Merge pull request #20607 from d10c/d10c/update-diff-informed-testing

Update diff-informed testing to always treat sources and sinks as alert locations
2025-12-16 16:53:25 +01:00 · 2025-10-28 11:52:31 +01:00
parent 8d49f26f3d a0975e7e19
commit 727bddea19
76 changed files with 134 additions and 152 deletions
--- a/actions/ql/lib/codeql/actions/security/ArgumentInjectionQuery.qll
+++ b/actions/ql/lib/codeql/actions/security/ArgumentInjectionQuery.qll
@@ -100,8 +100,6 @@ private module ArgumentInjectionConfig implements DataFlow::ConfigSig {

  predicate observeDiffInformedIncrementalMode() { any() }

-  Location getASelectedSourceLocation(DataFlow::Node source) { none() }
-
  Location getASelectedSinkLocation(DataFlow::Node sink) {
    result = sink.getLocation()
    or
--- a/actions/ql/lib/codeql/actions/security/ArtifactPoisoningQuery.qll
+++ b/actions/ql/lib/codeql/actions/security/ArtifactPoisoningQuery.qll
@@ -333,8 +333,6 @@ private module ArtifactPoisoningConfig implements DataFlow::ConfigSig {

  predicate observeDiffInformedIncrementalMode() { any() }

-  Location getASelectedSourceLocation(DataFlow::Node source) { none() }
-
  Location getASelectedSinkLocation(DataFlow::Node sink) {
    result = sink.getLocation()
    or
--- a/actions/ql/lib/codeql/actions/security/CodeInjectionQuery.qll
+++ b/actions/ql/lib/codeql/actions/security/CodeInjectionQuery.qll
@@ -80,8 +80,6 @@ private module CodeInjectionConfig implements DataFlow::ConfigSig {

  predicate observeDiffInformedIncrementalMode() { any() }

-  Location getASelectedSourceLocation(DataFlow::Node source) { none() }
-
  Location getASelectedSinkLocation(DataFlow::Node sink) {
    result = sink.getLocation()
    or
--- a/actions/ql/lib/codeql/actions/security/EnvPathInjectionQuery.qll
+++ b/actions/ql/lib/codeql/actions/security/EnvPathInjectionQuery.qll
@@ -130,8 +130,6 @@ private module EnvPathInjectionConfig implements DataFlow::ConfigSig {

  predicate observeDiffInformedIncrementalMode() { any() }

-  Location getASelectedSourceLocation(DataFlow::Node source) { none() }
-
  Location getASelectedSinkLocation(DataFlow::Node sink) {
    result = sink.getLocation()
    or
--- a/actions/ql/lib/codeql/actions/security/EnvVarInjectionQuery.qll
+++ b/actions/ql/lib/codeql/actions/security/EnvVarInjectionQuery.qll
@@ -184,8 +184,6 @@ private module EnvVarInjectionConfig implements DataFlow::ConfigSig {

  predicate observeDiffInformedIncrementalMode() { any() }

-  Location getASelectedSourceLocation(DataFlow::Node source) { none() }
-
  Location getASelectedSinkLocation(DataFlow::Node sink) {
    result = sink.getLocation()
    or
--- a/actions/ql/lib/codeql/actions/security/OutputClobberingQuery.qll
+++ b/actions/ql/lib/codeql/actions/security/OutputClobberingQuery.qll
@@ -212,8 +212,6 @@ private module OutputClobberingConfig implements DataFlow::ConfigSig {
  }

  predicate observeDiffInformedIncrementalMode() { any() }
-
-  Location getASelectedSourceLocation(DataFlow::Node sink) { none() }
 }

 /** Tracks flow of unsafe user input that is used to construct and evaluate an environment variable. */
--- a/actions/ql/lib/codeql/actions/security/RequestForgeryQuery.qll
+++ b/actions/ql/lib/codeql/actions/security/RequestForgeryQuery.qll
@@ -18,8 +18,6 @@ private module RequestForgeryConfig implements DataFlow::ConfigSig {
  predicate isSink(DataFlow::Node sink) { sink instanceof RequestForgerySink }

  predicate observeDiffInformedIncrementalMode() { any() }
-
-  Location getASelectedSourceLocation(DataFlow::Node sink) { none() }
 }

 /** Tracks flow of unsafe user input that is used to construct and evaluate a system command. */
--- a/actions/ql/lib/codeql/actions/security/SecretExfiltrationQuery.qll
+++ b/actions/ql/lib/codeql/actions/security/SecretExfiltrationQuery.qll
@@ -17,8 +17,6 @@ private module SecretExfiltrationConfig implements DataFlow::ConfigSig {
  predicate isSink(DataFlow::Node sink) { sink instanceof SecretExfiltrationSink }

  predicate observeDiffInformedIncrementalMode() { any() }
-
-  Location getASelectedSourceLocation(DataFlow::Node sink) { none() }
 }

 /** Tracks flow of unsafe user input that is used in a context where it may lead to a secret exfiltration. */
--- a/actions/ql/src/Models/CompositeActionsSinks.ql
+++ b/actions/ql/src/Models/CompositeActionsSinks.ql
@@ -26,8 +26,6 @@ private module MyConfig implements DataFlow::ConfigSig {
  }

  predicate observeDiffInformedIncrementalMode() { any() }
-
-  Location getASelectedSourceLocation(DataFlow::Node sink) { none() }
 }

 module MyFlow = TaintTracking::Global<MyConfig>;
--- a/actions/ql/src/Models/CompositeActionsSources.ql
+++ b/actions/ql/src/Models/CompositeActionsSources.ql
@@ -36,8 +36,6 @@ private module MyConfig implements DataFlow::ConfigSig {
  }

  predicate observeDiffInformedIncrementalMode() { any() }
-
-  Location getASelectedSourceLocation(DataFlow::Node sink) { none() }
 }

 module MyFlow = TaintTracking::Global<MyConfig>;
--- a/actions/ql/src/Models/CompositeActionsSummaries.ql
+++ b/actions/ql/src/Models/CompositeActionsSummaries.ql
@@ -27,8 +27,6 @@ private module MyConfig implements DataFlow::ConfigSig {
  }

  predicate observeDiffInformedIncrementalMode() { any() }
-
-  Location getASelectedSourceLocation(DataFlow::Node sink) { none() }
 }

 module MyFlow = TaintTracking::Global<MyConfig>;
--- a/actions/ql/src/Models/ReusableWorkflowsSinks.ql
+++ b/actions/ql/src/Models/ReusableWorkflowsSinks.ql
@@ -26,8 +26,6 @@ private module MyConfig implements DataFlow::ConfigSig {
  }

  predicate observeDiffInformedIncrementalMode() { any() }
-
-  Location getASelectedSourceLocation(DataFlow::Node sink) { none() }
 }

 module MyFlow = TaintTracking::Global<MyConfig>;
--- a/actions/ql/src/Models/ReusableWorkflowsSources.ql
+++ b/actions/ql/src/Models/ReusableWorkflowsSources.ql
@@ -36,8 +36,6 @@ private module MyConfig implements DataFlow::ConfigSig {
  }

  predicate observeDiffInformedIncrementalMode() { any() }
-
-  Location getASelectedSourceLocation(DataFlow::Node sink) { none() }
 }

 module MyFlow = TaintTracking::Global<MyConfig>;
--- a/actions/ql/src/Models/ReusableWorkflowsSummaries.ql
+++ b/actions/ql/src/Models/ReusableWorkflowsSummaries.ql
@@ -27,8 +27,6 @@ private module MyConfig implements DataFlow::ConfigSig {
  }

  predicate observeDiffInformedIncrementalMode() { any() }
-
-  Location getASelectedSourceLocation(DataFlow::Node sink) { none() }
 }

 module MyFlow = TaintTracking::Global<MyConfig>;
--- a/cpp/ql/src/Critical/OverflowDestination.ql
+++ b/cpp/ql/src/Critical/OverflowDestination.ql
@@ -85,10 +85,8 @@ module OverflowDestinationConfig implements DataFlow::ConfigSig {

  predicate observeDiffInformedIncrementalMode() { any() }

-  Location getASelectedSourceLocation(DataFlow::Node source) { none() }
-
  Location getASelectedSinkLocation(DataFlow::Node sink) {
-    exists(FunctionCall fc | result = fc.getLocation() |
+    exists(FunctionCall fc | result = [fc.getLocation(), sink.getLocation()] |
      sourceSized(fc, sink.asIndirectConvertedExpr())
    )
  }
--- a/Bugs/Format/NonConstantFormat.ql
+++ b/Bugs/Format/NonConstantFormat.ql
@@ -171,12 +171,10 @@ module NonConstFlowConfig implements DataFlow::ConfigSig {

  predicate observeDiffInformedIncrementalMode() { any() }

-  Location getASelectedSourceLocation(DataFlow::Node source) { none() }
-
  Location getASelectedSinkLocation(DataFlow::Node sink) {
-    result = sink.getLocation()
-    or
-    exists(FormattingFunctionCall call, Expr formatString | result = call.getLocation() |
+    exists(FormattingFunctionCall call, Expr formatString |
+      result = [call.getLocation(), sink.getLocation()]
+    |
      isSinkImpl(sink, formatString) and
      call.getArgument(call.getFormatParameterIndex()) = formatString
    )
--- a/cpp/ql/src/Security/CWE/CWE-078/ExecTainted.ql
+++ b/cpp/ql/src/Security/CWE/CWE-078/ExecTainted.ql
@@ -155,7 +155,7 @@ module ExecTaintConfig implements DataFlow::StateConfigSig {

  Location getASelectedSinkLocation(DataFlow::Node sink) {
    exists(DataFlow::Node concatResult, Expr command, ExecState state |
-      result = [concatResult.getLocation(), command.getLocation()] and
+      result = [concatResult.getLocation(), command.getLocation(), sink.getLocation()] and
      isSink(sink, state) and
      isSinkImpl(sink, command, _) and
      concatResult = state.getOutgoingNode()
--- a/cpp/ql/src/Security/CWE/CWE-089/SqlTainted.ql
+++ b/cpp/ql/src/Security/CWE/CWE-089/SqlTainted.ql
@@ -58,7 +58,9 @@ module SqlTaintedConfig implements DataFlow::ConfigSig {
  predicate observeDiffInformedIncrementalMode() { any() }

  Location getASelectedSinkLocation(DataFlow::Node sink) {
-    exists(Expr taintedArg | result = taintedArg.getLocation() | taintedArg = asSinkExpr(sink))
+    exists(Expr taintedArg | result = [taintedArg.getLocation(), sink.getLocation()] |
+      taintedArg = asSinkExpr(sink)
+    )
  }
 }

--- a/cpp/ql/src/Security/CWE/CWE-120/UnboundedWrite.ql
+++ b/cpp/ql/src/Security/CWE/CWE-120/UnboundedWrite.ql
@@ -128,7 +128,7 @@ module Config implements DataFlow::ConfigSig {
  predicate observeDiffInformedIncrementalMode() { any() }

  Location getASelectedSinkLocation(DataFlow::Node sink) {
-    exists(BufferWrite bw | result = bw.getLocation() | isSink(sink, bw, _))
+    exists(BufferWrite bw | result = [bw.getLocation(), sink.getLocation()] | isSink(sink, bw, _))
  }
 }

--- a/cpp/ql/src/Security/CWE/CWE-190/ArithmeticUncontrolled.ql
+++ b/cpp/ql/src/Security/CWE/CWE-190/ArithmeticUncontrolled.ql
@@ -124,7 +124,8 @@ module UncontrolledArithConfig implements DataFlow::ConfigSig {
  predicate observeDiffInformedIncrementalMode() { any() }

  Location getASelectedSourceLocation(DataFlow::Node source) {
-    result = getExpr(source).getLocation()
+    isSource(source) and
+    result = [getExpr(source).getLocation(), source.getLocation()]
  }
 }

--- a/cpp/ql/src/Security/CWE/CWE-190/TaintedAllocationSize.ql
+++ b/cpp/ql/src/Security/CWE/CWE-190/TaintedAllocationSize.ql
@@ -95,7 +95,7 @@ module TaintedAllocationSizeConfig implements DataFlow::ConfigSig {
  predicate observeDiffInformedIncrementalMode() { any() }

  Location getASelectedSinkLocation(DataFlow::Node sink) {
-    exists(Expr alloc | result = alloc.getLocation() | allocSink(alloc, sink))
+    exists(Expr alloc | result = [alloc.getLocation(), sink.getLocation()] | allocSink(alloc, sink))
  }
 }

--- a/cpp/ql/src/Security/CWE/CWE-290/AuthenticationBypass.ql
+++ b/cpp/ql/src/Security/CWE/CWE-290/AuthenticationBypass.ql
@@ -76,7 +76,9 @@ module Config implements DataFlow::ConfigSig {
  predicate observeDiffInformedIncrementalMode() { any() }

  Location getASelectedSinkLocation(DataFlow::Node sink) {
-    exists(Expr condition | result = condition.getLocation() | isSink(sink, condition))
+    exists(Expr condition | result = [condition.getLocation(), sink.getLocation()] |
+      isSink(sink, condition)
+    )
  }
 }

--- a/cpp/ql/src/Security/CWE/CWE-311/CleartextBufferWrite.ql
+++ b/cpp/ql/src/Security/CWE/CWE-311/CleartextBufferWrite.ql
@@ -51,7 +51,9 @@ module ToBufferConfig implements DataFlow::ConfigSig {
  predicate observeDiffInformedIncrementalMode() { any() }

  Location getASelectedSinkLocation(DataFlow::Node sink) {
-    exists(SensitiveBufferWrite w | result = w.getLocation() | isSinkImpl(sink, w))
+    exists(SensitiveBufferWrite w | result = [w.getLocation(), sink.getLocation()] |
+      isSinkImpl(sink, w)
+    )
  }
 }

--- a/cpp/ql/src/Security/CWE/CWE-311/CleartextFileWrite.ql
+++ b/cpp/ql/src/Security/CWE/CWE-311/CleartextFileWrite.ql
@@ -35,11 +35,13 @@ module FromSensitiveConfig implements DataFlow::ConfigSig {
  predicate observeDiffInformedIncrementalMode() { any() }

  Location getASelectedSourceLocation(DataFlow::Node sourceNode) {
-    exists(SensitiveExpr source | result = source.getLocation() | isSourceImpl(sourceNode, source))
+    exists(SensitiveExpr source | result = [source.getLocation(), sourceNode.getLocation()] |
+      isSourceImpl(sourceNode, source)
+    )
  }

  Location getASelectedSinkLocation(DataFlow::Node sink) {
-    exists(FileWrite w | result = w.getLocation() | isSinkImpl(sink, w, _))
+    exists(FileWrite w | result = [w.getLocation(), sink.getLocation()] | isSinkImpl(sink, w, _))
  }
 }

--- a/cpp/ql/src/Security/CWE/CWE-311/CleartextTransmission.ql
+++ b/cpp/ql/src/Security/CWE/CWE-311/CleartextTransmission.ql
@@ -249,7 +249,9 @@ module FromSensitiveConfig implements DataFlow::ConfigSig {
  predicate observeDiffInformedIncrementalMode() { any() }

  Location getASelectedSinkLocation(DataFlow::Node sink) {
-    exists(NetworkSendRecv networkSendRecv | result = networkSendRecv.getLocation() |
+    exists(NetworkSendRecv networkSendRecv |
+      result = [networkSendRecv.getLocation(), sink.getLocation()]
+    |
      isSinkSendRecv(sink, networkSendRecv)
    )
  }
--- a/cpp/ql/src/Security/CWE/CWE-313/CleartextSqliteDatabase.ql
+++ b/cpp/ql/src/Security/CWE/CWE-313/CleartextSqliteDatabase.ql
@@ -127,13 +127,13 @@ module FromSensitiveConfig implements DataFlow::ConfigSig {
  predicate observeDiffInformedIncrementalMode() { any() }

  Location getASelectedSourceLocation(DataFlow::Node source) {
-    exists(SensitiveExpr sensitive | result = sensitive.getLocation() |
+    exists(SensitiveExpr sensitive | result = [sensitive.getLocation(), source.getLocation()] |
      isSourceImpl(source, sensitive)
    )
  }

  Location getASelectedSinkLocation(DataFlow::Node sink) {
-    exists(SqliteFunctionCall sqliteCall | result = sqliteCall.getLocation() |
+    exists(SqliteFunctionCall sqliteCall | result = [sqliteCall.getLocation(), sink.getLocation()] |
      isSinkImpl(sink, sqliteCall, _)
    )
  }
--- a/cpp/ql/src/Security/CWE/CWE-319/UseOfHttp.ql
+++ b/cpp/ql/src/Security/CWE/CWE-319/UseOfHttp.ql
@@ -91,10 +91,9 @@ module HttpStringToUrlOpenConfig implements DataFlow::ConfigSig {
  predicate observeDiffInformedIncrementalMode() { any() }

  Location getASelectedSourceLocation(DataFlow::Node source) {
-    result = source.asIndirectExpr().getLocation()
+    isSource(source) and
+    result = [source.asIndirectExpr().getLocation(), source.getLocation()]
  }
-
-  Location getASelectedSinkLocation(DataFlow::Node sink) { none() }
 }

 module HttpStringToUrlOpen = TaintTracking::Global<HttpStringToUrlOpenConfig>;
--- a/cpp/ql/src/experimental/Security/CWE/CWE-078/WordexpTainted.ql
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-078/WordexpTainted.ql
@@ -50,8 +50,6 @@ module WordexpTaintConfig implements DataFlow::ConfigSig {
  }

  predicate observeDiffInformedIncrementalMode() { any() }
-
-  Location getASelectedSourceLocation(DataFlow::Node source) { none() }
 }

 module WordexpTaint = TaintTracking::Global<WordexpTaintConfig>;
--- a/cpp/ql/src/experimental/Security/CWE/CWE-193/ConstantSizeArrayOffByOne.ql
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-193/ConstantSizeArrayOffByOne.ql
@@ -187,12 +187,14 @@ module ArrayAddressToDerefConfig implements DataFlow::StateConfigSig {
  predicate observeDiffInformedIncrementalMode() { any() }

  Location getASelectedSourceLocation(DataFlow::Node source) {
-    exists(Variable v | result = v.getLocation() | isSourceImpl(source, v))
+    exists(Variable v | result = v.getLocation() or result = source.getLocation() |
+      isSourceImpl(source, v)
+    )
  }

  Location getASelectedSinkLocation(DataFlow::Node sink) {
    exists(PointerArithmeticInstruction pai, Instruction deref |
-      result = [pai, deref].getLocation() and
+      result = [[pai, deref].getLocation(), sink.getLocation()] and
      isInvalidPointerDerefSink2(sink, deref, _) and
      isSink(sink, ArrayAddressToDerefConfig::TOverflowArithmetic(pai))
    )
--- a/cpp/ql/src/experimental/Security/CWE/CWE-409/DecompressionBombs.ql
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-409/DecompressionBombs.ql
@@ -31,8 +31,6 @@ module DecompressionTaintConfig implements DataFlow::ConfigSig {

  predicate observeDiffInformedIncrementalMode() { any() }

-  Location getASelectedSourceLocation(DataFlow::Node source) { none() }
-
  Location getASelectedSinkLocation(DataFlow::Node sink) {
    exists(FunctionCall fc | result = [sink.getLocation(), fc.getLocation()] | isSink(fc, sink))
  }
--- a/Features/CWE-327/DontInstallRootCert.ql
+++ b/Features/CWE-327/DontInstallRootCert.ql
@@ -39,8 +39,6 @@ module AddCertToRootStoreConfig implements DataFlow::ConfigSig {
  }

  predicate observeDiffInformedIncrementalMode() { any() }
-
-  Location getASelectedSourceLocation(DataFlow::Node sink) { none() }
 }

 module AddCertToRootStore = DataFlow::Global<AddCertToRootStoreConfig>;
--- a/go/ql/src/InconsistentCode/UnhandledCloseWritableHandle.ql
+++ b/go/ql/src/InconsistentCode/UnhandledCloseWritableHandle.ql
@@ -132,7 +132,7 @@ module UnhandledFileCloseConfig implements DataFlow::ConfigSig {
  predicate observeDiffInformedIncrementalMode() { any() }

  Location getASelectedSourceLocation(DataFlow::Node source) {
-    exists(DataFlow::CallNode openCall | result = openCall.getLocation() |
+    exists(DataFlow::CallNode openCall | result = [openCall.getLocation(), source.getLocation()] |
      isWritableFileHandle(source, openCall)
    )
  }
--- a/go/ql/src/Security/CWE-326/InsufficientKeySize.ql
+++ b/go/ql/src/Security/CWE-326/InsufficientKeySize.ql
@@ -27,8 +27,6 @@ module Config implements DataFlow::ConfigSig {
  }

  predicate observeDiffInformedIncrementalMode() { any() }
-
-  Location getASelectedSourceLocation(DataFlow::Node sink) { none() }
 }

 /**
--- a/go/ql/src/experimental/CWE-369/DivideByZero.ql
+++ b/go/ql/src/experimental/CWE-369/DivideByZero.ql
@@ -47,8 +47,6 @@ module Config implements DataFlow::ConfigSig {
  }

  predicate observeDiffInformedIncrementalMode() { any() }
-
-  Location getASelectedSourceLocation(DataFlow::Node sink) { none() }
 }

 /**
--- a/go/ql/src/experimental/CWE-918/SSRF.qll
+++ b/go/ql/src/experimental/CWE-918/SSRF.qll
@@ -33,9 +33,9 @@ module ServerSideRequestForgery {

    predicate observeDiffInformedIncrementalMode() { any() }

-    Location getASelectedSourceLocation(DataFlow::Node source) { none() }
-
    Location getASelectedSinkLocation(DataFlow::Node sink) {
+      result = sink.(Sink).getLocation()
+      or
      result = sink.(Sink).getARequest().getLocation()
    }
  }
--- a/java/ql/lib/semmle/code/java/security/ArbitraryApkInstallationQuery.qll
+++ b/java/ql/lib/semmle/code/java/security/ArbitraryApkInstallationQuery.qll
@@ -25,8 +25,6 @@ module ApkInstallationConfig implements DataFlow::ConfigSig {
  }

  predicate observeDiffInformedIncrementalMode() { any() }
-
-  Location getASelectedSourceLocation(DataFlow::Node sink) { none() }
 }

 module ApkInstallationFlow = DataFlow::Global<ApkInstallationConfig>;
--- a/java/ql/lib/semmle/code/java/security/ArithmeticTaintedQuery.qll
+++ b/java/ql/lib/semmle/code/java/security/ArithmeticTaintedQuery.qll
@@ -19,7 +19,9 @@ module ArithmeticOverflowConfig implements DataFlow::ConfigSig {
  }

  Location getASelectedSinkLocation(DataFlow::Node sink) {
-    exists(ArithExpr exp | result = exp.getLocation() | overflowSink(exp, sink.asExpr()))
+    exists(ArithExpr exp | result = [exp.getLocation(), sink.getLocation()] |
+      overflowSink(exp, sink.asExpr())
+    )
  }
 }

@@ -43,7 +45,9 @@ module ArithmeticUnderflowConfig implements DataFlow::ConfigSig {
  }

  Location getASelectedSinkLocation(DataFlow::Node sink) {
-    exists(ArithExpr exp | result = exp.getLocation() | underflowSink(exp, sink.asExpr()))
+    exists(ArithExpr exp | result = [exp.getLocation(), sink.getLocation()] |
+      underflowSink(exp, sink.asExpr())
+    )
  }
 }

--- a/java/ql/lib/semmle/code/java/security/ArithmeticUncontrolledQuery.qll
+++ b/java/ql/lib/semmle/code/java/security/ArithmeticUncontrolledQuery.qll
@@ -25,7 +25,9 @@ module ArithmeticUncontrolledOverflowConfig implements DataFlow::ConfigSig {
  }

  Location getASelectedSinkLocation(DataFlow::Node sink) {
-    exists(ArithExpr exp | result = exp.getLocation() | overflowSink(exp, sink.asExpr()))
+    exists(ArithExpr exp | result = [exp.getLocation(), sink.getLocation()] |
+      overflowSink(exp, sink.asExpr())
+    )
  }
 }

@@ -46,7 +48,9 @@ module ArithmeticUncontrolledUnderflowConfig implements DataFlow::ConfigSig {
  }

  Location getASelectedSinkLocation(DataFlow::Node sink) {
-    exists(ArithExpr exp | result = exp.getLocation() | underflowSink(exp, sink.asExpr()))
+    exists(ArithExpr exp | result = [exp.getLocation(), sink.getLocation()] |
+      underflowSink(exp, sink.asExpr())
+    )
  }
 }

--- a/java/ql/lib/semmle/code/java/security/BrokenCryptoAlgorithmQuery.qll
+++ b/java/ql/lib/semmle/code/java/security/BrokenCryptoAlgorithmQuery.qll
@@ -36,7 +36,11 @@ module InsecureCryptoConfig implements DataFlow::ConfigSig {
  predicate observeDiffInformedIncrementalMode() { any() }

  Location getASelectedSinkLocation(DataFlow::Node sink) {
-    exists(CryptoAlgoSpec c | sink.asExpr() = c.getAlgoSpec() | result = c.getLocation())
+    exists(CryptoAlgoSpec c | sink.asExpr() = c.getAlgoSpec() |
+      result = c.getLocation()
+      or
+      result = sink.getLocation()
+    )
  }
 }

--- a/java/ql/lib/semmle/code/java/security/CommandLineQuery.qll
+++ b/java/ql/lib/semmle/code/java/security/CommandLineQuery.qll
@@ -63,10 +63,14 @@ module InputToArgumentToExecFlowConfig implements DataFlow::ConfigSig {
  // only to prevent overlapping results between two queries.
  predicate observeDiffInformedIncrementalMode() { any() }

-  // All queries use the argument as the primary location and do not use the
-  // sink as an associated location.
+  // ExecTainted.ql queries use the argument as the primary location;
+  // ExecUnescaped.ql does not (used to prevent overlapping results).
  Location getASelectedSinkLocation(DataFlow::Node sink) {
-    exists(Expr argument | argumentToExec(argument, sink) | result = argument.getLocation())
+    exists(Expr argument | argumentToExec(argument, sink) |
+      result = argument.getLocation()
+      or
+      result = sink.getLocation()
+    )
  }
 }

--- a/java/ql/lib/semmle/code/java/security/ConditionalBypassQuery.qll
+++ b/java/ql/lib/semmle/code/java/security/ConditionalBypassQuery.qll
@@ -51,7 +51,7 @@ module ConditionalBypassFlowConfig implements DataFlow::ConfigSig {
  predicate observeDiffInformedIncrementalMode() { any() }

  Location getASelectedSinkLocation(DataFlow::Node sink) {
-    exists(MethodCall m, Expr e | result = [m, e].getLocation() |
+    exists(MethodCall m, Expr e | result = [[m, e].getLocation(), sink.getLocation()] |
      conditionControlsMethod(m, e) and
      sink.asExpr() = e
    )
--- a/java/ql/lib/semmle/code/java/security/ImproperValidationOfArrayConstructionCodeSpecifiedQuery.qll
+++ b/java/ql/lib/semmle/code/java/security/ImproperValidationOfArrayConstructionCodeSpecifiedQuery.qll
@@ -22,7 +22,10 @@ module BoundedFlowSourceConfig implements DataFlow::ConfigSig {

  Location getASelectedSinkLocation(DataFlow::Node sink) {
    exists(ArrayCreationExpr arrayCreation, CheckableArrayAccess arrayAccess |
-      result = [arrayCreation, arrayAccess.getIndexExpr()].getLocation() and
+      result = [arrayCreation, arrayAccess.getIndexExpr()].getLocation()
+      or
+      result = sink.getLocation()
+    |
      arrayAccess.canThrowOutOfBoundsDueToEmptyArray(sink.asExpr(), arrayCreation)
    )
  }
--- a/java/ql/lib/semmle/code/java/security/ImproperValidationOfArrayConstructionQuery.qll
+++ b/java/ql/lib/semmle/code/java/security/ImproperValidationOfArrayConstructionQuery.qll
@@ -19,7 +19,10 @@ module ImproperValidationOfArrayConstructionConfig implements DataFlow::ConfigSi

  Location getASelectedSinkLocation(DataFlow::Node sink) {
    exists(ArrayCreationExpr arrayCreation, CheckableArrayAccess arrayAccess |
-      result = [arrayCreation, arrayAccess.getIndexExpr()].getLocation() and
+      result = [arrayCreation, arrayAccess.getIndexExpr()].getLocation()
+      or
+      result = sink.getLocation()
+    |
      arrayAccess.canThrowOutOfBoundsDueToEmptyArray(sink.asExpr(), arrayCreation)
    )
  }
--- a/java/ql/lib/semmle/code/java/security/MaybeBrokenCryptoAlgorithmQuery.qll
+++ b/java/ql/lib/semmle/code/java/security/MaybeBrokenCryptoAlgorithmQuery.qll
@@ -81,7 +81,9 @@ module InsecureCryptoConfig implements DataFlow::ConfigSig {
  predicate observeDiffInformedIncrementalMode() { any() }

  Location getASelectedSinkLocation(DataFlow::Node sink) {
-    exists(CryptoAlgoSpec c | result = c.getLocation() | sink.asExpr() = c.getAlgoSpec())
+    exists(CryptoAlgoSpec c | result = sink.getLocation() or result = c.getLocation() |
+      sink.asExpr() = c.getAlgoSpec()
+    )
  }
 }

--- a/java/ql/lib/semmle/code/java/security/NumericCastTaintedQuery.qll
+++ b/java/ql/lib/semmle/code/java/security/NumericCastTaintedQuery.qll
@@ -106,8 +106,9 @@ module NumericCastFlowConfig implements DataFlow::ConfigSig {
  predicate observeDiffInformedIncrementalMode() { any() }

  Location getASelectedSinkLocation(DataFlow::Node sink) {
-    exists(NumericNarrowingCastExpr cast |
-      cast.getExpr() = sink.asExpr() and
+    exists(NumericNarrowingCastExpr cast | cast.getExpr() = sink.asExpr() |
+      result = sink.getLocation()
+      or
      result = cast.getLocation()
    )
  }
--- a/java/ql/lib/semmle/code/java/security/TaintedEnvironmentVariableQuery.qll
+++ b/java/ql/lib/semmle/code/java/security/TaintedEnvironmentVariableQuery.qll
@@ -40,8 +40,6 @@ module ExecTaintedEnvironmentConfig implements DataFlow::ConfigSig {
  }

  predicate observeDiffInformedIncrementalMode() { any() }
-
-  Location getASelectedSourceLocation(DataFlow::Node source) { none() }
 }

 /**
--- a/java/ql/lib/semmle/code/java/security/TaintedPermissionsCheckQuery.qll
+++ b/java/ql/lib/semmle/code/java/security/TaintedPermissionsCheckQuery.qll
@@ -63,8 +63,9 @@ module TaintedPermissionsCheckFlowConfig implements DataFlow::ConfigSig {
  predicate observeDiffInformedIncrementalMode() { any() }

  Location getASelectedSinkLocation(DataFlow::Node sink) {
-    exists(PermissionsConstruction p |
-      sink.asExpr() = p.getInput() and
+    exists(PermissionsConstruction p | sink.asExpr() = p.getInput() |
+      result = sink.getLocation()
+      or
      result = p.getLocation()
    )
  }
--- a/java/ql/lib/semmle/code/java/security/TempDirLocalInformationDisclosureQuery.qll
+++ b/java/ql/lib/semmle/code/java/security/TempDirLocalInformationDisclosureQuery.qll
@@ -147,8 +147,6 @@ module TempDirSystemGetPropertyToCreateConfig implements DataFlow::ConfigSig {
  }

  predicate observeDiffInformedIncrementalMode() { any() }
-
-  Location getASelectedSinkLocation(DataFlow::Node sink) { none() }
 }

 /**
--- a/java/ql/lib/semmle/code/java/security/UnsafeDeserializationQuery.qll
+++ b/java/ql/lib/semmle/code/java/security/UnsafeDeserializationQuery.qll
@@ -313,6 +313,8 @@ private module UnsafeDeserializationConfig implements DataFlow::ConfigSig {
  predicate observeDiffInformedIncrementalMode() { any() }

  Location getASelectedSinkLocation(DataFlow::Node sink) {
+    result = sink.(UnsafeDeserializationSink).getLocation()
+    or
    result = sink.(UnsafeDeserializationSink).getMethodCall().getLocation()
  }
 }
--- a/java/ql/lib/semmle/code/java/security/WebviewDebuggingEnabledQuery.qll
+++ b/java/ql/lib/semmle/code/java/security/WebviewDebuggingEnabledQuery.qll
@@ -46,12 +46,6 @@ module WebviewDebugEnabledConfig implements DataFlow::ConfigSig {
  }

  predicate observeDiffInformedIncrementalMode() { any() }
-
-  Location getASelectedSourceLocation(DataFlow::Node source) {
-    // This module is only used in `WebviewDebuggingEnabled.ql`, which doesn't
-    // select the source in any "$@" column.
-    none()
-  }
 }

 /**
--- a/javascript/ql/lib/semmle/javascript/security/dataflow/CommandInjectionQuery.qll
+++ b/javascript/ql/lib/semmle/javascript/security/dataflow/CommandInjectionQuery.qll
@@ -34,8 +34,9 @@ module CommandInjectionConfig implements DataFlow::ConfigSig {
  predicate observeDiffInformedIncrementalMode() { any() }

  Location getASelectedSinkLocation(DataFlow::Node sink) {
-    exists(DataFlow::Node node |
-      isSinkWithHighlight(sink, node) and
+    exists(DataFlow::Node node | isSinkWithHighlight(sink, node) |
+      result = sink.getLocation()
+      or
      result = node.getLocation()
    )
  }
--- a/javascript/ql/lib/semmle/javascript/security/dataflow/IndirectCommandInjectionQuery.qll
+++ b/javascript/ql/lib/semmle/javascript/security/dataflow/IndirectCommandInjectionQuery.qll
@@ -30,8 +30,9 @@ module IndirectCommandInjectionConfig implements DataFlow::ConfigSig {
  predicate observeDiffInformedIncrementalMode() { any() }

  Location getASelectedSinkLocation(DataFlow::Node sink) {
-    exists(DataFlow::Node node |
-      isSinkWithHighlight(sink, node) and
+    exists(DataFlow::Node node | isSinkWithHighlight(sink, node) |
+      result = sink.getLocation()
+      or
      result = node.getLocation()
    )
  }
--- a/javascript/ql/lib/semmle/javascript/security/dataflow/ShellCommandInjectionFromEnvironmentQuery.qll
+++ b/javascript/ql/lib/semmle/javascript/security/dataflow/ShellCommandInjectionFromEnvironmentQuery.qll
@@ -33,7 +33,7 @@ module ShellCommandInjectionFromEnvironmentConfig implements DataFlow::ConfigSig
  Location getASelectedSinkLocation(DataFlow::Node sink) {
    exists(DataFlow::Node node |
      isSinkWithHighlight(sink, node) and
-      result = node.getLocation()
+      result = [node.getLocation(), sink.getLocation()]
    )
  }
 }
--- a/javascript/ql/lib/semmle/javascript/security/regexp/PolynomialReDoSQuery.qll
+++ b/javascript/ql/lib/semmle/javascript/security/regexp/PolynomialReDoSQuery.qll
@@ -29,6 +29,8 @@ module PolynomialReDoSConfig implements DataFlow::ConfigSig {
  predicate observeDiffInformedIncrementalMode() { any() }

  Location getASelectedSinkLocation(DataFlow::Node sink) {
+    result = sink.(Sink).getLocation()
+    or
    result = sink.(Sink).getHighlight().getLocation()
    or
    result = sink.(Sink).getRegExp().getLocation()
--- a/javascript/ql/src/experimental/Security/CWE-918/SSRF.qll
+++ b/javascript/ql/src/experimental/Security/CWE-918/SSRF.qll
@@ -29,10 +29,6 @@ module SsrfConfig implements DataFlow::ConfigSig {

  predicate isBarrierOut(DataFlow::Node node) { strictSanitizingPrefixEdge(node, _) }

-  Location getASelectedSourceLocation(DataFlow::Node source) {
-    none() // Does not select the source
-  }
-
  predicate observeDiffInformedIncrementalMode() { any() }
 }

--- a/python/ql/lib/semmle/python/security/dataflow/PolynomialReDoSQuery.qll
+++ b/python/ql/lib/semmle/python/security/dataflow/PolynomialReDoSQuery.qll
@@ -21,6 +21,8 @@ private module PolynomialReDoSConfig implements DataFlow::ConfigSig {
  predicate observeDiffInformedIncrementalMode() { any() }

  Location getASelectedSinkLocation(DataFlow::Node sink) {
+    result = sink.(Sink).getLocation()
+    or
    result = sink.(Sink).getHighlight().getLocation()
    or
    result = sink.(Sink).getABacktrackingTerm().getLocation()
--- a/python/ql/lib/semmle/python/security/dataflow/ServerSideRequestForgeryQuery.qll
+++ b/python/ql/lib/semmle/python/security/dataflow/ServerSideRequestForgeryQuery.qll
@@ -68,7 +68,8 @@ private module PartialServerSideRequestForgeryConfig implements DataFlow::Config
  predicate observeDiffInformedIncrementalMode() { any() }

  Location getASelectedSinkLocation(DataFlow::Node sink) {
-    // Note: this query does not select the sink itself
+    result = sink.(Sink).getLocation()
+    or
    result = sink.(Sink).getRequest().getLocation()
  }
 }
--- a/python/ql/src/experimental/Security/CWE-327/Azure/UnsafeUsageOfClientSideEncryptionVersion.ql
+++ b/python/ql/src/experimental/Security/CWE-327/Azure/UnsafeUsageOfClientSideEncryptionVersion.ql
@@ -147,8 +147,6 @@ private module AzureBlobClientConfig implements DataFlow::StateConfigSig {
  }

  predicate observeDiffInformedIncrementalMode() { any() }
-
-  Location getASelectedSourceLocation(DataFlow::Node sink) { none() }
 }

 module AzureBlobClientFlow = DataFlow::GlobalWithState<AzureBlobClientConfig>;
--- a/python/ql/src/experimental/Security/CWE-346/CorsBypass.ql
+++ b/python/ql/src/experimental/Security/CWE-346/CorsBypass.ql
@@ -81,8 +81,6 @@ module CorsBypassConfig implements DataFlow::ConfigSig {
  }

  predicate observeDiffInformedIncrementalMode() { any() }
-
-  Location getASelectedSourceLocation(DataFlow::Node sink) { none() }
 }

 module CorsFlow = TaintTracking::Global<CorsBypassConfig>;
--- a/python/ql/src/experimental/Security/UnsafeUnpackQuery.qll
+++ b/python/ql/src/experimental/Security/UnsafeUnpackQuery.qll
@@ -210,8 +210,6 @@ module UnsafeUnpackConfig implements DataFlow::ConfigSig {
  }

  predicate observeDiffInformedIncrementalMode() { any() }
-
-  Location getASelectedSourceLocation(DataFlow::Node sink) { none() }
 }

 /** Global taint-tracking for detecting "UnsafeUnpacking" vulnerabilities. */
--- a/python/ql/src/experimental/semmle/python/security/LdapInsecureAuth.qll
+++ b/python/ql/src/experimental/semmle/python/security/LdapInsecureAuth.qll
@@ -103,8 +103,6 @@ private module LdapInsecureAuthConfig implements DataFlow::ConfigSig {
  }

  predicate observeDiffInformedIncrementalMode() { any() }
-
-  Location getASelectedSourceLocation(DataFlow::Node sink) { none() }
 }

 /** Global taint-tracking for detecting "LDAP insecure authentications" vulnerabilities. */
--- a/ruby/ql/lib/codeql/ruby/security/regexp/PolynomialReDoSQuery.qll
+++ b/ruby/ql/lib/codeql/ruby/security/regexp/PolynomialReDoSQuery.qll
@@ -24,6 +24,8 @@ private module PolynomialReDoSConfig implements DataFlow::ConfigSig {
  predicate observeDiffInformedIncrementalMode() { none() }

  Location getASelectedSinkLocation(DataFlow::Node sink) {
+    result = sink.(Sink).getLocation()
+    or
    result = sink.(Sink).getHighlight().getLocation()
    or
    result = sink.(Sink).getRegExp().getRootTerm().getLocation()
--- a/ruby/ql/src/experimental/manually-check-http-verb/ManuallyCheckHttpVerb.ql
+++ b/ruby/ql/src/experimental/manually-check-http-verb/ManuallyCheckHttpVerb.ql
@@ -88,8 +88,6 @@ private module HttpVerbConfig implements DataFlow::ConfigSig {
  }

  predicate observeDiffInformedIncrementalMode() { any() }
-
-  Location getASelectedSourceLocation(DataFlow::Node source) { none() }
 }

 private module HttpVerbFlow = TaintTracking::Global<HttpVerbConfig>;
--- a/ruby/ql/src/experimental/weak-params/WeakParams.ql
+++ b/ruby/ql/src/experimental/weak-params/WeakParams.ql
@@ -48,8 +48,6 @@ private module WeakParamsConfig implements DataFlow::ConfigSig {
  predicate isSink(DataFlow::Node node) { node = any(PersistentWriteAccess a).getValue() }

  predicate observeDiffInformedIncrementalMode() { any() }
-
-  Location getASelectedSourceLocation(DataFlow::Node source) { none() }
 }

 private module WeakParamsFlow = TaintTracking::Global<WeakParamsConfig>;
--- a/ruby/ql/src/queries/security/cwe-732/WeakFilePermissions.ql
+++ b/ruby/ql/src/queries/security/cwe-732/WeakFilePermissions.ql
@@ -60,8 +60,9 @@ private module PermissivePermissionsConfig implements DataFlow::ConfigSig {
  predicate observeDiffInformedIncrementalMode() { any() }

  Location getASelectedSinkLocation(DataFlow::Node sink) {
-    exists(FileSystemPermissionModification mod |
-      sinkDef(sink, mod) and
+    exists(FileSystemPermissionModification mod | sinkDef(sink, mod) |
+      result = sink.getLocation()
+      or
      result = mod.getLocation()
    )
  }
--- a/rust/ql/src/queries/security/CWE-614/InsecureCookie.ql
+++ b/rust/ql/src/queries/security/CWE-614/InsecureCookie.ql
@@ -74,7 +74,9 @@ module PartitionedCookieConfig implements DataFlow::ConfigSig {
    node instanceof Barrier
  }

-  predicate observeDiffInformedIncrementalMode() { any() }
+  predicate observeDiffInformedIncrementalMode() {
+    none() // only used negatively
+  }
 }

 module InsecureCookieFlow = TaintTracking::Global<InsecureCookieConfig>;
--- a/rust/ql/src/queries/security/CWE-825/AccessAfterLifetime.ql
+++ b/rust/ql/src/queries/security/CWE-825/AccessAfterLifetime.ql
@@ -32,7 +32,9 @@ module AccessAfterLifetimeConfig implements DataFlow::ConfigSig {
  predicate observeDiffInformedIncrementalMode() { any() }

  Location getASelectedSourceLocation(DataFlow::Node source) {
-    exists(Variable target, DataFlow::Node sink | result = target.getLocation() |
+    exists(Variable target, DataFlow::Node sink |
+      result = [target.getLocation(), source.getLocation()]
+    |
      isSink(sink) and
      narrowDereferenceAfterLifetime(source, sink, target)
    )
--- a/shared/dataflow/codeql/dataflow/DataFlow.qll
+++ b/shared/dataflow/codeql/dataflow/DataFlow.qll
@@ -466,8 +466,10 @@ module Configs<LocationSig Location, InputSig<Location> Lang> {
     * `observeDiffInformedIncrementalMode`). By default, this is the location
     * of the source itself, but this predicate should include any locations
     * that are reported as the primary-location of the query or as an
-     * additional location ("$@" interpolation). For a query that doesn't
-     * report the source at all, this predicate can be `none()`.
+     * additional location ("$@" interpolation). Queries with `@kind path-problem`
+     * that override this predicate should also return the location of the source
+     * itself. For a query that doesn't report the source at all, this predicate
+     * should be `none()`.
     */
    default Location getASelectedSourceLocation(Node source) { result = source.getLocation() }

@@ -477,8 +479,10 @@ module Configs<LocationSig Location, InputSig<Location> Lang> {
     * `observeDiffInformedIncrementalMode`). By default, this is the location
     * of the sink itself, but this predicate should include any locations
     * that are reported as the primary-location of the query or as an
-     * additional location ("$@" interpolation). For a query that doesn't
-     * report the sink at all, this predicate can be `none()`.
+     * additional location ("$@" interpolation). Queries with `@kind path-problem`
+     * that override this predicate should also return the location of the sink
+     * itself. For a query that doesn't report the sink at all, this predicate
+     * should be `none()`.
     */
    default Location getASelectedSinkLocation(Node sink) { result = sink.getLocation() }
  }
@@ -615,8 +619,10 @@ module Configs<LocationSig Location, InputSig<Location> Lang> {
     * `observeDiffInformedIncrementalMode`). By default, this is the location
     * of the source itself, but this predicate should include any locations
     * that are reported as the primary-location of the query or as an
-     * additional location ("$@" interpolation). For a query that doesn't
-     * report the source at all, this predicate can be `none()`.
+     * additional location ("$@" interpolation). Queries with `@kind path-problem`
+     * that override this predicate should also return the location of the source
+     * itself. For a query that doesn't report the source at all, this predicate
+     * should be `none()`.
     */
    default Location getASelectedSourceLocation(Node source) { result = source.getLocation() }

@@ -626,8 +632,10 @@ module Configs<LocationSig Location, InputSig<Location> Lang> {
     * `observeDiffInformedIncrementalMode`). By default, this is the location
     * of the sink itself, but this predicate should include any locations
     * that are reported as the primary-location of the query or as an
-     * additional location ("$@" interpolation). For a query that doesn't
-     * report the sink at all, this predicate can be `none()`.
+     * additional location ("$@" interpolation). Queries with `@kind path-problem`
+     * that override this predicate should also return the location of the sink
+     * itself. For a query that doesn't report the sink at all, this predicate
+     * should be `none()`.
     */
    default Location getASelectedSinkLocation(Node sink) { result = sink.getLocation() }
  }
--- a/swift/ql/lib/codeql/swift/security/CleartextStorageDatabaseQuery.qll
+++ b/swift/ql/lib/codeql/swift/security/CleartextStorageDatabaseQuery.qll
@@ -52,12 +52,13 @@ module CleartextStorageDatabaseConfig implements DataFlow::ConfigSig {
  predicate observeDiffInformedIncrementalMode() { any() }

  Location getASelectedSinkLocation(DataFlow::Node sink) {
-    exists(DataFlow::Node cleanSink | result = cleanSink.getLocation() |
-      cleanSink = sink.(DataFlow::PostUpdateNode).getPreUpdateNode()
-      or
-      not sink instanceof DataFlow::PostUpdateNode and
-      cleanSink = sink
-    )
+    result = sink.(CleartextStorageDatabaseSink).getLocation()
+    or
+    result =
+      sink.(CleartextStorageDatabaseSink)
+          .(DataFlow::PostUpdateNode)
+          .getPreUpdateNode()
+          .getLocation()
  }
 }

--- a/swift/ql/lib/codeql/swift/security/CleartextStoragePreferencesQuery.qll
+++ b/swift/ql/lib/codeql/swift/security/CleartextStoragePreferencesQuery.qll
@@ -34,12 +34,13 @@ module CleartextStoragePreferencesConfig implements DataFlow::ConfigSig {
  predicate observeDiffInformedIncrementalMode() { any() }

  Location getASelectedSinkLocation(DataFlow::Node sink) {
-    exists(DataFlow::Node cleanSink | result = cleanSink.getLocation() |
-      cleanSink = sink.(DataFlow::PostUpdateNode).getPreUpdateNode()
-      or
-      not sink instanceof DataFlow::PostUpdateNode and
-      cleanSink = sink
-    )
+    result = sink.(CleartextStoragePreferencesSink).getLocation()
+    or
+    result =
+      sink.(CleartextStoragePreferencesSink)
+          .(DataFlow::PostUpdateNode)
+          .getPreUpdateNode()
+          .getLocation()
  }
 }

--- a/swift/ql/lib/codeql/swift/security/ConstantPasswordQuery.qll
+++ b/swift/ql/lib/codeql/swift/security/ConstantPasswordQuery.qll
@@ -40,8 +40,6 @@ module ConstantPasswordConfig implements DataFlow::ConfigSig {
  }

  predicate observeDiffInformedIncrementalMode() { any() }
-
-  Location getASelectedSourceLocation(DataFlow::Node sink) { none() }
 }

 module ConstantPasswordFlow = TaintTracking::Global<ConstantPasswordConfig>;
--- a/swift/ql/lib/codeql/swift/security/InsufficientHashIterationsQuery.qll
+++ b/swift/ql/lib/codeql/swift/security/InsufficientHashIterationsQuery.qll
@@ -36,8 +36,6 @@ module InsufficientHashIterationsConfig implements DataFlow::ConfigSig {
  }

  predicate observeDiffInformedIncrementalMode() { any() }
-
-  Location getASelectedSourceLocation(DataFlow::Node sink) { none() }
 }

 module InsufficientHashIterationsFlow = TaintTracking::Global<InsufficientHashIterationsConfig>;
--- a/swift/ql/lib/codeql/swift/security/StaticInitializationVectorQuery.qll
+++ b/swift/ql/lib/codeql/swift/security/StaticInitializationVectorQuery.qll
@@ -42,8 +42,6 @@ module StaticInitializationVectorConfig implements DataFlow::ConfigSig {
  }

  predicate observeDiffInformedIncrementalMode() { any() }
-
-  Location getASelectedSourceLocation(DataFlow::Node sink) { none() }
 }

 module StaticInitializationVectorFlow = TaintTracking::Global<StaticInitializationVectorConfig>;
--- a/swift/ql/lib/codeql/swift/security/StringLengthConflationQuery.qll
+++ b/swift/ql/lib/codeql/swift/security/StringLengthConflationQuery.qll
@@ -41,8 +41,6 @@ module StringLengthConflationConfig implements DataFlow::StateConfigSig {
  }

  predicate observeDiffInformedIncrementalMode() { any() }
-
-  Location getASelectedSourceLocation(DataFlow::Node sink) { none() }
 }

 /**
--- a/swift/ql/lib/codeql/swift/security/UnsafeJsEvalQuery.qll
+++ b/swift/ql/lib/codeql/swift/security/UnsafeJsEvalQuery.qll
@@ -24,8 +24,6 @@ module UnsafeJsEvalConfig implements DataFlow::ConfigSig {
  }

  predicate observeDiffInformedIncrementalMode() { any() }
-
-  Location getASelectedSourceLocation(DataFlow::Node sink) { none() }
 }

 /**
--- a/swift/ql/lib/codeql/swift/security/UnsafeUnpackQuery.qll
+++ b/swift/ql/lib/codeql/swift/security/UnsafeUnpackQuery.qll
@@ -26,8 +26,6 @@ module UnsafeUnpackConfig implements DataFlow::ConfigSig {
  }

  predicate observeDiffInformedIncrementalMode() { any() }
-
-  Location getASelectedSourceLocation(DataFlow::Node sink) { none() }
 }

 /**