1rem 1rem 1rem 3.7rem;
+    color: white;
+}
+
+    .blazor-error-boundary::after {
+        content: "An error has occurred."
+    }
+
+.darker-border-checkbox.form-check-input {
+    border-color: #929292;
+}