C++: Model find.

2025-12-17 01:03:14 +01:00 · 2020-09-24 18:06:41 +01:00
parent d550741c0c
commit 8b91d5077d
6 changed files with 122 additions and 26 deletions
--- a/cpp/ql/src/semmle/code/cpp/models/implementations/StdMap.qll
+++ b/cpp/ql/src/semmle/code/cpp/models/implementations/StdMap.qll
@@ -73,3 +73,17 @@ class StdMapAt extends TaintFunction {
    output.isQualifierObject()
  }
 }
+
+/**
+ * The standard map `find` function.
+ */
+class StdMapFind extends TaintFunction {
+  StdMapFind() {
+    this.hasQualifiedName("std", ["map", "unordered_map"], "find")
+  }
+
+  override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+    input.isQualifierObject() and
+    output.isReturnValue()
+  }
+}
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
@@ -695,10 +695,12 @@
 | map.cpp:113:7:113:8 | m4 | map.cpp:113:7:113:8 | call to map |  |
 | map.cpp:114:7:114:8 | m5 | map.cpp:114:7:114:8 | call to map |  |
 | map.cpp:115:7:115:8 | m6 | map.cpp:115:7:115:8 | call to map |  |
+| map.cpp:116:7:116:8 | m1 | map.cpp:116:10:116:13 | call to find | TAINT |
 | map.cpp:116:7:116:8 | ref arg m1 | map.cpp:122:7:122:8 | m1 |  |
 | map.cpp:116:7:116:8 | ref arg m1 | map.cpp:143:12:143:13 | m1 |  |
 | map.cpp:116:7:116:8 | ref arg m1 | map.cpp:143:30:143:31 | m1 |  |
 | map.cpp:116:7:116:8 | ref arg m1 | map.cpp:249:1:249:1 | m1 |  |
+| map.cpp:117:7:117:8 | m2 | map.cpp:117:10:117:13 | call to find | TAINT |
 | map.cpp:117:7:117:8 | ref arg m2 | map.cpp:123:7:123:8 | m2 |  |
 | map.cpp:117:7:117:8 | ref arg m2 | map.cpp:130:30:130:31 | m2 |  |
 | map.cpp:117:7:117:8 | ref arg m2 | map.cpp:131:32:131:33 | m2 |  |
@@ -712,19 +714,25 @@
 | map.cpp:117:7:117:8 | ref arg m2 | map.cpp:183:7:183:8 | m2 |  |
 | map.cpp:117:7:117:8 | ref arg m2 | map.cpp:184:7:184:8 | m2 |  |
 | map.cpp:117:7:117:8 | ref arg m2 | map.cpp:249:1:249:1 | m2 |  |
+| map.cpp:118:7:118:8 | m3 | map.cpp:118:10:118:13 | call to find | TAINT |
 | map.cpp:118:7:118:8 | ref arg m3 | map.cpp:124:7:124:8 | m3 |  |
 | map.cpp:118:7:118:8 | ref arg m3 | map.cpp:155:12:155:13 | m3 |  |
 | map.cpp:118:7:118:8 | ref arg m3 | map.cpp:155:30:155:31 | m3 |  |
 | map.cpp:118:7:118:8 | ref arg m3 | map.cpp:249:1:249:1 | m3 |  |
+| map.cpp:119:7:119:8 | m4 | map.cpp:119:10:119:13 | call to find | TAINT |
 | map.cpp:119:7:119:8 | ref arg m4 | map.cpp:125:7:125:8 | m4 |  |
 | map.cpp:119:7:119:8 | ref arg m4 | map.cpp:249:1:249:1 | m4 |  |
+| map.cpp:120:7:120:8 | m5 | map.cpp:120:10:120:13 | call to find | TAINT |
 | map.cpp:120:7:120:8 | ref arg m5 | map.cpp:126:7:126:8 | m5 |  |
 | map.cpp:120:7:120:8 | ref arg m5 | map.cpp:249:1:249:1 | m5 |  |
+| map.cpp:121:7:121:8 | m6 | map.cpp:121:10:121:13 | call to find | TAINT |
 | map.cpp:121:7:121:8 | ref arg m6 | map.cpp:127:7:127:8 | m6 |  |
 | map.cpp:121:7:121:8 | ref arg m6 | map.cpp:249:1:249:1 | m6 |  |
+| map.cpp:122:7:122:8 | m1 | map.cpp:122:10:122:13 | call to find | TAINT |
 | map.cpp:122:7:122:8 | ref arg m1 | map.cpp:143:12:143:13 | m1 |  |
 | map.cpp:122:7:122:8 | ref arg m1 | map.cpp:143:30:143:31 | m1 |  |
 | map.cpp:122:7:122:8 | ref arg m1 | map.cpp:249:1:249:1 | m1 |  |
+| map.cpp:123:7:123:8 | m2 | map.cpp:123:10:123:13 | call to find | TAINT |
 | map.cpp:123:7:123:8 | ref arg m2 | map.cpp:130:30:130:31 | m2 |  |
 | map.cpp:123:7:123:8 | ref arg m2 | map.cpp:131:32:131:33 | m2 |  |
 | map.cpp:123:7:123:8 | ref arg m2 | map.cpp:133:7:133:8 | m2 |  |
@@ -737,11 +745,15 @@
 | map.cpp:123:7:123:8 | ref arg m2 | map.cpp:183:7:183:8 | m2 |  |
 | map.cpp:123:7:123:8 | ref arg m2 | map.cpp:184:7:184:8 | m2 |  |
 | map.cpp:123:7:123:8 | ref arg m2 | map.cpp:249:1:249:1 | m2 |  |
+| map.cpp:124:7:124:8 | m3 | map.cpp:124:10:124:13 | call to find | TAINT |
 | map.cpp:124:7:124:8 | ref arg m3 | map.cpp:155:12:155:13 | m3 |  |
 | map.cpp:124:7:124:8 | ref arg m3 | map.cpp:155:30:155:31 | m3 |  |
 | map.cpp:124:7:124:8 | ref arg m3 | map.cpp:249:1:249:1 | m3 |  |
+| map.cpp:125:7:125:8 | m4 | map.cpp:125:10:125:13 | call to find | TAINT |
 | map.cpp:125:7:125:8 | ref arg m4 | map.cpp:249:1:249:1 | m4 |  |
+| map.cpp:126:7:126:8 | m5 | map.cpp:126:10:126:13 | call to find | TAINT |
 | map.cpp:126:7:126:8 | ref arg m5 | map.cpp:249:1:249:1 | m5 |  |
+| map.cpp:127:7:127:8 | m6 | map.cpp:127:10:127:13 | call to find | TAINT |
 | map.cpp:127:7:127:8 | ref arg m6 | map.cpp:249:1:249:1 | m6 |  |
 | map.cpp:130:30:130:31 | m2 | map.cpp:130:30:130:32 | call to map |  |
 | map.cpp:130:30:130:32 | call to map | map.cpp:134:7:134:8 | m7 |  |
@@ -763,8 +775,11 @@
 | map.cpp:134:7:134:8 | m7 | map.cpp:134:7:134:8 | call to map |  |
 | map.cpp:135:7:135:8 | m8 | map.cpp:135:7:135:8 | call to map |  |
 | map.cpp:136:7:136:8 | m9 | map.cpp:136:7:136:8 | call to map |  |
+| map.cpp:137:7:137:8 | m7 | map.cpp:137:10:137:13 | call to find | TAINT |
 | map.cpp:137:7:137:8 | ref arg m7 | map.cpp:249:1:249:1 | m7 |  |
+| map.cpp:138:7:138:8 | m8 | map.cpp:138:10:138:13 | call to find | TAINT |
 | map.cpp:138:7:138:8 | ref arg m8 | map.cpp:249:1:249:1 | m8 |  |
+| map.cpp:139:7:139:8 | m9 | map.cpp:139:10:139:13 | call to find | TAINT |
 | map.cpp:139:7:139:8 | ref arg m9 | map.cpp:249:1:249:1 | m9 |  |
 | map.cpp:143:12:143:13 | m1 | map.cpp:143:15:143:19 | call to begin | TAINT |
 | map.cpp:143:12:143:13 | ref arg m1 | map.cpp:143:30:143:31 | m1 |  |
@@ -1338,10 +1353,12 @@
 | map.cpp:265:7:265:8 | m4 | map.cpp:265:7:265:8 | call to unordered_map |  |
 | map.cpp:266:7:266:8 | m5 | map.cpp:266:7:266:8 | call to unordered_map |  |
 | map.cpp:267:7:267:8 | m6 | map.cpp:267:7:267:8 | call to unordered_map |  |
+| map.cpp:268:7:268:8 | m1 | map.cpp:268:10:268:13 | call to find | TAINT |
 | map.cpp:268:7:268:8 | ref arg m1 | map.cpp:274:7:274:8 | m1 |  |
 | map.cpp:268:7:268:8 | ref arg m1 | map.cpp:295:12:295:13 | m1 |  |
 | map.cpp:268:7:268:8 | ref arg m1 | map.cpp:295:30:295:31 | m1 |  |
 | map.cpp:268:7:268:8 | ref arg m1 | map.cpp:398:1:398:1 | m1 |  |
+| map.cpp:269:7:269:8 | m2 | map.cpp:269:10:269:13 | call to find | TAINT |
 | map.cpp:269:7:269:8 | ref arg m2 | map.cpp:275:7:275:8 | m2 |  |
 | map.cpp:269:7:269:8 | ref arg m2 | map.cpp:282:40:282:41 | m2 |  |
 | map.cpp:269:7:269:8 | ref arg m2 | map.cpp:283:42:283:43 | m2 |  |
@@ -1352,19 +1369,25 @@
 | map.cpp:269:7:269:8 | ref arg m2 | map.cpp:332:7:332:8 | m2 |  |
 | map.cpp:269:7:269:8 | ref arg m2 | map.cpp:333:7:333:8 | m2 |  |
 | map.cpp:269:7:269:8 | ref arg m2 | map.cpp:398:1:398:1 | m2 |  |
+| map.cpp:270:7:270:8 | m3 | map.cpp:270:10:270:13 | call to find | TAINT |
 | map.cpp:270:7:270:8 | ref arg m3 | map.cpp:276:7:276:8 | m3 |  |
 | map.cpp:270:7:270:8 | ref arg m3 | map.cpp:307:12:307:13 | m3 |  |
 | map.cpp:270:7:270:8 | ref arg m3 | map.cpp:307:30:307:31 | m3 |  |
 | map.cpp:270:7:270:8 | ref arg m3 | map.cpp:398:1:398:1 | m3 |  |
+| map.cpp:271:7:271:8 | m4 | map.cpp:271:10:271:13 | call to find | TAINT |
 | map.cpp:271:7:271:8 | ref arg m4 | map.cpp:277:7:277:8 | m4 |  |
 | map.cpp:271:7:271:8 | ref arg m4 | map.cpp:398:1:398:1 | m4 |  |
+| map.cpp:272:7:272:8 | m5 | map.cpp:272:10:272:13 | call to find | TAINT |
 | map.cpp:272:7:272:8 | ref arg m5 | map.cpp:278:7:278:8 | m5 |  |
 | map.cpp:272:7:272:8 | ref arg m5 | map.cpp:398:1:398:1 | m5 |  |
+| map.cpp:273:7:273:8 | m6 | map.cpp:273:10:273:13 | call to find | TAINT |
 | map.cpp:273:7:273:8 | ref arg m6 | map.cpp:279:7:279:8 | m6 |  |
 | map.cpp:273:7:273:8 | ref arg m6 | map.cpp:398:1:398:1 | m6 |  |
+| map.cpp:274:7:274:8 | m1 | map.cpp:274:10:274:13 | call to find | TAINT |
 | map.cpp:274:7:274:8 | ref arg m1 | map.cpp:295:12:295:13 | m1 |  |
 | map.cpp:274:7:274:8 | ref arg m1 | map.cpp:295:30:295:31 | m1 |  |
 | map.cpp:274:7:274:8 | ref arg m1 | map.cpp:398:1:398:1 | m1 |  |
+| map.cpp:275:7:275:8 | m2 | map.cpp:275:10:275:13 | call to find | TAINT |
 | map.cpp:275:7:275:8 | ref arg m2 | map.cpp:282:40:282:41 | m2 |  |
 | map.cpp:275:7:275:8 | ref arg m2 | map.cpp:283:42:283:43 | m2 |  |
 | map.cpp:275:7:275:8 | ref arg m2 | map.cpp:285:7:285:8 | m2 |  |
@@ -1374,11 +1397,15 @@
 | map.cpp:275:7:275:8 | ref arg m2 | map.cpp:332:7:332:8 | m2 |  |
 | map.cpp:275:7:275:8 | ref arg m2 | map.cpp:333:7:333:8 | m2 |  |
 | map.cpp:275:7:275:8 | ref arg m2 | map.cpp:398:1:398:1 | m2 |  |
+| map.cpp:276:7:276:8 | m3 | map.cpp:276:10:276:13 | call to find | TAINT |
 | map.cpp:276:7:276:8 | ref arg m3 | map.cpp:307:12:307:13 | m3 |  |
 | map.cpp:276:7:276:8 | ref arg m3 | map.cpp:307:30:307:31 | m3 |  |
 | map.cpp:276:7:276:8 | ref arg m3 | map.cpp:398:1:398:1 | m3 |  |
+| map.cpp:277:7:277:8 | m4 | map.cpp:277:10:277:13 | call to find | TAINT |
 | map.cpp:277:7:277:8 | ref arg m4 | map.cpp:398:1:398:1 | m4 |  |
+| map.cpp:278:7:278:8 | m5 | map.cpp:278:10:278:13 | call to find | TAINT |
 | map.cpp:278:7:278:8 | ref arg m5 | map.cpp:398:1:398:1 | m5 |  |
+| map.cpp:279:7:279:8 | m6 | map.cpp:279:10:279:13 | call to find | TAINT |
 | map.cpp:279:7:279:8 | ref arg m6 | map.cpp:398:1:398:1 | m6 |  |
 | map.cpp:282:40:282:41 | m2 | map.cpp:282:40:282:42 | call to unordered_map |  |
 | map.cpp:282:40:282:42 | call to unordered_map | map.cpp:286:7:286:8 | m7 |  |
@@ -1400,8 +1427,11 @@
 | map.cpp:286:7:286:8 | m7 | map.cpp:286:7:286:8 | call to unordered_map |  |
 | map.cpp:287:7:287:8 | m8 | map.cpp:287:7:287:8 | call to unordered_map |  |
 | map.cpp:288:7:288:8 | m9 | map.cpp:288:7:288:8 | call to unordered_map |  |
+| map.cpp:289:7:289:8 | m7 | map.cpp:289:10:289:13 | call to find | TAINT |
 | map.cpp:289:7:289:8 | ref arg m7 | map.cpp:398:1:398:1 | m7 |  |
+| map.cpp:290:7:290:8 | m8 | map.cpp:290:10:290:13 | call to find | TAINT |
 | map.cpp:290:7:290:8 | ref arg m8 | map.cpp:398:1:398:1 | m8 |  |
+| map.cpp:291:7:291:8 | m9 | map.cpp:291:10:291:13 | call to find | TAINT |
 | map.cpp:291:7:291:8 | ref arg m9 | map.cpp:398:1:398:1 | m9 |  |
 | map.cpp:295:12:295:13 | m1 | map.cpp:295:15:295:19 | call to begin | TAINT |
 | map.cpp:295:12:295:13 | ref arg m1 | map.cpp:295:30:295:31 | m1 |  |
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/map.cpp
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/map.cpp
@@ -114,17 +114,17 @@ void test_map()
 	sink(m5); // tainted
 	sink(m6); // tainted
 	sink(m1.find("abc"));
-	sink(m2.find("abc")); // tainted [NOT DETECTED]
-	sink(m3.find("abc"));
-	sink(m4.find("abc")); // tainted [NOT DETECTED]
-	sink(m5.find("abc")); // tainted [NOT DETECTED]
-	sink(m6.find("abc")); // tainted [NOT DETECTED]
+	sink(m2.find("abc")); // tainted
+	sink(m3.find("abc")); // [FALSE POSITIVE]
+	sink(m4.find("abc")); // tainted
+	sink(m5.find("abc")); // tainted
+	sink(m6.find("abc")); // tainted
 	sink(m1.find("def"));
-	sink(m2.find("def"));
-	sink(m3.find("def"));
-	sink(m4.find("def"));
-	sink(m5.find("def"));
-	sink(m6.find("def"));
+	sink(m2.find("def")); // [FALSE POSITIVE]
+	sink(m3.find("def")); // [FALSE POSITIVE]
+	sink(m4.find("def")); // [FALSE POSITIVE]
+	sink(m5.find("def")); // [FALSE POSITIVE]
+	sink(m6.find("def")); // [FALSE POSITIVE]

 	// copy constructors and assignment
 	std::map<char *, char *> m7(m2);
@@ -134,9 +134,9 @@ void test_map()
 	sink(m7); // tainted
 	sink(m8); // tainted
 	sink(m9); // tainted
-	sink(m7.find("abc")); // tainted [NOT DETECTED]
-	sink(m8.find("abc")); // tainted [NOT DETECTED]
-	sink(m9.find("abc")); // tainted [NOT DETECTED]
+	sink(m7.find("abc")); // tainted
+	sink(m8.find("abc")); // tainted
+	sink(m9.find("abc")); // tainted

 	// iterators
 	std::map<char *, char *>::iterator i1, i2, i3;
@@ -266,17 +266,17 @@ void test_unordered_map()
 	sink(m5); // tainted
 	sink(m6); // tainted
 	sink(m1.find("abc"));
-	sink(m2.find("abc")); // tainted [NOT DETECTED]
-	sink(m3.find("abc"));
-	sink(m4.find("abc")); // tainted [NOT DETECTED]
-	sink(m5.find("abc")); // tainted [NOT DETECTED]
-	sink(m6.find("abc")); // tainted [NOT DETECTED]
+	sink(m2.find("abc")); // tainted
+	sink(m3.find("abc")); // [FALSE POSITIVE]
+	sink(m4.find("abc")); // tainted
+	sink(m5.find("abc")); // tainted
+	sink(m6.find("abc")); // tainted
 	sink(m1.find("def"));
-	sink(m2.find("def"));
-	sink(m3.find("def"));
-	sink(m4.find("def"));
-	sink(m5.find("def"));
-	sink(m6.find("def"));
+	sink(m2.find("def")); // [FALSE POSITIVE]
+	sink(m3.find("def")); // [FALSE POSITIVE]
+	sink(m4.find("def")); // [FALSE POSITIVE]
+	sink(m5.find("def")); // [FALSE POSITIVE]
+	sink(m6.find("def")); // [FALSE POSITIVE]

 	// copy constructors and assignment
 	std::unordered_map<char *, char *> m7(m2);
@@ -286,9 +286,9 @@ void test_unordered_map()
 	sink(m7); // tainted
 	sink(m8); // tainted
 	sink(m9); // tainted
-	sink(m7.find("abc")); // tainted [NOT DETECTED]
-	sink(m8.find("abc")); // tainted [NOT DETECTED]
-	sink(m9.find("abc")); // tainted [NOT DETECTED]
+	sink(m7.find("abc")); // tainted
+	sink(m8.find("abc")); // tainted
+	sink(m9.find("abc")); // tainted

 	// iterators
 	std::unordered_map<char *, char *>::iterator i1, i2, i3;
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/taint.expected
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/taint.expected
@@ -53,9 +53,22 @@
 | map.cpp:113:7:113:8 | call to map | map.cpp:107:62:107:67 | call to source |
 | map.cpp:114:7:114:8 | call to map | map.cpp:108:34:108:39 | call to source |
 | map.cpp:115:7:115:8 | call to map | map.cpp:109:46:109:51 | call to source |
+| map.cpp:117:10:117:13 | call to find | map.cpp:105:39:105:44 | call to source |
+| map.cpp:118:10:118:13 | call to find | map.cpp:106:32:106:37 | call to source |
+| map.cpp:119:10:119:13 | call to find | map.cpp:107:62:107:67 | call to source |
+| map.cpp:120:10:120:13 | call to find | map.cpp:108:34:108:39 | call to source |
+| map.cpp:121:10:121:13 | call to find | map.cpp:109:46:109:51 | call to source |
+| map.cpp:123:10:123:13 | call to find | map.cpp:105:39:105:44 | call to source |
+| map.cpp:124:10:124:13 | call to find | map.cpp:106:32:106:37 | call to source |
+| map.cpp:125:10:125:13 | call to find | map.cpp:107:62:107:67 | call to source |
+| map.cpp:126:10:126:13 | call to find | map.cpp:108:34:108:39 | call to source |
+| map.cpp:127:10:127:13 | call to find | map.cpp:109:46:109:51 | call to source |
 | map.cpp:134:7:134:8 | call to map | map.cpp:105:39:105:44 | call to source |
 | map.cpp:135:7:135:8 | call to map | map.cpp:105:39:105:44 | call to source |
 | map.cpp:136:7:136:8 | call to map | map.cpp:105:39:105:44 | call to source |
+| map.cpp:137:10:137:13 | call to find | map.cpp:105:39:105:44 | call to source |
+| map.cpp:138:10:138:13 | call to find | map.cpp:105:39:105:44 | call to source |
+| map.cpp:139:10:139:13 | call to find | map.cpp:105:39:105:44 | call to source |
 | map.cpp:151:8:151:10 | call to pair | map.cpp:105:39:105:44 | call to source |
 | map.cpp:157:8:157:10 | call to pair | map.cpp:106:32:106:37 | call to source |
 | map.cpp:165:7:165:27 | ... = ... | map.cpp:165:20:165:25 | call to source |
@@ -101,9 +114,22 @@
 | map.cpp:265:7:265:8 | call to unordered_map | map.cpp:259:62:259:67 | call to source |
 | map.cpp:266:7:266:8 | call to unordered_map | map.cpp:260:34:260:39 | call to source |
 | map.cpp:267:7:267:8 | call to unordered_map | map.cpp:261:46:261:51 | call to source |
+| map.cpp:269:10:269:13 | call to find | map.cpp:257:39:257:44 | call to source |
+| map.cpp:270:10:270:13 | call to find | map.cpp:258:32:258:37 | call to source |
+| map.cpp:271:10:271:13 | call to find | map.cpp:259:62:259:67 | call to source |
+| map.cpp:272:10:272:13 | call to find | map.cpp:260:34:260:39 | call to source |
+| map.cpp:273:10:273:13 | call to find | map.cpp:261:46:261:51 | call to source |
+| map.cpp:275:10:275:13 | call to find | map.cpp:257:39:257:44 | call to source |
+| map.cpp:276:10:276:13 | call to find | map.cpp:258:32:258:37 | call to source |
+| map.cpp:277:10:277:13 | call to find | map.cpp:259:62:259:67 | call to source |
+| map.cpp:278:10:278:13 | call to find | map.cpp:260:34:260:39 | call to source |
+| map.cpp:279:10:279:13 | call to find | map.cpp:261:46:261:51 | call to source |
 | map.cpp:286:7:286:8 | call to unordered_map | map.cpp:257:39:257:44 | call to source |
 | map.cpp:287:7:287:8 | call to unordered_map | map.cpp:257:39:257:44 | call to source |
 | map.cpp:288:7:288:8 | call to unordered_map | map.cpp:257:39:257:44 | call to source |
+| map.cpp:289:10:289:13 | call to find | map.cpp:257:39:257:44 | call to source |
+| map.cpp:290:10:290:13 | call to find | map.cpp:257:39:257:44 | call to source |
+| map.cpp:291:10:291:13 | call to find | map.cpp:257:39:257:44 | call to source |
 | map.cpp:303:8:303:10 | call to pair | map.cpp:257:39:257:44 | call to source |
 | map.cpp:309:8:309:10 | call to pair | map.cpp:258:32:258:37 | call to source |
 | map.cpp:317:7:317:27 | ... = ... | map.cpp:317:20:317:25 | call to source |
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/test_diff.expected
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/test_diff.expected
@@ -50,9 +50,15 @@
 | map.cpp:113:7:113:8 | map.cpp:107:62:107:67 | AST only |
 | map.cpp:114:7:114:8 | map.cpp:108:34:108:39 | AST only |
 | map.cpp:115:7:115:8 | map.cpp:109:46:109:51 | AST only |
+| map.cpp:120:10:120:13 | map.cpp:108:34:108:39 | AST only |
+| map.cpp:121:10:121:13 | map.cpp:109:46:109:51 | AST only |
+| map.cpp:126:10:126:13 | map.cpp:108:34:108:39 | AST only |
+| map.cpp:127:10:127:13 | map.cpp:109:46:109:51 | AST only |
 | map.cpp:134:7:134:8 | map.cpp:105:39:105:44 | AST only |
 | map.cpp:135:7:135:8 | map.cpp:105:39:105:44 | AST only |
 | map.cpp:136:7:136:8 | map.cpp:105:39:105:44 | AST only |
+| map.cpp:137:10:137:13 | map.cpp:105:39:105:44 | AST only |
+| map.cpp:138:10:138:13 | map.cpp:105:39:105:44 | AST only |
 | map.cpp:152:12:152:16 | map.cpp:105:39:105:44 | IR only |
 | map.cpp:153:12:153:17 | map.cpp:105:39:105:44 | IR only |
 | map.cpp:158:12:158:16 | map.cpp:105:39:105:44 | IR only |
@@ -99,9 +105,15 @@
 | map.cpp:265:7:265:8 | map.cpp:259:62:259:67 | AST only |
 | map.cpp:266:7:266:8 | map.cpp:260:34:260:39 | AST only |
 | map.cpp:267:7:267:8 | map.cpp:261:46:261:51 | AST only |
+| map.cpp:272:10:272:13 | map.cpp:260:34:260:39 | AST only |
+| map.cpp:273:10:273:13 | map.cpp:261:46:261:51 | AST only |
+| map.cpp:278:10:278:13 | map.cpp:260:34:260:39 | AST only |
+| map.cpp:279:10:279:13 | map.cpp:261:46:261:51 | AST only |
 | map.cpp:286:7:286:8 | map.cpp:257:39:257:44 | AST only |
 | map.cpp:287:7:287:8 | map.cpp:257:39:257:44 | AST only |
 | map.cpp:288:7:288:8 | map.cpp:257:39:257:44 | AST only |
+| map.cpp:289:10:289:13 | map.cpp:257:39:257:44 | AST only |
+| map.cpp:290:10:290:13 | map.cpp:257:39:257:44 | AST only |
 | map.cpp:304:12:304:16 | map.cpp:257:39:257:44 | IR only |
 | map.cpp:305:12:305:17 | map.cpp:257:39:257:44 | IR only |
 | map.cpp:310:12:310:16 | map.cpp:257:39:257:44 | IR only |
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/test_ir.expected
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/test_ir.expected
@@ -83,6 +83,13 @@
 | map.cpp:107:10:107:15 | call to insert | map.cpp:107:62:107:67 | call to source |
 | map.cpp:108:7:108:48 | call to iterator | map.cpp:108:34:108:39 | call to source |
 | map.cpp:109:10:109:25 | call to insert_or_assign | map.cpp:109:46:109:51 | call to source |
+| map.cpp:117:10:117:13 | call to find | map.cpp:105:39:105:44 | call to source |
+| map.cpp:118:10:118:13 | call to find | map.cpp:106:32:106:37 | call to source |
+| map.cpp:119:10:119:13 | call to find | map.cpp:107:62:107:67 | call to source |
+| map.cpp:123:10:123:13 | call to find | map.cpp:105:39:105:44 | call to source |
+| map.cpp:124:10:124:13 | call to find | map.cpp:106:32:106:37 | call to source |
+| map.cpp:125:10:125:13 | call to find | map.cpp:107:62:107:67 | call to source |
+| map.cpp:139:10:139:13 | call to find | map.cpp:105:39:105:44 | call to source |
 | map.cpp:151:8:151:10 | call to pair | map.cpp:105:39:105:44 | call to source |
 | map.cpp:152:12:152:16 | first | map.cpp:105:39:105:44 | call to source |
 | map.cpp:153:12:153:17 | second | map.cpp:105:39:105:44 | call to source |
@@ -96,6 +103,13 @@
 | map.cpp:259:10:259:15 | call to insert | map.cpp:259:62:259:67 | call to source |
 | map.cpp:260:7:260:48 | call to iterator | map.cpp:260:34:260:39 | call to source |
 | map.cpp:261:10:261:25 | call to insert_or_assign | map.cpp:261:46:261:51 | call to source |
+| map.cpp:269:10:269:13 | call to find | map.cpp:257:39:257:44 | call to source |
+| map.cpp:270:10:270:13 | call to find | map.cpp:258:32:258:37 | call to source |
+| map.cpp:271:10:271:13 | call to find | map.cpp:259:62:259:67 | call to source |
+| map.cpp:275:10:275:13 | call to find | map.cpp:257:39:257:44 | call to source |
+| map.cpp:276:10:276:13 | call to find | map.cpp:258:32:258:37 | call to source |
+| map.cpp:277:10:277:13 | call to find | map.cpp:259:62:259:67 | call to source |
+| map.cpp:291:10:291:13 | call to find | map.cpp:257:39:257:44 | call to source |
 | map.cpp:303:8:303:10 | call to pair | map.cpp:257:39:257:44 | call to source |
 | map.cpp:304:12:304:16 | first | map.cpp:257:39:257:44 | call to source |
 | map.cpp:305:12:305:17 | second | map.cpp:257:39:257:44 | call to source |